@deksden-com/dd-flow-cli 0.9.0-beta.123 → 0.9.0-beta.124

package/dist/harness-runtime/lib/dd-zcode-daemon.mjs

@@ -3,9 +3,9 @@ import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, open, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import net from "node:net";
-import { durableDaemonDispatch } from "./daemon-operations.mjs";
+import { durableDaemonDispatch, completeDaemonShutdown, commitDaemonShutdown, assertDaemonDispatch, assertDaemonRestartable, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon } from "./daemon-operations.mjs";
 import path from "node:path";
-import { prepareRuntimeOwner, cleanupFailedDaemonStart, closeManagedBridge, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
+import { prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
 
 import {
   AcpBridge,
@@ -163,13 +163,14 @@ export async function startDaemon(options) {
   await prepareRuntimeOwner(config, paths.dir);
   await mkdir(paths.dir, { recursive: true, mode: 0o700 });
   await chmod(paths.dir, 0o700);
+  let previous = await readState(paths.dir); assertDaemonRestartable(previous);
   try {
     const status = await callDaemon(paths.dir, "daemon.status", {}, 1000);
     if (!sameConfig(status, config)) throw new DaemonError("daemon_config_mismatch", "a daemon is already running with different configuration");
     return { ...status, already_running: true };
   } catch (error) { if (error.code !== "daemon_not_running" && error.code !== "daemon_timeout") throw error; }
 
-  const previous = await readState(paths.dir);
+  previous = await readState(paths.dir); assertDaemonRestartable(previous);
   if (previous?.shutdown_state === "clean") {
     if (!sameNativeRouting(previous.config, config)) throw new DaemonError("daemon_config_mismatch", "retained ZCode native storage routing changed");
     await authorizeRetainedDaemonResume(paths.dir, previous, options.sessionId, config);
@@ -227,7 +228,7 @@ export async function startDaemon(options) {
 export async function stopDaemon(options) {
   const timeoutMs = options.timeoutMs ?? 30_000;
   const { socket } = locations(options.stateDir);
-  return await confirmDaemonStopped(() => callDaemon(options.stateDir, "daemon.stop", { cancelTree: options.cancelTree === true }, timeoutMs), socket, timeoutMs);
+  return await confirmDaemonStopped(() => callDaemon(options.stateDir, "daemon.stop", { cancelTree: options.cancelTree === true }, timeoutMs), socket, timeoutMs, { readState: () => readState(options.stateDir) });
 }
 
 export class DaemonRuntime {
@@ -241,7 +242,7 @@ export class DaemonRuntime {
   persist(patch = {}) {
     Object.assign(this.state, patch, { pid: process.pid, updated_at: new Date().toISOString(), sessions: [...this.sessions.values()] });
     const snapshot = structuredClone(this.state);
-    this.persisting = this.persisting.then(() => writeState(this.paths.state, snapshot));
+    this.persisting = this.persisting.catch(() => {}).then(() => writeState(this.paths.state, snapshot));
     return this.persisting;
   }
 
@@ -448,6 +449,7 @@ export class DaemonRuntime {
   }
 
   async dispatch(operation, params) {
+    if (["session.create", "session.prompt", "session.start", "session.fork", "session.resume"].includes(operation)) assertDaemonDispatch(this.paths.dir);
     if (operation === "daemon.status") return {
       daemon_id: this.state.daemon_id, pid: process.pid, socket: this.paths.socket,
       cwd: this.state.cwd, journal: this.state.journal, versions: this.state.versions,
@@ -548,12 +550,17 @@ export class DaemonRuntime {
       await this.persist({ active_tree: this.treeRunning(result) || Boolean(this.activeProductive) });
       return result;
     }
-    if (operation === "daemon.stop") return await this.prepareStop(params.cancelTree === true);
+    if (operation === "daemon.stop") return await completeDaemonShutdown(this.paths.dir, this.state, patch => this.persist(patch), () => this.prepareStop(params.cancelTree === true), [
+      ["provider_resource", () => finishDaemonProcess(this.state.config, this.state.provider_process)],
+      ["daemon_resource", () => finishDaemonProcess(this.state.config, this.state.resource_process)]
+    ]);
     throw new DaemonError("unknown_operation", `unknown daemon operation: ${operation}`);
   }
 
