@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.138

package/dist/cli/setup.js

@@ -0,0 +1,149 @@
+import { prepareCommandRoute } from "./command-inputs.js";
+import path from "node:path";
+import { parseOutputOptions } from "./output-options.js";
+import { resolveDdFlowHome } from "../storage/paths.js";
+import { readSetupStatus, installAuthenticatedRelease, readRetainedSetupExecutor, hasDeferredSetupOnboarding, readSetupOnboarding, commitSetupOnboarding } from "../services/setup.js";
+import { readTrustedReleaseProducers, readReleaseBundle } from "../services/release-source.js";
+import { createReleaseCompatibility, installedCatalogVersions } from "../services/release-compatibility.js";
+import { getCliVersionReport } from "../services/build-info.js";
+import { readOperatorProfiles, readProfileCreationIntent } from "../services/operator-profiles.js";
+import { onboardExecutor, selectOnboardingExecutor } from "../services/executor-onboarding.js";
+import { askExecutorChoice } from "./executor-onboarding.js";
+import { requiredOption, optionalOption } from "./argument-values.js";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { hybridDigest } from "../services/hybrid-contracts.js";
+import { prepareResponseDestination, writeResponseFile } from "./response-file.js";
+import { readRegistryRelease } from "../services/release-registry.js";
+import { writePreparationError } from "./error-output.js";
+import { publishSetup } from "../harness-runtime/lib/setup-progress.mjs";
+/** Lightweight global diagnostic ingress; never creates a runtime context. */
+export async function runSetupCli(args, env, io = { stdout: process.stdout, stderr: process.stderr, stdin: process.stdin }) {
+    let json = false;
+    try {
+        const output = parseOutputOptions(args);
+        json = output.json;
+        if (output.responseFile)
+            prepareResponseDestination(output.responseFile);
+        const route = prepareCommandRoute(output.args);
+        const humanProgress = !output.json && !output.progressJsonl;
+        const reportHumanProgress = (message) => {
+            // Diagnostic delivery cannot turn a completed installation into failure.
+            try {
+                io.stderr.write(`setup: ${message}\n`);
+            }
+            catch { /* Best-effort human progress only. */ }
+        };
+        const home = resolveDdFlowHome(env);
+        let result;
+        if (route.key === "setup status")
+            result = { ok: true, action: "setup_status", observed_cli: getCliVersionReport().cli, ...readSetupStatus(home) };
+        else if (route.key === "setup" || route.key === "setup update") {
+            const parsed = route.parsed;
+            const source = optionalOption(parsed, "canon-source"), version = optionalOption(parsed, "canon-version");
+            const registryFile = optionalOption(parsed, "release-registry");
+            if (source && (version || registryFile))
+                throw new AppError("usage", "--canon-source is exclusive with --canon-version and --release-registry; see dd-flow setup --help", 2, { effect: "no_effect" });
+            const channel = (optionalOption(parsed, "channel") ?? "stable");
+            const selection = source ? null : readRegistryRelease(registryFile ?? env.DD_FLOW_RELEASE_REGISTRY ?? path.join(home, "release-registry.json"), channel, version);
+            const profile = optionalOption(parsed, "profile"), skip = parsed.options.has("skip-agent-setup");
+            const intentFile = optionalOption(parsed, "save-profile-intent");
+            if (intentFile && skip)
+                throw new AppError("usage", "--save-profile-intent conflicts with --skip-agent-setup", 2, { effect: "no_effect" });
+            let profileCreation = intentFile ? readProfileCreationIntent(intentFile) : undefined;
+            const stdin = io.stdin ?? process.stdin;
+            const nonInteractive = parsed.options.has("non-interactive") || output.json || output.progressJsonl
+                || !stdin.isTTY || !io.stderr.isTTY;
+            const profileFile = optionalOption(parsed, "profile-file");
+            const requestId = requiredOption(parsed, "request-id");
+            const retained = profile === undefined && profileFile === undefined && !intentFile && !skip ? readRetainedSetupExecutor(home, requestId) : null;
+            if (retained?.profileCreation)
+                profileCreation = retained.profileCreation;
+            const choice = { ...(profile !== undefined ? { profileId: profile } : {}),
+                ...(profileFile !== undefined ? { profileFile } : {}),
+                ...(retained?.executor ? { profile: retained.executor } : profileCreation && profile === undefined && profileFile === undefined ? { profile: profileCreation.profile } : {}),
+                skip: skip || retained !== null && retained.executor === null };
+            let deferred = hasDeferredSetupOnboarding(home, requestId);
+            let selected;
+            if (!deferred) {
+                try {
+                    selected = selectOnboardingExecutor(choice, () => readOperatorProfiles(home), { allowSkip: true });
+                }
+                catch (error) {
+                    if (!(error instanceof AppError) || error.code !== "agent_profile_missing" || nonInteractive
+                        || profile !== undefined || profileFile !== undefined || intentFile || skip)
+                        throw error;
+                    deferred = true;
+                }
+            }
+            else if (profile !== undefined || profileFile !== undefined || intentFile || skip) {
+                // Explicit continuation inputs still fail before downloading or replaying.
+                selected = selectOnboardingExecutor(choice, () => readOperatorProfiles(home), { allowSkip: true });
+            }
+            const observedCli = getCliVersionReport().cli;
+            const compatibility = createReleaseCompatibility({ channel,
+                catalogVersions: installedCatalogVersions, routerVersion: observedCli.version });
+            const producers = readTrustedReleaseProducers(requiredOption(parsed, "trust-file"));
+            const bundle = await readReleaseBundle(source ?? selection.envelope_url, producers, compatibility, {
+                ...(selection ? { expectedVersion: selection.version } : {}),
+                ...((output.progressJsonl || humanProgress) ? { onProgress: (progress) => {
+                        if (output.progressJsonl)
+                            io.stdout.write(`${JSON.stringify({ type: "setup_download_progress", request_id: requestId, ...progress })}\n`);
+                        else if (progress.received_bytes === progress.expected_bytes)
+                            reportHumanProgress(`${progress.artifact} archive received (${progress.received_bytes} bytes); integrity validation follows`);
+                    } } : {})
+            });
+            if (selection && bundle.authenticated.manifest.version !== selection.version)
+                throw new AppError("release_registry", "Authenticated release differs from selected registry version", 1, { reason: "selected_version_mismatch", phase: "release_selection", effect: "no_effect", help: "setup" });
+            const installed = installAuthenticatedRelease(home, { requestId, action: route.key === "setup update" ? "update" : "install",
+                envelope: bundle.envelope, trustedProducers: producers, compatibility, canonArchive: bundle.canonArchive, engineArchive: bundle.engineArchive,
+                ...(deferred ? { deferredOnboarding: true } : { executor: selected.profile, ...(profileCreation ? { profileCreation } : {}) }),
+                onCheckpoint: phase => {
+                    publishSetup("dependency_check_completed", `release-setup:${phase}`);
+                    if (output.progressJsonl)
+                        io.stdout.write(`${JSON.stringify({ type: "setup_progress", request_id: requestId, phase })}\n`);
+                    else if (humanProgress)
+                        reportHumanProgress({ prepared: "verified release request retained", canon_cached: "canon cache verified", engine_cached: "engine cache verified",
+                            profiles_saved: "profile settings saved", committed: "installation committed; runtime qualification remains unknown" }[phase]);
+                } });
+            if (humanProgress && installed.replayed)
+                reportHumanProgress("exact request replay verified; retained selection was not reactivated");
+            if (deferred) {
+                const saved = readSetupOnboarding(home, requestId);
+                const explicit = profile !== undefined || profileFile !== undefined || intentFile !== undefined || skip;
+                const deferredChoice = saved && !explicit ? { ...(saved.executor ? { profile: saved.executor } : { skip: true }),
+                    ...(saved.profileCreation ? { profileCreation: saved.profileCreation } : {}) } : choice;
+                try {
+                    selected ??= await onboardExecutor(deferredChoice, () => readOperatorProfiles(home), { allowSkip: true, nonInteractive }, settings => askExecutorChoice(settings, { stdin, stderr: io.stderr }));
+                    const consent = commitSetupOnboarding(home, requestId, { executor: selected.profile,
+                        ...(profileCreation ?? selected.profileCreation ? { profileCreation: profileCreation ?? selected.profileCreation } : {}) });
+                    installed.executor = consent.executor;
+                    if (humanProgress)
+                        reportHumanProgress("executor onboarding committed after installation");
+                }
+                catch (error) {
+                    if (error instanceof AppError) {
+                        error.details.installation = "committed";
+                        error.details.request_id = requestId;
+                        error.details.next_action = "Replay the same setup request to resume executor onboarding; installation remains retained";
+                    }
+                    throw error;
+                }
+            }
+            result = { ...installed, action: route.key === "setup update" ? "setup_update" : "setup_install", observed_cli: observedCli,
+                executor: installed.executor ? { profile_id: installed.executor.id, revision: hybridDigest(installed.executor), readiness: "unknown_requires_qualification" } : { profile_id: null, readiness: "not_configured" },
+                ...readSetupStatus(home) };
+        }
+        else
+            throw new AppError("usage", "Unknown setup command; see dd-flow setup --help", 2, { effect: "no_effect" });
+        io.stdout.write(`${JSON.stringify(writeResponseFile(result, output), null, json ? undefined : 2)}\n`);
+        return 0;
+    }
+    catch (error) {
+        const record = errorRecord(error);
+        writePreparationError(io, args, record);
+        if (!json && error instanceof AppError && error.details.installation === "committed") {
+            io.stderr.write("setup: installation remains committed; replay the same request to resume executor onboarding\n");
+        }
+        return record.exitCode;
+    }
+}

