@deksden-com/dd-flow-cli 0.9.0-beta.121 → 0.9.0-beta.123

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -1,6 +1,7 @@
 import { observedTimeout } from "./observation-clock.mjs";
 import { ToolObservations, acpToolObservation, zcodePhysicalSession } from "./tool-observations.mjs";
 import { invokeNativeHook } from "./native-hook-command.mjs";
+import { parseLifecycleCommand, continuationCommand } from "./lifecycle-command.mjs";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
@@ -19,7 +20,7 @@ const LATE_RESPONSE_GRACE_MS = 5_000;
 
 function fail(message, code) { const error = new Error(message); if (code) error.code = code; throw error; }
 function fatalLifecycleError(error) {
-  return ["invocation_unknown", "invocation_identity_mismatch", "invocation_identity_conflict", "invocation_receipt_missing", "invocation_command_mismatch", "invocation_scope_mismatch", "invocation_generation_stale", "invocation_expired", "zcode_parent_identity_missing", "zcode_tool_identity_conflict"].includes(error?.code);
+  return ["invocation_unknown", "invocation_identity_mismatch", "invocation_identity_conflict", "invocation_receipt_missing", "invocation_command_mismatch", "invocation_scope_mismatch", "invocation_generation_stale", "invocation_expired", "zcode_parent_identity_missing", "zcode_tool_identity_conflict", "native_hook_timeout", "native_hook_failed", "native_hook_response_invalid", "hook_storage_unprepared", "storage_write_failed"].includes(error?.code);
 }
 function absolute(value, label) { if (!value || !path.isAbsolute(value)) fail(`${label} must be an absolute path`); return path.resolve(value); }
 function text(value, label) { if (typeof value !== "string" || !value.trim()) fail(`${label} is required`); return value.trim(); }
@@ -163,13 +164,15 @@ export class AcpBridge {
     const identity = this.modelSessions.get(adapterId); if (!identity) return;
     this.modelProfiles.set(identity.sessionId, observed);
     await observeModel({ journal: this.options.journal, harness: this.options.clientInfo?.name === "dd-grok" ? "grok-acp" : "zcode-acp",
-      sessionId: identity.sessionId, parentSessionId: identity.parentSessionId, requested: identity.requested, observed, source });
+      sessionId: identity.sessionId, parentSessionId: identity.parentSessionId, requested: identity.requested, observed, source: typeof source === "string" ? { channel: source, scope: "configured", raw_model: observed.raw_model ?? observed.model, raw_provider: observed.provider } : source });
   }
   async observeModelUpdate(message) {
     const update = message.params?.update;
     if (update?.sessionUpdate !== "config_option_update" || !Array.isArray(update.configOptions)) return;
     const value = category => update.configOptions.find(option => option.type === "select" && (option.category === category || option.id === category))?.currentValue ?? null;
-    const observed = { model: value("model"), reasoning: value("thought_level"), mode: value("mode") };
+    const raw = value("model");
+    const model = this.options.clientInfo?.name === "dd-grok" ? { model: raw } : zcodeModelSelector(raw);
+    const observed = { ...model, reasoning: value("thought_level"), mode: value("mode") };
     const identity = this.modelSessions.get(message.params.sessionId); if (!identity?.armed) return;
     checkObservedProfile(identity.requested, observed);
     await this.recordModel(message.params.sessionId, observed, "acp.config_option_update");
@@ -233,13 +236,14 @@ export class AcpBridge {
         // A validated no-effect rejection is returned through the invocation
         // ledger. It is evidence, not a poisoned ACP Session.
         const fatal = fatalLifecycleError(error);
-        if (!this.notificationError || fatal) this.notificationError = error;
+        const current = this.options.onLifecycleNotification === observer;
+        if (current && (!this.notificationError || fatal && !fatalLifecycleError(this.notificationError) && this.notificationError.code !== "profile_integrity_violation")) this.notificationError = error;
         // A missing/foreign authority is not a recoverable CLI validation
         // result. Stop admitting productive requests immediately; the managed
         // controller still owns physical stop/drain and evidence capture.
-        if (fatal) this.rejectAll(error);
+        if (fatal && current) this.rejectAll(this.notificationError ?? error);
         try {
-          await this.journal.write("notification_failure", { code: error.code ?? "invocation_observation_failed", message: error.message,
+          await this.journal.write("notification_failure", { code: error.code ?? "invocation_observation_failed", message: error.message, ...(error.details ? { details: error.details } : {}),
             session_id: message.params?.sessionId ?? null, tool_call_id: update?.toolCallId ?? null, event_time: now(), delivery_stage: "lifecycle_receipt", completeness: "incomplete" });
         } catch (persistenceError) {
           process.stderr.write(`${JSON.stringify({ code: error.code, message: error.message, persistence_error: persistenceError.message })}\n`);
@@ -281,7 +285,7 @@ export class AcpBridge {
     if (message.method) this.notifications = this.notifications
       .then(async () => { await this.observeModelUpdate(message); await this.options.onNotification?.(message); })
       .catch(async (error) => {
-        const failure = { code: error.code ?? "notification_observation_failed", message: error.message, session_id: message.params?.sessionId ?? null, tool_call_id: message.params?.update?.toolCallId ?? null, event_time: now(), delivery_stage: "acp_evidence", completeness: "incomplete" };
+        const failure = { code: error.code ?? "notification_observation_failed", message: error.message, ...(error.details ? { details: error.details } : {}), session_id: message.params?.sessionId ?? null, tool_call_id: message.params?.update?.toolCallId ?? null, event_time: now(), delivery_stage: "acp_evidence", completeness: "incomplete" };
         try { await this.journal.write("notification_failure", failure); }
         catch (persistenceError) { process.stderr.write(`${JSON.stringify({ ...failure, persistence_error: persistenceError.message })}\n`); }
         // Evidence loss does not retroactively revoke a committed native hook.
@@ -441,11 +445,20 @@ function isProductiveSessionNotification(message) {
   return true;
 }
 
