@deksden-com/dd-flow-cli 0.9.0-beta.127 → 0.9.0-beta.133

package/dist/services/tooling.js

@@ -2,7 +2,8 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { spawnSync } from "node:child_process";
+import { commandResult, commandText } from '../harness-runtime/lib/process-json.mjs';
+import { publishSetup, SETUP_STARTUP_MS } from '../harness-runtime/lib/setup-progress.mjs';
 import { AppError } from "../shared/errors.js";
 import { ensureDir } from "../storage/paths.js";
 const manifestRelativePath = path.join("tools", "worktrunk-manifest.json");
@@ -71,7 +72,7 @@ export function inspectManagedWorktrunk(context) {
         };
     }
 }
-export function ensureManagedWorktrunk(context) {
+export async function ensureManagedWorktrunk(context) {
     const manifest = worktrunkManifest();
     const platform = worktrunkPlatform();
     const cachedRoot = worktrunkCacheRoot(context, platform);
@@ -92,14 +93,14 @@ export function ensureManagedWorktrunk(context) {
                 next_action: "Place the verified official artifact in the managed tool cache and retry."
             });
         }
-        installWorktrunkArtifact(manifest, platform, cachedRoot);
+        await installWorktrunkArtifact(manifest, platform, cachedRoot);
         return verifyCachedWorktrunk(context, manifest, platform);
     }
     finally {
         fs.rmSync(lockDir, { recursive: true, force: true });
     }
 }
-function installWorktrunkArtifact(manifest, platform, targetRoot) {
+async function installWorktrunkArtifact(manifest, platform, targetRoot) {
     const artifact = artifactFor(manifest, platform);
     const parent = path.dirname(targetRoot);
     ensureDir(parent);
@@ -107,8 +108,17 @@ function installWorktrunkArtifact(manifest, platform, targetRoot) {
     const archivePath = path.join(tempRoot, `worktrunk.${artifact.archive}`);
     const extractedRoot = path.join(tempRoot, "extracted");
     try {
-        const download = spawnSync("curl", ["--fail", "--location", "--silent", "--show-error", "--max-time", "120", "-o", archivePath, artifact.url], { encoding: "utf8" });
-        if (download.status !== 0) {
+        let observedBytes = 0;
+        publishSetup('probe_started', 'worktrunk-download');
+        const download = await commandResult("curl", ["--fail", "--location", "--silent", "--show-error", "-o", archivePath, artifact.url], { startupMs: SETUP_STARTUP_MS, progress: () => {
+                const bytes = fs.existsSync(archivePath) ? fs.statSync(archivePath).size : 0;
+                if (bytes > observedBytes) {
+                    observedBytes = bytes;
+                    publishSetup('transfer_progress', `worktrunk-transfer:${bytes}`);
+                }
+                return observedBytes;
+            } });
+        if (download.exit_code !== 0) {
             throw new AppError("tool_unavailable", "Unable to download the pinned Worktrunk artifact", 1, {
                 tool: manifest.tool,
                 version: manifest.version,
@@ -118,6 +128,7 @@ function installWorktrunkArtifact(manifest, platform, targetRoot) {
                 stderr: sanitize(download.stderr)
             });
         }
+        publishSetup('probe_completed', 'worktrunk-download');
         const archiveChecksum = sha256File(archivePath);
         if (archiveChecksum !== artifact.sha256) {
             throw new AppError("tool_integrity_failed", "Pinned Worktrunk artifact checksum mismatch", 1, {
@@ -129,12 +140,12 @@ function installWorktrunkArtifact(manifest, platform, targetRoot) {
             });
         }
         ensureDir(extractedRoot);
-        extractArchive(archivePath, extractedRoot, artifact.archive);
+        await extractArchive(archivePath, extractedRoot, artifact.archive);
         const extractedBinary = findBinary(extractedRoot);
         if (!extractedBinary)
             throw new AppError("tool_integrity_failed", "Pinned Worktrunk archive does not contain wt", 1, { platform });
         fs.chmodSync(extractedBinary, 0o755);
-        verifyWorktrunkVersion(extractedBinary, manifest.version);
+        await verifyWorktrunkVersion(extractedBinary, manifest.version);
         const binaryChecksum = sha256File(extractedBinary);
         const stagedRoot = path.join(tempRoot, "managed");
         ensureDir(stagedRoot);
@@ -186,7 +197,7 @@ function verifyCachedWorktrunk(context, manifest, platform) {
             actual_binary_sha256: actualBinaryChecksum
         });
     }
-    verifyWorktrunkVersion(bin, manifest.version);
+    // The admitted binary checksum binds the version probe performed at install.
