@deksden-com/dd-flow-cli 0.9.0-beta.123 → 0.9.0-beta.127

package/dist/services/run-controller-process.js

@@ -7,7 +7,7 @@ import { AppError } from "../shared/errors.js";
 import { getResourceDatabase } from "../storage/database.js";
 import { finishManagedProcess, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processStartedAt, processTreeIsAlive, registerManagedProcess } from "./managed-processes.js";
 import { setFlowRunRecoveryPaused } from "./runs.js";
-import { assertRunMutationAllowed, recoveryGuard } from "./run-recovery.js";
+import { assertRunMutationAllowed, assertRunRecoveryAllowed, recoveryGuard } from "./run-recovery.js";
 import { requireRun, requireController, controllerReceipt, appendEvent, digest, errorRecord } from "./run-controller-state.js";
 const launchId = (row) => `${row.controller_id}:owner-launch:${digest(row.owner_token)}`;
 const processOperation = (context, row) => `controller:${digest({ database: context.db.path, project: row.project_id, run: row.run_id })}`;
@@ -27,17 +27,24 @@ function launchRecord(context, row) {
     const value = JSON.parse(record.receipt_json);
     return value?.registration === "controller_self@1" ? { ...record, value } : null;
 }
-function assertLaunchAllowed(context, row) {
+export function assertLaunchAllowed(context, row) {
     const run = requireRun(context, row.project_id, row.run_id);
     if (!["running", "paused", "waiting_for_user"].includes(run.status))
         throw new AppError("invalid_run_state", "A terminal RUN cannot start a physical controller", 1);
+    if (JSON.parse(row.state_json).recovery)
+        assertControllerRecoveryAllowed(context, row);
+    else
+        assertRunMutationAllowed(context, row.project_id, row.run_id, row.generation);
+}
+/** Existing owners must retain the recovery fence while finishing terminal capture/settlement. */
+export function assertControllerRecoveryAllowed(context, row) {
     const state = JSON.parse(row.state_json);
     if (!state.recovery) {
-        assertRunMutationAllowed(context, row.project_id, row.run_id, row.generation);
+        assertRunRecoveryAllowed(context, row.project_id, row.run_id, row.generation);
         return;
     }
     const guard = recoveryGuard(context, row.project_id, row.run_id);
-    if (guard?.generation !== row.generation || guard.recovery_id !== state.recovery.recovery_id || !["sealed", "resuming"].includes(guard.status)
+    if (guard?.generation !== row.generation || guard.recovery_id !== state.recovery.recovery_id || !["sealed", "resuming", "recovered"].includes(guard.status)
         || !context.db.get("SELECT 1 FROM run_controls WHERE control_id = ? AND recovery_id = ? AND status = 'resuming'", [state.recovery.control_id, state.recovery.recovery_id]))
         throw new AppError("run_control_superseded", "Controller launch no longer owns the accepted recovery", 1);
 }

package/dist/services/run-controller-recovery.js

@@ -221,6 +221,23 @@ export async function resumeControllerSession(context, row, manifest, state, ass
                 const binding = context.db.get("SELECT runtime_dispatch_json FROM run_recovery_bindings WHERE recovery_id = ?", [recovery.recovery_id]);
                 return binding?.runtime_dispatch_json ? JSON.parse(binding.runtime_dispatch_json).capacity_intents ?? [] : [];
             },
+            retainedFailures: () => {
+                const binding = context.db.get("SELECT runtime_dispatch_json FROM run_recovery_bindings WHERE recovery_id = ?", [recovery.recovery_id]);
+                return binding?.runtime_dispatch_json ? JSON.parse(binding.runtime_dispatch_json).capacity_failures ?? [] : [];
+            },
+            retainFailure: (_id, refusal) => {
+                assertRecoveryOwner();
+                context.db.writeTransaction(() => {
+                    const binding = context.db.get("SELECT runtime_dispatch_json FROM run_recovery_bindings WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared'", [recovery.recovery_id, daemonId]);
+                    if (!binding)
+                        throw new AppError("recovery_capacity_owner_changed", "Recovery binding changed before refusal retention", 1);
+                    const retained = JSON.parse(binding.runtime_dispatch_json);
+                    retained.capacity_failures = [...(retained.capacity_failures ?? []), refusal];
+                    const changed = context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared' AND runtime_dispatch_json = ?", [JSON.stringify(retained), recovery.recovery_id, daemonId, binding.runtime_dispatch_json]);
+                    if (changed.changes !== 1)
+                        throw new AppError("recovery_capacity_owner_changed", "Recovery binding changed during refusal retention", 1);
+                });
+            },
             inspectOperation: id => inspect(["daemon", "operation", "--state-dir", session.state_dir, "--operation-id", id, "--json"], `${id}:capacity-observe`),
             inspectSession: turnId => inspect(["session", "inspect", "--session-id", session.id, ...(turnId ? ["--turn-id", turnId] : []), ...sessionArguments(context, manifest, session)], `${dispatch.operation_id}:capacity-inspect`),
             assertCurrent: () => {