+// The qualified bridge encodes exactly providerId\\modelId; no other suffix or
+// slash normalization is authorized. Bare IDs do not prove account routing.
+export function zcodeModelSelector(raw, provider = null) {
+  if (typeof raw !== "string") return { model: null, provider, raw_model: raw };
+  const parts = raw.split("\\");
+  if (parts.length === 1) return { model: raw || null, provider, raw_model: raw };
+  if (parts.length !== 2 || !parts.every(Boolean) || provider && provider !== parts[0]) return { model: null, provider, raw_model: raw };
+  return { model: parts[1], provider: parts[0], raw_model: raw };
+}
+
 export function observedProfile(read) {
   const model = read?.settings?.model?.current ?? {};
   return {
-    provider: typeof model.providerId === "string" ? model.providerId : null,
-    model: typeof model.modelId === "string" ? model.modelId : null,
+    ...zcodeModelSelector(model.modelId, typeof model.providerId === "string" ? model.providerId : null),
     reasoning: read?.settings?.thoughtLevel?.current ?? null,
     mode: read?.settings?.mode?.current ?? read?.projection?.mode ?? null,
   };
@@ -551,7 +564,7 @@ export function zcodeChildSessionIds(snapshot) {
 // Read residency BEFORE each durable topology snapshot. An inactive node cannot
 // add descendants; a resident node never proves settlement, even when idle.
 // No resolve/read/subagents extension here: those may implicitly resume.
-export async function observeClosedZcodeTree(bridge, root, retainedChildren = []) {
+export async function observeClosedZcodeTree(bridge, root, retainedChildren = [], neverPromptedRootProof = null) {
   const pending = new Set([root, ...retainedChildren]), residents = [], snapshots = [];
   const deadline = performance.now() + 30_000;
   try {
@@ -561,6 +574,15 @@ export async function observeClosedZcodeTree(bridge, root, retainedChildren = []
       const resident = await bridge.request("zcode/session/resident", { sessionId }, timeout());
       if (resident?.sessionId !== sessionId || typeof resident.resident !== "boolean") throw new Error("Invalid residency identity or state");
       residents.push(resident);
+      // A newly allocated root is not durable in ZCode until its first prompt.
+      // This is an explicit owned-daemon ledger fact, never error→empty inference.
+      if (sessionId === root && resident.resident === false && pending.size === 1
+        && neverPromptedRootProof?.source === "owned_daemon_create_without_prompt"
+        && neverPromptedRootProof.close_confirmed === true
+        && neverPromptedRootProof.provider_session_id === root && typeof neverPromptedRootProof.daemon_id === "string") {
+        snapshots.push({ sessionId, childSessionIds: [], running: [], ended: {total:0,items:[]}, provenance: neverPromptedRootProof });
+        continue;
+      }
       const tree = await readZcodeSubagents(bridge, sessionId, deadline - performance.now(), true);
       if (!Array.isArray(tree?.childSessionIds)
         || tree.childSessionIds.some(id => typeof id !== "string" || !id || id === sessionId)
@@ -577,7 +599,7 @@ export async function observeClosedZcodeTree(bridge, root, retainedChildren = []
   }
 }
 
-async function cancelTree(bridge, sessionId, before, providerSessionId, retainedChildren = []) {
+async function cancelTree(bridge, sessionId, before, providerSessionId, retainedChildren = [], neverPromptedRootProof = null) {
   const knownChildren = new Set(retainedChildren);
   const remember = snapshot => {
     for (const id of zcodeChildSessionIds(snapshot)) knownChildren.add(id);
@@ -616,7 +638,7 @@ async function cancelTree(bridge, sessionId, before, providerSessionId, retained
   let close = null;
   try { close = await bridge.request("zcode/session/close", { sessionId }); }
   catch (error) { close = { closed: false, error: { code: error.code ?? "close_failed", message: error.message } }; }
-  const observation = close?.closed === true ? await observeClosedZcodeTree(bridge, providerSessionId, [...knownChildren])
+  const observation = close?.closed === true ? await observeClosedZcodeTree(bridge, providerSessionId, [...knownChildren], neverPromptedRootProof ? {...neverPromptedRootProof,close_confirmed:true} : null)
     : { topology: { root_session_id: providerSessionId, child_session_ids: [...knownChildren], complete: false }, settled: false };
   return { cancellations, before, after, root_status, cancellation_requested: true, close_requested: true, close, ...observation };
 }
@@ -713,9 +735,8 @@ function flowForwarder(options, rootProviderSessionId, bridge) {
     const childId = notification.params?.update?._meta?.zcodeRuntime?.childSessionId;
     const observed = bridge?.modelProfiles?.get(childId ?? rootProviderSessionId) ?? {};
     if (childId && !observed.model) await observeModel({ journal: options.journal, harness: "zcode-acp", sessionId: childId, parentSessionId: rootProviderSessionId, requested: profile(options), observed, source: "zcode.child_tool_event", evidence: "unavailable" });
-    // Native PreToolUse has already admitted (or denied) the command. ACP is
-    // intentionally only journal/model evidence: its serialized delivery can
-    // lag behind execution and must never mint a second lifecycle receipt.
+    // This serialized path is model evidence only. The independent observer
+    // below owns qualified ACP admission; do not mint a second receipt here.
   };
 }
 
