@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.138

package/dist/services/workspace-files.js

@@ -6,7 +6,7 @@ import { AppError } from "../shared/errors.js";
 import { agyWorkspaceHooks } from "../harness-runtime/lib/agy-hooks.mjs";
 /** Local environment/credential files are never an exported reviewer or EVAL input. */
 export function localEnvironmentAllowed(source) {
-    const name = path.basename(source);
+    const name = path.basename(source).normalize("NFC").toLowerCase();
     return name === ".env.example" || (name !== ".env" && !name.startsWith(".env."));
 }
 /** A damaged/inaccessible repository is not an intentional gitless workspace. */

package/dist/storage/database.js

@@ -27,6 +27,18 @@ function closeAfterOpenFailure(db, error) {
 const require = createRequire(import.meta.url);
 const { DatabaseSync } = require("node:sqlite");
 const resourceDatabases = new Map();
+const resourceDatabaseIdentities = new WeakMap();
+function assertResourceDatabaseIdentity(database) {
+    const expected = resourceDatabaseIdentities.get(database);
+    let actual;
+    try {
+        actual = fs.lstatSync(database.path);
+    }
+    catch { /* Refuse missing targets without reopening or initializing. */ }
+    if (!expected || !actual?.isFile() || actual.dev !== expected.dev || actual.ino !== expected.ino) {
+        throw new AppError("resource_storage_changed", "The cached resource registry no longer matches its physical database; close the owned connection before retrying", 1);
+    }
+}
 const publicationScopes = [];
 /** Defer committed cross-store projections until the surrounding writer exits. */
 export function withDeferredPublications(operation) {
@@ -334,6 +346,31 @@ export function ensureWorkLaunchStorage(db) {
     CREATE INDEX IF NOT EXISTS idx_work_launches_status ON work_launches(status, updated_at DESC);
   `);
 }
+/** Exclusive fresh creation; never reinterpret an empty/old database as fresh. */
+function claimNewStore(file) {
+    for (const candidate of [file, `${file}-wal`, `${file}-shm`, `${file}-journal`]) {
+        try {
+            fs.lstatSync(candidate);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        throw new AppError("store_already_exists", "Fresh store creation refuses existing database or sidecar files", 1, { effect: "no_effect", path: candidate });
+    }
+    ensureDir(path.dirname(file));
+    let fd;
+    try {
+        fd = fs.openSync(file, "wx", 0o600);
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            throw new AppError("store_already_exists", "Another owner already created this store", 1, { effect: "no_effect", path: file });
+        throw error;
+    }
+    fs.closeSync(fd);
+}
 export function getDatabase(ddFlowHome, mode = "initialize", importPermitId, hookDeadlineAt) {
     channel("dd-flow.sqlite.ingress").publish({ phase: "store_open", store_kind: "run" });
     if (hookDeadlineAt !== undefined && !Number.isSafeInteger(hookDeadlineAt))
@@ -348,7 +385,11 @@ export function getDatabase(ddFlowHome, mode = "initialize", importPermitId, hoo
     if (mode !== "read_existing")
         assertImportAdmission(ddFlowHome, importPermitId);
     const dbPath = path.join(ddFlowHome, "db.sqlite");
+    if (mode === "create_new")
+        claimNewStore(dbPath);
     const exists = fs.existsSync(dbPath);
+    if (mode === "prepared_existing" && (!exists || !fs.lstatSync(dbPath).isFile()))
+        throw new AppError("run_storage_unprepared", "Prepare a regular existing RUN store before execution admission", 1);
     if (mode === "read_existing" && !exists) {
         return emptyReadOnlyDatabase(dbPath);
     }
@@ -387,7 +428,12 @@ export function getDatabase(ddFlowHome, mode = "initialize", importPermitId, hoo
     if (mode !== "read_existing" && mode !== "reconcile") {
         try {
             const initialize = () => { migrate(db); ensureRecoveryStorage(db); ensureLifecycleInvocationStorage(db); };