   async prepareStop(cancel) {
+    if (this.activeProductive && !cancel) throw new DaemonError("tree_not_settled", "productive operation is running");
     if (cancel) this.controlGeneration = (this.controlGeneration ?? 0) + 1;
+    if (!this.state.native_stop_proof || this.state.native_stop_proof.daemon_id !== this.state.daemon_id) {
     const unsettled = [];
     for (const session of this.sessions.values()) {
       if (session.close_receipt) {
@@ -603,6 +610,10 @@ export class DaemonRuntime {
       }
     }
     if (unsettled.length) throw new DaemonError("tree_not_settled", "daemon still owns running Sessions", false, { sessions: unsettled });
+    commitDaemonShutdown(this.paths.dir);
+    await this.persist({ native_stop_proof: { daemon_id: this.state.daemon_id, sessions: [...this.sessions.keys()], observed_at: new Date().toISOString() } });
+    }
+    commitDaemonShutdown(this.paths.dir);
     // A cooperative close can make the native Session non-resident while its
     // original ACP prompt is still pending.  For an explicitly whole-RUN
     // cancellation this daemon owns the bridge process group, so retire that
@@ -614,7 +625,7 @@ export class DaemonRuntime {
         if (typeof this.bridge.close === "function") await this.bridge.close();
         bridgeClosed = true;
       } catch (error) {
-        throw new DaemonError(error.code ?? "provider_process_stop_incomplete", error.message ?? String(error), false);
+        throw new DaemonError(error.code ?? "provider_process_stop_incomplete", error.message ?? String(error), false, error.details);
       }
     }
     const deadline = Date.now() + 5000;
@@ -625,24 +636,11 @@ export class DaemonRuntime {
     // A bridge without a close method occurs only in in-memory diagnostics: it
     // owns no OS process boundary. Production AcpBridge always has one.
     try { if (!bridgeClosed && typeof this.bridge.close === "function") await this.bridge.close(); }
-    catch (error) { throw new DaemonError(error.code ?? "provider_process_stop_incomplete", error.message ?? String(error), false); }
+    catch (error) { throw new DaemonError(error.code ?? "provider_process_stop_incomplete", error.message ?? String(error), false, error.details); }
     await this.persist({ active_tree: false, shutdown_state: "stopping", active_operation: null, active_request: null, physical_settlement: { confirmed_at: new Date().toISOString(), bridge_pid: this.bridge.child?.pid ?? null } });
     return { daemon_id: this.state.daemon_id, stopped: true, clean: true, physical_settlement: this.state.physical_settlement, _shutdown: true };
   }
 
-  async shutdown() {
-    // prepareStop has already closed the owned bridge. Signal shutdown may get
-    // here directly, so close remains idempotent.
-    await closeManagedBridge(this.state.config, this.state, this.bridge);
-    await this.persist({ active_tree: false, shutdown_state: "clean", stopped_at: new Date().toISOString() });
-    const resourceProcess = this.state.resource_process;
-    if (resourceProcess?.id && resourceProcess.lease_token) {
-      try { await finishDaemonProcess(this.state.config, resourceProcess, "stopped", "daemon_stopped"); }
-      catch { /* Keep the state; the next reconciler owns stale processes. */ }
-    }
-    await new Promise((resolve) => this.server.close(resolve));
-    await removeSocket(this.paths.socket, this.paths.dir);
-  }
 }
 
 export function zcodeBridgeEnv(config, daemonId) {
@@ -660,11 +658,13 @@ export async function serveDaemon(stateDir) {
   scheduleDaemonProcessHeartbeat(state.config, state.resource_process);
   await removeSocket(paths.socket, paths.dir);
   const server = net.createServer((connection) => {
-    connection.setEncoding("utf8"); let buffer = "";
+    connection.setEncoding("utf8"); let buffer = "", consumed = false;
     connection.on("data", (chunk) => {
+      if (consumed) return;
       buffer += chunk;
       const newline = buffer.indexOf("\n");
       if (newline < 0) return;
+      consumed = true;
       const line = buffer.slice(0, newline); buffer = buffer.slice(newline + 1);
       void (async () => {
         let request;
@@ -672,15 +672,17 @@ export async function serveDaemon(stateDir) {
           request = JSON.parse(line);
           if (request.schema_id !== REQUEST_SCHEMA || !request.id || !request.operation) throw new DaemonError("daemon_protocol_mismatch", "invalid daemon request");
           const result = await durableDaemonDispatch(paths.dir, request, () => runtime.dispatch(request.operation, request.params ?? {}), () => runtime.dispatch("session.inspect", request.params ?? {}));
+          if (result?._shutdown) retireDaemonEndpoint(server);
           connection.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: true, result: { ...result, _shutdown: undefined } })}\n`);
-          if (result?._shutdown) setImmediate(() => void runtime.shutdown().then(() => process.exit(0)));
         } catch (error) {
+          await retireFailedDaemon(server, state, error, patch => runtime.persist(patch));
           connection.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request?.id ?? null, ok: false, error: errorPayload(error) })}\n`);
         }
       })();
     });
   });
   runtime.server = server;
+  trackDaemonConnections(server);
   await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); });
   await chmod(paths.socket, 0o600);
   await runtime.persist({ shutdown_state: "running", active_tree: false });

