@deksden-com/dd-flow-cli 0.9.0-beta.136 → 0.9.0-beta.137

package/dist/cli/setup.js

@@ -1,147 +0,0 @@
-import { prepareCommandRoute } from "./command-inputs.js";
-import path from "node:path";
-import { parseOutputOptions } from "./output-options.js";
-import { resolveDdFlowHome } from "../storage/paths.js";
-import { readSetupStatus, installAuthenticatedRelease, readRetainedSetupExecutor, hasDeferredSetupOnboarding, readSetupOnboarding, commitSetupOnboarding } from "../services/setup.js";
-import { readTrustedReleaseProducers, readReleaseBundle } from "../services/release-source.js";
-import { createReleaseCompatibility, installedCatalogVersions } from "../services/release-compatibility.js";
-import { getCliVersionReport } from "../services/build-info.js";
-import { readOperatorProfiles, readProfileCreationIntent } from "../services/operator-profiles.js";
-import { onboardExecutor, selectOnboardingExecutor } from "../services/executor-onboarding.js";
-import { askExecutorChoice } from "./executor-onboarding.js";
-import { requiredOption, optionalOption } from "./argument-values.js";
-import { AppError, errorRecord } from "../shared/errors.js";
-import { hybridDigest } from "../services/hybrid-contracts.js";
-import { prepareResponseDestination, writeResponseFile } from "./response-file.js";
-import { readRegistryRelease } from "../services/release-registry.js";
-import { writePreparationError } from "./error-output.js";
-/** Lightweight global diagnostic ingress; never creates a runtime context. */
-export async function runSetupCli(args, env, io = { stdout: process.stdout, stderr: process.stderr, stdin: process.stdin }) {
-    let json = false;
-    try {
-        const output = parseOutputOptions(args);
-        json = output.json;
-        if (output.responseFile)
-            prepareResponseDestination(output.responseFile);
-        const route = prepareCommandRoute(output.args);
-        const humanProgress = !output.json && !output.progressJsonl;
-        const reportHumanProgress = (message) => {
-            // Diagnostic delivery cannot turn a completed installation into failure.
-            try {
-                io.stderr.write(`setup: ${message}\n`);
-            }
-            catch { /* Best-effort human progress only. */ }
-        };
-        const home = resolveDdFlowHome(env);
-        let result;
-        if (route.key === "setup status")
-            result = { ok: true, action: "setup_status", observed_cli: getCliVersionReport().cli, ...readSetupStatus(home) };
-        else if (route.key === "setup" || route.key === "setup update") {
-            const parsed = route.parsed;
-            const source = optionalOption(parsed, "canon-source"), version = optionalOption(parsed, "canon-version");
-            const registryFile = optionalOption(parsed, "release-registry");
-            if (source && (version || registryFile))
-                throw new AppError("usage", "--canon-source is exclusive with --canon-version and --release-registry; see dd-flow setup --help", 2, { effect: "no_effect" });
-            const channel = (optionalOption(parsed, "channel") ?? "stable");
-            const selection = source ? null : readRegistryRelease(registryFile ?? env.DD_FLOW_RELEASE_REGISTRY ?? path.join(home, "release-registry.json"), channel, version);
-            const profile = optionalOption(parsed, "profile"), skip = parsed.options.has("skip-agent-setup");
-            const intentFile = optionalOption(parsed, "save-profile-intent");
-            if (intentFile && skip)
-                throw new AppError("usage", "--save-profile-intent conflicts with --skip-agent-setup", 2, { effect: "no_effect" });
-            let profileCreation = intentFile ? readProfileCreationIntent(intentFile) : undefined;
-            const stdin = io.stdin ?? process.stdin;
-            const nonInteractive = parsed.options.has("non-interactive") || output.json || output.progressJsonl
-                || !stdin.isTTY || !io.stderr.isTTY;
-            const profileFile = optionalOption(parsed, "profile-file");
-            const requestId = requiredOption(parsed, "request-id");
-            const retained = profile === undefined && profileFile === undefined && !intentFile && !skip ? readRetainedSetupExecutor(home, requestId) : null;
-            if (retained?.profileCreation)
-                profileCreation = retained.profileCreation;
-            const choice = { ...(profile !== undefined ? { profileId: profile } : {}),
-                ...(profileFile !== undefined ? { profileFile } : {}),
-                ...(retained?.executor ? { profile: retained.executor } : profileCreation && profile === undefined && profileFile === undefined ? { profile: profileCreation.profile } : {}),
-                skip: skip || retained !== null && retained.executor === null };
-            let deferred = hasDeferredSetupOnboarding(home, requestId);
-            let selected;
-            if (!deferred) {
-                try {
-                    selected = selectOnboardingExecutor(choice, () => readOperatorProfiles(home), { allowSkip: true });
-                }
-                catch (error) {
-                    if (!(error instanceof AppError) || error.code !== "agent_profile_missing" || nonInteractive
-                        || profile !== undefined || profileFile !== undefined || intentFile || skip)
-                        throw error;
-                    deferred = true;
-                }
-            }
-            else if (profile !== undefined || profileFile !== undefined || intentFile || skip) {