package/dist/cli.js

@@ -1,14 +1,66 @@
 #!/usr/bin/env node
 import { isNativeHookIngress } from "./cli/native-hook-ingress.js";
 import { isRuntimeMaintenanceIngress, runRuntimeMaintenanceIngress } from "./cli/runtime-maintenance-ingress.js";
+import { resolveHelp } from "./cli/help.js";
+import { errorRecord } from "./shared/errors.js";
+import { writePreparationError } from "./cli/error-output.js";
 import { publishSetup } from './harness-runtime/lib/setup-progress.mjs';
 const args = process.argv.slice(2);
-const managedHook = Boolean(process.env.DD_FLOW_CODEX_STATE_DIR) && args.slice(0, 3).join(" ") === "codex hook handle" && !args.includes("--help") && !args.includes("-h");
+let help;
+try {
+    help = resolveHelp(args);
+}
+catch (error) {
+    const record = errorRecord(error);
+    writePreparationError({ stderr: process.stderr }, args, record);
+    process.exit(record.exitCode);
+}
+if (help) {
+    process.stdout.write(`${help.json ? JSON.stringify(help.data) : help.text}\n`);
+    process.exit(0);
+}
+if (args[0] === "completion") {
+    const { runCompletionCli } = await import("./cli/completion-cli.js");
+    process.exit(runCompletionCli(args));
+}
+if (args[0] === "profiles") {
+    const { runOperatorProfilesCli } = await import("./cli/operator-profiles.js");
+    process.exit(runOperatorProfilesCli(args, process.env));
+}
+if (args[0] === "setup") {
+    const { runSetupCli } = await import("./cli/setup.js");
+    process.exit(await runSetupCli(args, process.env));
+}
+if (args[0] === "harnesses") {
+    const { runHarnessesCli } = await import("./cli/harnesses.js");
+    process.exit(await runHarnessesCli(args, process.env));
+}
+if (args[0] === "models") {
+    const { runModelsCli } = await import("./cli/models.js");
+    process.exit(runModelsCli(args));
+}
+if (args[0] === "flow" && ["list", "show"].includes(args[1] ?? "")) {
+    const { runFlowCatalogCli } = await import("./cli/flows.js");
+    process.exit(runFlowCatalogCli(args));
+}
+if (args[0] === "init" || args[0] === "flow" && args[1] === "mb-init") {
+    const { runMemoryInitCli } = await import("./cli/memory-init.js");
+    process.exit(await runMemoryInitCli(args, process.env));
+}
+if (args.slice(0, 3).join(" ") === "runtime storage admit") {
+    const { runMemoryStorageAdmissionCli } = await import("./cli/memory-storage-admission.js");
+    process.exit(runMemoryStorageAdmissionCli(args));
+}
+if (args.slice(0, 3).join(" ") === "runtime flow admit") {
+    const { runMemoryFlowAdmissionCli } = await import("./cli/memory-flow-admission.js");
+    process.exit(await runMemoryFlowAdmissionCli(args));
+}
+const managedHook = Boolean(process.env.DD_FLOW_CODEX_STATE_DIR) && args.slice(0, 3).join(" ") === "codex hook handle";
 const exitCode = isRuntimeMaintenanceIngress(args, process.env)
     ? await runRuntimeMaintenanceIngress(args)
     : managedHook
         ? await (await import("./cli/hook-ingress.js")).runHookIngress(args)
-        : isNativeHookIngress(args) && !args.includes("--help") && !args.includes("-h")
+        : isNativeHookIngress(args)
             ? await (await import("./cli/native-hook-ingress.js")).runNativeHookIngress(args)
             : await (async () => {
                 publishSetup('ingress_entered');

