@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.139

package/dist/services/operator-profiles.js

@@ -0,0 +1,236 @@
+import fs from "node:fs";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest, validateHybridContract } from "./hybrid-contracts.js";
+import { acquireInstallationLock } from "./installation-lock.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+export function operatorSettingsPath(home) { return path.join(home, "profile-settings.json"); }
+function profileError(code, message, exitCode = 2) {
+    return new AppError(code, `${message}; use dd-flow profiles --help`, exitCode, { phase: "profiles", effect: "no_effect", recoverable: true });
+}
+function completeSettings(input) {
+    const value = { ...input, profiles: input.profiles.map(entry => ({ ...entry, revision: hybridDigest(entry.profile) })) };
+    return { ...value, revision: hybridDigest(value) };
+}
+function admittedSettings(input) {
+    const issues = validateHybridContract("profile-settings", input);
+    if (issues.length)
+        throw profileError("profile_settings_invalid", "Profile settings violate the schema or aliases/revision contract");
+    const settings = input;
+    for (const { profile } of settings.profiles) {
+        if ([profile.provider, profile.model, profile.reasoning, profile.mode].some(value => !value.trim())) {
+            throw profileError("profile_settings_invalid", "Profile execution values must not be blank");
+        }
+    }
+    return settings;
+}
+function readRegularJson(file) {
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readBoundedReleaseFile(file, 4 * 1024 * 1024)));
+    }
+    catch {
+        // Parser errors can contain submitted secrets. Never retain input text or cause.
+        throw profileError("profile_settings_invalid", "Profile input is unreadable or malformed JSON");
+    }
+}
+/** First successful write imports valid legacy IDs; thereafter the settings file is the sole owner. */
+export function readOperatorProfiles(home) {
+    const file = operatorSettingsPath(home);
+    if (fs.existsSync(file))
+        return admittedSettings(readRegularJson(file));
+    const profiles = [];
+    const legacy = path.join(home, "agent-profiles");
+    if (fs.existsSync(legacy)) {
+        for (const entry of fs.readdirSync(legacy).sort()) {
+            if (!entry.endsWith(".json"))
+                continue;
+            const profile = readRegularJson(path.join(legacy, entry));
+            const id = entry.slice(0, -5);
+            profiles.push({ id, revision: hybridDigest(profile), profile });
+        }
+    }
+    return admittedSettings(completeSettings({ schema_id: "dd-flow/profile-settings@1", profiles,
+        aliases: {}, default_profile: null }));
+}
+export function resolveOperatorProfile(settings, id) {
+    const selected = id ?? settings.default_profile;
+    if (!selected)
+        throw profileError("agent_profile_missing", "Select an explicit profile or configure a default", 1);
+    const target = Object.hasOwn(settings.aliases, selected) ? settings.aliases[selected] : selected;
+    const entry = settings.profiles.find(item => item.id === target);
+    if (!entry)
+        throw profileError("agent_profile_missing", "Selected profile is unavailable", 1);
+    return structuredClone(entry.profile);
+}
+/** Used by explicit files and onboarding alike; extra credential fields fail before any write. */
+export function prepareOperatorProfile(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        throw profileError("profile_settings_invalid", "Profile must be an object");
+    const sample = input;
+    const value = completeSettings({ schema_id: "dd-flow/profile-settings@1", profiles: [
+            { id: sample?.id, revision: hybridDigest(input), profile: sample }
+        ], aliases: {}, default_profile: null });
+    return admittedSettings(value).profiles[0].profile;
+}
+export function readOperatorProfileInput(file) {
+    return prepareOperatorProfile(readRegularJson(file));
+}
+function changedSettings(current, mutation) {
+    const next = structuredClone(current);
+    if (mutation.action === "create" || mutation.action === "edit") {
+        if (mutation.action === "create" && mutation.setDefault !== undefined && typeof mutation.setDefault !== "boolean") {
+            throw profileError("profile_settings_invalid", "Default selection must be an explicit boolean");
+        }
+        const profile = prepareOperatorProfile(mutation.profile);
+        const index = next.profiles.findIndex(entry => entry.id === profile.id);
+        if (mutation.action === "create" && index >= 0)
+            throw profileError("profile_conflict", "Profile ID already exists", 1);
+        if (mutation.action === "edit" && index < 0)
+            throw profileError("agent_profile_missing", "Cannot edit a missing profile", 1);
+        const entry = { id: profile.id, revision: hybridDigest(profile), profile };
+        if (index >= 0)
+            next.profiles[index] = entry;
+        else
+            next.profiles.push(entry);
+        if (mutation.action === "create" && mutation.setDefault === true)
+            next.default_profile = profile.id;
+    }
+    else if (mutation.action === "remove") {
+        if (!next.profiles.some(entry => entry.id === mutation.id))
+            throw profileError("agent_profile_missing", "Cannot remove a missing profile", 1);
+        if (Object.values(next.aliases).includes(mutation.id) || next.default_profile === mutation.id
+            || next.default_profile !== null && next.aliases[next.default_profile] === mutation.id) {
+            throw profileError("profile_in_use", "Remove aliases and change the default before removing this profile", 1);
+        }
+        next.profiles = next.profiles.filter(entry => entry.id !== mutation.id);
+    }
+    else if (mutation.action === "alias") {
+        if (mutation.target === null) {
+            if (!Object.hasOwn(next.aliases, mutation.alias))
+                throw profileError("profile_alias_missing", "Alias is unavailable", 1);
+            if (next.default_profile === mutation.alias)
+                throw profileError("profile_in_use", "Change the default before removing its alias", 1);