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -7,7 +7,8 @@ import { createHash } from "node:crypto";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import readline from "node:readline";
-import { stopProcessGroup } from "./managed-daemon.mjs";
+import { closeBridgeProcess } from "./managed-daemon.mjs";
+import { errorRecord } from "./operation-errors.mjs";
 import { checkObservedProfile, observeModel, observedFields } from "./model-observations.mjs";
 
 import { readZcodeUsage } from "./zcode-usage.mjs";
@@ -423,13 +424,10 @@ export class AcpBridge {
   async close() {
     // Productive notification failures belong to flush()/the original Turn.
     // Draining them must not relabel a successful physical shutdown as failed.
-    await Promise.allSettled([...this.lifecycleNotifications, this.notifications]);
-    if (this.child) {
-      this.child.stdin.end();
-      await Promise.race([new Promise((resolve) => this.child.once("exit", resolve)), new Promise((resolve) => setTimeout(resolve, 2000))]);
-      await stopProcessGroup(this.child, 2_000);
-    }
-    await this.journal.flush();
+    return await closeBridgeProcess(this, async () => {
+      await Promise.allSettled([...this.lifecycleNotifications, this.notifications]);
+      await this.journal.flush();
+    });
   }
 }
 
@@ -721,9 +719,10 @@ function requireJournal(options) { absolute(options.journal, "--journal"); }
 function receipt(options, value) { return options.daemonId ? { daemon_id: options.daemonId, ...value } : value; }
 
 async function withBridge(options, operation) {
-  const bridge = new AcpBridge(options);
+  const bridge = new AcpBridge(options); let primary;
   try { const initialized = await bridge.start(); const result = await operation(bridge, initialized); await bridge.flush(); return result; }
-  finally { await bridge.close(); }
+  catch (error) { primary = error; throw error; }
+  finally { try { await bridge.close(); } catch (error) { if (!primary) throw error; primary.cleanup_error = errorRecord(error); primary.details = { ...primary.details, cleanup_error: primary.cleanup_error }; } }
 }
 
 function flowForwarder(options, rootProviderSessionId, bridge) {

package/dist/harness-runtime/lib/driver-recovery.mjs

@@ -7,11 +7,21 @@ import { reportedError } from "./operation-errors.mjs";
 import { ObservationClock } from "./observation-clock.mjs";
 import { runtimeProcess } from "./managed-daemon.mjs";
 
