@deksden-com/dd-flow-cli 0.9.0-beta.127 → 0.9.0-beta.133

package/dist/services/engines.js

@@ -2,7 +2,9 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { spawn, spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
+import { commandText } from '../harness-runtime/lib/process-json.mjs';
+import { SETUP_STARTUP_MS, publishSetup } from '../harness-runtime/lib/setup-progress.mjs';
 import { createRequire } from "node:module";
 import { getCliBuildInfo } from "./build-info.js";
 import { AppError } from "../shared/errors.js";
@@ -32,6 +34,24 @@ export function isRouterNativeCommand(args) {
     return routerNativeFamilies.has(first) || first === "codex" && args[1] === "hook" && args[2] === "handle";
 }
 export function installCurrentEngine(context, input = {}) {
+    const installation = prepareInstallation(context, input);
+    const first = installation.next();
+    if (first.done && input.forRouting)
+        return first.value;
+    const manifest = first.done ? requireManifest(path.join(String(first.value.path), 'engine.json')) : first.value;
+    return probeEntrypoint(manifest, undefined, context.ddFlowHome, process.env).then(() => first.done ? first.value : installation.next().value)
+        .catch(error => {
+        let cleanup_error;
+        try {
+            installation.return({});
+        }
+        catch (cleanup) {
+            cleanup_error = { message: String(cleanup).slice(0, 2000) };
+        }
+        throw new AppError('engine_install_failed', 'Staged engine admission failed', 1, { ...error.details, cause: error.code, probe_error: { code: error.code, details: error.details }, ...(cleanup_error ? { cleanup_error } : {}) });
+    });
+}
+function* prepareInstallation(context, input) {
     const build = getCliBuildInfo();
     const packageRoot = findPackageRoot(path.dirname(sourceFile));
     if (!packageRoot) {
@@ -67,6 +87,7 @@ export function installCurrentEngine(context, input = {}) {
         const tmp = path.join(parent, `.${path.basename(target)}.tmp-${process.pid}-${Date.now()}`);
         fs.rmSync(tmp, { recursive: true, force: true });
         ensureDir(tmp);
+        publishSetup('probe_started', `engine-staging:${tmp}`);
         copyPackageSnapshot(packageRoot, tmp);
         const stagedManifest = buildManifest(context, build.package_name, build.version, packageRoot, target, tmp);
         const stagedChecksum = stagedManifest.integrity.checksum;
@@ -95,13 +116,15 @@ export function installCurrentEngine(context, input = {}) {
         const manifest = { ...stagedManifest, package_root: activationTarget, snapshot_root: activationTarget };
         fs.writeFileSync(path.join(tmp, "engine.json"), `${JSON.stringify(manifest, null, 2)}\n`);
         const checkedManifest = requireManifest(path.join(tmp, "engine.json"));
-        const stagedDiagnostics = manifestDiagnostics({ ...checkedManifest, package_root: tmp, snapshot_root: tmp }, { checkEntrypoint: !input.forRouting });
+        const stagedDiagnostics = manifestDiagnostics({ ...checkedManifest, package_root: tmp, snapshot_root: tmp }, { checkEntrypoint: false });
         if (stagedDiagnostics.length > 0) {
             throw new AppError("engine_install_failed", "Staged dd-flow engine failed its integrity or dependency health check", 1, {
                 diagnostics: stagedDiagnostics,
                 path: tmp
             });
         }
+        if (!input.forRouting)
+            yield { ...checkedManifest, package_root: tmp, snapshot_root: tmp };
         activateEngineAtomically(tmp, activationTarget);
         const installed = requireManifest(path.join(activationTarget, "engine.json"));
         return {
@@ -136,13 +159,23 @@ export function resolveEngine(context, input = {}) {
     }
     return { ok: true, schema_id: "dd-flow/engine-resolve@1", selection, contexts: compatibilityContexts(context, { ...input, classification }) };
 }
-export function doctorEngines(context, input = {}) {
+export async function doctorEngines(context, input = {}) {
     const root = engineStoreRoot(context.ddFlowHome);
     const installed = readInstalledManifests(root);
-    const checks = installed.map(manifest => {
+    const checks = [];
+    for (const manifest of installed) {
         const diagnostics = manifestDiagnostics(manifest);
-        return { engine: manifestSummary(manifest, diagnostics), status: diagnostics.includes("entrypoint_probe_unavailable") ? "unverified" : diagnostics.length ? "corrupt" : "ok", diagnostics };
-    });
+        let probe_error;
+        if (!diagnostics.length)
+            try {
+                await probeEntrypoint(manifest, undefined, context.ddFlowHome, context.env);
+            }
+            catch (error) {
+                probe_error = error instanceof AppError ? error.details : { message: String(error) };
+                diagnostics.push(error instanceof AppError && error.code === 'engine_probe_failed' ? 'entrypoint_dependency_load_failed' : 'entrypoint_probe_unavailable');
+            }
+        checks.push({ engine: manifestSummary(manifest, diagnostics), status: diagnostics.includes("entrypoint_probe_unavailable") ? "unverified" : diagnostics.length ? "corrupt" : "ok", diagnostics, ...(probe_error ? { probe_error } : {}) });
+    }
     const classification = input.classification ?? classifyCliOperation(["engine", "doctor"], input.env ?? context.env);
     const selection = selectEngine(context, input, {}, classification);
     return {
@@ -155,13 +188,14 @@ export function doctorEngines(context, input = {}) {
         exit_code: checks.every((check) => check.status === "ok") && selection.status === "selected" ? 0 : 1
     };
 }
-export function routeArgsThroughEngine(context, args, io, stdin, env, resolvedProjectRoot) {
+export async function routeArgsThroughEngine(context, args, io, stdin, env, resolvedProjectRoot) {