package/dist/domain/stage-handler-identities.js

@@ -0,0 +1,20 @@
+/** Engine-owned identities shared by inspection and executable registration.
+ * Keep this module dependency-free: catalog inspection must not load handlers.
+ */
+export const sdlcHandlerIdentities = Object.freeze({
+    specify: Object.freeze({ stage: "specify", entryId: "sdlc-specify-entry", finishId: "sdlc-specify-finish" }),
+    protocolize: Object.freeze({ stage: "protocolize", entryId: "sdlc-protocolize-entry", finishId: "sdlc-protocolize-finish" }),
+    plan: Object.freeze({ stage: "plan", entryId: "sdlc-plan-entry", finishId: "sdlc-plan-finish" }),
+    "plan-review": Object.freeze({ stage: "plan-review", entryId: "sdlc-plan-review-entry", finishId: "sdlc-plan-review-finish" }),
+    code: Object.freeze({ stage: "code", entryId: "sdlc-code-entry", finishId: "sdlc-code-finish" }),
+    "code-review": Object.freeze({ stage: "code-review", entryId: "sdlc-code-review-entry", finishId: "sdlc-code-review-finish" }),
+    merge: Object.freeze({ stage: "merge", entryId: "sdlc-merge-entry", finishId: "sdlc-merge-finish" })
+});
+export const memoryInitHandlerIdentities = Object.freeze({
+    preflight: Object.freeze({ stage: "preflight", entryId: "memory-stage-entry", finishId: "memory-stage-finish" }),
+    discover: Object.freeze({ stage: "discover", entryId: "memory-stage-entry", finishId: "memory-stage-finish" }),
+    compose: Object.freeze({ stage: "compose", entryId: "memory-stage-entry", finishId: "memory-stage-finish" }),
+    verify: Object.freeze({ stage: "verify", entryId: "memory-stage-entry", finishId: "memory-stage-finish" }),
+    review: Object.freeze({ stage: "review", entryId: "memory-stage-entry", finishId: "memory-stage-finish" }),
+    finish: Object.freeze({ stage: "finish", entryId: "memory-stage-entry", finishId: "memory-stage-finish" })
+});

package/dist/harness-runtime/lib/daemon-operations.d.mts

@@ -0,0 +1 @@
+export function inspectDaemonOperation(root: string, id: string): Promise<Record<string, unknown>>;

package/dist/harness-runtime/lib/daemon-operations.mjs

@@ -8,6 +8,7 @@ import { errorRecord, isObservationLoss, isProvenShellCorrection, reportedError
 import { assertDaemonOwnership, budgetObservationScope, releaseBudgetObservation, completeBudgetOperation } from "./managed-daemon.mjs";
 import { readModelObservations, modelAttribution } from "./model-observations.mjs";
 import { publishOperationProgress, publishOperationWaiting, withOperationProgress } from './operation-progress.mjs';
+import { prepareDaemonRequest } from "./native-request-proof.mjs";
 
 const productive = new Set(["session.create", "session.prompt", "session.start", "session.fork", "session.resume"]);
 const controls = new Map();
@@ -301,7 +302,7 @@ export async function durableDaemonStart(options, action) {
   // scope can reuse this exact adapter launch after retiring the old daemon.
   const launch = { schema_id: "dd-flow/native-launch@1", executable: options.entryPath ?? null, args: process.argv.slice(2), cwd: process.cwd(), runtime_owner: process.env.DD_FLOW_RUNTIME_OWNER ?? null,
     env: Object.fromEntries(["CODEX_HOME", "DD_FLOW_CONFIG_HOME", "DD_FLOW_HOME", "DD_FLOW_BIN", "DD_FLOW_RESOURCE_HOME"].map(key => [key, process.env[key] ?? null])) };
-  const request = { id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation: "daemon.start", params: { ...options, runtimeOwner: process.env.DD_FLOW_RUNTIME_OWNER ?? null, resourceHome: process.env.DD_FLOW_RESOURCE_HOME ?? null, launch } };
+  const request = prepareDaemonRequest({ id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation: "daemon.start", params: { ...options, runtimeOwner: process.env.DD_FLOW_RUNTIME_OWNER ?? null, resourceHome: process.env.DD_FLOW_RESOURCE_HOME ?? null, launch } });
   return await journalDispatch(root, request, () => action(options));
 }
 