+function cleanShutdownConfirmed(state) {
+  const proof = state.shutdown;
+  return state.shutdown_state === "clean" && state.active_tree === false
+    && proof?.schema_id === "dd-flow/daemon-shutdown@1" && proof.daemon_id === state.daemon_id
+    && proof.result?.clean === true && Array.isArray(proof.required_phases)
+    && proof.required_phases.length >= 3 && proof.required_phases.includes("tree")
+    && proof.required_phases.includes("daemon_resource")
+    && proof.required_phases.every(phase => typeof phase === "string" && proof.phases?.[phase] === true);
+}
+
 /** Explicit same-Session restart retains native stores and the old daemon
  * receipt; it does not turn a terminal directory into a new execution. */
 export async function authorizeRetainedDaemonResume(root, previous, sessionId, config) {
   const sessions = [...(previous.sessions ?? []), ...(previous.root_session_id ? [previous.root_session_id] : [])];
-  if (previous.shutdown_state !== "clean" || previous.active_tree === true || typeof sessionId !== "string" || !sessions.some(session => (typeof session === "string" ? session : session.provider_session_id) === sessionId)) throw Object.assign(new Error("terminal daemon restart requires a retained, settled Session identity"), { code: "daemon_state_terminal" });
+  if (!cleanShutdownConfirmed(previous) || typeof sessionId !== "string" || !sessions.some(session => (typeof session === "string" ? session : session.provider_session_id) === sessionId)) throw Object.assign(new Error("terminal daemon restart requires a retained, settled Session identity and complete shutdown proof"), { code: "daemon_state_terminal" });
   for (const key of ["cwd", "projectRoot", "ddFlowHome", "ddFlowBin", "provider", "model", "reasoning", "mode", "variant", "agent", "bin", "noFlow"]) {
     if ((previous.config?.[key] ?? null) !== (config[key] ?? null)) throw Object.assign(new Error(`retained daemon configuration changed: ${key}`), { code: "daemon_config_mismatch" });
   }
@@ -43,7 +53,7 @@ export async function recoverySettlement(driversRoot) {
       }
       else if (entry.name === "daemon.json") {
         const state = JSON.parse(await readFile(file, "utf8"));
-        if (state.shutdown_state !== "clean" || state.active_tree === true) throw Object.assign(new Error("provider tree has no clean shutdown receipt"), { code: "recovery_settlement_unconfirmed" });
+        if (!cleanShutdownConfirmed(state)) throw Object.assign(new Error("provider tree has no complete clean shutdown receipt"), { code: "recovery_settlement_unconfirmed" });
         await assertDaemonReplaceable(directory);
         await reconcileDriverReplies(directory);
         if (state.config?.resourceHome && state.resource_process?.id) {

package/dist/harness-runtime/lib/managed-daemon.d.mts

@@ -0,0 +1,2 @@
+import type { ChildProcess } from "node:child_process";
+export function stopProcessGroup(child: ChildProcess | null | undefined, graceMs?: number, options?: { detached?: boolean }): Promise<void>;

package/dist/harness-runtime/lib/managed-daemon.mjs

@@ -286,43 +286,111 @@ export async function cleanupFailedDaemonStart(config, daemonRecord, daemonChild
   }
 }
 