@@ -753,6 +774,8 @@ export async function zcodeInvocationObserver(options, rootProviderSessionId, se
     const command = update.rawInput?.command ?? update.rawInput?.cmd;
     const toolName = update._meta?.claudeCode?.toolName;
     if (!["Bash", "bash", "execute"].includes(toolName) || typeof command !== "string") return;
+    const analysis = parseLifecycleCommand(command);
+    if (analysis.kind === "none" && !analysis.unresolved && !continuationCommand(command)) return;
     const parent = session === rootProviderSessionId ? null : owners.get(native.parentToolCallId);
     if (session !== rootProviderSessionId && !parent) throw Object.assign(new Error("Native child has no confirmed immediate parent tool owner"), { code: "zcode_parent_identity_missing" });
     await send({ bin: options.ddFlowBin, home: options.ddFlowHome,
@@ -808,6 +831,7 @@ export function zcodeLifecycleQualification(sha256, bridgeCommit, harnessContrac
     ["91a1470650f5fd6105f9863fd31d1cad7b90a109", "dd-zcode-harness@2"],
     ["b9e0f5106dddb439b76186278bd9be5f45dbf3ef", "dd-zcode-harness@2"],
     ["636b14181d5c9a95476055079836fd6b58169f58", "dd-zcode-harness@2"],
+    ["4621fabd3f517ecdd349dfebebae9077c01d2f2b", "dd-zcode-harness@2"],
   ]);
   const qualified = qualifiedBridgeCommits.get(bridgeCommit) === harnessContract;
   return { status: qualified ? "qualified" : "unqualified", mechanism: "cli-invocation@1", sha256,
@@ -965,7 +989,7 @@ export async function cancelSessionWithBridge(bridge, options) {
   requireJournal(options);
   const identity = await controlledIdentity(bridge, options);
   const before = await readZcodeSubagents(bridge, identity.adapterSessionId).catch(error => ({ observation_error: { code: error.code, message: error.message } }));
-  return receipt(options, { harness: "zcode-acp", provider_session_id: identity.providerSessionId, adapter_session_id: identity.adapterSessionId, ...await cancelTree(bridge, identity.adapterSessionId, before, identity.providerSessionId, options.knownChildSessionIds) });
+  return receipt(options, { harness: "zcode-acp", provider_session_id: identity.providerSessionId, adapter_session_id: identity.adapterSessionId, ...await cancelTree(bridge, identity.adapterSessionId, before, identity.providerSessionId, options.knownChildSessionIds, options.neverPromptedRootProof) });
 }
 
 export async function forkSession(options) {

package/dist/harness-runtime/lib/delegation-instructions.mjs

@@ -56,7 +56,7 @@ export const lifecycleRetryInstruction = `${lifecycleCommandCompletionInstructio
 export const stageLifecycleInstruction = [
   "The project root identifies this RUN; use the Stage packet's declared execution workspace and absolute artifact paths. Do not change a native Session's working directory to a workspace provisioned for a later Stage.",
   "In a controller-managed fanout, the coordinator ends the entry Turn after the Work graph is returned; the controller dispatches children. A completed child or Work is not Stage success: settle the declared graph and Stage gate before finishing.",
-  "Execute each runtime-issued lifecycle operation as a standalone call. Invocation IDs are internal authority; never add, copy or invent one.",
+  "Execute each runtime-issued lifecycle operation and its arguments exactly. One literal lifecycle call may be composed with ordinary shell commands; preserve conditions, stdin and redirects, and never replay the surrounding shell chain after failure. Invocation IDs are internal authority; never add, copy or invent one.",
   lifecycleRetryInstruction
 ].join(" ");
 
@@ -68,13 +68,13 @@ export function workerDelegationTask({ workId, startCommand, launchPolicy }) {
   return [
     `Complete one already-declared Work: ${workId}.`,
     context,
-    "Your first technical action must be this exact standalone lifecycle command:",
+    "Your first technical action must be this exact lifecycle command:",
     startCommand,
     "Execute the issued operation and target exactly. Lifecycle invocation IDs are internal runtime authority and are intentionally omitted; never add or invent them. Preserve any explicit native receipt handle that the command does contain.",
     "Use the native shell's inherited working directory. Do not set or override a workdir/cwd field for this lifecycle command.",
     "Continue only if it succeeds and returns the authoritative Work packet.",
     lifecycleRetryInstruction,
-    "After a successful start, complete the assigned Work, write its required result, invoke its exact standalone work finish command, then stop.",
+    "After a successful start, complete the assigned Work, write its required result, invoke its exact work finish command, then stop.",
     "Do not start another Work, create a child, change dependencies, ask the user, or treat a quiet sibling as failed. You cannot ask the user or pause the parent Stage. Missing facts go through this Work's declared result/failure contract; only the coordinator handles Stage HITL."
   ].join("\n");
 }