@@ -314,13 +315,13 @@ async function journalDispatch(root, request, action) {
   const daemon = await read(path.join(root, "daemon.json"));
   const startup = request.operation === "daemon.start";
   const daemonId = daemon?.daemon_id ?? daemon?.config?.daemonId ?? null;
-  await writeJsonAtomic(temporary, { schema_id: "dd-flow/daemon-operation@1", operation_id: request.id, operation: request.operation, session_id: request.params?.sessionId ?? null, daemon_id: startup ? null : daemonId, owner_id: daemon?.config?.runtime_owner?.owner_id ?? null, generation: dispatchGenerations.get(root) ?? 0, ...(startup ? { predecessor_daemon_id: daemonId, launch: request.params?.launch } : {}), params_sha256: fingerprint, requested_at: new Date().toISOString() });
+  await writeJsonAtomic(temporary, { schema_id: "dd-flow/daemon-operation@1", operation_id: request.id, operation: request.operation, session_id: request.params?.sessionId ?? null, daemon_id: startup ? null : daemonId, owner_id: daemon?.config?.runtime_owner?.owner_id ?? null, generation: dispatchGenerations.get(root) ?? 0, ...(startup ? { predecessor_daemon_id: daemonId, launch: request.params?.launch } : {}), params_sha256: fingerprint, ...(request.invocation_sha256 ? { invocation_sha256: request.invocation_sha256 } : {}), requested_at: new Date().toISOString() });
   try {
     await link(temporary, path.join(directory, "requested.json"));
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
     const saved = await inspectDaemonOperation(root, request.id);
-    if (saved.params_sha256 !== fingerprint) throw Object.assign(new Error("operation id was reused with different parameters"), { code: "operation_conflict", details: { operation_id: request.id } });
+    if (saved.params_sha256 !== fingerprint || (saved.invocation_sha256 ?? null) !== (request.invocation_sha256 ?? null)) throw Object.assign(new Error("operation id was reused with different parameters or invocation"), { code: "operation_conflict", details: { operation_id: request.id } });
     if (saved.state === "completed") return saved.result;
     if (["failed", "interrupted"].includes(saved.state)) throw reportedError(saved.error, "provider operation failed");
     throw Object.assign(new Error("provider operation has no confirmed terminal result; inspect the existing operation instead of resending it"), { code: "operation_observation_lost", details: { operation_id: request.id, receipt_directory: directory } });

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -1,6 +1,8 @@
+import { managedFlowEnv } from './managed-flow-env.mjs';
 import { SETUP_STARTUP_MS, startupObserver, observationDetails } from './setup-progress.mjs';
 import { callDaemonObserved } from './daemon-observation.mjs';
 import { operationProgressReporter } from './operation-progress.mjs';
+import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mjs";
 import { errorRecord } from "./operation-errors.mjs";
 import { ToolObservations, agyToolObservation, agyTranscriptObservations } from "./tool-observations.mjs";
@@ -58,7 +60,7 @@ async function writeJson(file, value) { const temporary = `${file}.${process.pid
 async function readState(dir) { try { return JSON.parse(await readFile(locations(dir).state, "utf8")); } catch (error) { if (error.code === "ENOENT") return null; throw error; } }
 async function removeSocket(paths) { try { if (!(await lstat(paths.socket)).isSocket()) throw new DaemonError("unsafe_socket", "refusing to replace a non-socket daemon path"); await unlink(paths.socket); } catch (error) { if (error.code !== "ENOENT") throw error; } }
 const shell = value => `'${String(value).replaceAll("'", `'"'"'`)}'`;
-export function sanitizedEnv(config) { const env = { ...process.env, TMPDIR: config.temporary, DD_AGY_HOOK_NODE: process.execPath, DD_AGY_HOOK_ENTRY: config.entryPath, DD_AGY_STATE_DIR: config.stateDir, DD_AGY_DAEMON_ID: config.daemonId }; for (const key of ["GEMINI_API_KEY","GOOGLE_API_KEY","ANTHROPIC_API_KEY","OPENAI_API_KEY","DD_FLOW_DAEMON_ID"]) env[key] = undefined; if (config.ddFlowHome && config.daemonId) env.DD_FLOW_DAEMON_ID = config.daemonId; return env; }
+export function sanitizedEnv(config) { const env = { ...process.env, TMPDIR: config.temporary, DD_AGY_HOOK_NODE: process.execPath, DD_AGY_HOOK_ENTRY: config.entryPath, DD_AGY_STATE_DIR: config.stateDir, DD_AGY_DAEMON_ID: config.daemonId }; for (const key of ["GEMINI_API_KEY","GOOGLE_API_KEY","ANTHROPIC_API_KEY","OPENAI_API_KEY"]) env[key] = undefined; return { ...env, ...managedFlowEnv(config) }; }
 const errorPayload = errorRecord;
 async function forwardUsage(config, sessionId, result, tools, descendants) {
   if (!config.ddFlowBin || !config.projectRoot) return;
@@ -164,7 +166,7 @@ export async function qualifyAgyHooks(projectRoot, { stateDir = null, install =
 }
 
 export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000, requestId = null) {
-  const request = { schema_id: REQUEST_SCHEMA, id: requestId ?? process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params };
+  const request = prepareDaemonRequest({ schema_id: REQUEST_SCHEMA, id: requestId ?? process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params });
   return await callDaemonObserved({ stateDir, socket: locations(stateDir).socket, request, responseSchema: RESPONSE_SCHEMA, harness: 'agy', timeoutMs });
 }
 

package/dist/harness-runtime/lib/dd-codex-daemon.mjs

@@ -1,6 +1,8 @@
+import { managedFlowEnv } from './managed-flow-env.mjs';
 import { SETUP_STARTUP_MS, startupObserver, observationDetails } from './setup-progress.mjs';
 import { callDaemonObserved } from './daemon-observation.mjs';
 import { admitNativeRequestBuffer } from "./native-streams.mjs";
+import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, open, readFile, rename, unlink, writeFile } from "node:fs/promises";
@@ -12,9 +14,11 @@ import path from "node:path";
 import { spawn } from "node:child_process";
 import { waitForSettlement } from "./session-settlement.mjs";
 import { errorRecord } from "./operation-errors.mjs";
-import { CodexBridge, cancelSessionWithBridge, createSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge, startSessionWithBridge } from "./dd-codex.mjs";
+import { CODEX_REQUEST_TIMEOUT_MS, LATE_RESPONSE_GRACE_MS, CodexBridge, cancelSessionWithBridge, createSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge, startSessionWithBridge } from "./dd-codex.mjs";
 import { assertDaemonOwnership, prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
 