+            delete next.aliases[mutation.alias];
+        }
+        else
+            Object.defineProperty(next.aliases, mutation.alias, { value: mutation.target, enumerable: true, writable: true, configurable: true });
+    }
+    else if (mutation.action === "set-default")
+        next.default_profile = mutation.id;
+    else
+        throw profileError("profile_settings_invalid", "Unknown profile mutation");
+    const { revision: _revision, ...content } = next;
+    void _revision;
+    return admittedSettings(completeSettings(content));
+}
+/** Pure preflight suitable for freezing into an installation request before any effects. */
+export function prepareProfileCreation(settings, profile, setDefault) {
+    if (typeof setDefault !== "boolean")
+        throw profileError("profile_settings_invalid", "Default selection requires explicit consent");
+    const before = admittedSettings(structuredClone(settings)), admitted = prepareOperatorProfile(profile);
+    const after = changedSettings(before, { action: "create", profile: admitted, setDefault });
+    return { schema_id: "dd-flow/profile-creation-intent@1", before, after, profile: structuredClone(admitted), set_default: setDefault };
+}
+/** Exact frozen intent reconciliation: an already-applied write is not applied a second time.
+ * A later edit/default change is a conflict, never a reason to restore old settings.
+ */
+export function validateProfileCreationIntent(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input)
+        || Object.keys(input).some(key => !["schema_id", "before", "after", "profile", "set_default"].includes(key))
+        || ["schema_id", "before", "after", "profile", "set_default"].some(key => !Object.hasOwn(input, key))
+        || input.schema_id !== "dd-flow/profile-creation-intent@1")
+        throw profileError("profile_settings_invalid", "Invalid profile creation intent");
+    const expected = prepareProfileCreation(input.before, input.profile, input.set_default);
+    admittedSettings(input.after);
+    if (hybridDigest(expected) !== hybridDigest(input))
+        throw profileError("profile_settings_invalid", "Profile creation intent changed");
+}
+export function readProfileCreationIntent(file) {
+    try {
+        const input = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readBoundedReleaseFile(file, 4 * 1024 * 1024)));
+        validateProfileCreationIntent(input);
+        return input;
+    }
+    catch {
+        throw profileError("profile_settings_invalid", "Profile creation intent must be a bounded valid regular JSON file");
+    }
+}
+export function commitProfileCreation(home, input) {
+    validateProfileCreationIntent(input);
+    const current = readOperatorProfiles(home);
+    if (current.revision === input.after.revision)
+        return { replayed: true, settings: current };
+    return { replayed: false, settings: mutateOperatorProfiles(home, input.before.revision, { action: "create", profile: input.profile, setDefault: input.set_default }) };
+}
+/** Compare-and-swap under an exclusive owned lock; no dual writer for legacy profile files. */
+export function mutateOperatorProfiles(home, expectedRevision, mutation) {
+    const before = readOperatorProfiles(home);
+    if (before.revision !== expectedRevision)
+        throw profileError("profile_revision_conflict", "Profile settings changed; reread before retrying", 1);
+    const prepared = changedSettings(before, mutation); // Fully validate before creating the home/lock.
+    const serialized = JSON.stringify(prepared, null, 2) + "\n";
+    if (Buffer.byteLength(serialized) > 4 * 1024 * 1024)
+        throw profileError("profile_settings_invalid", "Profile settings exceed the bounded reader limit");
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    const lock = path.join(home, "profile-settings.lock");
+    // Profiles use storage-owner identity, not a setup request ledger. A dead
+    // writer may be recovered by a later CAS mutation, including after commit.
+    let lease;
+    try {
+        lease = acquireInstallationLock(lock, hybridDigest({ resource: "profile-settings", home: path.resolve(home) }));
+    }
+    catch {
+        throw profileError("profile_write_conflict", "Another profile writer or unreconciled lock exists", 1);
+    }
+    const temporary = path.join(home, `.profile-settings-${randomUUID()}.tmp`);
+    let ownsTemporary = false;
+    let renameAttempted = false;
+    let failure;
+    let result;
+    try {
+        if (readOperatorProfiles(home).revision !== expectedRevision)
+            throw profileError("profile_revision_conflict", "Profile settings changed while acquiring the lock", 1);
+        const fd = fs.openSync(temporary, "wx", 0o600);
+        ownsTemporary = true;
+        try {
+            fs.writeFileSync(fd, serialized);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        renameAttempted = true;
+        fs.renameSync(temporary, operatorSettingsPath(home));
+        result = readOperatorProfiles(home);
+    }
+    catch (error) {
+        failure = error instanceof AppError && !renameAttempted ? error : new AppError("profile_write_interrupted", "Profile write requires reconciliation; reread settings before retrying", 1, { phase: "profiles", effect: "unknown", recoverable: true,
+            next_action: "dd-flow profiles list --json" });
+    }
+    finally {
+        let cleanupFailed = false;
+        try {
+            if (ownsTemporary && fs.existsSync(temporary))
+                fs.unlinkSync(temporary);
+        }
+        catch {
+            cleanupFailed = true;
+        }
+        try {
+            lease.release();
+        }
+        catch {
+            cleanupFailed = true;
+        }
+        if (cleanupFailed) {
+            if (failure)
+                failure.details.cleanup = "not_confirmed";
+            else
+                failure = new AppError("profile_cleanup_failed", "Profile writer cleanup requires reconciliation", 1, { phase: "profiles", effect: "unknown", cleanup: "not_confirmed", next_action: "dd-flow profiles list --json" });
+        }
+    }
+    if (failure)
+        throw failure;
+    return result;
+}