-            if (mode !== "hook") {
+            if (mode === "prepared_existing") {
+                const required = readStoreWriterContract(db);
+                if (required !== STORE_WRITER_VERSION)
+                    throw new AppError("store_writer_incompatible", "Existing RUN store has no compatible writer contract", 1, { required, supported: STORE_WRITER_VERSION });
+            }
+            else if (mode !== "hook") {
                 const fresh = !db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%' LIMIT 1").get();
                 if (fresh || readStoreWriterContract(db) !== null)
                     executeStoreSchema(db, initialize, fresh);
@@ -486,6 +532,11 @@ export function getResourceDatabase(resourceHome, mode = "initialize", deadlineA
     deadline?.("resource_open");
     const dbPath = path.join(resourceHome, "runtime.sqlite");
     const cached = resourceDatabases.get(dbPath);
+    if (mode === "create_new") {
+        if (cached)
+            throw new AppError("store_already_exists", "Fresh store creation refuses a cached resource owner", 1, { effect: "no_effect", path: dbPath });
+        claimNewStore(dbPath);
+    }
     if (mode === "read_existing" || mode === "read_isolated") {
         // Reuse a current transaction's view without exposing its write capability.
         if (cached && mode === "read_existing") {
@@ -494,6 +545,7 @@ export function getResourceDatabase(resourceHome, mode = "initialize", deadlineA
         }
         if (!fs.existsSync(dbPath))
             return emptyReadOnlyDatabase(dbPath);
+        channel("dd-flow.sqlite.ingress").publish({ phase: "store_connection", store_kind: "resource" });
         const db = new DatabaseSync(dbPath, { readOnly: true });
         try {
             db.exec(`PRAGMA busy_timeout = ${deadline?.("resource_open") ?? 4000}; PRAGMA query_only = ON`);
@@ -510,6 +562,8 @@ export function getResourceDatabase(resourceHome, mode = "initialize", deadlineA
     if (mode === "prepared_existing" && !fs.existsSync(dbPath))
         throw new AppError("resource_storage_unprepared", "Prepare the resource registry before maintenance", 1);
     if (cached) {
+        if (mode === "prepared_existing")
+            assertResourceDatabaseIdentity(cached);
         const bounded = deadlineAt === undefined ? cached : cached.withDeadline(deadlineAt);
         if (mode === "prepared_existing")
             assertResourceStoreReady({ prepare: sql => ({ get: (...params) => bounded.get(sql, params), all: (...params) => bounded.all(sql, params), run: (...params) => bounded.run(sql, params) }) });
@@ -517,9 +571,11 @@ export function getResourceDatabase(resourceHome, mode = "initialize", deadlineA
     }
     if (mode !== "prepared_existing")
         ensureDir(resourceHome);
+    channel("dd-flow.sqlite.ingress").publish({ phase: "store_connection", store_kind: "resource" });
     const db = new DatabaseSync(dbPath);
-    db.exec(`PRAGMA busy_timeout = ${deadline?.("resource_open") ?? 4000}`);
     try {
+        channel("dd-flow.sqlite.ingress").publish({ phase: "store_writer_registration", store_kind: "resource" });
+        db.exec(`PRAGMA busy_timeout = ${deadline?.("resource_open") ?? 4000}`);
         registerStoreWriter(db);
     }
     catch (error) {
@@ -535,8 +591,14 @@ export function getResourceDatabase(resourceHome, mode = "initialize", deadlineA
     catch (error) {
         return closeAfterOpenFailure(db, error);
     }
-    db.exec("PRAGMA foreign_keys = ON");
-    const fresh = !db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%' LIMIT 1").get();
+    let fresh;
+    try {
+        db.exec("PRAGMA foreign_keys = ON");
+        fresh = !db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%' LIMIT 1").get();
+    }
+    catch (error) {
+        return closeAfterOpenFailure(db, error);
+    }
     try {
         if (mode !== "prepared_existing")