     if (isEngineMode(env) || isRouterNativeCommand(args))
         return Promise.resolve(null);
     const classification = classifyCliOperation(args, env);
     const bound = boundRunEngineForArgs(context, args, resolvedProjectRoot ?? resolveExplicitProjectRoot(args) ?? undefined);
     if (bound) {
         const entrypoint = resolveManifestEntrypoint(bound.manifest);
+        await probeEntrypoint(bound.manifest, undefined, context.ddFlowHome, process.env);
         return spawnEngine(bound.manifest, entrypoint, args, io, stdin, env, getCliBuildInfo().version);
     }
     const selection = selectEngine(context, { projectRoot: resolvedProjectRoot ?? resolveExplicitProjectRoot(args) ?? undefined, env }, { allowCurrentInProcess: true }, classification);
@@ -180,9 +214,18 @@ export function routeArgsThroughEngine(context, args, io, stdin, env, resolvedPr
         return Promise.resolve({ routed: true, exitCode: 0, inProcess: true });
     }
     const entrypoint = resolveManifestEntrypoint(selection.selected);
+    try {
+        await probeEntrypoint(selection.selected, undefined, context.ddFlowHome, process.env);
+    }
+    catch (cause) {
+        const error = cause;
+        if (error.code !== 'engine_probe_failed')
+            throw error;
+        throw new AppError('missing_engine', 'Selected engine cannot load its runtime dependencies', 1, { probe: error.details });
+    }
     return spawnEngine(selection.selected, entrypoint, args, io, stdin, env, current.version);
 }
-export function prepareRunEngineBind(context, input) {
+export async function prepareRunEngineBind(context, input) {
     const reason = requiredText(input.reason, "reason");
     const projectRoot = resolveProjectRoot(input.projectRoot);
     const located = locateRunRoot(context.db, projectRoot, input.runId);
@@ -204,12 +247,18 @@ export function prepareRunEngineBind(context, input) {
             requested
         });
     }
+    await probeEntrypoint(manifest, ['run', 'status', located.run_id, '--project-root', projectRoot, '--json'], context.ddFlowHome, context.env, 'run_engine');
     return { kind: "create", projectRoot, located, manifest, requested, reason, entrypoint: resolveManifestEntrypoint(manifest) };
 }
-export function bindRunEngine(context, input, prepared = prepareRunEngineBind(context, input)) {
+export async function bindRunEngine(context, input, supplied) {
+    const prepared = supplied ?? await prepareRunEngineBind(context, input);
     if (prepared.kind === "replay")
         return { ok: true, action: "run_engine_bind", changed: false, binding: prepared.binding };
-    const { projectRoot, located, manifest, requested, reason, entrypoint } = prepared;
+    const { projectRoot, located, manifest, requested, reason } = prepared;
+    const current = locateRunRoot(context.db, projectRoot, input.runId);
+    if (!current || current.run_root !== located.run_root)
+        throw new AppError('run_engine_binding_conflict', 'RUN identity changed during probe', 1);
+    requireBoundManifest(context.ddFlowHome, { packageName: manifest.package_name, packageVersion: manifest.package_version, integrityChecksum: requested.integrity_checksum });
     const existing = readRunEngineBinding(located.binding_path, { allowMissing: true });
     if (existing) {
         if (sameEngineIdentity(existing.engine, requested))
@@ -217,23 +266,6 @@ export function bindRunEngine(context, input, prepared = prepareRunEngineBind(co
         throw new AppError("run_engine_binding_immutable", "RUN engine binding cannot be changed", 1, { run_id: located.run_id, current: existing.engine, requested });
     }
     const probeArgs = ["run", "status", located.run_id, "--project-root", projectRoot, "--json"];
-    const probe = spawnSync(process.execPath, [entrypoint, ...probeArgs], {
-        cwd: manifest.snapshot_root,
-        env: { ...process.env, ...context.env, DD_FLOW_HOME: context.ddFlowHome, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: manifest.snapshot_root },
-        encoding: "utf8",
-        timeout: 30_000
-    });
-    if (probe.error || probe.signal)
-        throw new AppError("run_engine_probe_unavailable", "Selected engine observation could not complete; compatibility is unknown", 1, { run_id: located.run_id, cause: probe.error?.message, signal: probe.signal });
-    if (probe.status !== 0) {
-        throw new AppError("run_engine_probe_failed", "Selected engine cannot read the RUN authority", 1, {
-            run_id: located.run_id,
-            engine: manifestSummary(manifest),
-            command: `dd-flow ${probeArgs.join(" ")}`,
-            exit_code: probe.status,
-            stderr: probe.stderr.slice(0, 2000)
-        });
-    }
     const binding = {
         schema_id: runEngineBindingSchemaId,
         run_id: located.run_id,
@@ -272,7 +304,7 @@ export function bindCurrentEngineToRun(context, input) {
 /** Forks are a new execution authority.  The source binding stays immutable;
  * this replaces only the copied binding after proving the selected engine can
  * read the copied RUN. */
-export function upgradeForkedRunEngine(context, input) {
+export async function upgradeForkedRunEngine(context, input) {
     const projectRoot = resolveProjectRoot(input.projectRoot);
     const located = locateRunRoot(context.db, projectRoot, input.runId);
     if (!located)
@@ -283,20 +315,16 @@ export function upgradeForkedRunEngine(context, input) {
         ...(input.integrityChecksum ? { integrityChecksum: input.integrityChecksum } : {})
     });
     const requested = engineIdentity(manifest);
-    readRunEngineBinding(located.binding_path);
+    const priorBinding = fs.readFileSync(located.binding_path, 'utf8');
     const lineage = path.join(located.run_root, "fork-lineage.json");