package/dist/harness-runtime/lib/lifecycle-command.d.mts

@@ -0,0 +1,20 @@
+import type { LifecycleOperation } from "./lifecycle-contract.mjs";
+export type { LifecycleOperation } from "./lifecycle-contract.mjs";
+export interface ParsedCommandArgs { positional: string[]; options: Map<string, string[]> }
+export interface LifecycleInvocation {
+  operation: LifecycleOperation; executable: string; launcher?: string; argv: string[]; env: Record<string, string>; args: ParsedCommandArgs; command: string;
+  rewriteSafe: boolean; wrapped: boolean; heredoc: boolean; sourceRange?: { start: number; end: number }; contexts?: string[]; expectedCwd?: string;
+}
+export type LifecycleAnalysis =
+  | { kind: "none"; unresolved?: true; reason?: string }
+  | { kind: "standalone"; invocation: LifecycleInvocation; supported?: boolean; invocations?: LifecycleInvocation[] }
+  | { kind: "compound"; invocation: LifecycleInvocation; reason: string; supported?: boolean; invocations?: LifecycleInvocation[] };
+export function lifecycleCommandFromPayload(payload: { command?: unknown; tool_input?: unknown }): string | undefined;
+export function parseLifecycleCommand(command: string): LifecycleAnalysis;
+export function continuationCommand(command: string): { operation: string; args: ParsedCommandArgs } | null;
+export function unwrapShellCommand(command: string): string;
+export function parseCommandArgs(argv: string[]): ParsedCommandArgs;
+export function commandOption(invocation: LifecycleInvocation, name: string): string | undefined;
+export function commandHasOption(invocation: LifecycleInvocation, name: string): boolean;
+export function commandPosition(invocation: LifecycleInvocation, index: number): string | undefined;
+export function shellSuffixOffset(command: string): number;

