@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.139

package/dist/schemas/profile-settings.schema.json

@@ -0,0 +1,122 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "dd-flow/profile-settings@1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_id",
+    "revision",
+    "profiles",
+    "aliases",
+    "default_profile"
+  ],
+  "properties": {
+    "schema_id": {
+      "const": "dd-flow/profile-settings@1"
+    },
+    "revision": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "profiles": {
+      "type": "array",
+      "minItems": 0,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "id",
+          "revision",
+          "profile"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"
+          },
+          "revision": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "profile": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "schema_id",
+              "id",
+              "harness",
+              "provider",
+              "model",
+              "reasoning",
+              "mode",
+              "permission"
+            ],
+            "properties": {
+              "schema_id": {
+                "const": "dd-flow/agent-profile@1"
+              },
+              "id": {
+                "type": "string",
+                "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"
+              },
+              "harness": {
+                "enum": [
+                  "codex",
+                  "zcode",
+                  "agy",
+                  "opencode",
+                  "grok",
+                  "droid"
+                ]
+              },
+              "provider": {
+                "type": "string",
+                "minLength": 1
+              },
+              "model": {
+                "type": "string",
+                "minLength": 1
+              },
+              "reasoning": {
+                "type": "string",
+                "minLength": 1
+              },
+              "mode": {
+                "type": "string",
+                "minLength": 1
+              },
+              "permission": {
+                "enum": [
+                  "allow",
+                  "deny"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "aliases": {
+      "type": "object",
+      "propertyNames": {
+        "type": "string",
+        "pattern": "^[a-z][a-z0-9-]{0,47}$"
+      },
+      "additionalProperties": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"
+      }
+    },
+    "default_profile": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    }
+  }
+}

package/dist/schemas/release-manifest.schema.json

@@ -0,0 +1,291 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "dd-flow/release-manifest@1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_id",
+    "channel",
+    "version",
+    "canon",
+    "engine",
+    "min_router_version",
+    "catalog_versions",
+    "schema_versions",
+    "qualified_routes",
+    "impact"
+  ],
+  "properties": {
+    "schema_id": {
+      "const": "dd-flow/release-manifest@1"
+    },
+    "channel": {
+      "enum": [
+        "stable",
+        "preview",
+        "development"
+      ]
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$"
+    },
+    "canon": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "version",
+        "commit",
+        "archive"
+      ],
+      "properties": {
+        "version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$"
+        },
+        "commit": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{40}$"
+        },
+        "archive": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "url",
+            "sha256",
+            "bytes"
+          ],
+          "properties": {
+            "url": {
+              "type": "string",
+              "pattern": "^https://[^\\s]+$"
+            },
+            "sha256": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            },
+            "bytes": {
+              "type": "integer",
+              "minimum": 1
+            }
+          }
+        }
+      }
+    },
+    "engine": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "package",
+        "version",
+        "compatible_range",
+        "archive"