-                // Explicit continuation inputs still fail before downloading or replaying.
-                selected = selectOnboardingExecutor(choice, () => readOperatorProfiles(home), { allowSkip: true });
-            }
-            const observedCli = getCliVersionReport().cli;
-            const compatibility = createReleaseCompatibility({ channel,
-                catalogVersions: installedCatalogVersions, routerVersion: observedCli.version });
-            const producers = readTrustedReleaseProducers(requiredOption(parsed, "trust-file"));
-            const bundle = await readReleaseBundle(source ?? selection.envelope_url, producers, compatibility, {
-                ...(selection ? { expectedVersion: selection.version } : {}),
-                ...((output.progressJsonl || humanProgress) ? { onProgress: (progress) => {
-                        if (output.progressJsonl)
-                            io.stdout.write(`${JSON.stringify({ type: "setup_download_progress", request_id: requestId, ...progress })}\n`);
-                        else if (progress.received_bytes === progress.expected_bytes)
-                            reportHumanProgress(`${progress.artifact} archive received (${progress.received_bytes} bytes); integrity validation follows`);
-                    } } : {})
-            });
-            if (selection && bundle.authenticated.manifest.version !== selection.version)
-                throw new AppError("release_registry", "Authenticated release differs from selected registry version", 1, { reason: "selected_version_mismatch", phase: "release_selection", effect: "no_effect", help: "setup" });
-            const installed = installAuthenticatedRelease(home, { requestId, action: route.key === "setup update" ? "update" : "install",
-                envelope: bundle.envelope, trustedProducers: producers, compatibility, canonArchive: bundle.canonArchive, engineArchive: bundle.engineArchive,
-                ...(deferred ? { deferredOnboarding: true } : { executor: selected.profile, ...(profileCreation ? { profileCreation } : {}) }),
-                ...((output.progressJsonl || humanProgress) ? { onCheckpoint: phase => {
-                        if (output.progressJsonl)
-                            io.stdout.write(`${JSON.stringify({ type: "setup_progress", request_id: requestId, phase })}\n`);
-                        else
-                            reportHumanProgress({ prepared: "verified release request retained", canon_cached: "canon cache verified", engine_cached: "engine cache verified",
-                                profiles_saved: "profile settings saved", committed: "installation committed; runtime qualification remains unknown" }[phase]);
-                    } } : {}) });
-            if (humanProgress && installed.replayed)
-                reportHumanProgress("exact request replay verified; retained selection was not reactivated");
-            if (deferred) {
-                const saved = readSetupOnboarding(home, requestId);
-                const explicit = profile !== undefined || profileFile !== undefined || intentFile !== undefined || skip;
-                const deferredChoice = saved && !explicit ? { ...(saved.executor ? { profile: saved.executor } : { skip: true }),
-                    ...(saved.profileCreation ? { profileCreation: saved.profileCreation } : {}) } : choice;
-                try {
-                    selected ??= await onboardExecutor(deferredChoice, () => readOperatorProfiles(home), { allowSkip: true, nonInteractive }, settings => askExecutorChoice(settings, { stdin, stderr: io.stderr }));
-                    const consent = commitSetupOnboarding(home, requestId, { executor: selected.profile,
-                        ...(profileCreation ?? selected.profileCreation ? { profileCreation: profileCreation ?? selected.profileCreation } : {}) });
-                    installed.executor = consent.executor;
-                    if (humanProgress)
-                        reportHumanProgress("executor onboarding committed after installation");
-                }
-                catch (error) {
-                    if (error instanceof AppError) {
-                        error.details.installation = "committed";
-                        error.details.request_id = requestId;
-                        error.details.next_action = "Replay the same setup request to resume executor onboarding; installation remains retained";
-                    }
-                    throw error;
-                }
-            }
-            result = { ...installed, action: route.key === "setup update" ? "setup_update" : "setup_install", observed_cli: observedCli,
-                executor: installed.executor ? { profile_id: installed.executor.id, revision: hybridDigest(installed.executor), readiness: "unknown_requires_qualification" } : { profile_id: null, readiness: "not_configured" },
-                ...readSetupStatus(home) };
-        }
-        else
-            throw new AppError("usage", "Unknown setup command; see dd-flow setup --help", 2, { effect: "no_effect" });
-        io.stdout.write(`${JSON.stringify(writeResponseFile(result, output), null, json ? undefined : 2)}\n`);
-        return 0;
-    }
-    catch (error) {
-        const record = errorRecord(error);
-        writePreparationError(io, args, record);
-        if (!json && error instanceof AppError && error.details.installation === "committed") {
-            io.stderr.write("setup: installation remains committed; replay the same request to resume executor onboarding\n");
-        }
-        return record.exitCode;
-    }
-}