     return {
         bin,
         version: manifest.version,
@@ -195,23 +206,23 @@ function verifyCachedWorktrunk(context, manifest, platform) {
         binary_sha256: actualBinaryChecksum
     };
 }
-function extractArchive(archive, destination, format) {
+async function extractArchive(archive, destination, format) {
     if (format === "tar.xz") {
-        const listing = spawnSync("tar", ["-tJf", archive], { encoding: "utf8" });
-        if (listing.status !== 0 || listing.stdout.split("\n").some(unsafeArchivePath)) {
+        const listing = await commandResult("tar", ["-tJf", archive], { startupMs: SETUP_STARTUP_MS });
+        if (listing.exit_code !== 0 || listing.stdout.split("\n").some(unsafeArchivePath)) {
             throw new AppError("tool_integrity_failed", "Pinned Worktrunk archive has an unsafe or unreadable file list", 1);
         }
-        const extracted = spawnSync("tar", ["-xJf", archive, "-C", destination], { encoding: "utf8" });
-        if (extracted.status !== 0)
+        const extracted = await commandResult("tar", ["-xJvf", archive, "-C", destination], { startupMs: SETUP_STARTUP_MS });
+        if (extracted.exit_code !== 0)
             throw new AppError("tool_integrity_failed", "Pinned Worktrunk archive extraction failed", 1, { stderr: sanitize(extracted.stderr) });
         return;
     }
-    const listing = spawnSync("unzip", ["-Z1", archive], { encoding: "utf8" });
-    if (listing.status !== 0 || listing.stdout.split("\n").some(unsafeArchivePath)) {
+    const listing = await commandResult("unzip", ["-Z1", archive], { startupMs: SETUP_STARTUP_MS });
+    if (listing.exit_code !== 0 || listing.stdout.split("\n").some(unsafeArchivePath)) {
         throw new AppError("tool_integrity_failed", "Pinned Worktrunk archive has an unsafe or unreadable file list", 1);
     }
-    const extracted = spawnSync("unzip", ["-q", archive, "-d", destination], { encoding: "utf8" });
-    if (extracted.status !== 0)
+    const extracted = await commandResult("unzip", [archive, "-d", destination], { startupMs: SETUP_STARTUP_MS });
+    if (extracted.exit_code !== 0)
         throw new AppError("tool_integrity_failed", "Pinned Worktrunk archive extraction failed", 1, { stderr: sanitize(extracted.stderr) });
 }
 function findBinary(root) {
@@ -229,13 +240,11 @@ function findBinary(root) {
     }
     return null;
 }
-function verifyWorktrunkVersion(bin, expected) {
-    const result = spawnSync(bin, ["--version"], { encoding: "utf8" });
-    const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
-    if (result.status !== 0 || !output.includes(expected)) {
+async function verifyWorktrunkVersion(bin, expected) {
+    const output = await commandText(bin, ['--version'], { startupMs: SETUP_STARTUP_MS, phase: 'native-version' });
+    if (!output.includes(expected)) {
         throw new AppError("tool_integrity_failed", "Managed Worktrunk version verification failed", 1, {
             expected_version: expected,
-            status: result.status,
             output: sanitize(output)
         });
     }

package/dist/services/vnext-code-review.js

@@ -4,6 +4,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
+import { assertSourceRepairEligible } from "./check-runner-evidence.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { requireProjectByRoot } from "./projects.js";
 import { advanceFlowRun, appendFlowRunTimelineEvent, attachFlowRunStage, completeFlowRun, completeFlowRunStage, prepareFlowRunStageCompletion, freezeFlowRunReviewMode, gitFacts } from "./runs.js";
@@ -243,6 +244,7 @@ export async function finishVnextCodeReview(context, input) {
     const matrix = prepareRunVerificationMatrix(context, { projectId: project.id, runId: run.id, stage, role: "output", receipts, semanticFile: decisionFile });
     const failed = receipts.filter((receipt) => receipt.status !== "passed");
     if (failed.length) {
+        assertSourceRepairEligible(failed);
         context.db.writeTransaction(() => acceptVerificationMatrix(context, matrix));
         publishVerificationMatrix(context, matrix);