package/dist/harness-runtime/lib/lifecycle-command.mjs

@@ -0,0 +1,218 @@
+import path from "node:path";
+import Parser from "tree-sitter";
+import Bash from "tree-sitter-bash";
+import { parse, quote } from "shell-quote";
+import { lifecycleOperationForArgv } from "./lifecycle-contract.mjs";
+
+// One grammar owns structure. shell-quote decodes identified command words;
+// neither parser grants authority or executes expansions.
+const parser = new Parser();
+parser.setLanguage(Bash);
+const shells = new Set(["bash", "sh", "zsh"]);
+const repeatedContexts = new Set(["for_statement", "while_statement", "function_definition", "c_style_for_statement"]);
+const dynamicTypes = ["command_substitution", "process_substitution", "arithmetic_expansion", "brace_expression", "extglob_pattern"];
+function words(text) {
+  try { const entries = parse(text, name => `$${name}`); return entries.every(entry => typeof entry === "string") ? entries : null; }
+  catch { return null; }
+}
+function ancestors(node) {
+  const result = [];
+  for (let parent = node.parent; parent; parent = parent.parent) result.push(parent.type);
+  return result;
+}
+function backgroundContext(node) {
+  for (let unit = node; unit.parent; unit = unit.parent) {
+    const siblings = unit.parent.children;
+    if (siblings[siblings.findIndex(child => child.id === unit.id) + 1]?.type === "&") return true;
+  }
+  return false;
+}
+function dynamicWord(node) {
+  return node.descendantsOfType(dynamicTypes).length > 0
+    || node.descendantsOfType(["simple_expansion", "expansion"]).some(expansion => !["$DD_FLOW_BIN", "${DD_FLOW_BIN}"].includes(expansion.text))
+    || node.type === "word" && /[*?[]/.test(node.text);
+}
+function launcherIndex(values, env) {
+  let index = 0;
+  while (values[index] && /^[A-Za-z_][A-Za-z0-9_]*=/.test(values[index])) {
+    const value = values[index++], equals = value.indexOf("="); env[value.slice(0, equals)] = value.slice(equals + 1);
+  }
+  if (path.basename(values[index] ?? "") === "env") {
+    index++; if (values[index] === "--") index++;
+    if (values[index]?.startsWith("-")) return null;
+    while (values[index] && /^[A-Za-z_][A-Za-z0-9_]*=/.test(values[index])) {
+      const value = values[index++], equals = value.indexOf("="); env[value.slice(0, equals)] = value.slice(equals + 1);
+    }
+  }
+  if (["command", "exec"].includes(values[index] ?? "")) { index++; if (values[index] === "--") index++; }
+  return index;
+}
+function executionCwd(node, nodes) {
+  const lineage = unit => { const result = []; for (; unit; unit = unit.parent) result.push(unit); return result; };
+  const target = lineage(node), targetIds = new Set(target.map(unit => unit.id));
+  let cwd;
+  for (const previous of nodes) {
+    if (previous.endIndex >= node.startIndex) continue;
+    const values = words(previous.text);
+    if (!values) continue;
+    let index = launcherIndex(values, {});
+    if (values[index - 1] === "command" && values[index] === "-p") { index++; if (values[index] === "--") index++; }
+    if (values[index] === "builtin") { index++; if (values[index] === "--") index++; }
+    if (!["cd", "pushd", "popd"].includes(values[index])) continue;
+    const directoryIndex = index + (values[index + 1] === "--" ? 2 : 1);
+    const source = lineage(previous);
+    // A different subshell/substitution cannot change this leaf's directory.
+    // Pipelines are not treated as isolated: bash lastpipe is configurable.
+    if (source.some(unit => ["subshell", "command_substitution", "process_substitution"].includes(unit.type) && !targetIds.has(unit.id))) continue;
+    const common = source.find(unit => targetIds.has(unit.id));
+    const andList = unit => unit.type === "list" && unit.children.some(child => child.type === "&&");
+    const sourcePath = source.slice(1, source.indexOf(common));
+    const targetPath = target.slice(1, target.findIndex(unit => unit.id === common?.id));
+    // Only a successful, foreground absolute cd dominating the leaf is a
+    // route. This walks the grammar's nested left-associative && lists;
+    // it does not evaluate conditionals, directory stacks or shell programs.
+    // `command cd` is a builtin in bash but an external child in zsh;
+    // without native dialect proof none of these prefixes proves parent cwd.
+    if (values.slice(0, index).some(value => ["env", "exec", "command"].includes(path.basename(value)))
+      || values[index] !== "cd" || values.length !== directoryIndex + 1 || !path.isAbsolute(values[directoryIndex]) || dynamicWord(previous)
+      || backgroundContext(previous) || !common || !andList(common)
+      || sourcePath.some(unit => unit.type !== "redirected_statement" && !andList(unit))
+      || targetPath.some(unit => !["redirected_statement", "subshell", "compound_statement"].includes(unit.type) && !andList(unit))) return { unresolved: true };
+    cwd = path.resolve(values[directoryIndex]);
+  }
+  return { cwd };
+}
+function invocationFromWords(values, node, wrapped, env) {
+  let index = launcherIndex(values, env);
+  if (index === null) return null;
+  let executable = values[index], launcher;
+  if (path.basename(executable ?? "") === "node" && (path.basename(values[index + 1] ?? "") === "cli.js" || values[index + 1] === "$DD_FLOW_BIN")) {
+    launcher = executable; executable = values[++index];
+  }
+  if (!executable || !(path.basename(executable) === "dd-flow" || executable === "$DD_FLOW_BIN" || launcher && path.basename(executable) === "cli.js")) return null;
+  const argv = values.slice(index + 1), operation = lifecycleOperationForArgv(argv);
+  if (!operation) return null;
+  const contexts = ancestors(node);
+  const heredoc = node.parent?.type === "redirected_statement" && node.parent.descendantsOfType("heredoc_redirect").length > 0;
+  return { operation, executable, ...(launcher ? { launcher } : {}), argv, env, args: parseCommandArgs(argv.slice(operation === "recovery_accept" ? 3 : 2)),
+    command: quote(values), rewriteSafe: !wrapped, wrapped, heredoc, contexts, ...(!wrapped ? { sourceRange: { start: node.startIndex, end: node.endIndex } } : {}) };
+}
+export function parseLifecycleCommand(command) { return analyze(command, false, 0); }
+function analyze(command, wrapped, depth) {
+  if (depth > 8 || command.length > 1_000_000) return { kind: "none", unresolved: true, reason: "shell_input_limit" };
+  const tree = parser.parse(command);
+  if (!tree) return { kind: "none", unresolved: true, reason: "shell_parse_error" };
+  try {
+    const root = tree.rootNode;
+    if (root.hasError) return { kind: "none", unresolved: true, reason: "shell_parse_error" };
+    const nodes = root.descendantsOfType("command"), found = [];
+    let unsupported;
+    for (const node of nodes) {
+      const name = node.childForFieldName("name"), values = words(node.text);
+      if (!name || !values) { if (name && dynamicWord(name)) unsupported ??= "dynamic_executable"; continue; }
+      const inherited = {};
+      // Conditional exports cannot become unconditional facts in a sibling.
+      for (const previous of root.namedChildren) {
+        if (previous.endIndex > node.startIndex) break;
+        if (previous.type !== "declaration_command" || !previous.text.startsWith("export ")) continue;
+        for (const assignment of previous.descendantsOfType("variable_assignment")) {
+          if (dynamicWord(assignment)) continue;
+          const decoded = words(assignment.text)?.[0], equals = decoded?.indexOf("=") ?? -1;