package/dist/services/cli-upgrade-allowlist.js

@@ -1,27 +0,0 @@
-import { parseCommandArgs } from "./lifecycle-command.js";
-/** Syntax eligibility only. Storage/project/RUN authority is checked separately. */
-export function isUpgradeAllowlisted(args) {
-    const parsed = parseCommandArgs(args), [family, command] = parsed.positional;
-    const option = (name) => {
-        const value = parsed.options.get(name)?.at(-1);
-        return value && value !== "__dd_flow_flag__" ? value : null;
-    };
-    if (family === "status")
-        return true;
-    if (family === "engine" && command === "resolve")
-        return true;
-    if (family === "migration" && ["impact", "plan", "report", "verify", "apply"].includes(command ?? ""))
-        return true;
-    if (family === "memory" && command === "permissions" && parsed.positional[2] === "preflight")
-        return true;
-    if (family === "run" && command === "start")
-        return option("flow-kind") === "mb-upgrade";
-    const bound = Boolean(option("run") || parsed.positional.some(value => value.startsWith("RUN-")));
-    if (family === "stage" && ["start", "pause", "resume", "finish"].includes(command ?? ""))
-        return bound;
-    if (family === "session" && ["status", "register", "stop", "usage"].includes(command ?? ""))
-        return bound;
-    if (family === "dashboard" && ["data", "render", "refresh", "open"].includes(command ?? ""))
-        return true;
-    return false;
-}

package/dist/services/discovery/agy-discovery.js

@@ -1,2 +0,0 @@
-import { discoverExecutable } from "./static.js";
-export const discoverAgy = (input) => discoverExecutable("agy", ["agy"], input);

package/dist/services/discovery/codex-discovery.js

@@ -1,2 +0,0 @@
-import { discoverExecutable } from "./static.js";
-export const discoverCodex = (input) => discoverExecutable("codex", ["codex"], input);

package/dist/services/discovery/droid-discovery.js

@@ -1,2 +0,0 @@
-import { discoverExecutable } from "./static.js";
-export const discoverDroid = (input) => discoverExecutable("droid", ["droid"], input);

package/dist/services/discovery/grok-discovery.js

@@ -1,2 +0,0 @@
-import { discoverExecutable } from "./static.js";
-export const discoverGrok = (input) => discoverExecutable("grok", ["grok"], input);

package/dist/services/discovery/opencode-discovery.js

@@ -1,2 +0,0 @@
-import { discoverExecutable } from "./static.js";
-export const discoverOpenCode = (input) => discoverExecutable("opencode", ["opencode"], input);