     if (!fs.existsSync(lineage))
         throw new AppError("fork_lineage_missing", "Engine upgrade is permitted only for a derived RUN", 1, { run_id: located.run_id });
     const probeArgs = ["run", "status", located.run_id, "--project-root", projectRoot, "--json"];
-    const probe = spawnSync(process.execPath, [resolveManifestEntrypoint(manifest), ...probeArgs], {
-        cwd: manifest.snapshot_root,
-        env: { ...process.env, ...context.env, DD_FLOW_HOME: context.ddFlowHome, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: manifest.snapshot_root },
-        encoding: "utf8", timeout: 30_000
-    });
-    if (probe.error || probe.signal)
-        throw new AppError("fork_engine_probe_unavailable", "Selected engine observation could not complete; compatibility is unknown", 1, { run_id: located.run_id, cause: probe.error?.message, signal: probe.signal });
-    if (probe.status !== 0)
-        throw new AppError("fork_engine_probe_failed", "Selected engine cannot read the forked RUN", 1, { run_id: located.run_id, engine: manifestSummary(manifest), stderr: probe.stderr.slice(0, 2000) });
+    const priorLineage = fs.readFileSync(lineage, 'utf8');
+    await probeEntrypoint(manifest, probeArgs, context.ddFlowHome, context.env, 'fork_engine');
+    if (fs.readFileSync(located.binding_path, 'utf8') !== priorBinding || fs.readFileSync(lineage, 'utf8') !== priorLineage)
+        throw new AppError('fork_engine_binding_conflict', 'Fork identity changed during probe', 1);
+    requireBoundManifest(context.ddFlowHome, { packageName: manifest.package_name, packageVersion: manifest.package_version, integrityChecksum: manifest.integrity.checksum });
     const binding = { schema_id: runEngineBindingSchemaId, run_id: located.run_id, project_root: projectRoot, bound_at: context.now(), source: "fork_upgrade", reason: requiredText(input.reason, "reason"), engine: requested, probe: { status: "passed", command: `dd-flow ${probeArgs.join(" ")}` } };
     const temporary = `${located.binding_path}.fork-${process.pid}-${Date.now()}.tmp`;
     fs.writeFileSync(temporary, `${JSON.stringify(binding, null, 2)}\n`);
@@ -678,10 +706,13 @@ function buildManifest(context, packageName, version, packageRoot, snapshotRoot,
     };
 }
 function copyPackageSnapshot(packageRoot, target) {
+    let copied = 0;
     for (const [relative, source] of packageSnapshotFiles(packageRoot)) {
         const destination = path.join(target, relative);
         ensureDir(path.dirname(destination));
         fs.copyFileSync(source, destination);
+        if (++copied % 64 === 0)
+            publishSetup('transfer_progress', `${target}:${copied}`);
     }
 }
 /** The same source inventory drives validation and copying; no staging writes. */
@@ -920,26 +951,20 @@ function manifestDiagnostics(manifest, options = {}) {
             }
         }
     }
-    if (options.checkEntrypoint !== false && entrypoint && fs.existsSync(entrypoint) && !diagnostics.includes("entrypoint_outside_snapshot")) {
-        const health = spawnSync(process.execPath, [entrypoint, "--version", "--json"], {
-            cwd: snapshotRoot,
-            env: {
-                ...process.env,
-                DD_FLOW_ENGINE_MODE: "1",
-                DD_FLOW_ENGINE_HOME: snapshotRoot,
-                DD_FLOW_ENGINE_HEALTHCHECK: "1"
-            },
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "pipe"],
-            timeout: 15_000
-        });
-        if (health.error || health.signal)
-            diagnostics.push("entrypoint_probe_unavailable");
-        else if (health.status !== 0)
-            diagnostics.push("entrypoint_dependency_load_failed");
-    }
     return diagnostics;
 }
+async function probeEntrypoint(manifest, args = ['--version', '--json'], runtimeHome, env = {}, purpose = 'engine') {
+    publishSetup('probe_started', manifest.snapshot_root);
+    try {
+        await commandText(resolveManifestEntrypoint(manifest), args, { cwd: manifest.snapshot_root,
+            env: { ...env, DD_FLOW_ENGINE_MODE: '1', DD_FLOW_ENGINE_HOME: manifest.snapshot_root, ...(runtimeHome ? { DD_FLOW_HOME: runtimeHome } : {}), ...(args[0] === '--version' ? { DD_FLOW_ENGINE_HEALTHCHECK: '1' } : {}) }, startupMs: SETUP_STARTUP_MS, phase: 'engine-probe' });
+        publishSetup('probe_completed', manifest.snapshot_root);
+    }
+    catch (cause) {
+        const error = cause;
+        throw new AppError(error.details?.reason === 'child_exit' && error.details?.signal === null && error.details?.exit_code !== null ? `${purpose}_probe_failed` : `${purpose}_probe_unavailable`, 'Selected engine probe did not complete successfully', 1, { cause: error.code, message: error.message, ...error.details });
+    }
+}
 function manifestSummary(manifest, diagnostics = manifestDiagnostics(manifest, { checkEntrypoint: false })) {
     return {
         schema_id: manifest.schema_id,
@@ -1104,16 +1129,22 @@ function findPackageRoot(start) {
     }
 }
 export function engineSnapshotChecksum(root) {
+    publishSetup('probe_started', `engine-digest:${root}`);
     const files = [];
     collectFiles(root, root, files);
     const checksum = crypto.createHash("sha256");
+    let checked = 0;
     for (const file of files.sort()) {
         checksum.update(file);
         checksum.update("\0");
         checksum.update(fs.readFileSync(path.join(root, file)));
+        if (++checked % 64 === 0)
+            publishSetup('identity_digest_progress', `${root}:${checked}`);
         checksum.update("\0");
     }
-    return checksum.digest("hex");
+    const result = checksum.digest("hex");
+    publishSetup('identity_digest_completed', root);
+    return result;
 }
 function collectFiles(root, current, files) {
     for (const entry of fs.readdirSync(current, { withFileTypes: true })) {