-export async function stopProcessGroup(child, graceMs = 1_000) {
+const processStops = new WeakMap();
+export async function closeBridgeProcess(bridge, drain) {
+  if (bridge.closePending) return await bridge.closePending;
+  const pending = (async () => {
+    let primary;
+    try {
+      if (!bridge.physicallyClosed && bridge.child) {
+        const child = bridge.child;
+        if (!bridge.stdinEnded && !child.stdin?.destroyed) { bridge.stdinEnded = true; child.stdin?.end(); }
+        if (child.exitCode == null && child.signalCode == null) {
+          await new Promise(resolve => {
+            const done = () => { clearTimeout(timer); child.removeListener("exit", done); resolve(); };
+            const timer = setTimeout(done, 2_000); child.once("exit", done);
+          });
+        }
+        await stopProcessGroup(child, 2_000);
+        bridge.physicallyClosed = true;
+      }
+    } catch (error) { primary = error; }
+    let drainTimer;
+    try { await Promise.race([drain(), new Promise((_, reject) => { drainTimer = setTimeout(() => reject(Object.assign(new Error("bridge drain did not finish"), { code: "bridge_drain_timeout" })), 10_000); })]); }
+    catch (error) { if (primary) { primary.cleanup_error = errorRecord(error); primary.details = { ...primary.details, cleanup_error: primary.cleanup_error }; } else primary = error; }
+    finally { clearTimeout(drainTimer); }
+    if (primary) throw primary;
+  })();
+  bridge.closePending = pending;
+  try { return await pending; }
+  finally { bridge.closePending = null; }
+}
+
+export async function stopProcessGroup(child, graceMs = 1_000, { detached = true } = {}) {
   if (!child?.pid) return;
-  // Harness bridges are detached on Unix, so their own process group is the
-  // smallest reliable unit of cleanup. Windows has no equivalent negative-PID
-  // signal operation; there the direct child is the safe best effort.
-  const target = process.platform === "win32" ? child.pid : -child.pid;
+  if (processStops.has(child)) return await processStops.get(child);
+  const pending = stopOwnedChild(child, graceMs, detached);
+  processStops.set(child, pending);
+  try { return await pending; } finally { processStops.delete(child); }
+}
+async function stopOwnedChild(child, graceMs, detached) {
+  const target = process.platform === "win32" || !detached ? child.pid : -child.pid;
+  const details = signal => ({ pid: child.pid, pgid: target < 0 ? child.pid : null, signal, platform: process.platform, exit_code: child.exitCode ?? null, signal_code: child.signalCode ?? null, observed_at: new Date().toISOString() });
   const alive = () => { try { process.kill(target, 0); return true; } catch (error) { if (error.code === "ESRCH") return false; if (error.code === "EPERM") return true; throw error; } };
-  const signal = name => { try { process.kill(target, name); return true; } catch (error) { if (error.code === "ESRCH") return false; throw error; } };
-  if (!alive()) return;
-  if ((child.exitCode !== undefined && child.exitCode !== null) || (child.signalCode !== undefined && child.signalCode !== null)) {
-    // The leader can exit a few ticks before its helpers. Observe their normal
-    // shutdown before failing ownership; never signal a leaderless group.
-    const deadline = Date.now() + Math.max(1_000, graceMs);
-    while (alive() && Date.now() < deadline) await new Promise(resolve => setTimeout(resolve, 25));
-    if (!alive()) return;
-    throw Object.assign(new Error("process group remains after its leader exited; ownership cannot be proven from this child handle"), { code: "process_group_ownership_unknown", details: { pid: child.pid } });
-  }
-  if (!signal("SIGTERM")) return; // The group may exit after the liveness read.
-  await new Promise((resolve) => setTimeout(resolve, graceMs));
+  const gone = async ms => {
+    const deadline = performance.now() + ms;
+    while (alive() && performance.now() < deadline) await new Promise(resolve => setTimeout(resolve, 25));
+    return !alive();
+  };
+  const signal = async name => {
+    try { process.kill(target, name); return true; }
+    catch (error) {
+      if (error.code === "ESRCH") return false;
+      error.details = { ...error.details, ...details(name), syscall: error.syscall ?? "kill" };
+      // Permission denial is not permission to escalate. Observe only the retained target.
+      let absent = false;
+      try { absent = await gone(Math.min(250, Math.max(25, graceMs))); }
+      catch (observation) { error.details.observation_error = errorRecord(observation); }
+      if (absent) {
+        process.stderr.write(`${JSON.stringify({ cleanup_reobserved: errorRecord(error), physical_exit: "ESRCH" })}\n`);
+        return false;
+      }
+      throw error;
+    }
+  };
   if (!alive()) return;
-  if (child.exitCode != null || child.signalCode != null) return stopProcessGroup(child, graceMs);
-  if (!signal("SIGKILL")) return;
-  // Grace controls escalation, not the OS acknowledgement budget. A caller
-  // testing immediate escalation must still allow the kernel to reap children.
-  const deadline = Date.now() + Math.max(1_000, graceMs);
-  while (alive() && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 25));
-  if (alive()) throw Object.assign(new Error(`process group ${child.pid} did not stop`), { code: "process_group_stop_incomplete" });
+  const leaderExited = () => child.exitCode != null || child.signalCode != null;
+  const observeLeaderless = async () => {
+    if (await gone(Math.max(1_000, graceMs))) return;
+    throw Object.assign(new Error("process group remains after its leader exited; ownership cannot be proven from this child handle"), { code: "process_group_ownership_unknown", details: details(null) });
+  };
+  if (leaderExited()) return await observeLeaderless();
+  if (!await signal("SIGTERM")) return;
+  if (await gone(graceMs)) return;
+  if (leaderExited()) return await observeLeaderless();
+  if (!await signal("SIGKILL")) return;
+  if (!await gone(Math.max(1_000, graceMs))) throw Object.assign(new Error(`process group ${child.pid} did not stop`), { code: "process_group_stop_incomplete", details: details("SIGKILL") });
 }
 