+          if (decoded && equals > 0) inherited[decoded.slice(0, equals)] = decoded.slice(equals + 1);
+        }
+      }
+      const direct = invocationFromWords(values, node, wrapped, inherited);
+      if (direct) {
+        if (backgroundContext(node)) unsupported ??= "background_lifecycle_execution";
+        if (node.namedChildren.some(dynamicWord)) unsupported ??= "unresolved_lifecycle_word";
+        if (direct.contexts.some(type => repeatedContexts.has(type))) unsupported ??= "repeated_lifecycle_context";
+        if (direct.contexts.some(type => ["command_substitution", "process_substitution"].includes(type))) unsupported ??= "executable_substitution";
+        const route = executionCwd(node, nodes);
+        if (route.unresolved) unsupported ??= "unresolved_execution_cwd";
+        else if (route.cwd) direct.expectedCwd = route.cwd;
+        found.push(direct); continue;
+      }
+      const outerEnv = { ...inherited }, shellIndex = launcherIndex(values, outerEnv);
+      const wrapper = path.basename(values[shellIndex] ?? "");
+      if (["time", "nohup", "timeout"].includes(wrapper)) {
+        let nestedIndex = shellIndex + 1;
+        if (wrapper === "time" && values[nestedIndex] === "-p") nestedIndex++;
+        if (values[nestedIndex] === "--") nestedIndex++;
+        if (wrapper === "timeout" && /^\d+(?:\.\d+)?[smhd]?$/.test(values[nestedIndex] ?? "")) nestedIndex++;
+        const nested = analyze(quote(values.slice(nestedIndex)), true, depth + 1);
+        if (nested.kind !== "none") { found.push(...(nested.invocations ?? [nested.invocation])); unsupported ??= "opaque_execution_wrapper"; continue; }
+        if (nested.unresolved) unsupported ??= nested.reason;
+      }
+      if (shellIndex !== null && shells.has(path.basename(values[shellIndex] ?? "")) && /^-(?:l?c|cl)$/.test(values[shellIndex + 1] ?? "") && values[shellIndex + 2] !== undefined) {
+        const payloadNode = node.namedChildren[shellIndex + 2];
+        if (!payloadNode || dynamicWord(payloadNode)) { unsupported ??= "dynamic_shell_payload"; continue; }
+        if (node.namedChildren.some(child => child !== payloadNode && dynamicWord(child))) unsupported ??= "unresolved_shell_environment";
+        const nested = analyze(values[shellIndex + 2], true, depth + 1);
+        if (nested.kind !== "none") {
+          const route = executionCwd(node, nodes);
+          if (route.unresolved) unsupported ??= "unresolved_execution_cwd";
+          for (const invocation of nested.invocations ?? [nested.invocation]) {
+            invocation.env = { ...outerEnv, ...invocation.env };
+            if (!invocation.expectedCwd && route.cwd) invocation.expectedCwd = route.cwd;
+          }
+          found.push(...(nested.invocations ?? [nested.invocation]));
+          if (backgroundContext(node)) unsupported ??= "background_lifecycle_execution";
+          if (ancestors(node).some(type => repeatedContexts.has(type))) unsupported ??= "repeated_lifecycle_context";
+          if (ancestors(node).some(type => ["command_substitution", "process_substitution"].includes(type))) unsupported ??= "executable_substitution";
+          if (nested.supported === false) unsupported ??= nested.reason ?? "unsupported_wrapper";
+        }
+        else if (nested.unresolved) unsupported ??= nested.reason;
+      } else if (values[shellIndex] === "eval") unsupported ??= "dynamic_eval";
+      else if (values[shellIndex] === "coproc") unsupported ??= "background_lifecycle_execution";
+      else if (dynamicWord(name)) unsupported ??= "dynamic_executable";
+    }
+    if (!found.length) return unsupported ? { kind: "none", unresolved: true, reason: unsupported } : { kind: "none" };
+    if (found.length > 1) unsupported ??= "multiple_lifecycle_invocations";
+    const invocation = found[0];
+    const composed = nodes.length > 1 || root.namedChildren.length !== 1 || invocation.contexts.some(type => !["program", "redirected_statement", "command"].includes(type));
+    return composed || unsupported ? { kind: "compound", invocation, invocations: found, supported: !unsupported, reason: unsupported ?? "shell_composition" }
+      : { kind: "standalone", invocation, invocations: found, supported: true };
+  } finally { /* Native Tree lifetime is managed by the Node binding. */ }
+}
+export function lifecycleCommandFromPayload(payload) {
+  const input = payload.tool_input && typeof payload.tool_input === "object" ? payload.tool_input : {};
+  const command = [payload.command, input.command, input.cmd].find(value => typeof value === "string" && value.length > 0);
+  return typeof command === "string" ? unwrapShellCommand(command) : undefined;
+}
+export function continuationCommand(command) {
+  const values = words(command); if (!values) return null;
+  const start = values.findIndex(word => ["stage", "work"].includes(word)); if (start < 1) return null;
+  const launcher = values.slice(0, start);
+  while (launcher[0] && /^[A-Za-z_][A-Za-z0-9_]*=/.test(launcher[0])) launcher.shift();
+  const direct = launcher.length === 1 && (path.basename(launcher[0]) === "dd-flow" || launcher[0] === "$DD_FLOW_BIN");
+  const node = launcher.length === 2 && path.basename(launcher[0]) === "node" && (path.basename(launcher[1]) === "cli.js" || launcher[1] === "$DD_FLOW_BIN");
+  if (!direct && !node) return null;
+  const args = parseCommandArgs(values.slice(start)), route = args.positional.slice(0, 3).join(" ");
+  const operation = route === "work repair add" ? "work_repair_add" : args.positional[0] === "stage" && args.positional[1] === "block" ? "stage_block" : null;
+  return operation ? { operation, args } : null;
+}
+export function unwrapShellCommand(command) {
+  const values = words(command); if (!values || values.length !== 3 || !shells.has(path.basename(values[0])) || !/^-(?:l?c|cl)$/.test(values[1])) return command;
+  const tree = parser.parse(command);
+  try { const node = tree?.rootNode.namedChildren[0]?.namedChildren[2]; return node && !dynamicWord(node) ? values[2] : command; }
+  finally { /* Native Tree lifetime is managed by the Node binding. */ }
+}
+export function parseCommandArgs(argv) {
+  const positional = [], options = new Map();
+  for (let index = 0; index < argv.length; index++) {
+    const value = argv[index];
+    if (value?.startsWith("--")) {
+      const equals = value.indexOf("=");
+      if (equals > 2) { const key = value.slice(2, equals); options.set(key, [...(options.get(key) ?? []), value.slice(equals + 1)]); continue; }
+      const key = value.slice(2), next = argv[index + 1], optionValue = !next || next.startsWith("--") ? "__dd_flow_flag__" : next;
+      options.set(key, [...(options.get(key) ?? []), optionValue]); if (optionValue !== "__dd_flow_flag__") index++;
+    } else if (value) positional.push(value);
+  }
+  return { positional, options };
+}
+export function commandOption(invocation, name) { const value = invocation.args.options.get(name)?.at(-1); return value === "__dd_flow_flag__" ? undefined : value; }
+export function commandHasOption(invocation, name) { return invocation.args.options.has(name); }
+export function commandPosition(invocation, index) { return invocation.args.positional[index]; }
+export function shellSuffixOffset(command) {
+  const analysis = parseLifecycleCommand(command); return analysis.kind === "none" ? command.length : analysis.invocation.sourceRange?.end ?? command.length;
+}