package/dist/services/lifecycle-invocations.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import { checkRepairDisposition } from "./check-runner-evidence.js";
 import path from "node:path";
 import fs from "node:fs";
 import { quote } from "shell-quote";
@@ -70,8 +71,9 @@ export function isRetryableLifecycleRejection(code, details = {}) {
         return details.phase === "prepare" && details.effect === "no_effect" && details.recoverable === true;
     if (["invocation_command_mismatch", "invocation_argument_mismatch"].includes(code))
         return details.recoverable !== false;
-    return details.recoverable === true || ["work_checks_failed", "code_gate_failed", "code_review_gate_failed", "merge_gate_failed",
-        "review_repair_incomplete", "plan_review_incomplete", "semantic_result_invalid",
+    if (["work_checks_failed", "code_gate_failed", "code_review_gate_failed", "merge_gate_failed"].includes(code))
+        return Array.isArray(details.failures) && details.failures.length > 0 && details.failures.every(receipt => checkRepairDisposition(receipt) === "source_repair");
+    return details.recoverable === true || ["review_repair_incomplete", "plan_review_incomplete", "semantic_result_invalid",
         "review_evidence_invalid", "evidence_obligation_unknown", "invalid_evidence_ref",
         "evidence_ref_missing", "evidence_line_out_of_range", "document_update_missing",
         "document_update_not_materialized", "review_repair_no_change"].includes(code)