package/dist/services/discovery/static.js

@@ -1,31 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { AppError } from "../../shared/errors.js";
-/** Presence only: no child process, config/credential read, network or generative probe. */
-export function discoverExecutable(harness, names, input) {
-    const platform = input.platform ?? process.platform;
-    if (input.executable && !path.isAbsolute(input.executable))
-        throw new AppError("usage", "Explicit executable must be an absolute path", 2, { effect: "no_effect" });
-    const suffixes = platform === "win32" ? (input.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter(suffix => /^\.[A-Za-z0-9]+$/.test(suffix)) : [""];
-    const paths = input.executable ? [input.executable] : (input.env.PATH ?? "").split(platform === "win32" ? ";" : path.delimiter)
-        .filter(directory => path.isAbsolute(directory)).flatMap(directory => names.flatMap(name => suffixes.map(suffix => path.join(directory, `${name}${suffix}`))));
-    const candidates = new Map();
-    let unreadable = false;
-    for (const file of paths) {
-        try {
-            if (!fs.statSync(file).isFile())
-                continue;
-            fs.accessSync(file, platform === "win32" ? fs.constants.F_OK : fs.constants.X_OK);
-            candidates.set(fs.realpathSync(file), file);
-        }
-        catch (error) {
-            if (!["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
-                unreadable = true;
-        }
-    }
-    const selected = candidates.size === 1;
-    return { harness, candidates: [...candidates.keys()].map(file => ({ path: file, version: null, selected })),
-        installed: selected ? "yes" : candidates.size > 1 || unreadable ? "unknown" : "no",
-        compatible: "unknown", protocol: "unknown", auth: "unknown", qualified: "unknown", evidence: [],
-        reason: selected ? "executable_present_no_qualification_probe" : candidates.size > 1 ? "multiple_installations_require_explicit_selection" : unreadable ? "filesystem_observation_incomplete" : "executable_not_found" };
-}

package/dist/services/discovery/zcode-discovery.js

@@ -1,2 +0,0 @@
-import { discoverExecutable } from "./static.js";
-export const discoverZcode = (input) => discoverExecutable("zcode", ["zcode"], input);

package/dist/services/executor-onboarding.js

@@ -1,56 +0,0 @@
-import { AppError } from "../shared/errors.js";
-import { hybridDigest } from "./hybrid-contracts.js";
-import { prepareOperatorProfile, readOperatorProfileInput, resolveOperatorProfile, validateProfileCreationIntent } from "./operator-profiles.js";
-function refuse(code, message, exitCode = 2) {
-    throw new AppError(code, message, exitCode, { phase: "executor_onboarding", effect: "no_effect", help: "profiles" });
-}
-/** Shared setup/first-flow admission; settings are read lazily, never written. */
-export function selectOnboardingExecutor(choice, readSettings, policy) {
-    if (!choice || typeof choice !== "object" || Array.isArray(choice)
-        || Object.keys(choice).some(key => !["profileId", "profile", "profileFile", "skip", "profileCreation"].includes(key))
-        || choice.profileFile !== undefined && (typeof choice.profileFile !== "string" || !choice.profileFile.trim())
-        || choice.skip !== undefined && typeof choice.skip !== "boolean"
-        || choice.profileId !== undefined && (typeof choice.profileId !== "string" || !choice.profileId.trim())) {
-        refuse("usage", "Invalid executor selection");
-    }
-    if ([choice.profileId !== undefined, choice.profile !== undefined, choice.profileFile !== undefined, choice.skip === true].filter(Boolean).length > 1) {
-        refuse("usage", "Executor profile, profile ID and skip are mutually exclusive");
-    }
-    if (choice.profileCreation !== undefined) {
-        validateProfileCreationIntent(choice.profileCreation);
-        if (choice.profile === undefined || hybridDigest(choice.profile) !== hybridDigest(choice.profileCreation.profile))
-            refuse("usage", "Profile save intent requires its exact explicit profile");
-    }
-    if (choice.skip) {
-        if (!policy.allowSkip)
-            refuse("agent_profile_missing", "This operation requires an executor profile", 1);
-        return { profile: null, revision: null, source: "skip" };
-    }
-    const explicit = choice.profile !== undefined || choice.profileFile !== undefined || choice.profileId !== undefined;
-    if (!explicit && policy.projectProfileId !== undefined && (typeof policy.projectProfileId !== "string" || !policy.projectProfileId.trim())) {
-        refuse("usage", "Invalid project executor profile selection");
-    }
-    const profile = prepareOperatorProfile(choice.profile !== undefined ? choice.profile : choice.profileFile !== undefined
-        ? readOperatorProfileInput(choice.profileFile) : resolveOperatorProfile(readSettings(), choice.profileId ?? policy.projectProfileId));
-    return { profile: structuredClone(profile), revision: hybridDigest(profile),
-        ...(choice.profileCreation ? { profileCreation: structuredClone(choice.profileCreation) } : {}),
-        source: choice.profile !== undefined ? "explicit-profile" : choice.profileFile !== undefined ? "explicit-file" : choice.profileId !== undefined ? "explicit-id" : policy.projectProfileId !== undefined ? "project-default" : "default" };
-}
-/** Interactive decisions use exactly the same admission as headless choices. */
-export async function onboardExecutor(choice, readSettings, policy, ask) {
-    try {
-        return selectOnboardingExecutor(choice, readSettings, policy);
-    }
-    catch (error) {
-        if (!(error instanceof AppError) || error.code !== "agent_profile_missing"
-            || choice.profileId !== undefined || choice.profile !== undefined || choice.profileFile !== undefined || choice.skip === true
-            || policy.projectProfileId !== undefined || policy.nonInteractive || !ask)
-            throw error;
-        // No speculative defaults or writes: the human supplies a concrete choice.
-        const decision = await ask(structuredClone(readSettings()));
-        if (decision.profileId === undefined && decision.profile === undefined && decision.profileFile === undefined && decision.skip !== true) {
-            refuse("agent_profile_missing", "Onboarding requires an explicit choice", 1);
-        }
-        return selectOnboardingExecutor(decision, readSettings, policy);
-    }
-}

