@deksden-com/dd-flow-cli 0.9.0-beta.104 → 0.9.0-beta.106

package/dist/services/run-controller-process.js

@@ -14,9 +14,9 @@ const processOperation = (context, row) => `controller:${digest({ database: cont
 const birth = () => ({ pid: process.pid, pid_started_at: processStartedAt(process.pid) });
 const dead = (value) => Boolean(value && Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.pid_started_at === "string" && value.pid_started_at && !processIsAlive(value));
 /** Called inside the RUN intent transaction, before the client can disappear. */
-export function recordControllerLauncher(context, row, retired) {
+export function recordControllerLauncher(context, row, retired, identity = birth()) {
     const request = { action: "controller_owner_launch", owner_id: launchId(row) };
-    const receipt = { ...birth(), registration: "controller_self@1", ...(retired ? { retired_process: { id: retired.id, lease_token: retired.lease_token, pid: retired.pid, pid_started_at: retired.pid_started_at } } : {}) };
+    const receipt = { ...identity, registration: "controller_self@1", ...(retired ? { retired_process: { id: retired.id, lease_token: retired.lease_token, pid: retired.pid, pid_started_at: retired.pid_started_at } } : {}) };
     const now = context.now();
     context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, receipt_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'completed', ?, ?, ?)", [launchId(row), row.controller_id, row.generation, digest(request), JSON.stringify(request), JSON.stringify(receipt), now, now]);
 }
@@ -92,48 +92,37 @@ function prepareSpawn(context, row) {
         return null;
     if (launch.value.retired_process)
         retire(resourceContext, row, launch.value.retired_process);
-    context.db.beginWriteTransaction();
-    try {
+    const launcher = birth();
+    return context.db.writeTransaction(() => {
         assertLaunchAllowed(context, row);
         const changed = context.db.run(`UPDATE run_controllers SET owner_token = ?, owner_pid = NULL, process_id = NULL, process_lease_token = NULL, status = 'starting', last_error_json = NULL, updated_at = ?
       WHERE controller_id = ? AND owner_token = ? AND owner_pid IS ? AND process_id IS ? AND status = ? AND state_json = ?
         AND (SELECT receipt_json FROM run_controller_operations WHERE operation_id = ?) = ?`, [token, context.now(), row.controller_id, row.owner_token, row.owner_pid, row.process_id, row.status, row.state_json, launchId(row), launch.receipt_json]);
-        if (changed.changes !== 1) {
-            context.db.exec("ROLLBACK");
+        if (changed.changes !== 1)
             return null;
-        }
         const current = requireController(context, row.controller_id);
         if (!ours) {
-            recordControllerLauncher(context, current);
+            recordControllerLauncher(context, current, undefined, launcher);
             appendEvent(context, row.controller_id, "launch_owner_reconciled", { prior_launch: launchId(row), generation: row.generation, prior_process_id: row.process_id });
         }
         context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.spawn_started', json('true')), updated_at = ? WHERE operation_id = ?", [context.now(), launchId(current)]);
-        context.db.exec("COMMIT");
         return current;
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 /** The physical child records its own birth before resource registration. */
 export function claimControllerProcess(context, row) {
     const launch = launchRecord(context, row);
     if (!launch && (!row.process_id || !row.process_lease_token))
         throw new AppError("controller_owner_mismatch", "Managed registration is not authorized", 1);
-    context.db.beginWriteTransaction();
-    try {
+    const owner = birth();
+    context.db.writeTransaction(() => {
         const claimed = context.db.run("UPDATE run_controllers SET owner_pid = ?, status = 'running', updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [process.pid, context.now(), row.controller_id, row.owner_token]);
         if (claimed.changes !== 1)
             throw new AppError("controller_already_owned", "Managed owner has already claimed this launch", 1);
         if (launch)
-            context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.owner', json(?)), updated_at = ? WHERE operation_id = ?", [JSON.stringify(birth()), context.now(), launchId(row)]);