package/dist/harness-runtime/lib/lifecycle-contract.d.mts

@@ -0,0 +1,10 @@
+export const lifecycleRoutes: {
+  readonly "session register": "session_register"; readonly "stage start": "stage_start"; readonly "stage finish": "stage_finish";
+  readonly "stage pause": "stage_pause"; readonly "stage resume": "stage_resume"; readonly "work start": "work_start";
+  readonly "work finish": "work_finish"; readonly "work fail": "work_fail"; readonly "merge apply": "merge_apply";
+  readonly "merge repair": "merge_repair"; readonly "run recovery accept": "recovery_accept";
+};
+export type LifecycleOperation = typeof lifecycleRoutes[keyof typeof lifecycleRoutes];
+export const lifecycleInternalOptions: readonly ["invocation-id", "hook-event-id"];
+export function lifecycleOperationForArgv(argv: readonly string[]): LifecycleOperation | null;
+export function lifecycleRouteForOperation(operation: LifecycleOperation): keyof typeof lifecycleRoutes;

package/dist/harness-runtime/lib/lifecycle-contract.mjs

@@ -0,0 +1,19 @@
+export const lifecycleRoutes = {
+  "session register": "session_register", "stage start": "stage_start", "stage finish": "stage_finish",
+  "stage pause": "stage_pause", "stage resume": "stage_resume", "work start": "work_start",
+  "work finish": "work_finish", "work fail": "work_fail", "merge apply": "merge_apply",
+  "merge repair": "merge_repair", "run recovery accept": "recovery_accept"
+};
+export const lifecycleInternalOptions = ["invocation-id", "hook-event-id"];
+export function lifecycleOperationForArgv(argv) {
+  if (argv.some(arg => arg === "--help" || arg === "-h")) return null;
+  for (const [route, operation] of Object.entries(lifecycleRoutes)) {
+    if (route.split(" ").every((part, index) => argv[index] === part)) return operation;
+  }
+  return null;
+}
+export function lifecycleRouteForOperation(operation) {
+  const entry = Object.entries(lifecycleRoutes).find(([, value]) => value === operation);
+  if (!entry) throw new Error(`Unknown lifecycle operation: ${operation}`);
+  return entry[0];
+}

package/dist/harness-runtime/lib/managed-daemon.mjs

@@ -293,6 +293,7 @@ export async function stopProcessGroup(child, graceMs = 1_000) {
   // signal operation; there the direct child is the safe best effort.
   const target = process.platform === "win32" ? child.pid : -child.pid;
   const alive = () => { try { process.kill(target, 0); return true; } catch (error) { if (error.code === "ESRCH") return false; if (error.code === "EPERM") return true; throw error; } };
+  const signal = name => { try { process.kill(target, name); return true; } catch (error) { if (error.code === "ESRCH") return false; throw error; } };
   if (!alive()) return;
   if ((child.exitCode !== undefined && child.exitCode !== null) || (child.signalCode !== undefined && child.signalCode !== null)) {
     // The leader can exit a few ticks before its helpers. Observe their normal
@@ -302,11 +303,11 @@ export async function stopProcessGroup(child, graceMs = 1_000) {
     if (!alive()) return;
     throw Object.assign(new Error("process group remains after its leader exited; ownership cannot be proven from this child handle"), { code: "process_group_ownership_unknown", details: { pid: child.pid } });
   }
-  process.kill(target, "SIGTERM");
+  if (!signal("SIGTERM")) return; // The group may exit after the liveness read.
   await new Promise((resolve) => setTimeout(resolve, graceMs));
   if (!alive()) return;
   if (child.exitCode != null || child.signalCode != null) return stopProcessGroup(child, graceMs);
-  process.kill(target, "SIGKILL");
+  if (!signal("SIGKILL")) return;
   // Grace controls escalation, not the OS acknowledgement budget. A caller
   // testing immediate escalation must still allow the kernel to reap children.
   const deadline = Date.now() + Math.max(1_000, graceMs);

package/dist/harness-runtime/lib/model-observations.mjs

@@ -5,6 +5,7 @@ import { withRunnerLock } from "./runner-lock.mjs";
 
 const text = value => typeof value === "string" && value.trim() ? value.trim() : null;
 const fields = ["provider", "model", "reasoning", "mode", "permission_mode"];
+const observationScope = source => JSON.stringify([source?.channel ?? null, source?.scope ?? null, source?.attempt_id ?? null, source?.turn_id ?? null, source?.non_asserting === true]);
 export const observedFields = value => Object.fromEntries(fields.map(key => [key, text(value?.[key])]));
 export const modelObservationFile = journal => path.join(path.dirname(journal), "model-observations.jsonl");
 