package/dist/services/managed-lease-monitor.js

@@ -2,8 +2,8 @@ import { setTimeout as delay } from "node:timers/promises";
 import { AppError } from "../shared/errors.js";
 import { createRenewalState, maintenanceRetryable, renewalConfirmed, renewalDelay, renewalFailure, renewalRemaining, RENEWAL_POLICY } from "../harness-runtime/lib/lease-renewal.mjs";
 /** Registry renewals happen outside RUN writers. Assertions never renew. */
-export function managedLeaseMonitor(renew) {
-    const episode = createRenewalState();
+export function managedLeaseMonitor(renew, leaseExpiresAt = null) {
+    const episode = createRenewalState({ leaseExpiresAt });
     let expiry = 0;
     let failure = null;
     let lost = false;
@@ -11,6 +11,11 @@ export function managedLeaseMonitor(renew) {
     let closing = false;
     let pending;
     const shutdown = new AbortController();
+    const retainAuthority = (leaseExpiresAt) => {
+        if (!renewalConfirmed(episode, performance.now(), leaseExpiresAt))
+            throw new AppError("managed_lease_receipt_invalid", "Confirmation has no current persisted expiry", 1);
+        expiry = Date.parse(leaseExpiresAt);
+    };
     const uncertain = () => new AppError("controller_lease_unconfirmed", "Managed lease requires confirmation outside the writer", 1, { cause: failure, exhausted: episode.exhausted, closing });
     const assertNoRenewal = () => {
         if (closing)
@@ -46,7 +51,7 @@ export function managedLeaseMonitor(renew) {
                 throw new AppError("managed_lease_receipt_invalid", "Renewal has no valid persisted expiry", 1);
             if (value <= Date.now())
                 throw new AppError("controller_lease_unconfirmed", "Renewal receipt has already expired", 1);
-            if ((!failure || renewalRemaining(episode)) && renewalConfirmed(episode)) {
+            if (renewalConfirmed(episode, performance.now(), receipt.lease_expires_at)) {
                 expiry = value;
                 failure = null;
             }
@@ -122,7 +127,7 @@ export function managedLeaseMonitor(renew) {
             }
         });
     };
-    return { tick, assertNoRenewal, assertConfirmed, ensureConfirmed, background,
+    return { tick, assertNoRenewal, assertConfirmed, ensureConfirmed, background, retainAuthority,
         close: () => { closing = true; shutdown.abort(); },
         isConfirmed: () => !closing && !lost && !failure && Date.now() < expiry };
 }

package/dist/services/prompts.js

@@ -268,7 +268,9 @@ function assertGitFacts(workspaceRoot, expected, runId) {
     if (!expected?.head && !expected?.branch)
         return;
     const read = (args) => {
-        const result = spawnSync("git", ["-C", workspaceRoot, ...args.split(" ")], { encoding: "utf8" });
+        const result = spawnSync("git", ["-C", workspaceRoot, ...args.split(" ")], { encoding: "utf8", timeout: 5000 });
+        if (result.error || result.signal)
+            throw new AppError("git_observation_unavailable", "Cannot establish RUN workspace identity", 1, { run_id: runId, effect: "unknown" });
         return result.status === 0 ? result.stdout.trim() || null : null;
     };
     const actual = { branch: read("branch --show-current"), head: read("rev-parse HEAD") };

package/dist/services/protocols.js

@@ -668,7 +668,9 @@ function removeProtocolWorktreeBeforeCancel(protocol, state, record, force) {
     }
     const existsBefore = fs.existsSync(worktreePath);
     if (existsBefore && !force) {
-        const dirty = spawnSync("git", ["-C", worktreePath, "status", "--porcelain"], { encoding: "utf8" });
+        const dirty = spawnSync("git", ["-C", worktreePath, "status", "--porcelain"], { encoding: "utf8", timeout: 5000 });
+        if (dirty.error || dirty.status !== 0)
+            throw new AppError("workspace_status_failed", "Cannot establish worktree status before removal", 1, { path: worktreePath, cause: dirty.error?.message ?? dirty.stderr });
         if (dirty.status === 0 && dirty.stdout.trim().length > 0) {
             throw new AppError("worktree_dirty", "Refusing to remove dirty worktree without --force --reason", 1, {
                 path: worktreePath