+      ],
+      "properties": {
+        "package": {
+          "const": "@deksden-com/dd-flow-cli"
+        },
+        "version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$"
+        },
+        "compatible_range": {
+          "type": "string",
+          "minLength": 1
+        },
+        "archive": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "url",
+            "sha256",
+            "bytes"
+          ],
+          "properties": {
+            "url": {
+              "type": "string",
+              "pattern": "^https://[^\\s]+$"
+            },
+            "sha256": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            },
+            "bytes": {
+              "type": "integer",
+              "minimum": 1
+            }
+          }
+        }
+      }
+    },
+    "min_router_version": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$"
+    },
+    "catalog_versions": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "harness",
+        "model",
+        "flow"
+      ],
+      "properties": {
+        "harness": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$"
+        },
+        "model": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$"
+        },
+        "flow": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?$"
+        }
+      }
+    },
+    "schema_versions": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "descriptor",
+        "execution",
+        "bundle"
+      ],
+      "properties": {
+        "descriptor": {
+          "const": "dd-flow/flow-descriptor@1"
+        },
+        "execution": {
+          "const": "dd-flow/execution-settings@1"
+        },
+        "bundle": {
+          "const": "dd-flow/execution-bundle@1"
+        }
+      }
+    },
+    "qualified_routes": {
+      "type": "array",
+      "minItems": 0,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "platform",
+          "harness",
+          "flow",
+          "delegation",
+          "evidence"
+        ],
+        "properties": {
+          "platform": {
+            "enum": [
+              "darwin-arm64",
+              "darwin-x64",
+              "linux-arm64",
+              "linux-x64",
+              "win32-x64"
+            ]
+          },
+          "harness": {
+            "enum": [
+              "codex",
+              "zcode",
+              "agy",
+              "opencode",
+              "grok",
+              "droid"
+            ]
+          },
+          "flow": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9-]{0,47}$"
+          },
+          "delegation": {
+            "enum": [
+              "external",
+              "native"
+            ]
+          },
+          "evidence": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "path",
+              "sha256"
+            ],
+            "properties": {
+              "path": {
+                "type": "string",
+                "pattern": "^[a-zA-Z0-9_-][a-zA-Z0-9_.-]*(/[a-zA-Z0-9_-][a-zA-Z0-9_.-]*)*$"
+              },
+              "sha256": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              }
+            }
+          }
+        }
+      }
+    },
+    "impact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "sha256"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "pattern": "^[a-zA-Z0-9_-][a-zA-Z0-9_.-]*(/[a-zA-Z0-9_-][a-zA-Z0-9_.-]*)*$"
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": { "channel": { "enum": ["stable", "preview"] } },
+        "required": ["channel"]
+      },
+      "then": {
+        "properties": { "qualified_routes": { "type": "array", "minItems": 1 } }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "channel": {
+            "const": "stable"
+          }
+        },
+        "required": [
+          "channel"
+        ]
+      },
+      "then": {
+        "properties": {
+          "version": {
+            "type": "string",
+            "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
+          },
+          "canon": {
+            "type": "object",
+            "properties": {
+              "version": {
+                "type": "string",
+                "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
+}