@@ -31,20 +32,23 @@ export async function readModelObservations(journal) {
 export async function observeModel({ journal, harness, sessionId, parentSessionId = null, requested = {}, observed = {}, source, evidence = "configured", reason = null, nativeTimestamp = null, previousModel = null }) {
   if (!journal || !sessionId) return null;
   if (!source || !["configured", "request", "response", "unavailable"].includes(evidence)) throw new Error("model observation requires a native source and evidence level");
+  if (typeof source === "string") source = { channel: source, ...(["configured", "response"].includes(evidence) ? { scope: evidence } : {}) };
   const file = modelObservationFile(journal), profile = observedFields(observed);
   await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
   return withRunnerLock(file, async () => {
     const events = await readModelObservations(journal);
-    const replay = source?.event_sha256 ? events.find(item => item.harness === harness && item.session_id === sessionId && item.source?.event_sha256 === source.event_sha256) : null;
+    const replay = source?.event_sha256 ? events.find(item => item.harness === harness && item.session_id === sessionId && observationScope(item.source) === observationScope(source) && item.source?.event_sha256 === source.event_sha256) : null;
     if (replay) return replay;
-    const channel = source?.channel ?? evidence;
-    const previous = events.findLast(item => item.harness === harness && item.session_id === sessionId && (item.source?.channel ?? item.evidence) === channel
-      && (item.source?.attempt_id ?? null) === (source?.attempt_id ?? null));
+    const previous = events.findLast(item => item.harness === harness && item.session_id === sessionId && observationScope(item.source) === observationScope(source));
     const normalizedReason = text(reason)?.slice(0, 200) ?? null;
-    if (previous && JSON.stringify(previous.observed) === JSON.stringify(profile) && previous.reason === normalizedReason && previous.evidence === evidence) return previous;
-    const previousKnown = events.findLast(item => item.harness === harness && item.session_id === sessionId && item.evidence === evidence && item.observed?.model);
+    if (previous && JSON.stringify(previous.observed) === JSON.stringify(profile) && previous.reason === normalizedReason && previous.evidence === evidence
+      && previous.source?.raw_model === source?.raw_model && previous.source?.raw_provider === source?.raw_provider) return previous;
+    const previousKnown = events.findLast(item => item.harness === harness && item.session_id === sessionId && item.evidence === evidence && item.observed?.model
+      && (item.source?.scope ?? "session") === (source?.scope ?? "session") && (item.source?.attempt_id ?? null) === (source?.attempt_id ?? null));
     const fromModel = text(previousModel) ?? previousKnown?.observed.model ?? null;
-    const changed = Boolean(profile.model && fromModel && profile.model !== fromModel);
+    const previousRouting = events.findLast(item => item.harness === harness && item.session_id === sessionId && item.evidence === evidence && item.observed?.provider
+      && (item.source?.scope ?? "session") === (source?.scope ?? "session") && (item.source?.attempt_id ?? null) === (source?.attempt_id ?? null));
+    const changed = Boolean(profile.model && fromModel && (profile.model !== fromModel || profile.provider && previousRouting && profile.provider !== previousRouting.observed.provider));
     const value = { schema_id: "dd-flow/model-observation@1", sequence: events.length + 1,
       harness, session_id: sessionId, parent_session_id: parentSessionId,
       kind: changed ? "model_changed" : !profile.model ? "model_observation_unavailable" : "model_observed",
@@ -76,19 +80,22 @@ export function modelAttribution(events, expectedSessions = []) {
   const missingSessions = expectedSessions.filter(session => typeof session === "string" ? !observedIds.has(session)
     : !sessions.has(`${session.harness}:${session.session_id}`));
   const models = [...new Set(events.map(event => event.observed?.model).filter(Boolean))];
+  const providers = [...new Set(events.map(event => event.observed?.provider).filter(Boolean))];
   const incomplete = !events.length || missingSessions.length > 0 || [...sessions.values()].some(session => {
     const known = session.observations.filter(event => event.observed?.model);
     if (!known.length) return true;
     const knownScopes = new Set(known.map(event => `${event.evidence}:${event.source?.scope ?? "session"}:${event.source?.attempt_id ?? ""}:${event.source?.turn_id ?? ""}`));
     return session.observations.some(event => {
-      if (event.evidence !== "unavailable") return false;
       if (event.source?.non_asserting) return false;
+      if (["configured", "response"].includes(event.evidence) && !event.observed?.model) return true;
+      if (event.evidence !== "unavailable") return false;
       const scope = event.source?.scope;
       return !scope || !knownScopes.has(`configured:${scope}:${event.source?.attempt_id ?? ""}:${event.source?.turn_id ?? ""}`)
         && !knownScopes.has(`response:${scope}:${event.source?.attempt_id ?? ""}:${event.source?.turn_id ?? ""}`);
     });
   });
-  return { models, mixed: models.length > 1 || events.some(event => event.observed?.model && event.requested?.model && event.observed.model !== event.requested.model),
+  return { models, providers, mixed: models.length > 1 || providers.length > 1 || events.some(event => event.observed?.model && event.requested?.model && event.observed.model !== event.requested.model
+    || event.observed?.provider && event.requested?.provider && event.observed.provider !== event.requested.provider),
     observation_completeness: incomplete ? "incomplete" : "available_native_sources", transitions: events.filter(event => event.kind === "model_changed"),
     sessions: [...sessions.values()], missing_sessions: missingSessions, usage_attribution: "session_totals_unattributed_to_model", note: "Native settings/events do not prove undisclosed server routing or per-model token costs." };
 }

package/dist/harness-runtime/lib/native-hook-command.d.mts

@@ -1,3 +1,3 @@
-export function invokeNativeHook(input: { bin: string; args: string[]; payload: unknown; home?: string | undefined; timeoutMs?: number }): Promise<Record<string, unknown> & { timing?: Record<string, number> }>;
-export function hookBudget(timeoutMs?: number, deadlineAt?: number | null): { remaining(phase: string): number };
+export function invokeNativeHook(input: { bin: string; args: string[]; payload: unknown; home?: string | undefined; cwd?: string; env?: NodeJS.ProcessEnv; timeoutMs?: number }): Promise<Record<string, unknown> & { timing?: Record<string, number> }>;
+export function hookBudget(timeoutMs?: number, deadlineAt?: number | null): { deadlineAt: number; remaining(phase: string, maximum?: number): number; run<T>(action: () => T | Promise<T>, phase: string): Promise<T> };
 export function readNativeHookInput(stream: NodeJS.ReadStream, budget: { remaining(phase: string): number }, maxBytes?: number): Promise<string>;