         throw new AppError("code_review_gate_failed", "CODE-REVIEW repair changed the project but the aggregate gate failed", 2, {

package/dist/services/vnext-code.js

@@ -7,8 +7,9 @@ import fs from "node:fs";
 import { prepareAgentOutputFile } from "../storage/agent-output.js";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
+import { assertSourceRepairEligible } from "./check-runner-evidence.js";
 import { resolveProjectRoot } from "../storage/paths.js";
-import { aggregateCheckDeclarations, effectiveCheckDeclarations, finalCodeCheckDeclarations, runCodeChecks, validateFailedCheckRetry, workspaceChangedPaths } from "./code-checks.js";
+import { aggregateCheckDeclarations, checkReceipts, effectiveCheckDeclarations, finalCodeCheckDeclarations, runCodeChecks, validateFailedCheckRetry, workspaceChangedPaths } from "./code-checks.js";
 import { requireProjectByRoot } from "./projects.js";
 import { appendFlowRunTimelineEvent, advanceFlowRun, attachFlowRunStage, prepareFlowRunStageAttachment, completeFlowRunStage, prepareFlowRunStageCompletion, completeFlowRun, withStageSettlement, getFlowRunVariables, gitFacts } from "./runs.js";
 import { validateSchema } from "./schema-validation.js";
@@ -224,6 +225,7 @@ export async function finishVnextCode(context, input) {
     const matrix = prepareRunVerificationMatrix(context, { projectId: project.id, runId: run.id, stage, role: "output", receipts, semanticFile: input.verificationFile });
     const matrixInstruction = matrix ? verificationMatrixInstruction(matrix.metadata, home, "semantic verification in code-verification.json") : "";
     if (failed.length) {
+        assertSourceRepairEligible(failed);
         context.db.writeTransaction(() => acceptVerificationMatrix(context, matrix));
         publishVerificationMatrix(context, matrix);
         const continuation = registerAggregateCodeRepair(context, { projectRoot, runId: run.id, stage, failures: failed, checks, generation });
@@ -406,6 +408,8 @@ export function prepareVnextCodeRepair(context, input) {
             check_receipt_id: input.checkReceiptId
         });
     }
+    if (input.checkReceiptId)
+        assertSourceRepairEligible(checkReceipts(context, { projectId: project.id, runId: run.id }).filter(item => item.id === input.checkReceiptId));
     const origins = [...new Set(input.originWorkIds)].map((id) => requireCodeWork(context, project.id, run.id, id));
     const packets = origins.map((work) => packet(work));
     const invariantPackets = receipt || input.semanticUnresolved?.length

package/dist/services/vnext-merge.js

@@ -7,6 +7,7 @@ import path from "node:path";
 import { execFileSync, spawnSync } from "node:child_process";
 import { vnextStageDirectory } from "../domain/stage-catalog.js";
 import { AppError } from "../shared/errors.js";
+import { assertSourceRepairEligible, checkRepairDisposition } from "./check-runner-evidence.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { requireProjectByRoot } from "./projects.js";
 import { nextMergeRequestId } from "./ids.js";
@@ -314,7 +315,8 @@ export async function finishVnextMerge(context, input, prepared = prepareVnextMe
     const failed = receipts.filter((receipt) => receipt.status !== "passed");
     if (failed.length) {
         context.db.run("UPDATE merge_requests SET status = 'action_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "merge_gate_failed", failures: failed }), context.now(), request.merge_request_id]);
-        throw new AppError("merge_gate_failed", "Integrated target checks failed. Classify retained evidence: source defects use source repair; restored environment uses retry.", 2, { failures: failed, repair_command: repairCommand(context, request, projectRoot), continuation: { ...recoveryEvidenceInput(run.run_root, failed[0].id), command_after_input: finishCommand(context, run.id, request, projectRoot, failed[0].id) } });
+        const sourceRepair = failed.every(receipt => checkRepairDisposition(receipt) === "source_repair");