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+            context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.owner', json(?)), updated_at = ? WHERE operation_id = ?", [JSON.stringify(owner), context.now(), launchId(row)]);
+    });
+    row.owner_pid = process.pid;
     if (!row.process_id) {
         const manifest = JSON.parse(row.manifest_json);
         const resourceContext = { ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: manifest.resource_home } };
@@ -173,16 +162,18 @@ export async function spawnController(context, row) {
         return controllerReceipt(requireController(context, controllerId));
     }
     catch (error) {
-        context.db.exec("SAVEPOINT controller_spawn_status");
         try {
-            const changed = context.db.run("UPDATE run_controllers SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [JSON.stringify(errorRecord(error)), context.now(), controllerId, token]);
-            if (changed.changes && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation)
-                setFlowRunRecoveryPaused(context, row.project_id, row.run_id, true);
-            context.db.exec("RELEASE controller_spawn_status");
+            context.db.writeTransaction(() => {
+                const changed = context.db.run("UPDATE run_controllers SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [JSON.stringify(errorRecord(error)), context.now(), controllerId, token]);
+                if (changed.changes && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation)
+                    setFlowRunRecoveryPaused(context, row.project_id, row.run_id, true);
+            });
         }
         catch (failure) {
-            context.db.exec("ROLLBACK TO controller_spawn_status; RELEASE controller_spawn_status");
-            throw failure;
+            const secondary = { status_persistence_error: errorRecord(failure) };
+            if (error instanceof AppError)
+                throw new AppError(error.code, error.message, error.exitCode, { ...error.details, ...secondary });
+            throw new AppError("controller_spawn_failed", error instanceof Error ? error.message : String(error), 1, { cause: errorRecord(error), ...secondary });
         }
         throw error;
     }

package/dist/services/run-controller-recovery.js

@@ -10,7 +10,7 @@ import { verifyRecoverySnapshot } from "./eval-snapshots.js";
 import { recoveryGuard, resumeRunRecovery } from "./run-recovery.js";
 import { prepareRunRecoveryDispatch } from "./run-recovery-runtime.js";
 import { runtimeHarness } from "./execution-policy.js";
-import { managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive } from "./managed-processes.js";
+import { managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, processStartedAt } from "./managed-processes.js";
 import { requireRun, requireController, controllerReceipt, appendEvent, saveState, digest, errorRecord } from "./run-controller-state.js";
 import { controllerAdapter, sessionArguments } from "./run-controller-adapter.js";
 import { spawnController, recordControllerLauncher } from "./run-controller-process.js";
@@ -18,6 +18,7 @@ import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-da
 import { managedInvocationContext } from "./lifecycle-invocations.js";
 import { runControlStatus } from "./run-control.js";
 import { runtimeBudgetStatus, waitForRuntimeScopeRecovery } from "./runtime-budget.js";
+import { prepareControllerPublication } from "./run-controller-capture.js";
 /** CLI observation is bounded; the physical controller owns the recovery work. */
 export async function resumeRunController(context, input) {
     if (input.waitMs !== undefined && (!Number.isSafeInteger(input.waitMs) || input.waitMs < 0 || input.waitMs > 60_000))
@@ -35,6 +36,11 @@ export async function resumeRunController(context, input) {
 }
 /** Retain the logical controller and its receipts; replace only its dead owner. */
 export function recordControllerResume(context, input) {
+    return prepareControllerResume(context, input)();
+}
+/** Verify immutable recovery evidence before a caller reserves the registry
+ * writer. The returned operation rechecks SQL ownership under the RUN CAS. */
+export function prepareControllerResume(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.requestId) || !input.controlId.trim())
         throw new AppError("usage", "Resume requires request-id and the exact source control", 2);
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
@@ -53,7 +59,7 @@ export function recordControllerResume(context, input) {
     };
     const prior = findPrior();
     if (prior)