package/dist/services/harness-discovery.js

@@ -1,29 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { validateHybridContract } from "./hybrid-contracts.js";
-import { AppError } from "../shared/errors.js";
-import { discoverCodex } from "./discovery/codex-discovery.js";
-import { discoverZcode } from "./discovery/zcode-discovery.js";
-import { discoverAgy } from "./discovery/agy-discovery.js";
-import { discoverOpenCode } from "./discovery/opencode-discovery.js";
-import { discoverGrok } from "./discovery/grok-discovery.js";
-import { discoverDroid } from "./discovery/droid-discovery.js";
-import { readOnlyProbeScope, runScopedProbe, staticDiscoveryEffects } from "./harness-probe-effects.js";
-const modules = { codex: discoverCodex, zcode: discoverZcode, agy: discoverAgy, opencode: discoverOpenCode, grok: discoverGrok, droid: discoverDroid };
-export const harnessCatalog = {
-    schema_id: "dd-flow/harness-catalog@1", version: "1.0.0",
-    entries: Object.keys(modules).map(id => ({ id, executable_candidates: [id], probe_module: `${id}-discovery`,
-        probe_timeout_ms: 3000, version_range: "unknown_requires_review", protocol_version: "unknown_requires_protocol_probe" }))
-};
-export function discoverHarnesses(input) {
-    if (input.harness && !Object.hasOwn(modules, input.harness))
-        throw new AppError("usage", "Unknown harness family", 2, { effect: "no_effect" });
-    if (input.executable && !input.harness)
-        throw new AppError("usage", "Explicit executable requires one harness family", 2, { effect: "no_effect" });
-    const families = input.harness ? [input.harness] : Object.keys(modules);
-    const result = { schema_id: "dd-flow/discovery-result@1", request_id: input.requestId ?? randomUUID(), observed_at: new Date().toISOString(),
-        probe_scope: "static", live_authorization_receipt: null, entries: families.map(family => runScopedProbe(staticDiscoveryEffects, readOnlyProbeScope, () => modules[family](input))) };
-    if (validateHybridContract("harness-catalog", harnessCatalog).length || validateHybridContract("discovery-result", result).length) {
-        throw new AppError("discovery_contract", "Discovery owner produced invalid facts", 1, { effect: "no_effect" });
-    }
-    return result;
-}