package/dist/services/run-controller-state.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
-import { AppError } from "../shared/errors.js";
+import { AppError, errorRecord as structuredErrorRecord } from "../shared/errors.js";
 import { runtimeHarness } from "./execution-policy.js";
+import { managedProcessRuntimeHome, managedProcessStatus, processTreeIsAlive } from "./managed-processes.js";
 export function requireRun(context, projectId, runId) {
     const run = context.db.get("SELECT id, project_id, project_root, workspace_root, run_root, status, index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
     if (!run?.run_root)
@@ -18,8 +19,66 @@ export function controllerReceipt(row) {
     const manifest = JSON.parse(row.manifest_json);
     return { ok: true, schema_id: "dd-flow/run-controller-receipt@1", controller: { controller_id: row.controller_id, request_id: row.request_id, project_id: row.project_id, run_id: row.run_id, generation: row.generation, runtime_budget: manifest.budget ?? null, status: row.status, process_id: row.process_id, owner_pid: row.owner_pid, state_dir: row.state_dir, stage: state.stage, sessions: state.sessions.map(session => ({ session_id: session.id, harness: runtimeHarness(session.profile), profile_id: session.profile.id, state_dir: session.state_dir, journal: session.journal, stopped: session.stopped === true })), error: row.last_error_json ? JSON.parse(row.last_error_json) : null } };
 }
+/** Read-only causal diagnostics, not a settlement or capture authorization. */
+export function terminalControllerFinalization(context, project, runId, runStatus) {
+    if (!["done", "failed", "cancelled"].includes(runStatus) || !context.db.get("SELECT 1 FROM sqlite_schema WHERE name = 'run_controllers'"))
+        return null;
+    const row = context.db.get("SELECT * FROM run_controllers WHERE project_id = ? AND run_id = ? ORDER BY created_at DESC, controller_id DESC LIMIT 1", [project.id, runId]);
+    if (!row?.last_error_json || !["recovery_required", "capture_failed"].includes(row.status))
+        return null;
+    const error = JSON.parse(row.last_error_json);
+    if (error.details?.phase !== "terminal_finalization" || error.details.project_root !== project.root || error.details.run_id !== runId || error.details.controller_id !== row.controller_id)
+        return null;
+    let owner = "unknown";
+    try {
+        const manifest = JSON.parse(row.manifest_json);
+        const records = managedProcessStatus({ ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: manifest.resource_home } });
+        const record = records.find(item => item.id === row.process_id);
+        if (record && record.kind === "run-controller" && record.owner_id === row.controller_id && record.project_id === project.id && record.run_id === runId
+            && record.lease_token === row.process_lease_token && record.pid === row.owner_pid && record.pid && record.pid_started_at
+            && managedProcessRuntimeHome(record, context) === context.ddFlowHome) {
+            if (processTreeIsAlive(record))
+                owner = "live";
+            else if (["stopped", "failed"].includes(record.state) && record.finished_at)
+                owner = "absent";
+        }
+        // Any other still-owned controller record makes absence unproven.
+        if (owner === "absent" && records.some(item => item.id !== row.process_id && item.kind === "run-controller" && item.project_id === project.id && item.run_id === runId
+            && managedProcessRuntimeHome(item, context) === context.ddFlowHome && (!item.pid_started_at || !["stopped", "failed"].includes(item.state) || processTreeIsAlive(item))))
+            owner = "unknown";
+    }
+    catch { /* Missing registry or unreadable identity is uncertainty, never death. */ }
+    const control = context.db.get("SELECT 1 FROM sqlite_schema WHERE name = 'run_controls'")
+        && context.db.get("SELECT 1 FROM run_controls WHERE project_id = ? AND run_id = ? AND status IN ('requested','settled','resuming')", [project.id, runId]);
+    const capture = context.db.get("SELECT 1 FROM run_controller_operations WHERE controller_id = ? AND generation = ? AND status = 'completed' AND json_extract(input_json, '$.action') = 'boundary_capture' AND json_type(input_json, '$.stage_entry') = 'null'", [row.controller_id, row.generation]);