+export function codexBridgeEnv(config, daemonId) { return { ...config.env, ...managedFlowEnv(config, daemonId) }; }
+
 const requestSchema = "dd-codex/daemon-request@1";
 const responseSchema = "dd-codex/daemon-response@1";
 const stateSchema = "dd-codex/daemon-state@1";
@@ -72,13 +76,15 @@ export async function cancelCodexTree(bridge, options, { remember = () => {}, ac
   return { harness: "codex-desktop", provider_session_id: options.sessionId, adapter_session_id: options.sessionId, cancelled: true, settled: true, tree_session_ids: [...sessions], cleanup_errors: settlement.cleanup_errors, tree_observations: settlement.observations.map(item => ({ provider_session_id: item.provider_session_id, status: item.status, settled: item.settled })) };
 }
 
-export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000) {
-  const request = { schema_id: requestSchema, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params };
+export async function callDaemon(stateDir, operation, params = {}, timeoutMs = operation === "session.create" ? params.timeoutMs ?? CODEX_REQUEST_TIMEOUT_MS + LATE_RESPONSE_GRACE_MS : 30_000) {
+  const request = prepareDaemonRequest({ schema_id: requestSchema, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params });
   return await callDaemonObserved({ stateDir, socket: locations(stateDir).socket, request, responseSchema: responseSchema, harness: 'codex', timeoutMs });
 }
 
 export async function startDaemon(options) {
-  const paths = locations(options.stateDir); const cwd = absolute(options.cwd, "--cwd"); const config = { cwd, journal: absolute(options.journal, "--journal"), bin: options.bin ?? null, ddFlowBin: options.ddFlowBin ? absolute(options.ddFlowBin, "--dd-flow-bin") : null, ddFlowHome: options.ddFlowHome ? absolute(options.ddFlowHome, "--dd-flow-home") : null, projectRoot: options.projectRoot ? absolute(options.projectRoot, "--project-root") : cwd, resourceHome: process.env.DD_FLOW_RESOURCE_HOME ? absolute(process.env.DD_FLOW_RESOURCE_HOME, "DD_FLOW_RESOURCE_HOME") : null, env: options.ddFlowHome ? { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home"), ...(options.ddFlowBin ? { DD_FLOW_BIN: absolute(options.ddFlowBin, "--dd-flow-bin") } : {}) } : {} };
+  if (!options.noFlow && Boolean(options.ddFlowHome) !== Boolean(options.ddFlowBin)) throw Object.assign(new Error("--dd-flow-home and --dd-flow-bin must be provided together"), { code: "flow_context_incomplete" });
+  if (options.noFlow) options = { ...options, ddFlowHome: undefined, ddFlowBin: undefined };
+  const paths = locations(options.stateDir); const cwd = absolute(options.cwd, "--cwd"); const config = { cwd, journal: absolute(options.journal, "--journal"), bin: options.bin ?? null, ddFlowBin: options.ddFlowBin ? absolute(options.ddFlowBin, "--dd-flow-bin") : null, ddFlowHome: options.ddFlowHome ? absolute(options.ddFlowHome, "--dd-flow-home") : null, projectRoot: options.projectRoot ? absolute(options.projectRoot, "--project-root") : cwd, resourceHome: !options.noFlow && process.env.DD_FLOW_RESOURCE_HOME ? absolute(process.env.DD_FLOW_RESOURCE_HOME, "DD_FLOW_RESOURCE_HOME") : null, env: options.ddFlowHome ? { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home"), ...(options.ddFlowBin ? { DD_FLOW_BIN: absolute(options.ddFlowBin, "--dd-flow-bin") } : {}) } : {} };
   await prepareRuntimeOwner(config, paths.dir);
   await mkdir(paths.dir, { recursive: true, mode: 0o700 }); await chmod(paths.dir, 0o700);
   let previous = await readState(paths.state); assertDaemonRestartable(previous);
@@ -95,7 +101,7 @@ export async function stopDaemon(options) { const timeoutMs = options.timeoutMs
 
 export async function serveDaemon(stateDir) {
   const paths = locations(stateDir); const state = await readState(paths.state); if (!state || state.schema_id !== stateSchema) throw Object.assign(new Error("daemon state missing"), { code: "daemon_state_missing" });
-  const bridge = new CodexBridge({ ...state.config, env: { ...state.config.env, CODEX_HOME: process.env.CODEX_HOME, DD_FLOW_DAEMON_ID: state.daemon_id, DD_FLOW_CODEX_STATE_DIR: paths.dir } }); await startManagedBridge({ config: state.config, state, bridge, kind: "codex-provider", publish: snapshot => writeState(paths.state, snapshot) }); const sessions = new Set(state.sessions ?? []); let active = null; let server; let persist = Promise.resolve();
+  const bridge = new CodexBridge({ ...state.config, env: { ...codexBridgeEnv(state.config, state.daemon_id), CODEX_HOME: process.env.CODEX_HOME, DD_FLOW_CODEX_STATE_DIR: paths.dir } }); await startManagedBridge({ config: state.config, state, bridge, kind: "codex-provider", publish: snapshot => writeState(paths.state, snapshot) }); const sessions = new Set(state.sessions ?? []); let active = null; let server; let persist = Promise.resolve();
   scheduleDaemonProcessHeartbeat(state.config, state.resource_process);
   const save = (patch = {}) => { Object.assign(state, patch, { pid: process.pid, updated_at: new Date().toISOString(), sessions: [...sessions] }); const snapshot = structuredClone(state); persist = persist.catch(() => {}).then(() => writeState(paths.state, snapshot)); return persist; };
   const dispatch = async (operation, params, operationId) => {