package/dist/services/harness-doctor.js

@@ -1,75 +0,0 @@
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { parse } from "semver";
-import { AppError } from "../shared/errors.js";
-import { legacyDoctorEffects, runScopedProbe } from "./harness-probe-effects.js";
-import { readBoundedReleaseFile } from "./release-source.js";
-import { discoverExecutable } from "./discovery/static.js";
-const binOptions = {
-    codex: "codex-bin", zcode: "zcode-acp-bin", agy: "agy-bin", opencode: "opencode-bin", grok: "grok-bin", droid: "droid-bin"
-};
-function refuse(code, message, exitCode = 1) {
-    throw new AppError(code, message, exitCode, { phase: "harness_doctor", help: "harnesses doctor" });
-}
-/** Existing non-generative adapter doctor, bounded by its owner transport.
- * Reported compatibility is not qualification or verified account access.
- * OpenCode observes an explicitly bound existing daemon; it never starts one.
- */
-export async function probeHarnessDoctor(input) {
-    const timeoutMs = input.timeoutMs ?? 30_000;
-    if (!Object.hasOwn(binOptions, input.harness) || !path.isAbsolute(input.executable)
-        || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60_000
-        || input.stateDir !== undefined && !path.isAbsolute(input.stateDir)
-        || input.nativeExecutable !== undefined && (!path.isAbsolute(input.nativeExecutable) || input.harness !== "zcode")
-        || input.stateDir !== undefined && input.harness !== "opencode")
-        refuse("usage", "Doctor requires explicit contained diagnostic inputs", 2);
-    return runScopedProbe(legacyDoctorEffects[input.harness], input.scope, async () => {
-        if (input.harness === "droid" && discoverExecutable("system-ps", ["ps"], { env: { ...process.env, ...input.env } }).candidates.length === 0) {
-            throw new AppError("doctor_prerequisite_missing", "Droid doctor requires the OS ps utility for physical process settlement", 1, { phase: "harness_doctor", effect: "no_effect", prerequisite: "ps", help: "harnesses doctor" });
-        }
-        const args = [fileURLToPath(new URL(`../harness-runtime/bin/dd-${input.harness}.mjs`, import.meta.url)), "doctor",
-            `--${binOptions[input.harness]}`, input.executable, "--timeout-ms", String(timeoutMs), "--json"];
-        if (input.harness === "zcode") {
-            if (!input.nativeExecutable)
-                refuse("harness_selection_required", "ZCode doctor also requires --native-executable for its native runtime");
-            args.push("--zcode-path", input.nativeExecutable);
-        }
-        if (input.harness === "opencode") {
-            if (!input.stateDir)
-                refuse("harness_selection_required", "OpenCode doctor requires --state-dir for an existing owned daemon; no service is started");
-            let state;
-            try {
-                state = JSON.parse(readBoundedReleaseFile(path.join(input.stateDir, "daemon.json"), 1024 * 1024).toString("utf8"));
-            }
-            catch {
-                return refuse("doctor_state_unavailable", "Selected daemon identity cannot be read");
-            }
-            const selected = state;
-            if (selected?.config?.bin !== input.executable)
-                refuse("doctor_state_mismatch", "Selected daemon does not bind the discovered executable");
-            args.push("--state-dir", input.stateDir);
-        }
-        const transport = await import(new URL("../harness-runtime/lib/process-json.mjs", import.meta.url).href);
-        let report;
-        try {
-            report = await transport.commandJson(process.execPath, args, { env: input.env, timeoutMs, signal: AbortSignal.timeout(timeoutMs), phase: "native-doctor" });
-        }
-        catch {
-            return refuse("harness_doctor_failed", "Adapter doctor failed or could not confirm its observation; no model Turn was requested");
-        }
-        if (!report || typeof report !== "object" || Array.isArray(report) || report.ok !== true)
-            refuse("harness_doctor_failed", "Adapter doctor did not return an accepted diagnostic");
-        const observed = report.observed_runtime && typeof report.observed_runtime === "object" ? report.observed_runtime : {};
-        const versionField = input.harness === "codex" ? "codex_cli" : input.harness === "zcode" ? "zcode_acp" : input.harness;
-        const versions = report.versions && typeof report.versions === "object" && !Array.isArray(report.versions) ? report.versions : {};
-        // Existing OpenCode doctor reports versions separately from observed_runtime.
-        const versionValue = input.harness === "opencode" ? versions.opencode : observed[versionField];
-        const version = typeof versionValue === "string" ? parse(versionValue)?.version ?? null : null;
-        const protocol = observed.dd_harness_contract;
-        const models = Array.isArray(report.models) ? report.models.filter((model) => typeof model === "string" && /^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,255}$/.test(model)).slice(0, 10_000) : [];
-        return { harness: input.harness, effects: legacyDoctorEffects[input.harness], reported_version: version,
-            reported_protocol: typeof protocol === "string" && /^dd-[a-z0-9-]+@[0-9]+$/.test(protocol) ? protocol : null,
-            reported_models: [...new Set(models)].sort(), models_complete: false, reported_compatible: typeof report.compatible === "boolean" ? report.compatible : null,
-            account_access: "unknown", qualified: "unknown", model_turn: "not_requested" };
-    });
-}