package/dist/schemas/run-engine-binding.schema.json

@@ -10,7 +10,7 @@
     "run_id": {"type": "string", "pattern": "^RUN-[0-9]+-[a-z0-9][a-z0-9-]*$"},
     "project_root": {"type": "string", "minLength": 1},
     "bound_at": {"type": "string", "format": "date-time"},
-    "source": {"enum": ["run_creation", "legacy_recovery"]},
+    "source": {"enum": ["run_creation", "legacy_recovery", "fork_upgrade"]},
     "reason": {"type": "string", "minLength": 1},
     "engine": {
       "type": "object",

package/dist/services/check-runner-evidence.js

@@ -3,6 +3,49 @@ import path from "node:path";
 import { parse } from "shell-quote";
 import { AppError } from "../shared/errors.js";
 import { validateObservationDuration } from "../harness-runtime/lib/observation-clock.mjs";
+function object(value) { return Boolean(value) && typeof value === "object" && !Array.isArray(value); }
+function boundedString(value, bytes) { return typeof value === "string" && Buffer.byteLength(value) <= bytes; }
+export function runnerFailureValid(value) {
+    if (!object(value) || typeof value.category !== "string" || !["assertion", "tooling", "unclassified"].includes(value.category))
+        return false;
+    for (const key of ["code", "message", "file", "test_id", "native_code", "classification_reason"])
+        if (value[key] !== undefined && !boundedString(value[key], 4096))
+            return false;
+    if (value.stack !== undefined && !boundedString(value.stack, 16384) || value.origin !== undefined && (typeof value.origin !== "string" || !["candidate", "tooling", "unknown"].includes(value.origin)) || value.phase !== undefined && (typeof value.phase !== "string" || !["test", "setup", "teardown", "collection", "runner"].includes(value.phase)))
+        return false;
+    if (value.repair_evidence !== undefined) {
+        const proof = value.repair_evidence;
+        if (!object(proof) || !boundedString(proof.rule, 128) || !boundedString(proof.native_code, 128) || !boundedString(proof.file, 4096) || !object(proof.world))
+            return false;
+        const world = proof.world;
+        if (world.schema_id !== "dd-tasks/test-world-ready@1" || !boundedString(world.invocation_id, 4096) || typeof world.world_id !== "string" || !/^[a-f0-9]{32}$/.test(world.world_id) || typeof world.migrations_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(world.migrations_sha256) || world.ready !== true || world.setup_completed !== true || !boundedString(world.role, 128) || !world.role)
+            return false;
+    }
+    return true;
+}
+function candidateFile(root, file) {
+    if (!root || !path.isAbsolute(file))
+        return false;
+    try {
+        const relative = path.relative(fs.realpathSync(root), fs.realpathSync(file));
+        return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative) && fs.statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+export function candidateFailureFiles(evidence, root) {
+    return [...new Set((evidence?.failures ?? []).flatMap(failure => failure.file && candidateFile(root, failure.file) ? [failure.file] : []))];
+}
+function candidateFailure(failure, evidence, root, capturedFiles) {
+    const owned = (file) => capturedFiles === undefined ? candidateFile(root, file) : capturedFiles.includes(file);
+    if (failure.origin === "tooling" || failure.origin === "unknown")
+        return false;
+    if (failure.category === "assertion")
+        return failure.origin === undefined || failure.origin === "candidate" && failure.file !== undefined && owned(failure.file);
+    const proof = failure.repair_evidence;
+    return failure.category === "unclassified" && failure.origin === "candidate" && ["test", "setup"].includes(failure.phase ?? "") && proof?.rule === "candidate_sql_integrity" && ["23502", "23503", "23505", "23514"].includes(proof.native_code) && failure.native_code === proof.native_code && failure.file === proof.file && proof.world.invocation_id === evidence.binding.invocation_id && owned(proof.file);
+}
 export function runnerObservationDurations(environment) {
     // Both observers leave the launcher its bounded physical cleanup tail.
     return { startupMs: validateObservationDuration(validateObservationDuration(Number(environment.DD_FLOW_TEST_STARTUP_SILENCE_MS ?? 120_000)) + 10_000),
@@ -68,7 +111,7 @@ export function runnerContractsValid(value) {
         if (!raw || typeof raw !== "object" || Array.isArray(raw))
             return false;