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -13,7 +13,8 @@ import { readNativeLines, streamNativeDiagnostics, nativeObservationError } from
 import { operationProgressReporter } from "./operation-progress.mjs";
 import { publishSetup } from './setup-progress.mjs';
 
-const LATE_RESPONSE_GRACE_MS = 5_000;
+export const CODEX_REQUEST_TIMEOUT_MS = 120_000;
+export const LATE_RESPONSE_GRACE_MS = 5_000;
 const CODEX_SESSION_CONFIG = Object.freeze({
   bypass_hook_trust: true,
   "features.plugins": false,
@@ -409,7 +410,7 @@ export class CodexBridge {
     this.send({ jsonrpc: "2.0", id: message.id, error });
   }
 
-  request(method, params = {}, timeoutMs = this.options.timeoutMs ?? 120_000) {
+  request(method, params = {}, timeoutMs = this.options.timeoutMs ?? CODEX_REQUEST_TIMEOUT_MS) {
     const turnFloor = method === "turn/start" ? new Set([this.currentTurns?.get(params.threadId), ...[...this.turns].filter(([, value]) => value.threadId === params.threadId).map(([id]) => id)].filter(Boolean)) : null;
     if (method === "turn/start" && params.threadId) {
       // Only one productive root Turn is admitted by the daemon fence. Drop
@@ -576,7 +577,8 @@ export async function promptSessionWithBridge(bridge, options) {
   const started = await bridge.request("turn/start", { threadId: sessionId, input: [{ type: "text", text: prompt }], cwd, model: options.model ?? null, effort: options.reasoning ?? null, approvalPolicy: "never", sandboxPolicy: { type: "dangerFullAccess" } }, 30_000);
   const turn = started?.turn ?? started; const turnId = turn?.id ?? null;
   let completed;
-  try { completed = await waitForTurn(bridge, sessionId, turnId, options.livenessTimeoutMs ?? options.timeoutMs ?? 1_800_000, options, cwd, clock); }
+  try { completed = isTerminalTurnStatus(turn?.status) ? terminalTurn({ turn }, sessionId, turnId, bridge)
+    : await waitForTurn(bridge, sessionId, turnId, options.livenessTimeoutMs ?? options.timeoutMs ?? 1_800_000, options, cwd, clock, turn?.status); }
   catch (error) {
     const retained = bridge.turns?.get(turnId);
     if (retained?.value?.threadId === sessionId && retained.value.turn?.id === turnId && retained.value.turn.status === "completed") {
@@ -624,11 +626,20 @@ async function ensureThreadLoaded(bridge, sessionId, options, cwd) {
   }, 30_000);
 }
 
-async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, clock = new ObservationClock({ timeoutMs, onGap: gap => bridge.journal?.write("observation_gap", { ...gap, session_id: sessionId, turn_id: turnId }) })) {
+async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, clock = new ObservationClock({ timeoutMs, onGap: gap => bridge.journal?.write("observation_gap", { ...gap, session_id: sessionId, turn_id: turnId }) }), startStatus) {
   // app-server can briefly expose the new Turn as `interrupted` between the
   // turn/start response and its turn/started notification. Give that snapshot
   // one event-loop grace window before treating failure as authoritative.
   const failureNotBefore = Date.now() + 1_000;
+  const reconcileSnapshot = async (status, threadStatus) => {
+    if (!isAuthoritativeTerminal(bridge, turnId, status, threadStatus, failureNotBefore)) return false;
+    if (status === "completed" || startStatus !== "inProgress" || bridge.turns.get(turnId)?.status === "completed") return true;
+    // A provisional failure can contradict the accepted start before its
+    // delayed notification arrives. Recheck this Turn, never start another.
+    const current = await readTurn(bridge, sessionId, turnId, true);
+    return bridge.turns.get(turnId)?.status === "completed" || current?.turn?.status === status
+      && isAuthoritativeTerminal(bridge, turnId, status, current.threadStatus, failureNotBefore);
+  };
   let nextStoredReadAt = Date.now();
   while (true) {
     bridge.assertHookHealthy?.(sessionId);
@@ -636,20 +647,20 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, c
     const expired = clock.sample(bridge.activityObservations?.get(sessionId) ?? bridge.activity?.get(sessionId));
     if (expired || Date.now() >= nextStoredReadAt) {
       const stored = await readTurn(bridge, sessionId, turnId, false);
-      if (stored?.turn && isAuthoritativeTerminal(bridge, turnId, stored.turn.status, stored.threadStatus, failureNotBefore)) return terminalTurn({ turn: stored.turn }, sessionId, turnId, bridge);
+      if (stored?.turn && await reconcileSnapshot(stored.turn.status, stored.threadStatus)) return terminalTurn({ turn: stored.turn }, sessionId, turnId, bridge);
       // A loaded app-server can retain a stale `active` Thread state after a
       // provider-side interruption. The persisted turn page is independent of
       // that live subscription and is the compact authority for its terminal
       // status; unlike `includeTurns`, it never hydrates the whole history.
       const persisted = await readPersistedTurn(bridge, sessionId, turnId);
-      if (persisted && isAuthoritativeTerminal(bridge, turnId, persisted.status, stored?.threadStatus, failureNotBefore)) return terminalTurn({ turn: persisted }, sessionId, turnId, bridge);
+      if (persisted && await reconcileSnapshot(persisted.status, stored?.threadStatus)) return terminalTurn({ turn: persisted }, sessionId, turnId, bridge);
       // Desktop may unload an idle Thread immediately after an interrupted
       // Turn. Reload it once before polling again: otherwise the compact
       // status remains `notLoaded` forever and hides the terminal Turn.
       if (stored?.threadStatus === "notLoaded") {
         await ensureThreadLoaded(bridge, sessionId, options, cwd);
         const hydrated = await readTurn(bridge, sessionId, turnId, true);
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
+        if (hydrated?.turn && await reconcileSnapshot(hydrated.turn.status, hydrated.threadStatus)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
       }
       // Some app-server versions correctly omit turns for a compact read.
       // Once the thread is idle, hydrate exactly once to recover the terminal
@@ -660,7 +671,7 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, c
         // an inProgress Turn after emitting the final agent message; treating
         // that stale Turn as terminal incorrectly aborts an otherwise usable
         // worker session.
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
+        if (hydrated?.turn && await reconcileSnapshot(hydrated.turn.status, hydrated.threadStatus)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
       }
       // Some app-server builds emit a final agent message but omit both the
       // terminal event and the compact turn record. Wait briefly, hydrate once,
@@ -671,8 +682,9 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, c
       // app-server reports the Thread idle.
       if (final?.turnId === turnId && stored?.threadStatus === "idle" && Date.now() - final.completedAt >= 1_000) {
         const hydrated = await readTurn(bridge, sessionId, turnId, true);
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
-        return terminalTurn({ turn: { id: turnId, status: "completed", synthetic: true, final_message: final.item } }, sessionId, turnId, bridge);
+        if (hydrated?.turn && await reconcileSnapshot(hydrated.turn.status, hydrated.threadStatus)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
+        if (hydrated?.threadStatus === "idle" && !isTerminalTurnStatus(hydrated.turn?.status))
+          return terminalTurn({ turn: { id: turnId, status: "completed", synthetic: true, final_message: final.item } }, sessionId, turnId, bridge);
       }
       nextStoredReadAt = Date.now() < failureNotBefore ? failureNotBefore : Date.now() + 15_000;
     }