+        throw new AppError("merge_gate_failed", "Integrated target checks failed. Only assertion-backed failures permit source repair; tooling or unknown evidence requires diagnosis/settlement first.", 2, { failures: failed, ...(sourceRepair ? { repair_command: repairCommand(context, request, projectRoot) } : { outcome: "blocked", recoverable: false }), continuation: { ...recoveryEvidenceInput(run.run_root, failed[0].id), command_after_input: finishCommand(context, run.id, request, projectRoot, failed[0].id) } });
     }
     const passedRefs = new Set(receipts.flatMap((receipt) => receipt.check_refs));
     const missingRefs = frozenGateRefs(gate).filter((ref) => !passedRefs.has(ref));
@@ -476,6 +478,7 @@ export async function repairVnextMerge(context, input) {
     if (request.project_id !== project.id || request.status !== "action_required" || errorCode(request) !== "merge_gate_failed") {
         throw new AppError("invalid_merge_repair_state", "MERGE source repair requires an action-required failed integration gate", 2, { merge_request_id: input.requestId, status: request.status, code: errorCode(request) });
     }
+    assertSourceRepairEligible(checkReceipts(context, { projectId: project.id, runId: request.run_id }).filter(receipt => failedReceiptIds(request).includes(receipt.id)));
     abortIntegration(request);
     const originWorkIds = sourceCodeWorkIds(context, request.project_id, request.run_id);
     if (!originWorkIds.length)

package/dist/services/vnext-protocolize.js

@@ -71,10 +71,10 @@ export function prepareVnextProtocolizeArtifacts(context, input) {
     return { projectRoot, project, run, work, stageRoot, specifyPath, specifyMarkdownPath, obligations, resultPath, promptPath, template, projectCatalog, workspace };
 }
 /** Materialize the next-stage packet; this is execution, not read-only CLI preparation. */
-export function prepareVnextProtocolize(context, input, prepared = prepareVnextProtocolizeArtifacts(context, input)) {
+export async function prepareVnextProtocolize(context, input, prepared = prepareVnextProtocolizeArtifacts(context, input)) {
     const { projectRoot, project, run, work, stageRoot, specifyPath, specifyMarkdownPath, obligations, resultPath, promptPath, template, projectCatalog } = prepared;
     fs.mkdirSync(stageRoot, { recursive: true });
-    const policy = provisionWorkspaceForProtocolize(context, projectRoot, run, prepared.workspace);
+    const policy = await provisionWorkspaceForProtocolize(context, projectRoot, run, prepared.workspace);
     const routedRun = requireRun(context, projectRoot, run.id);
     writeJson(path.join(stageRoot, "work-context.json"), { schema_id: "dd-flow/vnext-protocolize-context@2", system: { run_id: run.id, work_id: work.work_id, stage, handoff: input.handoff }, input: { accepted_specify_json: specifyPath, accepted_specify_markdown: specifyMarkdownPath }, catalog: projectCatalog, workspace: { project_root: projectRoot, workspace_root: routedRun.workspace_root, stage_root: stageRoot, git_policy: policy } });
     if (!fs.existsSync(resultPath))
@@ -138,7 +138,7 @@ function readProtocolizeContext(file) {
     catch { /* retained context is not a caller argument */ }
     throw new AppError("runtime_context_invalid", "PROTOCOLIZE context is missing a valid frozen handoff", 1, { file });
 }
-export function startVnextProtocolize(context, input, prepared = prepareVnextProtocolizeStart(context, input)) {
+export async function startVnextProtocolize(context, input, prepared = prepareVnextProtocolizeStart(context, input)) {
     const { projectRoot, project, run, work, protocolizeRoot, contextPath, packetInput, packet, stageAttached, mode, promptPath } = prepared;
     assertStageStartHookEvent(context, { projectId: project.id, eventKey: input.hookEventId, runId: run.id, stage, projectRoot, ...(input.contextSha256 ? { contextSha256: input.contextSha256 } : {}) });
     const previous = context.db.get("SELECT ws.session_id, s.stop_reason FROM work_sessions ws LEFT JOIN sessions s ON s.project_id = ? AND s.session_id = ws.session_id WHERE ws.work_id = ? ORDER BY ws.created_at DESC LIMIT 1", [project.id, work.work_id]);
@@ -153,7 +153,7 @@ export function startVnextProtocolize(context, input, prepared = prepareVnextPro