package/dist/services/harness-probe-effects.js

@@ -1,51 +0,0 @@
-import { AppError } from "../shared/errors.js";
-export const readOnlyProbeScope = Object.freeze({
-    processes: false, services: false, credentials: false, writes: false
-});
-/** Source-grounded effects of existing adapters; this is not permission to invoke them. */
-export const legacyDoctorEffects = {
-    codex: { child_process: true, service_process: true, credential_access: "possible", filesystem: "temporary_or_runtime_writes", model_turn: "not_requested", source_owner: "harness-runtime/lib/dd-codex.mjs:doctor/withBridge" },
-    zcode: { child_process: true, service_process: false, credential_access: "possible", filesystem: "read_only", model_turn: "not_requested", source_owner: "harness-runtime/lib/dd-zcode.mjs:doctor" },
-    agy: { child_process: true, service_process: false, credential_access: "possible", filesystem: "temporary_or_runtime_writes", model_turn: "not_requested", source_owner: "harness-runtime/lib/dd-agy.mjs:doctor" },
-    opencode: { child_process: true, service_process: true, credential_access: "possible", filesystem: "temporary_or_runtime_writes", model_turn: "not_requested", source_owner: "harness-runtime/lib/dd-opencode-daemon.mjs:daemon.doctor/startDaemon" },
-    grok: { child_process: true, service_process: false, credential_access: "possible", filesystem: "read_only", model_turn: "not_requested", source_owner: "harness-runtime/lib/dd-grok.mjs:doctor" },
-    droid: { child_process: true, service_process: true, credential_access: "possible", filesystem: "temporary_or_runtime_writes", model_turn: "not_requested", source_owner: "harness-runtime/lib/dd-droid-daemon.mjs:runtime.start" }
-};
-for (const effects of Object.values(legacyDoctorEffects))
-    Object.freeze(effects);
-Object.freeze(legacyDoctorEffects);
-export const staticDiscoveryEffects = Object.freeze({
-    child_process: false, service_process: false, credential_access: "none", filesystem: "read_only", model_turn: "not_requested",
-    source_owner: "services/discovery/static.ts:discoverExecutable"
-});
-/** Enforce effect ceilings before invoking a probe. A non-generative label alone is insufficient. */
-export function assertProbeWithinScope(effects, scope) {
-    const scopeKeys = ["processes", "services", "credentials", "writes"];
-    const effectKeys = ["child_process", "service_process", "credential_access", "filesystem", "model_turn", "source_owner"];
-    if (!scope || typeof scope !== "object" || Array.isArray(scope)
-        || Object.keys(scope).some(key => !scopeKeys.includes(key))
-        || scopeKeys.some(key => !Object.hasOwn(scope, key) || typeof scope[key] !== "boolean")
-        || !effects || typeof effects !== "object" || Array.isArray(effects)
-        || effectKeys.some(key => !Object.hasOwn(effects, key)) || Object.keys(effects).some(key => !effectKeys.includes(key))
-        || typeof effects.child_process !== "boolean" || typeof effects.service_process !== "boolean"
-        || !["none", "possible"].includes(effects.credential_access)
-        || !["read_only", "temporary_or_runtime_writes"].includes(effects.filesystem)
-        || !["not_requested", "possible"].includes(effects.model_turn)
-        || typeof effects.source_owner !== "string" || !effects.source_owner.trim()) {
-        throw new AppError("probe_scope_invalid", "Probe effects and permissions require an explicit typed scope", 2, { phase: "probe_admission", effect: "no_effect", help: "harnesses" });
-    }
-    const blocked = [
-        effects.child_process && !scope.processes ? "child_process" : null,
-        effects.service_process && !scope.services ? "service_process" : null,
-        effects.credential_access !== "none" && !scope.credentials ? "credential_access" : null,
-        effects.filesystem !== "read_only" && !scope.writes ? "filesystem_writes" : null,
-        effects.model_turn !== "not_requested" ? "live_authorization_required" : null
-    ].filter(Boolean);
-    if (blocked.length)
-        throw new AppError("probe_effects_not_authorized", "Probe exceeds the selected effect scope", 1, { phase: "probe_admission", effect: "no_effect", blocked_effects: blocked, help: "harnesses" });
-}
-/** The callback is not entered, including synchronous effects, until admission succeeds. */
-export function runScopedProbe(effects, scope, probe) {
-    assertProbeWithinScope(effects, scope);
-    return probe();
-}