 /** A daemon acknowledgement is not a completed stop until its endpoint closes. */
-export async function confirmDaemonStopped(request, socket, timeoutMs = 30_000) {
-  const result = await request();
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    try { await lstat(socket); }
-    catch (error) { if (error.code === "ENOENT") return result; throw error; }
-    await new Promise((resolve) => setTimeout(resolve, 25));
+export async function confirmDaemonStopped(request, socket, timeoutMs = 30_000, { readState } = {}) {
+  const deadline = performance.now() + timeoutMs;
+  const expected = await readState?.();
+  const identity = state => state?.daemon_id ?? state?.config?.daemonId;
+  if (readState && (!identity(expected) || !Number.isSafeInteger(expected?.pid) || expected.pid < 1)) throw Object.assign(new Error('daemon stop has no retained incarnation/PID proof'), { code: 'daemon_cleanup_identity_mismatch' });
+  const failure = async observer => {
+    const state = await readState?.();
+    if (expected && identity(state) !== identity(expected)) throw Object.assign(new Error("daemon incarnation changed during stop"), { code: "daemon_identity_mismatch" });
+    const primary = state?.shutdown_state === "cleanup_failed" ? state.cleanup_error : null;
+    if (primary) throw Object.assign(new Error(primary.message), primary, { details: { ...primary.details, socket, phase: "confirm_daemon_stop", observer_error: errorRecord(observer) } });
+    throw observer;
+  };
+  let result;
+  try { result = await request(); }
+  catch (error) { return await failure(error); }
+  if (result?.stopped !== true) return await failure(Object.assign(new Error("stop acknowledgement does not prove shutdown"), { code: "daemon_stop_incomplete" }));
+  for (;;) {
+    const state = await readState?.();
+    if (expected && identity(state) !== identity(expected)) return await failure(Object.assign(new Error("daemon incarnation changed"), { code: "daemon_identity_mismatch" }));
+    let endpointPresent = true;
+    try { await lstat(socket); } catch (error) { if (error.code === "ENOENT") endpointPresent = false; else throw error; }
+    let daemonPresent = false;
+    if (expected?.pid) { try { process.kill(expected.pid, 0); daemonPresent = true; } catch (error) { if (error.code !== "ESRCH") daemonPresent = true; } }
+    if (!endpointPresent && !daemonPresent) {
+      if (readState && result.clean === true && (state?.shutdown_state !== 'clean' || state.active_tree !== false)) return await failure(Object.assign(new Error('daemon clean ACK conflicts with its retained state'), { code: 'daemon_stop_incomplete' }));
+      return result;
+    }
+    if (performance.now() >= deadline) return await failure(Object.assign(new Error("daemon stop could not confirm endpoint retirement and owned PID exit"), { code: "daemon_stop_incomplete", details: { socket, daemon_pid: expected?.pid ?? null, endpoint_present: endpointPresent, daemon_present: daemonPresent } }));
+    await new Promise(resolve => setTimeout(resolve, 25));
   }
-  throw Object.assign(new Error("daemon acknowledged stop but its socket remained live"), { code: "daemon_stop_incomplete", details: { socket } });
 }

package/dist/schemas/flow-run.schema.json

@@ -13,6 +13,7 @@
     "subject": {"$ref": "#/definitions/identity"},
     "flow_kind": {"type": "string", "minLength": 1},
     "verification_matrix_contract": {"const": "dd-flow/verification-matrix@1"},
+    "final_check_coverage_contract": {"const": "dd-flow/final-check-coverage@1"},
     "status": {"enum": ["created", "running", "paused", "waiting_for_user", "done", "failed", "blocked", "cancelled", "discarded"]},
     "verdict": {"type": ["string", "null"]},
     "started_at": {"type": "string", "format": "date-time"},

package/dist/schemas/plan-review-decision.schema.json

@@ -1,14 +1,14 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "dd-flow/plan-review-decision@3",
+  "$id": "dd-flow/plan-review-decision@4",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema_id", "outcome", "summary", "finding_decisions", "correction"],
   "properties": {
-    "schema_id": {"const": "dd-flow/plan-review-decision@3"},
+    "schema_id": {"const": "dd-flow/plan-review-decision@4"},
     "outcome": {"enum": ["accepted", "failed", "cancelled"]},
     "summary": {"type": "string", "minLength": 1},
-    "finding_decisions": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["finding_ref", "decision", "reason"], "properties": {"finding_ref": {"type": "string", "pattern": "^WRK-[^/]+/FIND-[0-9]{3}$"}, "decision": {"enum": ["accepted_fix", "rejected", "deferred_as_DEF", "requires_user", "duplicate"]}, "reason": {"type": "string", "minLength": 1}}}},
+    "finding_decisions": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["finding_ref", "decision", "reason"], "properties": {"finding_ref": {"type": "string", "pattern": "^WRK-[^/]+/FIND-[0-9]{3}$"}, "decision": {"enum": ["accepted_fix", "rejected", "deferred_as_DEF", "requires_user", "duplicate"]}, "reason": {"type": "string", "minLength": 1}, "duplicate_of": {"type": "string", "pattern": "^WRK-[^/]+/FIND-[0-9]{3}$"}, "def_id": {"type": "string", "pattern": "^DEF-[A-Za-z0-9][A-Za-z0-9_-]*$"}}}},
     "correction": {"type": "object", "additionalProperties": false, "required": ["status", "previous_plan_revision", "changed_paths", "summary"], "properties": {"status": {"enum": ["applied", "not_required"]}, "previous_plan_revision": {"type": "integer", "minimum": 1}, "changed_paths": {"type": "array", "items": {"type": "string", "minLength": 1}}, "summary": {"type": "string", "minLength": 1}}}
   }
 }