     if (mode === "new_session" && previous?.session_id === sessionId)
         throw new AppError("handoff_session_mismatch", "Project policy requires PROTOCOLIZE to start in a fresh session", 1);
     if (packet)
-        prepareVnextProtocolize(context, packetInput, packet);
+        await prepareVnextProtocolize(context, packetInput, packet);
     const frozenContext = prepared.frozenContext ?? readProtocolizeContext(contextPath);
     const externalContext = applyExternalStageContext({ context, stageRoot: protocolizeRoot, promptPath, ...(input.externalContext ? { loaded: input.externalContext } : {}) });
     const binding = bindStageCoordinatorWork(context, { workId: work.work_id, hookEventId: input.hookEventId, stage, promptPath, resultPath: path.join(requireRunHome(run), "02-protocolize", "stage-report.json"), ...(input.contextSha256 ? { contextSha256: input.contextSha256 } : {}) });
@@ -178,7 +178,7 @@ function specifyHandoff(file, workId) {
     catch { /* reported below */ }
     throw new AppError("runtime_context_invalid", "SPECIFY Work is missing its immutable handoff policy", 1, { work_id: workId });
 }
-export function finishVnextProtocolize(context, input) {
+export async function finishVnextProtocolize(context, input) {
     const projectRoot = resolveProjectRoot(input.projectRoot);
     const project = requireProjectByRoot(context, projectRoot);
     const run = requireRun(context, projectRoot, input.runId);
@@ -205,7 +205,7 @@ export function finishVnextProtocolize(context, input) {
     const resolvedPolicy = requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" });
     const receipt = readWorkspaceRouteReceipt(root);
     const workspaceRoot = run.workspace_root;
-    const intent = prepareProtocolizeIntent(context, run, resultFile, result, obligations);
+    const intent = await prepareProtocolizeIntent(context, run, resultFile, result, obligations);
     publishProtocolizeIntent(context, project.id, intent);
     const protocolIds = intent.protocol_ids;
     const changedFiles = intent.changed_files;
@@ -246,7 +246,7 @@ export function finishVnextProtocolize(context, input) {
     const next = stageSuccessor(context, { projectRoot, runId: run.id, stage: "plan", command: `${flowCommand(context)} stage start ${run.id} --stage plan --project-root ${JSON.stringify(projectRoot)} --json`, metadata: { cwd: workspaceRoot, session_mode: resolvedPolicy.stage_session_mode } });
     return { ok: true, outcome: "protocolized", run_id: run.id, protocol_ids: protocolIds, workspace_root: workspaceRoot, git_policy: resolvedPolicy, next_action: "await_plan", ...(next.command ? { next_command: next.command } : {}), next, artifacts: { result: resultFile, report_json: reportJson, report_markdown: reportMarkdown, report_html: reportHtml, protocols: protocolIds.map((id) => path.join(workspaceRoot, ".memory-bank", "protocol", id, "summary.md")) } };
 }
-function prepareProtocolizeIntent(context, run, resultFile, result, obligations) {
+async function prepareProtocolizeIntent(context, run, resultFile, result, obligations) {
     const row = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [run.project_id, run.id]);
     const index = row ? JSON.parse(row.index_json) : null;
     const attempt = index?.stage_runs?.find(item => item.stage === stage)?.attempt;
@@ -270,11 +270,12 @@ function prepareProtocolizeIntent(context, run, resultFile, result, obligations)
             ? { ...result.feature, epic_path: path.join(draft, path.relative(projectRoot, result.feature.epic_path)) }
             : result.feature;
         const draftResult = { ...result, feature };
-        const changedFiles = materialize(draft, run.id, requireRunHome(run), draftResult, obligations, protocolIds, psetId);
+        const materialized = await materialize(draft, run.id, requireRunHome(run), draftResult, obligations, protocolIds, psetId);
+        const changedFiles = materialized.files;
         const files = changedFiles.map(relative => {
-            const source = path.join(projectRoot, relative), target = path.join(draft, relative);
+            const target = path.join(draft, relative);