         const contract = raw;
-        return alias.startsWith("@check/") && contract.schema_id === "dd-flow/check-runner-evidence@1" && typeof contract.path === "string" && contract.path.length > 0 && !contract.path.includes("\\") && !path.isAbsolute(contract.path) && !contract.path.split("/").some(part => part === ".." || part === "" || part === ".");
+        return alias.startsWith("@check/") && contract.schema_id === "dd-flow/check-runner-evidence@1" && typeof contract.path === "string" && contract.path.length > 0 && contract.path.split("/")[0] !== "engine-outcome.json" && !contract.path.includes("\\") && !path.isAbsolute(contract.path) && !contract.path.split("/").some(part => part === ".." || part === "" || part === ".");
     });
 }
 export function readRunnerEvidence(root, contract, binding) {
@@ -88,7 +131,7 @@ export function readRunnerEvidence(root, contract, binding) {
         if (evidence.schema_id !== contract.schema_id || !evidence.binding || Object.entries(binding).some(([key, value]) => evidence.binding[key] !== value)
             || typeof evidence.runner?.name !== "string" || !evidence.runner.name || typeof evidence.runner.version !== "string" || !evidence.runner.version || typeof evidence.completed !== "boolean" || !evidence.counts
             || ![evidence.counts.passed, evidence.counts.failed, evidence.counts.skipped].every(n => Number.isSafeInteger(n) && n >= 0)
-            || !Array.isArray(evidence.failures) || evidence.failures.some(f => !f || !["assertion", "tooling", "unclassified"].includes(f.category))
+            || !Array.isArray(evidence.failures) || evidence.failures.length > 64 || evidence.failures.some(f => !runnerFailureValid(f))
             || evidence.counts.failed > evidence.failures.length || evidence.observation_unknown !== undefined && typeof evidence.observation_unknown !== "boolean")
             return null;
         return evidence;
@@ -103,6 +146,10 @@ export function checkRepairDisposition(receipt) {
         return "settlement_required";
     if (receipt.status === "passed")
         return "passed";
+    if (receipt.execution_failures?.length || receipt.mutation_paths?.length || receipt.before_fingerprint !== receipt.after_fingerprint || receipt.diagnostic_evidence_valid === false)
+        return "tooling_blocker";
+    if (!Number.isSafeInteger(receipt.exit_code) || receipt.exit_code === 0)
+        return "unclassified";
     const evidence = receipt.runner_evidence;
     if (!evidence || !Array.isArray(evidence.failures) || !evidence.failures.length || receipt.exit_code === 0 || evidence.failures.some(f => !f || !["assertion", "tooling", "unclassified"].includes(f.category)))
         return "unclassified";
@@ -110,12 +157,12 @@ export function checkRepairDisposition(receipt) {
         return "tooling_blocker";
     if (!evidence.completed)
         return "unclassified";
-    if (evidence.failures.some(f => f.category === "unclassified"))
+    if (evidence.failures.some(f => !runnerFailureValid(f) || !candidateFailure(f, evidence, receipt.candidate_root, receipt.candidate_files)))
         return "unclassified";
     return "source_repair";
 }
 export function assertSourceRepairEligible(receipts) {
     const blockers = receipts.filter(receipt => checkRepairDisposition(receipt) !== "source_repair");
     if (!receipts.length || blockers.length)
-        throw new AppError("check_gate_blocked", "Checks require tooling diagnosis or settlement before product repair; retained nonzero is not an assertion verdict", 2, { failures: receipts, dispositions: receipts.map(receipt => ({ check_receipt_id: receipt.id, disposition: checkRepairDisposition(receipt) })), outcome: "blocked", recoverable: false, instruction: "Inspect retained runner evidence. Do not change product code to repair tooling, unknown observation or unclassified failure. Retry only after establishing and correcting the cause." });
+        throw new AppError("check_gate_blocked", "Checks require tooling diagnosis or settlement before product repair; retained nonzero is not a candidate-source verdict", 2, { failures: receipts, dispositions: receipts.map(receipt => ({ check_receipt_id: receipt.id, disposition: checkRepairDisposition(receipt) })), outcome: "blocked", recoverable: false, instruction: "Inspect retained runner evidence. Do not change product code to repair tooling, unknown observation or unclassified failure. Retry only after establishing and correcting the cause." });
 }