package/dist/services/code-checks.js

@@ -6,7 +6,8 @@ import path from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { parse } from "shell-quote";
 import { assertRunMutationAllowed } from "./run-recovery.js";
-import { AppError } from "../shared/errors.js";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { stopProcessGroup } from "../harness-runtime/lib/managed-daemon.mjs";
 import { confirmManagedProcess, finishManagedProcess, heartbeatManagedProcess, managedProcessStatus, managedProcessRuntimeHome, managedOwnerIsAlive, processTreeIsAlive, registerManagedProcess, reservePorts } from "./managed-processes.js";
 import { admitRuntimeCheck, runtimeBudgetForRun } from "./runtime-budget.js";
 import { getResourceDatabase } from "../storage/database.js";
@@ -340,7 +341,8 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
             if (processTreeIsAlive(current))
                 throw new AppError("check_in_progress", "The check shell exited but its process tree is still live; retain this receipt and its resources until settlement", 2, { process_id: managed.id, check_receipt_id: id });
             allocation.release();
-            finishManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, state: result.aborted || result.exitCode !== 0 || Boolean(result.error) ? "failed" : "stopped", reason: result.error });
+            if (!result.cleanupUnconfirmed)
+                finishManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, state: result.aborted || result.exitCode !== 0 || Boolean(result.error) ? "failed" : "stopped", reason: result.error });
         }
         catch (error) {
             if (error instanceof AppError && error.code === "check_in_progress")
@@ -825,7 +827,8 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
         let error = null;
         let stopping = false;
         let progress;
-        let escalation;
+        let cleanup;
+        let cleanupUnconfirmed = false;
         const stop = (cause) => {
             if (stopping)
                 return;
@@ -835,23 +838,21 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
                 clearInterval(progress);
                 progress = undefined;
             }
-            if (child.pid) {
-                terminateProcessGroup(child.pid, "SIGTERM");
-                escalation = setTimeout(() => terminateProcessGroup(child.pid, "SIGKILL"), 5_000);
-            }
+            cleanup = stopProcessGroup(child, 5_000).catch(cause => {
+                cleanupUnconfirmed = true;
+                error = `${error}; cleanup: ${JSON.stringify(errorRecord(cause))}`;
+                resolve({ exitCode: null, error, aborted: true, cleanupUnconfirmed });
+            });
         };
         // Register handlers before checking pid or calling persistence callbacks.
         // Failure is not completion until the spawned process has actually closed.
         child.once("error", (value) => { error = value.message; });
         child.stdin.on("error", stop);
-        child.once("close", (exitCode, signal) => {
+        child.once("close", async (exitCode, signal) => {
             if (progress)
                 clearInterval(progress);
-            if (escalation)
-                clearTimeout(escalation);
-            if (stopping)
-                terminateProcessGroup(child.pid, "SIGKILL");
-            resolve({ exitCode, error: error ?? (signal ? `terminated by ${signal}` : null), aborted: stopping || Boolean(signal) || Boolean(error) });
+            await cleanup;
+            resolve({ exitCode, error: error ?? (signal ? `terminated by ${signal}` : null), aborted: stopping || Boolean(signal) || Boolean(error), ...(cleanupUnconfirmed ? { cleanupUnconfirmed } : {}) });
         });
         if (!child.pid) {
             error = "check process did not provide a PID";
@@ -890,8 +891,3 @@ function checkShellScript() {
         'exit "$code"'
     ].join("\n");
 }
-function terminateProcessGroup(pid, signal) { if (!pid)
-    return; try {
-    process.kill(process.platform === "win32" ? pid : -pid, signal);
-}
-catch { /* already exited */ } }