             const bytes = fs.readFileSync(target, "utf8");
-            return { relative, before_sha256: fs.existsSync(source) ? sha256(fs.readFileSync(source)) : null, after_sha256: sha256(bytes), bytes };
+            return { relative, before_sha256: materialized.before[path.relative(draft, target)] ?? null, after_sha256: sha256(bytes), bytes };
         });
         const candidate = { run_id: run.id, attempt, workspace_root: projectRoot, result_sha256: resultSha, protocol_ids: protocolIds, pset_id: psetId, changed_files: changedFiles, files };
         return context.db.writeTransaction(() => {
@@ -366,7 +367,7 @@ function ensureManagedWorktreeRecorded(context, input) {
     recordManagedWorktree(context, input);
 }
 function sha256(bytes) { return crypto.createHash("sha256").update(bytes).digest("hex"); }
-function materialize(projectRoot, runId, runHome, result, obligations, ids, psetId) {
+async function materialize(projectRoot, runId, runHome, result, obligations, ids, psetId) {
     const psetPath = psetId ? path.join(projectRoot, ".memory-bank", "protocol", "_set", `${psetId}.md`) : null;
     const created = [];
     const changed = new Set();
@@ -404,8 +405,8 @@ function materialize(projectRoot, runId, runHome, result, obligations, ids, pset
             const absolute = path.resolve(projectRoot, file);
             return created.some((directory) => absolute.startsWith(`${directory}${path.sep}`)) || absolute === psetPath;
         });
-        runTargetedMemoryBankLint(projectRoot, materializedFiles);
-        return files;
+        await runTargetedMemoryBankLint(projectRoot, materializedFiles);
+        return { files, before: Object.fromEntries([...originals].map(([file, bytes]) => [path.relative(projectRoot, file), bytes === null ? null : sha256(bytes)])) };
     }
     catch (error) {
         for (const [file, content] of originals) {
@@ -670,7 +671,7 @@ function prepareWorkspaceForProtocolize(context, projectRoot, projectId, run, st
     prepareManagedWorktreeBootstrapSources(projectRoot);
     return { kind: "feature", receiptPath, config, stableFacts, sessionMode, branch, create };
 }
-function provisionWorkspaceForProtocolize(context, projectRoot, run, prepared) {
+async function provisionWorkspaceForProtocolize(context, projectRoot, run, prepared) {
     if (prepared.kind === "retained")
         return prepared.policy;
     const { receiptPath } = prepared;
@@ -679,8 +680,8 @@ function provisionWorkspaceForProtocolize(context, projectRoot, run, prepared) {
         return prepared.policy;
     }
     const { config, stableFacts, sessionMode, branch, create } = prepared;
-    const created = createManagedWorktree(context, create, create);
-    const bootstrap = bootstrapManagedWorktree(context, { projectRoot, worktreePath: created.worktreePath });
+    const created = await createManagedWorktree(context, create, create);
+    const bootstrap = await bootstrapManagedWorktree(context, { projectRoot, worktreePath: created.worktreePath });
     rebindFlowRunWorkspace(context, { projectRoot, runId: run.id, workspaceRoot: created.worktreePath, reason: "PROTOCOLIZE start provisioned the configured feature-worktree route" });
     const policy = { route: "feature_worktree", integration_branch: config.workspace.integration_branch, base_ref: stableFacts.head, feature_branch: branch, worktree_path: created.worktreePath, reason: "Project workspace configuration requires a managed feature worktree before durable protocol documents exist.", provision_stage: "protocolize_start", stage_session_mode: sessionMode, provisioned: true, bootstrap_status: bootstrap.status };
     writeJson(receiptPath, { schema_id: "dd-flow/vnext-workspace-route@1", policy, created, bootstrap });

package/dist/services/work-registry.js

@@ -12,7 +12,7 @@ import { validateSchema } from "./schema-validation.js";
 import { resolveProjectRoot, resolveRunReferences } from "../storage/paths.js";
 import { prepareAgentOutputFile } from "../storage/agent-output.js";
 import { refreshRunSessionProjection } from "./run-projection.js";