package/dist/harness-runtime/lib/dd-droid-daemon.mjs

@@ -1,6 +1,7 @@
 import { SETUP_STARTUP_MS, startupObserver, observationDetails } from './setup-progress.mjs';
 import { callDaemonObserved } from './daemon-observation.mjs';
 import { admitNativeRequestBuffer, nativeObservationError } from "./native-streams.mjs";
+import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, open, unlink, realpath } from "node:fs/promises";
 import { spawn } from "node:child_process";
@@ -16,7 +17,7 @@ import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmD
 const REQUEST = "dd-droid/daemon-request@1", RESPONSE = "dd-droid/daemon-response@1";
 async function removeSocket(file) { try { if (!(await lstat(file)).isSocket()) throw new DroidError("unsafe_socket", "Refusing to replace non-socket daemon path"); await unlink(file); } catch (error) { if (error.code !== "ENOENT") throw error; } }
 export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000, operationId = process.env.DD_EVAL_OPERATION_ID ?? randomUUID()) {
-  const request = { schema_id: REQUEST, id: operationId, operation, params };
+  const request = prepareDaemonRequest({ schema_id: REQUEST, id: operationId, operation, params });
   return await callDaemonObserved({ stateDir, socket: droidPaths(stateDir).socket, request, responseSchema: RESPONSE, harness: 'droid', timeoutMs });
 }
 function sameConfig(a, b) { return ["cwd", "bin", "model", "reasoning", "mode", "provider", "ddFlowBin", "ddFlowHome", "resourceHome", "projectRoot", "noFlow","inactivityMs"].every(key => a?.[key] === b[key]); }

package/dist/harness-runtime/lib/dd-droid.mjs

@@ -1,3 +1,4 @@
+import { managedFlowEnv } from './managed-flow-env.mjs';
 import { processSnapshot } from "./process-snapshot.mjs";
 import { ToolObservations, droidToolObservations, journalToolObservations } from "./tool-observations.mjs";
 export { processSnapshot } from "./process-snapshot.mjs";
@@ -44,7 +45,7 @@ export function droidEnvironment(config) {
   // This adapter deliberately uses the operator's existing Factory login.
   // Undefined is a tombstone: downstream env overlays must not resurrect keys.
   for (const key of Object.keys(env)) if (key.endsWith("API_KEY")) env[key] = undefined;
-  return env;
+  return { ...env, ...managedFlowEnv(config) };
 }
 export async function prepareDroidHome(config) {
   const paths = droidPaths(config.stateDir);

package/dist/harness-runtime/lib/dd-grok-daemon.mjs

@@ -1,7 +1,9 @@
+import { managedFlowEnv } from './managed-flow-env.mjs';
 import { SETUP_STARTUP_MS, startupObserver, observationDetails } from './setup-progress.mjs';
 import { callDaemonObserved } from './daemon-observation.mjs';
 import { canonicalNativeOperation } from './adapter-timeouts.mjs';
 import { admitNativeRequestBuffer } from "./native-streams.mjs";
+import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mjs";
 import { errorRecord, isProvenShellCorrection } from "./operation-errors.mjs";
 import { ToolObservations, acpToolObservation } from "./tool-observations.mjs";
@@ -39,7 +41,7 @@ const errorPayload = errorRecord;
 function shellQuote(value) { return `'${String(value).replace(/'/g, "'\\''")}'`; }
 
 function executable(command, args = []) { const resolved = command ?? process.env.DD_GROK_BIN ?? "grok"; return /\.[cm]?js$/.test(resolved) ? { command: process.execPath, args: [resolved, ...args] } : { command: resolved, args }; }
-export function isolatedEnv(config) { const env = { ...process.env, HOME: config.grokHome, GROK_HOME: config.grokHome, ...(config.ddFlowHome ? { DD_FLOW_HOME: config.ddFlowHome } : {}), ...(config.resourceHome ? { DD_FLOW_RESOURCE_HOME: config.resourceHome } : {}), ...(config.authPath ? { GROK_AUTH_PATH: config.authPath } : {}) }; env.DD_FLOW_DAEMON_ID = undefined; if (config.ddFlowHome && config.daemonId) env.DD_FLOW_DAEMON_ID = config.daemonId; return env; }
+export function isolatedEnv(config) { return { ...process.env, HOME: config.grokHome, GROK_HOME: config.grokHome, ...(config.authPath ? { GROK_AUTH_PATH: config.authPath } : {}), ...managedFlowEnv(config) }; }
 function within(candidate, root) { const resolved = path.resolve(candidate); const parent = path.resolve(root); return resolved === parent || resolved.startsWith(`${parent}${path.sep}`); }
 