-        return prior;
+        return () => findPrior() ?? prior;
     try {
         const row = context.db.get("SELECT * FROM run_controllers WHERE project_id = ? AND run_id = ? AND status NOT IN ('completed','cancelled','superseded')", [project.id, run.id]);
         if (!row)
@@ -78,18 +84,20 @@ export function recordControllerResume(context, input) {
         if (!previousOwner || previousOwner.lease_token !== row.process_lease_token || previousOwner.kind !== "run-controller" || previousOwner.owner_id !== row.controller_id || previousOwner.project_id !== project.id || previousOwner.run_id !== run.id || managedProcessRuntimeHome(previousOwner, context) !== context.ddFlowHome || !previousOwner.pid || !previousOwner.pid_started_at || processTreeIsAlive(previousOwner))
             throw new AppError("controller_owner_unsettled", "Resume requires proof that the previous physical controller has exited", 1);
         const token = crypto.randomUUID(), now = context.now();
-        context.db.beginWriteTransaction();
-        try {
+        const launcher = { pid: process.pid, pid_started_at: processStartedAt(process.pid) };
+        return () => context.db.writeTransaction(() => {
             const duplicate = context.db.get("SELECT input_hash, status FROM run_controller_operations WHERE operation_id = ?", [operationId]);
             if (duplicate) {
                 if (duplicate.input_hash !== hash)
                     throw new AppError("runtime_request_conflict", "Resume request id has different inputs", 1);
-                context.db.exec("COMMIT");
                 return { controller: requireController(context, row.controller_id), operationId };
             }
             const current = recoveryGuard(context, project.id, run.id);
             if (current?.recovery_id !== guard.recovery_id || current.generation !== guard.generation || current.status !== "sealed" || current.capture_path !== guard.capture_path)
                 throw new AppError("run_control_superseded", "Control changed before resume could be accepted", 1);
+            const currentOwner = managedProcessStatus(resourceContext).find(record => record.id === previousOwner.id);
+            if (!currentOwner || digest(managedProcessBinding(currentOwner, manifest.resource_home)) !== digest(managedProcessBinding(previousOwner, manifest.resource_home)))
+                throw new AppError("controller_owner_unsettled", "Retired controller binding changed while recovery was prepared", 1);
             if (!["running", "paused", "waiting_for_user"].includes(requireRun(context, project.id, run.id).status))
                 throw new AppError("invalid_run_state", "RUN became terminal before resume could be accepted", 1);
             const changed = context.db.run("UPDATE run_controls SET status = 'resuming', updated_at = ? WHERE control_id = ? AND recovery_id = ? AND status = 'settled'", [now, input.controlId, guard.recovery_id]);
@@ -100,22 +108,17 @@ export function recordControllerResume(context, input) {
             if (claimed.changes !== 1)
                 throw new AppError("controller_owner_mismatch", "Controller changed before resume could claim its next physical owner", 1);
             context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'accepted', ?, ?)", [operationId, row.controller_id, guard.generation, hash, JSON.stringify(request), now, now]);
-            recordControllerLauncher(context, requireController(context, row.controller_id), previousOwner);
+            recordControllerLauncher(context, requireController(context, row.controller_id), previousOwner, launcher);
             appendEvent(context, row.controller_id, "resume_requested", { operation_id: operationId, control_id: input.controlId, recovery_id: guard.recovery_id, generation: guard.generation, retired_process_id: previousOwner.id, retained_session_id: state.sessions[state.current_session].id });
-            context.db.exec("COMMIT");
-        }
-        catch (error) {
-            context.db.exec("ROLLBACK");
-            throw error;
-        }
-        return { controller: requireController(context, row.controller_id), operationId, retiredProcess: previousOwner };
+            return { controller: requireController(context, row.controller_id), operationId, retiredProcess: previousOwner };
+        });
     }
     catch (error) {
         // A concurrent identical client may commit between our first lookup and
         // validation. Its durable request wins even if our preflight saw the fence.