+    return { schema_id: "dd-flow/terminal-finalization@1", issuer: "dd-flow", phase: "terminal_finalization", project_root: project.root, run_id: runId,
+        controller_id: row.controller_id, generation: row.generation, controller_status: row.status, run_status: runStatus,
+        status: !control && owner === "absent" ? "blocked" : "pending", owner, capture: capture ? "recorded" : "missing", error };
+}
 export function appendEvent(context, id, type, data) { context.db.run("INSERT INTO run_controller_events (controller_id, event_type, data_json, created_at) VALUES (?, ?, ?, ?)", [id, type, JSON.stringify(data), context.now()]); }
-export function saveState(context, row, state) { context.db.run("UPDATE run_controllers SET state_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ?", [JSON.stringify(state), context.now(), row.controller_id, row.owner_token]); }
+export function saveState(context, row, state) {
+    const changed = context.db.run("UPDATE run_controllers SET state_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND generation = ? AND status NOT IN ('completed','cancelled','superseded')", [JSON.stringify(state), context.now(), row.controller_id, row.owner_token, row.generation]);
+    if (changed.changes !== 1)
+        throw new AppError("controller_owner_mismatch", "Controller state owner or generation changed", 1);
+}
+export function retainControllerCapacityIntent(context, row, state, intent, sessionId, kind, assertCurrent) {
+    const root = intent.root_operation_id;
+    if (!root || intent.session_id !== sessionId || !intent.refusal)
+        throw new AppError("capacity_continuation_conflict", "Capacity intent has no exact controller root/Session/refusal", 1);
+    const pending = { root_operation_id: root, predecessor: intent.predecessor, successor: intent.operation_id, session_id: sessionId, generation: row.generation, kind };
+    context.db.writeTransaction(() => {
+        assertCurrent();
+        const owner = context.db.get("SELECT status FROM run_controllers WHERE controller_id = ? AND owner_token = ? AND generation = ?", [row.controller_id, row.owner_token, row.generation]);
+        if (!owner || !["running", "waiting_for_user", "waiting_for_children", "waiting_for_capacity", "waiting_for_merge"].includes(owner.status))
+            throw new AppError("controller_owner_mismatch", "Controller no longer owns continuation preparation", 1);
+        const changed = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_root: root, capacity_failure: intent.refusal, capacity_intent: intent }), context.now(), intent.predecessor, row.controller_id, row.generation]);
+        if (changed.changes !== 1)
+            throw new AppError("capacity_continuation_blocked", "Failed native operation changed before continuation", 1);
+        saveState(context, row, { ...state, pending_capacity: pending });
+        appendEvent(context, row.controller_id, "capacity_continuation", intent);
+    });
+    state.pending_capacity = pending;
+}
 export function retainControllerContinuation(state, fingerprint, error) {
     if (state.last_continuation === fingerprint)
         throw new AppError(error.code, error.message, 1, error.details);
@@ -28,9 +87,11 @@ export function retainControllerContinuation(state, fingerprint, error) {
 export function digest(value) { return digestBytes(JSON.stringify(value)); }
 export function digestBytes(value) { return crypto.createHash("sha256").update(value).digest("hex"); }
 export function errorRecord(error) {
-    return {
-        code: error instanceof AppError ? error.code : "controller_failed",
-        message: error instanceof Error ? error.message : String(error),
-        ...(error instanceof AppError && Object.keys(error.details).length ? { details: error.details } : {})
-    };
+    const record = structuredErrorRecord(error);
+    let typed = false;
+    try {
+        typed = typeof error?.code === "string";
+    }
+    catch { /* Preserve a serializable controller failure for unreadable diagnostics. */ }
+    return { ...record, code: typed ? record.code : "controller_failed" };
 }