 async function writeIsolatedConfig(paths) {
@@ -151,7 +153,7 @@ async function materializeSessionArchive(paths, archiveDir) {
 
 export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000) {
   operation = canonicalNativeOperation('grok', operation);
-  const request = { schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params };
+  const request = prepareDaemonRequest({ schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params });
   return await callDaemonObserved({ stateDir, socket: locations(stateDir).socket, request, responseSchema: RESPONSE_SCHEMA, harness: 'grok', timeoutMs });
 }
 

package/dist/harness-runtime/lib/dd-opencode-daemon.mjs

@@ -1,6 +1,8 @@
+import { managedFlowEnv } from './managed-flow-env.mjs';
 import { SETUP_STARTUP_MS, startupObserver, observationDetails } from './setup-progress.mjs';
 import { callDaemonObserved } from './daemon-observation.mjs';
 import { admitNativeRequestBuffer } from "./native-streams.mjs";
+import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mjs";
 import { openCodeToolObservation, journalToolObservations } from "./tool-observations.mjs";
 import { ObservationClock } from "./observation-clock.mjs";
@@ -40,13 +42,13 @@ const writeJson = writeJsonAtomic;
 async function readState(dir) { try { return JSON.parse(await readFile(locations(dir).state, "utf8")); } catch (error) { if (error.code === "ENOENT") return null; throw error; } }
 async function removeSocket(paths) { try { if (!(await lstat(paths.socket)).isSocket()) throw new DaemonError("unsafe_socket", "refusing to replace non-socket daemon path"); await unlink(paths.socket); } catch (error) { if (error.code !== "ENOENT") throw error; } }
 function executable(bin, args = []) { return /\.[cm]?js$/.test(bin) ? { command: process.execPath, args: [bin, ...args] } : { command: bin, args }; }
-function isolatedEnv(config) {
+export function isolatedEnv(config) {
   const env = { ...process.env };
   for (const name of ["OPENCODE_CONFIG", "OPENCODE_CONFIG_CONTENT", "OPENCODE_PASSWORD", "OPENCODE_PTY_HANDOFF", "OPENCODE_SERVER", "OPENCODE_SIMULATE"]) delete env[name];
   return { ...env, XDG_DATA_HOME: config.dataHome, XDG_CONFIG_HOME: config.configHome, XDG_CACHE_HOME: config.cacheHome,
     XDG_STATE_HOME: config.stateHome, OPENCODE_DB: config.database, OPENCODE_CONFIG_DIR: config.adapterDir,
     OPENCODE_CONFIG_PROJECT_DISABLE: "1", OPENCODE_SERVER_PASSWORD: config.password,
-    ...(config.ddFlowHome ? { DD_FLOW_HOME: config.ddFlowHome } : {}), ...(config.resourceHome ? { DD_FLOW_RESOURCE_HOME: config.resourceHome } : {}),
+    ...managedFlowEnv(config),
     DD_OPENCODE_PLUGIN_SHA256: config.pluginSha256 ?? "none" };
 }
 export async function run(bin, args, config, options = {}) {
@@ -63,7 +65,7 @@ const errorPayload = errorRecord;
 
 async function writePlugin(paths, config) {
   const directory = path.join(paths.config, "opencode", "plugins"); await mkdir(directory, { recursive: true, mode: 0o700 });
-  const source = `import { makeOpenCodePlugin } from ${JSON.stringify(new URL("./opencode-plugin.mjs", import.meta.url).href)};\nexport default makeOpenCodePlugin(${JSON.stringify({ daemonId: config.daemonId, version: config.version, ddFlowBin: config.ddFlowBin, nodeBin: process.execPath, ddFlowHome: config.ddFlowHome, projectRoot: config.projectRoot })});\n`;
+  const source = `import { makeOpenCodePlugin } from ${JSON.stringify(new URL("./opencode-plugin.mjs", import.meta.url).href)};\nexport default makeOpenCodePlugin(${JSON.stringify({ daemonId: config.daemonId, version: config.version, ddFlowBin: config.ddFlowBin, nodeBin: process.execPath, ddFlowHome: config.ddFlowHome, projectRoot: config.projectRoot, resourceHome: config.resourceHome })});\n`;
   const checksum = createHash("sha256").update(source).digest("hex"); await writeFile(path.join(directory, "dd-flow.js"), source, { mode: 0o600 }); return checksum;
 }
 async function prepare(paths, config, authSource) {
@@ -136,7 +138,7 @@ async function importArchive(config, client) {
 export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000) {
   const state = await readState(stateDir);
   if (state && state.schema_id !== STATE_SCHEMA) throw new DaemonError("legacy_opencode_state", "Use archive/opencode-v1-final-beta134 for v1 states; the v2 adapter cannot dispatch to a legacy daemon", false, { effect: "no_effect" });
-  const request = { schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params };
+  const request = prepareDaemonRequest({ schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params });
   return await callDaemonObserved({ stateDir, socket: locations(stateDir).socket, request, responseSchema: RESPONSE_SCHEMA, harness: 'opencode', timeoutMs });
 }
 function sameConfig(state, config) { return ["cwd","journal","bin","provider","model","variant","agent","projectRoot","ddFlowBin","ddFlowHome","sessionArchive","resourceHome","noFlow","configSource","authSource"].every(key => (state.config?.[key] ?? null) === (config[key] ?? null)); }