package/dist/services/repair-intents.js

@@ -2,10 +2,12 @@ import crypto from "node:crypto";
 import { stageAttempt, stageCycle, bindStageWork } from "./stage-work-graph.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
 import { AppError } from "../shared/errors.js";
+import { assertSourceRepairEligible } from "./code-checks.js";
 /** Checks finish before entering this synchronous registration transaction. */
 export function ensureAggregateRepair(context, input, create) {
-    if (!input.failures.length || input.failures.some(receipt => receipt.status !== "failed" && receipt.status !== "aborted"))
-        throw new AppError("repair_intent_invalid", "Repair requires settled failed receipts", 1);
+    if (!input.failures.length)
+        throw new AppError("repair_intent_invalid", "Repair requires assertion-backed failed receipts", 1);
+    assertSourceRepairEligible(input.failures);
     const causes = input.failures.map(receipt => ({ id: receipt.id, epoch: receipt.verification_epoch, fingerprint: receipt.workspace_fingerprint })).sort((a, b) => a.id.localeCompare(b.id));
     return ensureRepairIntent(context, { ...input, causes: { receipts: causes, origins: [...(input.origins ?? [])].sort() } }, create);
 }

package/dist/services/run-control-worker.js

@@ -268,7 +268,8 @@ export async function serveRunControl(context, input) {
             }
             if (!worker.process_lease_token)
                 throw new AppError("run_control_owner_mismatch", "Control owner has no resource lease", 1);
-            confirmManagedProcess(resourceContext, { id: worker.process_id, leaseToken: worker.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
+            const confirmed = confirmManagedProcess(resourceContext, { id: worker.process_id, leaseToken: worker.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
+            lease.retainAuthority(confirmed.lease_expires_at);
             let priorObservation = null;
             try {
                 priorObservation = worker.snapshot_json ? JSON.parse(worker.snapshot_json) : null;

package/dist/services/run-controller.js

@@ -176,22 +176,21 @@ export async function serveRunController(context, input) {
     claimControllerProcess(context, row);
     if (!row.process_id || !row.process_lease_token)
         throw new AppError("controller_owner_mismatch", "Managed owner has no resource lease", 1);
-    confirmManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
-    const lease = controllerLeaseMonitor(attemptMs => {
-        const deadline = Date.now() + attemptMs;
-        const receipt = renewManagedProcess({ ...context, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: deadline }, { id: row.process_id, leaseToken: row.process_lease_token });
-        if (receipt.owned) {
-            // These exact-owner keepalive writes are idempotent. Finish the resource
-            // transaction before acquiring RUN writer; both share one attempt budget.
-            const db = context.db.withDeadline(deadline);
-            if (db.get("SELECT 1 FROM merge_requests WHERE project_id = ? AND run_id = ? AND dispatch_owner = ? AND status = 'dispatching' LIMIT 1", [row.project_id, row.run_id, row.controller_id]))
-                db.writeTransaction(() => {
-                    const guard = recoveryGuard({ ...context, db }, row.project_id, row.run_id);
-                    if ((guard?.generation ?? 0) === row.generation && !["draining", "sealed", "resuming"].includes(guard?.status ?? ""))
-                        db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE project_id = ? AND run_id = ? AND dispatch_owner = ? AND status = 'dispatching'", [new Date(Date.now() + 120_000).toISOString(), context.now(), row.project_id, row.run_id, row.controller_id]);
-                });
-        }
-        return receipt;
+    const confirmed = confirmManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
+    const lease = controllerLeaseMonitor(attemptMs => renewManagedProcess({ ...context, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: Date.now() + attemptMs }, { id: row.process_id, leaseToken: row.process_lease_token }), confirmed.lease_expires_at);
+    // Resource and RUN commits are distinct effects. A RUN keepalive failure must
+    // neither erase a resource receipt nor grant RUN dispatch authority.
+    const mergeLease = controllerLeaseMonitor(attemptMs => {
+        const expiry = new Date(Date.now() + 120_000).toISOString();
+        const db = context.db.withDeadline(Date.now() + attemptMs);
+        if (db.get("SELECT 1 FROM merge_requests WHERE project_id = ? AND run_id = ? AND dispatch_owner = ? AND status = 'dispatching' LIMIT 1", [row.project_id, row.run_id, row.controller_id]))
+            db.writeTransaction(() => {
+                const guard = recoveryGuard({ ...context, db }, row.project_id, row.run_id);
+                if ((guard?.generation ?? 0) !== row.generation || ["draining", "sealed", "resuming"].includes(guard?.status ?? ""))
+                    throw new AppError("controller_lease_lost", "RUN generation changed before MERGE keepalive", 1);
+                db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE project_id = ? AND run_id = ? AND dispatch_owner = ? AND status = 'dispatching'", [expiry, context.now(), row.project_id, row.run_id, row.controller_id]);
+            });
+        return { owned: true, lease_expires_at: expiry };
     });
     const assertLeaseFence = () => {
         const current = requireController(context, row.controller_id);
@@ -201,12 +200,14 @@ export async function serveRunController(context, input) {
     };
     const heartbeat = setInterval(() => {
         lease.background(assertLeaseFence, () => { });
+        mergeLease.background(assertLeaseFence, () => { });
     }, 30_000);
     heartbeat.unref();
     const manifest = JSON.parse(row.manifest_json);
     const state = JSON.parse(row.state_json);
     const assertPhysicalOwner = () => {
         lease.assertNoRenewal();
+        mergeLease.assertNoRenewal();
         assertManagedProcessLease({ ...context, databaseDeadlineAt: Date.now() + 5_000 }, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid });
         const current = requireController(context, row.controller_id);
         if (current.owner_pid !== process.pid || current.owner_token !== row.owner_token || !["running", "capturing", "waiting_for_user", "waiting_for_context", "waiting_for_children", "waiting_for_capacity", "waiting_for_merge"].includes(current.status))
@@ -219,6 +220,7 @@ export async function serveRunController(context, input) {
     };
     try {
         await lease.ensureConfirmed(assertLeaseFence);
+        await mergeLease.ensureConfirmed(assertLeaseFence);
         context.db.writeTransaction(() => {
             markControllerDispatchReady(context, row);
             if (!state.recovery && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation && requireRun(context, row.project_id, row.run_id).status === "paused")
@@ -227,7 +229,7 @@ export async function serveRunController(context, input) {
         appendEvent(context, row.controller_id, "owner_started", { pid: process.pid, generation: row.generation });
         if (state.recovery && !["done", "failed", "cancelled"].includes(requireRun(context, row.project_id, row.run_id).status))
             await resumeControllerSession(context, row, manifest, state, assertPhysicalOwner);
-        await executeController(context, row, manifest, state, assertOwner, assertPhysicalOwner, () => lease.ensureConfirmed(assertLeaseFence));
+        await executeController(context, row, manifest, state, assertOwner, assertPhysicalOwner, async () => { await lease.ensureConfirmed(assertLeaseFence); await mergeLease.ensureConfirmed(assertLeaseFence); });
         return controllerReceipt(requireController(context, row.controller_id));
     }
     catch (error) {
@@ -273,6 +275,7 @@ export async function serveRunController(context, input) {
     }
     finally {
         lease.close();
+        mergeLease.close();
         clearInterval(heartbeat);
         finishOwner();
     }