-import { ignoredWorkspacePaths, normalizeWorkspacePath, readCodeCheckProfile, runCodeChecks, validateCheckDeclaration, validateFailedCheckRetry, workspaceFingerprint } from "./code-checks.js";
+import { assertSourceRepairEligible, ignoredWorkspacePaths, normalizeWorkspacePath, readCodeCheckProfile, runCodeChecks, validateCheckDeclaration, validateFailedCheckRetry, workspaceFingerprint } from "./code-checks.js";
 import { nextWorkId, nextWorkIds } from "./ids.js";
 import { appendFlowRunTimelineEvent } from "./runs.js";
 import { resolveStageTransition } from "./execution-policy.js";
@@ -1104,6 +1104,8 @@ async function settle(context, id, status, result, progress, retry) {
                 validateFailedCheckRetry(context, { projectId: work.project_id, runId: work.run_id, receiptId: retry.receiptId, declarations: requiredChecks, reason: retry.reason });
             receipts = await runCodeChecks(context, { projectId: work.project_id, runId: work.run_id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, workId: work.work_id, artifactDir, scope: "work", checks: requiredChecks, ...(retry ? { retryReceiptId: retry.receiptId, retryReason: retry.reason } : {}), ...(progress ? { progress } : {}) });
             const failed = receipts.filter((receipt) => receipt.status !== "passed");
+            if (failed.length)
+                assertSourceRepairEligible(failed);
             if (failed.length)
                 throw new AppError("work_checks_failed", "Work remains running because required checks failed", 2, { work_id: id, failures: failed, all_receipts: receipts });
         }

package/dist/services/worktrees.js

@@ -10,6 +10,8 @@ import { persistProtocolState, readProtocolRuntimeState, requireProtocol } from
 import { requireProjectByRoot } from "./projects.js";
 import { ensureManagedWorktrunk, inspectManagedWorktrunk } from "./tooling.js";
 import { propagateOwnedWorkspaceHooks } from "./workspace-files.js";
+import { commandResult } from '../harness-runtime/lib/process-json.mjs';
+import { SETUP_STARTUP_MS } from '../harness-runtime/lib/setup-progress.mjs';
 export function planWorktree(context, input) {
     const protocol = scopedProtocol(context, input.projectRoot, input.protocolId);
     const state = readProtocolRuntimeState(context, protocol).state;
@@ -40,11 +42,11 @@ export function prepareWorktreeCreate(context, input) {
     }
     return prepareManagedWorktree({ ...input, projectRoot: protocol.project_root });
 }
-export function createWorktreeRecord(context, input, prepared = prepareWorktreeCreate(context, input)) {
+export async function createWorktreeRecord(context, input, prepared = prepareWorktreeCreate(context, input)) {
     const protocol = scopedProtocol(context, input.projectRoot, input.protocolId);
     if (activeWorktreeRecord(context, protocol.project_id, protocol.id))
         throw new AppError("worktree_already_exists", "Protocol already has an active worktree record", 1);
-    const created = createManagedWorktree(context, prepared, prepared);
+    const created = await createManagedWorktree(context, prepared, prepared);
     recordManagedWorktree(context, { protocolId: protocol.id, projectRoot: protocol.project_root, branch: prepared.branch, base: prepared.base, created });
     return { ok: true, worktree: activeWorktreeRecord(context, protocol.project_id, protocol.id) };
 }
@@ -82,13 +84,13 @@ export function prepareManagedWorktree(input) {
     return { projectRoot, branch: input.branch, base: base.stdout.trim(), path: destination };
 }
 /** Creates the checkout before a PRT exists. PROTOCOLIZE materializes the PRT only inside this checkout. */
-export function createManagedWorktree(context, input, prepared = prepareManagedWorktree(input)) {
+export async function createManagedWorktree(context, input, prepared = prepareManagedWorktree(input)) {
     const { projectRoot } = prepared;
-    const worktrunk = ensureManagedWorktrunk(context);
+    const worktrunk = await ensureManagedWorktrunk(context);
     // Worktrunk owns creation; the CLI supplies its project-scoped service path
     // as a one-shot config override rather than relying on a developer's user config.