             executeStoreSchema(db, `
@@ -587,6 +649,15 @@ export function getResourceDatabase(resourceHome, mode = "initialize", deadlineA
         resourceDatabases.delete(dbPath);
         db.close?.();
     });
+    try {
+        const identity = fs.lstatSync(dbPath);
+        if (!identity.isFile())
+            throw new AppError("resource_storage_changed", "Resource registry target is not a regular file", 1);
+        resourceDatabaseIdentities.set(database, { dev: identity.dev, ino: identity.ino });
+    }
+    catch (error) {
+        return closeAfterOpenFailure(db, error);
+    }
     resourceDatabases.set(dbPath, database);
     return deadlineAt === undefined ? database : database.withDeadline(deadlineAt);
 }
@@ -644,6 +715,7 @@ function databaseFacade(dbPath, writable, db, close = () => db.close?.(), deadli
     let afterCommit = [];
     let manualFrames = [];
     let readDepth = 0;
+    let ownedWriterToken = null;
     const writerTiming = channel("dd-flow.sqlite.writer");
     const ingressPhase = channel("dd-flow.sqlite.ingress");
     const storeKind = path.basename(dbPath) === "runtime.sqlite" ? "resource" : "run";
@@ -674,6 +746,7 @@ function databaseFacade(dbPath, writable, db, close = () => db.close?.(), deadli
         bound("writer_reservation");
         db.exec("BEGIN IMMEDIATE");
         reserved = true;
+        ownedWriterToken = Object.freeze({});
         if (ingressPhase.hasSubscribers)
             ingressPhase.publish({ phase: "writer_reserved", store_kind: storeKind });
     };
@@ -841,6 +914,9 @@ function databaseFacade(dbPath, writable, db, close = () => db.close?.(), deadli
             assertUsable();
             if (readDepth)
                 throw new AppError("read_snapshot_write", "Cannot execute SQL inside a read snapshot", 1);
+            // Raw SQL may replace the transaction (including behind comments).
+            // Do not infer continuity by parsing SQL or its final isTransaction.
+            ownedWriterToken = null;
             try {
                 db.exec(sql);
                 applyManualBoundary(sql);
@@ -866,9 +942,11 @@ function databaseFacade(dbPath, writable, db, close = () => db.close?.(), deadli
             }
         },
         execSchema: (sql) => { assertUsable(); if (db.isTransaction && !reserved)
-            throw new AppError("write_transaction_unowned", "Cannot change schema inside an unowned transaction", 1); executeStoreSchema(db, sql); },
+            throw new AppError("write_transaction_unowned", "Cannot change schema inside an unowned transaction", 1); ownedWriterToken = null; executeStoreSchema(db, sql); },
         beginWriteTransaction,
         writeTransaction,
+        isOwnedWriteTransaction: () => { assertUsable(); return writable && reserved && ownedWriterToken !== null && db.isTransaction && readDepth === 0; },
+        ownedWriteTransactionToken: () => { assertUsable(); return writable && reserved && db.isTransaction && readDepth === 0 ? ownedWriterToken : null; },
         readSnapshot,
         afterCommit: (operation) => { assertUsable(); if (readDepth)
             throw new AppError("read_snapshot_write", "Cannot queue publication inside a read snapshot", 1); if (db.isTransaction)
@@ -904,7 +982,7 @@ function errorDetails(error) {
     return { message: String(value?.message ?? error), ...(typeof value?.code === "string" ? { code: value.code } : {}), ...(typeof value?.errcode === "number" ? { sqlite_extended_code: value.errcode } : {}) };
 }
 function configureDatabase(db, mode, ingressDeadline) {
-    if (mode !== "read_existing") {
+    if (mode !== "read_existing" && mode !== "prepared_existing") {
         // Concurrent first openers can collide while changing journal mode, even
         // with busy_timeout set. Retrying this configuration does not replay writes.
         const deadline = performance.now() + 4000, pause = new Int32Array(new SharedArrayBuffer(4));