package/dist/services/run-fork.js

@@ -57,7 +57,7 @@ function assertForkOutput(output, intentFile, intent) {
             throw new AppError("fork_retry_inspect_required", "Fork output contains data not owned by the interrupted fork", 1, { output, unknown });
     }
 }
-export function forkRunFromSnapshot(context, input, prepared = prepareRunFork(input)) {
+export async function forkRunFromSnapshot(context, input, prepared = prepareRunFork(input)) {
     if ("receipt" in prepared)
         return prepared.receipt;
     const { manifest, snapshot, output, intent, intentFile, receiptFile, requestId } = prepared;
@@ -95,7 +95,7 @@ export function forkRunFromSnapshot(context, input, prepared = prepareRunFork(in
         // CLI into the new home. Its exact version/checksum were checked before
         // any interrupted-copy cleanup; snapshots exclude installed engines.
         installCurrentEngine(restoredContext, { forRouting: true });
-        const binding = upgradeForkedRunEngine(restoredContext, {
+        const binding = await upgradeForkedRunEngine(restoredContext, {
             projectRoot,
             runId: String(restored.run_id),
             engineVersion: intent.engine_version,

package/dist/services/runtime-scope-worker.js

@@ -171,9 +171,9 @@ export async function serveRuntimeScopeControl(context, scopeId, generation) {
             const record = registerManagedProcess(context, { kind: "scope-control", ownerId: key, operationId: `scope-control:${key}:${token}`, ownerPid: process.pid, metadata: { role: "control", scope_id: scopeId, generation } });
             worker.process_id = record.id;
             worker.process_lease_token = record.lease_token;
-            confirmManagedProcess(context, { id: record.id, leaseToken: record.lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
+            const confirmed = confirmManagedProcess(context, { id: record.id, leaseToken: record.lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
             db.run("UPDATE managed_resources SET metadata_json = ?, updated_at = ? WHERE resource_kind = 'scope-control-worker' AND resource_key = ? AND lease_token = ?", [JSON.stringify(worker), context.now(), key, token]);
-            lease = managedLeaseMonitor(attemptMs => renewManagedProcess({ ...context, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: Date.now() + attemptMs }, { id: record.id, leaseToken: record.lease_token }));
+            lease = managedLeaseMonitor(attemptMs => renewManagedProcess({ ...context, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: Date.now() + attemptMs }, { id: record.id, leaseToken: record.lease_token }), confirmed.lease_expires_at);
             let timerFailure;
             const assertScopeCurrent = () => {
                 const latest = runtimeBudgetStatus(context, scopeId);