package/dist/services/cli-operation-classifier.js

@@ -1,4 +1,8 @@
 import { parseCommandArgs } from "./lifecycle-command.js";
+import { commandKeyForPositions, routerNativeRoute } from "../cli/command-metadata.js";
+import { hasHelpIntent } from "../cli/help.js";
+import { isUpgradeAllowlisted } from "./cli-upgrade-allowlist.js";
+export { isUpgradeAllowlisted } from "./cli-upgrade-allowlist.js";
 export function classifyCliOperation(args, env = process.env) {
     const positional = positionalArgs(args);
     const [family = null, command = null, action = null] = positional;
@@ -48,62 +52,19 @@ function isMbUpgradeMode(args, env) {
     }
     return marked && isUpgradeAllowlisted(args);
 }
-export function isUpgradeAllowlisted(args) {
-    const positional = positionalArgs(args);
-    const [family, command] = positional;
-    if (family === "status")
-        return true;
-    if (family === "engine" && command === "resolve")
-        return true;
-    if (family === "migration" && ["impact", "plan", "report", "verify", "apply"].includes(command ?? ""))
-        return true;
-    if (family === "memory" && command === "permissions" && positional[2] === "preflight")
-        return true;
-    if (family === "run" && command === "start")
-        return optionValue(args, "flow-kind") === "mb-upgrade";
-    if (family === "stage" && ["start", "pause", "resume", "finish"].includes(command ?? ""))
-        return hasRunBinding(args);
-    if (family === "session" && ["status", "register", "stop", "usage"].includes(command ?? ""))
-        return hasRunBinding(args);
-    if (family === "dashboard" && ["data", "render", "refresh", "open"].includes(command ?? ""))
-        return true;
-    return false;
-}
-function hasRunBinding(args) {
-    return Boolean(optionValue(args, "run") || positionalArgs(args).some((value) => value.startsWith("RUN-")));
-}
 function optionValue(args, name) {
     const values = parseCommandArgs(args).options.get(name);
     const value = values?.[values.length - 1];
     return value && value !== "__dd_flow_flag__" ? value : null;
 }
-function isRouterNative(args) {
+export function isRouterNative(args) {
     const first = args[0];
     if (!first || first === "--version")
         return true;
-    if (first === "--help" || first === "-h")
-        return true;
-    if (args.includes("--help") || args.includes("-h"))
-        return true;
-    if (["engine", "version", "schema"].includes(first))
-        return true;
-    if (first === "run" && args[1] === "reconcile")
-        return true;
-    if (first === "storage" && args[1] === "migrate-writer")
+    if (hasHelpIntent(args))
         return true;
-    return (first === "codex" && args[1] === "hook" && args[2] === "handle")
-        || (first === "zcode" && args[1] === "hook" && args[2] === "handle")
-        || (first === "zcode" && args[1] === "invocation" && args[2] === "prepare")
-        || (first === "zcode" && args[1] === "event" && args[2] === "handle")
-        || (first === "zcode" && args[1] === "usage" && args[2] === "ingest")
-        || (first === "grok" && args[1] === "event" && args[2] === "handle")
-        || (first === "grok" && args[1] === "usage" && args[2] === "ingest")
-        || (first === "droid" && args[1] === "event" && args[2] === "handle")
-        || (first === "droid" && args[1] === "usage" && args[2] === "ingest")
-        || (first === "opencode" && args[1] === "event" && args[2] === "handle")
-        || (first === "opencode" && args[1] === "usage" && args[2] === "ingest")
-        || (first === "agy" && args[1] === "event" && args[2] === "handle")
-        || (first === "agy" && args[1] === "usage" && args[2] === "ingest");
+    const key = commandKeyForPositions(positionalArgs(args));
+    return key !== undefined && routerNativeRoute(key);
 }
 function isReadOnlyDiagnostic(family, command, action) {
     if (!family)

package/dist/services/cli-upgrade-allowlist.js

@@ -0,0 +1,27 @@
+import { parseCommandArgs } from "./lifecycle-command.js";
+/** Syntax eligibility only. Storage/project/RUN authority is checked separately. */
+export function isUpgradeAllowlisted(args) {
+    const parsed = parseCommandArgs(args), [family, command] = parsed.positional;
+    const option = (name) => {
+        const value = parsed.options.get(name)?.at(-1);
+        return value && value !== "__dd_flow_flag__" ? value : null;
+    };
+    if (family === "status")
+        return true;
+    if (family === "engine" && command === "resolve")
+        return true;
+    if (family === "migration" && ["impact", "plan", "report", "verify", "apply"].includes(command ?? ""))
+        return true;
+    if (family === "memory" && command === "permissions" && parsed.positional[2] === "preflight")
+        return true;
+    if (family === "run" && command === "start")
+        return option("flow-kind") === "mb-upgrade";
+    const bound = Boolean(option("run") || parsed.positional.some(value => value.startsWith("RUN-")));
+    if (family === "stage" && ["start", "pause", "resume", "finish"].includes(command ?? ""))
+        return bound;
+    if (family === "session" && ["status", "register", "stop", "usage"].includes(command ?? ""))
+        return bound;
+    if (family === "dashboard" && ["data", "render", "refresh", "open"].includes(command ?? ""))
+        return true;
+    return false;
+}