package/dist/storage/writer-contract.js

@@ -5,6 +5,15 @@ export const STORE_WRITER_VERSION = 2;
 const version = STORE_WRITER_VERSION;
 const table = "dd_flow_writer_contract";
 const quote = (name) => `"${name.replaceAll('"', '""')}"`;
+/** The executing writer's fence definition, also used for readonly admission. */
+export function storeWriterTriggerSql(name, action) {
+    const key = crypto.createHash("sha256").update(name).digest("hex").slice(0, 24);
+    const trigger = `dd_flow_writer_${key}_${action.toLowerCase()}`;
+    return { name: trigger, sql: `CREATE TRIGGER ${quote(trigger)} BEFORE ${action} ON ${quote(name)} BEGIN
+          SELECT CASE WHEN dd_flow_writer_version() <> (SELECT version FROM ${table} WHERE id = 1)
+            OR (SELECT COUNT(*) FROM ${table}) <> 1 THEN RAISE(ABORT, 'store_writer_incompatible') END;
+        END;` };
+}
 /** Publish additive schema and its writer fences in the same transaction. */
 export function executeStoreSchema(db, sql, initialize = false) {
     const ownsTransaction = !db.isTransaction;
@@ -64,14 +73,9 @@ export function installStoreWriterContract(db) {
             throw new AppError("store_writer_incompatible", "Store writer contract changed before migration", 1);
         const tables = db.prepare("SELECT name FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").all();
         for (const target of tables) {
-            const key = crypto.createHash("sha256").update(target.name).digest("hex").slice(0, 24);
             for (const action of ["INSERT", "UPDATE", "DELETE"]) {
-                const trigger = quote(`dd_flow_writer_${key}_${action.toLowerCase()}`);
-                db.exec(`DROP TRIGGER IF EXISTS ${trigger};
-          CREATE TRIGGER ${trigger} BEFORE ${action} ON ${quote(target.name)} BEGIN
-          SELECT CASE WHEN dd_flow_writer_version() <> (SELECT version FROM ${table} WHERE id = 1)
-            OR (SELECT COUNT(*) FROM ${table}) <> 1 THEN RAISE(ABORT, 'store_writer_incompatible') END;
-        END;`);
+                const trigger = storeWriterTriggerSql(target.name, action);
+                db.exec(`DROP TRIGGER IF EXISTS ${quote(trigger.name)}; ${trigger.sql}`);
             }
         }
         if (ownsTransaction)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.137",
+  "version": "0.9.0-beta.138",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",
@@ -27,7 +27,13 @@
     "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
     "typecheck": "tsc --noEmit",
     "lint": "eslint . --max-warnings=0",
-    "test": "pnpm test:release && pnpm test:integration && pnpm test:runtime-sensitive",
+    "test": "pnpm test:hybrid && pnpm test:e2 && pnpm test:e3 && pnpm test:release && pnpm test:integration && pnpm test:runtime-sensitive",
+    "test:hybrid": "node --test scripts/hybrid-contracts.test.mjs",
+    "test:hybrid:canon": "node --import ./scripts/source-test-loader.mjs --test scripts/hybrid-canon.test.mjs scripts/hybrid-inventory.test.mjs scripts/hybrid-consumers.test.mjs scripts/hybrid-schema-copies.test.mjs",
+    "test:e2": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e2-*.test.mjs",
+    "test:e2:installed": "node --test scripts/verify-e2-built-cli.test.mjs scripts/verify-e2-installed-cli.test.mjs",
+    "test:e3": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e3-*.test.mjs",
+    "test:e3:canon": "node --import ./scripts/source-test-loader.mjs --test scripts/verify-e3-canon.test.mjs",
     "test:release": "node --test scripts/verify-release-build.test.mjs && vitest run --project=release",
     "test:integration": "vitest run --project='integration-*'",
     "test:fast": "vitest run --project=integration-fast",
@@ -38,7 +44,9 @@
     "version-packages": "changeset version",
     "release:candidate:pack": "node scripts/release-candidate.mjs pack",
     "release:candidate:accept": "node scripts/release-candidate.mjs accept",
-    "release:publish": "node scripts/publish-release.mjs"
+    "release:publish": "node scripts/publish-release.mjs",
+    "release:hybrid:produce": "node tools/produce-hybrid-release.mjs",
+    "release:canon:archive": "node tools/create-canon-release.mjs"
   },
   "devDependencies": {
     "@opencode/client": "2.0.28",
@@ -46,6 +54,7 @@
     "@changesets/cli": "^2.31.0",
     "@eslint/js": "^9.39.1",
     "@types/node": "^24.10.1",
+    "@types/semver": "7.8.0",
     "eslint": "^9.39.1",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.47.0",
@@ -54,6 +63,7 @@
   "dependencies": {
     "ajv": "^8.20.0",
     "jsonc-parser": "3.3.1",
+    "semver": "7.8.1",
     "shell-quote": "^1.10.0",
     "smol-toml": "^1.6.1",
     "tree-sitter": "0.25.1",