package/dist/services/stage-lifecycle.js

@@ -2,6 +2,8 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
+import { commandResult } from '../harness-runtime/lib/process-json.mjs';
+import { SETUP_STARTUP_MS } from '../harness-runtime/lib/setup-progress.mjs';
 import { requireProjectByRoot } from "./projects.js";
 import { appendAudit } from "./audit.js";
 import { persistProtocolState, requireProtocol, readProtocolRuntimeState } from "./protocols.js";
@@ -283,7 +285,7 @@ export function prepareStageFinish(context, input) {
     const planFinish = input.stage === "plan" ? preparePlanFinish(context, projectRoot, view, stageRoot) : undefined;
     return { projectRoot, runId, view, existing, runHome, stageRoot, semanticFile, semantic, status, source, planFinish };
 }
-export function finishStage(context, input, prepared = prepareStageFinish(context, input)) {
+export async function finishStage(context, input, prepared = prepareStageFinish(context, input)) {
     const { projectRoot, runId, view, runHome, stageRoot, semanticFile, semantic, status, source, planFinish } = prepared;
     assertRunMutationAllowed(context, view.run.project_id, view.run.id);
     fs.mkdirSync(stageRoot, { recursive: true });
@@ -293,7 +295,7 @@ export function finishStage(context, input, prepared = prepareStageFinish(contex
         if (coverage.jobs.missing?.length) {
             throw new AppError("worker_jobs_incomplete", "Stage finish requires all declared worker jobs", 1, { coverage });
         }
-        const lint = runTargetedMemoryBankLint(projectRoot);
+        const lint = await runTargetedMemoryBankLint(projectRoot);
         if (planFinish)
             boundCanonicalPlan(context, { projectId: view.run.project_id, protocolId: view.run.subject.id, planPath: planFinish.plan_path }, planFinish.canonical);
         const report = buildStageReport(context, view, input.stage, status, semantic, stageRoot, lint, planFinish);
@@ -833,7 +835,7 @@ function workerCoverage(context, projectId, runId) {
         jobs: { expected: jobs.map((job) => job.job_id), missing: missingJobs }
     };
 }
-export function runTargetedMemoryBankLint(projectRoot, selectedFiles) {
+export async function runTargetedMemoryBankLint(projectRoot, selectedFiles) {
     const files = [...new Set((selectedFiles ?? gitChangedFiles(projectRoot)).filter((file) => file.startsWith(".memory-bank/") && file.toLowerCase().endsWith(".md") && !file.split(/[\\/]/u).some((part) => part === ".." || part.startsWith(".env"))))];
     for (const file of files)
         ensureWithin(projectRoot, path.resolve(projectRoot, file), "lint target");
@@ -841,9 +843,13 @@ export function runTargetedMemoryBankLint(projectRoot, selectedFiles) {
         return { ok: true, status: "not_applicable_no_changed_docs", files, finding_count: 0 };
     }
     const binary = process.env.MB_LINT_BIN ?? "mb-lint";
-    const result = spawnSync(binary, ["--root", projectRoot, "--files", ...files, "--format", "json"], { cwd: projectRoot, encoding: "utf8" });
-    if (result.error || result.status === null) {
-        throw new AppError("lint_gate_unavailable", "Selected-file mb-lint is unavailable", 1, { binary, files, cause: String(result.error ?? "process did not start") });
+    let result;
+    try {
+        result = await commandResult(binary, ["--root", projectRoot, "--files", ...files, "--format", "json"], { cwd: projectRoot, startupMs: SETUP_STARTUP_MS });
+    }
+    catch (cause) {
+        const error = cause;
+        throw new AppError("lint_gate_unavailable", "Selected-file mb-lint is unavailable", 1, { binary, files, cause: error.code, ...error.details });
     }
     let parsed = {};
     try {
@@ -852,7 +858,7 @@ export function runTargetedMemoryBankLint(projectRoot, selectedFiles) {
     catch {
         throw new AppError("lint_gate_invalid_output", "Selected-file mb-lint did not return JSON", 1, { binary, files });
     }
-    if (result.status !== 0) {
+    if (result.exit_code !== 0) {
         throw new AppError("lint_gate_failed", "Selected-file mb-lint reported blocking findings", 1, { binary, files, result: parsed });
     }
     const findingCount = parsed && typeof parsed === "object" && Array.isArray(parsed.findings)