     const command = [worktrunk.bin, "-C", projectRoot, "--config-set", `worktree-path = ${JSON.stringify(prepared.path)}`, "switch", "--create", prepared.branch, "--base", prepared.base, "--no-cd", "--format=json", "-y"];
-    const result = runExternal(command);
+    const result = await runExternal(command);
     if (result.exit_code !== 0)
         throw new AppError("worktrunk_command_unavailable", "Worktrunk switch failed", 1, { command: sanitizeCommand(command), result });
     const response = parseWorktrunkResponse(result.stdout, command);
@@ -137,16 +139,16 @@ export function prepareManagedWorktreeBootstrap(input) {
         throw new AppError("bootstrap_unavailable", "Bootstrap worktree must be a directory", 1, { worktree_path: worktreePath });
     return { projectRoot, worktreePath };
 }
-export function bootstrapManagedWorktree(context, input, prepared = prepareManagedWorktreeBootstrap(input)) {
+export async function bootstrapManagedWorktree(context, input, prepared = prepareManagedWorktreeBootstrap(input)) {
     const { worktreePath } = prepared;
-    const worktrunk = ensureManagedWorktrunk(context);
+    const worktrunk = await ensureManagedWorktrunk(context);
     const commands = [
         [worktrunk.bin, "-C", worktreePath, "step", "copy-ignored", "--require-include"],
         [worktrunk.bin, "-C", worktreePath, "hook", "pre-start", "--yes"]
     ];
     const results = [];
     for (const command of commands) {
-        const result = runExternal(command);
+        const result = await runExternal(command);
         results.push({ command: sanitizeCommand(command), ...result });
         if (result.exit_code !== 0) {
             throw new AppError("bootstrap_failed", "Project-owned Worktrunk bootstrap failed", 1, { command: sanitizeCommand(command), result, results });
@@ -167,14 +169,14 @@ export function prepareWorktreeBootstrap(context, input) {
     }
     return { protocol, record, managed: prepareManagedWorktreeBootstrap({ projectRoot: protocol.project_root, worktreePath: record.worktree_path }) };
 }
-export function bootstrapWorktree(context, input, prepared = prepareWorktreeBootstrap(context, input)) {
+export async function bootstrapWorktree(context, input, prepared = prepareWorktreeBootstrap(context, input)) {
     const { protocol, record } = prepared;
     const active = activeWorktreeRecord(context, protocol.project_id, protocol.id);
     if (!active || active.worktree_path !== record.worktree_path)
         throw new AppError("worktree_active", "Worktree changed after bootstrap preparation", 1);
     let result;
     try {
-        result = bootstrapManagedWorktree(context, prepared.managed, prepared.managed);
+        result = await bootstrapManagedWorktree(context, prepared.managed, prepared.managed);
     }
     catch (error) {
         if (error instanceof AppError && error.code === "bootstrap_failed")
@@ -254,16 +256,16 @@ export function worktreeRecord(context, projectId, protocolId) {
 function activeWorktreeRecord(context, projectId, protocolId) {
     return context.db.get("SELECT * FROM worktree_records WHERE project_id = ? AND protocol_id = ? AND status = 'active'", [projectId, protocolId]);
 }
-function runExternal(command) {
+async function runExternal(command) {
     const [bin, ...args] = command;
     if (!bin) {
         return { exit_code: null, stdout: "", stderr: "Missing executable." };
     }
-    const result = spawnSync(bin, args, { encoding: "utf8" });
+    const result = await commandResult(bin, args, { startupMs: SETUP_STARTUP_MS });
     return {
-        exit_code: typeof result.status === "number" ? result.status : null,
+        exit_code: result.exit_code,
         stdout: sanitizeOutput(result.stdout),
-        stderr: sanitizeOutput(result.stderr || result.error?.message || "")
+        stderr: sanitizeOutput(result.stderr)
     };
 }
 function sanitizeCommand(command) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.127",
+  "version": "0.9.0-beta.133",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",