         const concurrent = findPrior();
         if (concurrent)
-            return concurrent;
+            return () => concurrent;
         throw error;
     }
 }
@@ -126,8 +129,9 @@ export async function resumeControllerSession(context, row, manifest, state, ass
         throw new AppError("recovery_owner_missing", "Recovery lost its retained coordinator Session", 1);
     let executionContext = { ...context, env: { ...context.env, DD_FLOW_BIN: manifest.flow_executable, DD_FLOW_RESOURCE_HOME: manifest.resource_home } };
     const scopeControl = manifest.budget ? runtimeBudgetStatus(executionContext, manifest.budget.scope_id).control : null;
-    const assertRecoveryOwner = () => {
-        assertPhysicalOwner();
+    const assertRecoveryOwner = (physical = true) => {
+        if (physical)
+            assertPhysicalOwner();
         const guard = recoveryGuard(context, row.project_id, row.run_id);
         if (guard?.generation !== row.generation || guard.recovery_id !== recovery.recovery_id)
             throw new AppError("run_recovery_generation_stale", "A newer control superseded this recovery owner", 1);
@@ -168,22 +172,21 @@ export async function resumeControllerSession(context, row, manifest, state, ass
         throw new AppError("recovery_session_unsettled", "Retained native Session is not ready for same-Session recovery", 1);
     assertRecoveryOwner();
     const prepared = { prepared: true, recovery_id: recovery.recovery_id, session_id: session.id, daemon_id: daemonId, process_id: dispatch.process_id, resume_operation_id: dispatch.resume_operation_id };
-    context.db.beginWriteTransaction();
-    try {
-        assertRecoveryOwner();
-        const binding = requireManagedDaemonBinding(executionContext, { stateDir: session.state_dir, projectId: row.project_id, runId: row.run_id, ownerId: session.owner.owner_id });
-        if (binding.process.id !== dispatch.process_id || binding.state.daemon_id !== daemonId || binding.process.state !== "running" || !processIsAlive(binding.process))
-            throw new AppError("recovery_runtime_mismatch", "Prepared recovery lost its physical Session owner", 1);
+    const binding = requireManagedDaemonBinding(executionContext, { stateDir: session.state_dir, projectId: row.project_id, runId: row.run_id, ownerId: session.owner.owner_id });
+    if (binding.process.id !== dispatch.process_id || binding.state.daemon_id !== daemonId || binding.process.state !== "running" || !processIsAlive(binding.process))
+        throw new AppError("recovery_runtime_mismatch", "Prepared recovery lost its physical Session owner", 1);
+    const assertPreparedOwner = prepareControllerPublication(executionContext, row, assertPhysicalOwner);
+    context.db.writeTransaction(() => {
+        assertPreparedOwner();
+        assertRecoveryOwner(false);
+        const currentNative = managedProcessStatus(executionContext).find(item => item.id === binding.process.id);
+        if (!currentNative || currentNative.state !== "running" || currentNative.lease_expires_at <= context.now() || digest(managedProcessBinding(currentNative, manifest.resource_home)) !== digest(managedProcessBinding(binding.process, manifest.resource_home)))
+            throw new AppError("recovery_runtime_mismatch", "Prepared recovery lost its current native lease", 1);
         const recorded = context.db.run("UPDATE run_controller_operations SET receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'accepted'", [JSON.stringify(prepared), context.now(), recovery.operation_id, row.controller_id, row.generation]);
         if (recorded.changes !== 1)
             throw new AppError("run_recovery_generation_stale", "Recovery preparation no longer owns its operation", 1);
         appendEvent(context, row.controller_id, "recovery_prepared", prepared);
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
     if (scopeControl && manifest.budget) {
         await waitForRuntimeScopeRecovery(executionContext, { scopeId: manifest.budget.scope_id, generation: scopeControl.generation, controllerId: row.controller_id, operationId: recovery.operation_id }, assertRecoveryOwner);
     }
@@ -195,9 +198,10 @@ export async function resumeControllerSession(context, row, manifest, state, ass
     assertRecoveryOwner();
     if (recoveryGuard(context, row.project_id, row.run_id)?.status !== "recovered")
         throw new AppError("trusted_recovery_acceptance_required", "Recovery Turn ended without its native acknowledgement", 1);
-    context.db.beginWriteTransaction();
-    try {
-        assertRecoveryOwner();
+    const assertAcceptedOwner = prepareControllerPublication(executionContext, row, assertPhysicalOwner);
+    context.db.writeTransaction(() => {
+        assertAcceptedOwner();
+        assertRecoveryOwner(false);
         context.db.run("UPDATE run_controls SET status = 'resumed', updated_at = ? WHERE control_id = ? AND status = 'resuming'", [context.now(), recovery.control_id]);
         context.db.run("UPDATE run_controller_operations SET status = 'completed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND status = 'accepted'", [JSON.stringify({ resumed: true, recovery_id: recovery.recovery_id, session_id: session.id, daemon_id: daemonId }), context.now(), recovery.operation_id]);
         state.last_receipt = receipt;
@@ -205,12 +209,7 @@ export async function resumeControllerSession(context, row, manifest, state, ass
         delete state.recovery;
         saveState(context, row, state);
         appendEvent(context, row.controller_id, "recovery_resumed", { control_id: recovery.control_id, recovery_id: recovery.recovery_id, session_id: session.id, daemon_id: daemonId, generation: row.generation });
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 export function failControllerRecovery(context, row, state, error) {
     if (state.recovery) {