package/dist/services/harness-version-probe.js

@@ -1,100 +0,0 @@
-import { spawn } from "node:child_process";
-import path from "node:path";
-import { parse } from "semver";
-import { stopProcessGroup } from "../harness-runtime/lib/managed-daemon.mjs";
-import { AppError } from "../shared/errors.js";
-import { runScopedProbe } from "./harness-probe-effects.js";
-// Even --version runs operator-installed code. Do not infer credential/write
-// isolation from an argument spelling or execute it during static discovery.
-export const versionProbeEffects = Object.freeze({
-    child_process: true, service_process: false, credential_access: "possible",
-    filesystem: "temporary_or_runtime_writes", model_turn: "not_requested",
-    source_owner: "services/harness-version-probe.ts:probeHarnessVersion"
-});
-/** Recognized version fields only; unrelated diagnostic numbers are not facts. */
-export function parseHarnessVersion(harness, stdout) {
-    const normalize = (value) => {
-        const version = parse(value);
-        return version ? `${version.version}${version.build.length ? `+${version.build.join(".")}` : ""}` : null;
-    };
-    if (harness === "grok") {
-        try {
-            const value = JSON.parse(stdout);
-            if (!value || typeof value !== "object" || Array.isArray(value))
-                return null;
-            const reported = value.currentVersion;
-            return typeof reported === "string" ? normalize(reported.trim().split(/\s+/)[0]) : null;
-        }
-        catch {
-            return null;
-        }
-    }
-    const labels = {
-        codex: "codex(?:-cli)?", zcode: "zcode", agy: "(?:agy|antigravity)", opencode: "opencode", droid: "droid"
-    };
-    const pattern = new RegExp(`^(?:${labels[harness]}\\s+)?(v?[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?(?:\\+[A-Za-z0-9.-]+)?)$`, "i");
-    const versions = new Set(stdout.split(/\r?\n/).flatMap(line => {
-        const matched = line.trim().match(pattern)?.[1];
-        const version = matched ? normalize(matched) : null;
-        return version ? [version] : [];
-    }));
-    return versions.size === 1 ? [...versions][0] : null;
-}
-/** Diagnostic only: a version is not protocol, account or flow qualification. */
-export function probeHarnessVersion(input) {
-    const timeoutMs = input.timeoutMs ?? 3000;
-    if (!["codex", "zcode", "agy", "opencode", "grok", "droid"].includes(input.harness)) {
-        throw new AppError("usage", "Unknown harness family", 2, { effect: "no_effect" });
-    }
-    if (!path.isAbsolute(input.executable) || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60_000) {
-        throw new AppError("usage", "Version probe requires an absolute executable and a timeout of 1–60000 ms", 2, { effect: "no_effect" });
-    }
-    return runScopedProbe(versionProbeEffects, input.scope, () => new Promise((resolve, reject) => {
-        const args = input.harness === "grok" ? ["version", "--json"] : ["--version"];
-        const detached = process.platform !== "win32";
-        const child = spawn(input.executable, args, { env: input.env, detached, stdio: ["ignore", "pipe", "pipe"] });
-        let stdout = "";
-        let bytes = 0;
-        let failure;
-        let cleanup;
-        const stop = (code, message) => {
-            failure ??= new AppError(code, message, 1, { phase: "version_probe", effect: "process_dispatched" });
-            cleanup ??= stopProcessGroup(child, 1000, { detached });
-            // Observe immediately; close may arrive after asynchronous cleanup failure.
-            void cleanup.catch(() => { });
-        };
-        const timer = setTimeout(() => stop("probe_timeout", "Version probe exceeded its deadline"), timeoutMs);
-        child.stdout.setEncoding("utf8").on("data", (chunk) => {
-            bytes += Buffer.byteLength(chunk);
-            if (bytes > 64_000)
-                stop("probe_output_limit", "Version probe exceeded its output limit");
-            else
-                stdout += chunk;
-        });
-        child.stderr.on("data", (chunk) => {
-            bytes += chunk.length;
-            if (bytes > 64_000)
-                stop("probe_output_limit", "Version probe exceeded its output limit");
-        });
-        child.on("error", () => { failure ??= new AppError("probe_launch_failed", "Version probe could not start", 1); });
-        child.on("close", (code, signal) => {
-            clearTimeout(timer);
-            void (async () => {
-                try {
-                    await cleanup;
-                    if (failure)
-                        throw failure;
-                    if (code !== 0 || signal)
-                        throw new AppError("probe_failed", "Version probe did not exit successfully", 1);
-                    // Never expose arbitrary subprocess output: it can contain secrets.
-                    const version = parseHarnessVersion(input.harness, stdout);
-                    resolve({ harness: input.harness, version, status: version ? "observed" : "unrecognized",
-                        compatible: "unknown", protocol: "unknown", auth: "unknown", qualified: "unknown" });
-                }
-                catch (error) {
-                    reject(error instanceof AppError ? error : new AppError("probe_cleanup_unconfirmed", "Version probe cleanup could not be confirmed", 1));
-                }
-            })();
-        });
-    }));
-}