package/tools/create-canon-release.mjs

@@ -0,0 +1,33 @@
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { createHash, randomUUID } from "node:crypto";
+import { produceCanonArchive } from "../dist/services/release-provenance.js";
+
+const args = process.argv.slice(2), names = ["canon-root", "commit", "output"];
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write("Usage: node tools/create-canon-release.mjs --canon-root <checkout> --commit <40-hex-commit> --output <new-archive.tgz>\nCreates an immutable Git-object archive with reviewed aliases materialized. Does not publish or qualify a release.\n");
+} else {
+  let temporary;
+  let ownsTemporary = false;
+  try {
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+      const name = args[index]?.slice(2), value = args[index + 1];
+      if (!args[index]?.startsWith("--") || !names.includes(name) || options.has(name) || !value || value.startsWith("--")) throw new Error("invalid arguments");
+      options.set(name, value);
+    }
+    if (names.some(name => !options.has(name))) throw new Error("missing arguments");
+    const bytes = produceCanonArchive(options.get("canon-root"), options.get("commit"));
+    const output = path.resolve(options.get("output"));
+    temporary = path.join(path.dirname(output), `.canon-archive-${randomUUID()}.tmp`);
+    const fd = fs.openSync(temporary, "wx", 0o600);
+    ownsTemporary = true;
+    try { fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    fs.linkSync(temporary, output); // Atomic no-replace publication, including dangling symlink targets.
+    process.stdout.write(`${JSON.stringify({ ok: true, commit: options.get("commit"), output, bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") })}\n`);
+  } catch {
+    process.stderr.write("Canonical archive production refused; check committed source and a new output path.\n");
+    process.exitCode = 1;
+  } finally { if (temporary && ownsTemporary) fs.rmSync(temporary, { force: true }); }
+}

package/tools/produce-hybrid-release.mjs

@@ -0,0 +1,41 @@
+import { createPrivateKey } from "node:crypto";
+import { Buffer } from "node:buffer";
+import process from "node:process";
+import { publishReleaseBundle } from "../dist/services/release-producer.js";
+import { readBoundedReleaseFile } from "../dist/services/release-source.js";
+import { createReleaseCompatibility, installedCatalogVersions } from "../dist/services/release-compatibility.js";
+import { getCliVersionReport } from "../dist/services/build-info.js";
+import { verifyProducerSource, verifyCanonArchiveSource } from "../dist/services/release-provenance.js";
+
+const names = ["payload-file", "canon-root", "canon-archive", "engine-archive", "key-file", "output", "channel"];
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(`Produce an immutable local signed release bundle from existing qualification evidence.\nUsage: node tools/produce-hybrid-release.mjs ${names.map(name => `--${name} <value>`).join(" ")}\nThis does not publish remotely or qualify a route. Private keys never enter the output.\n`);
+} else {
+  try {
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+      const name = args[index]?.slice(2), value = args[index + 1];
+      if (!args[index]?.startsWith("--") || !names.includes(name) || options.has(name) || !value || value.startsWith("--")) throw new Error("invalid arguments");
+      options.set(name, value);
+    }
+    if (names.some(name => !options.has(name))) throw new Error("missing arguments");
+    const compatibility = createReleaseCompatibility({ channel: options.get("channel"), catalogVersions: installedCatalogVersions, routerVersion: getCliVersionReport().cli.version });
+    const payload = JSON.parse(readBoundedReleaseFile(options.get("payload-file"), 16 * 1024 * 1024).toString("utf8"));
+    const manifest = JSON.parse(Buffer.from(payload.manifest_base64, "base64").toString("utf8"));
+    verifyProducerSource(options.get("canon-root"), payload.source, manifest.canon.version);
+    const canonArchive = readBoundedReleaseFile(options.get("canon-archive"), 256 * 1024 * 1024);
+    verifyCanonArchiveSource(options.get("canon-root"), payload.source.commit, manifest.canon.archive, canonArchive);
+    const result = publishReleaseBundle(options.get("output"), {
+      payload,
+      privateKey: createPrivateKey(readBoundedReleaseFile(options.get("key-file"), 64 * 1024)), compatibility,
+      canonArchive,
+      engineArchive: readBoundedReleaseFile(options.get("engine-archive"), 256 * 1024 * 1024)
+    });
+    process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`);
+  } catch {
+    // Key/parser/network excerpts must never appear in producer diagnostics.
+    process.stderr.write("Release production refused; check explicit inputs and qualification evidence.\n");
+    process.exitCode = 1;
+  }
+}