package/dist/services/projects.js

@@ -11,9 +11,24 @@ import { loadProjectFlowContract } from "../domain/flow-contract.js";
 import { buildStaticFlowGuidance } from "./flow-guidance.js";
 import { normalizeProtocolLifecycle } from "./protocol-lifecycle.js";
 import { buildProjectSummary, projectRegistrySummary, readPublishedProjectSummary } from "./project-summary.js";
+/** Resolve filesystem identity before entering a composite SQL writer. */
+export class PreparedProjectRegistration {
+    #root;
+    constructor(root) { this.#root = root; Object.freeze(this); }
+    static prepare(input) {
+        return new PreparedProjectRegistration(resolveProjectRoot(input.root));
+    }
+    root() { return this.#root; }
+}
 export function registerProject(context, input) {
-    const root = resolveProjectRoot(input.root);
-    const existing = findProjectByRoot(context, root);
+    return registerPreparedProject(context, PreparedProjectRegistration.prepare(input));
+}
+/** Metadata-only registration; the composite caller owns its SQL transaction. */
+export function registerPreparedProject(context, prepared) {
+    if (!(prepared instanceof PreparedProjectRegistration))
+        throw new AppError("validation", "Project registration must be prepared", 2);
+    const root = prepared.root();
+    const existing = context.db.get("SELECT * FROM projects WHERE root = ?", [root]);
     const now = context.now();
     const project = existing ?? newProjectRecord(context, root, now);
     if (existing) {

package/dist/services/{codex-capacity.js → provider-capacity.js}

@@ -1,11 +1,14 @@
 import { setTimeout as delay } from "node:timers/promises";
 import crypto from "node:crypto";
-import { CAPACITY_POLICY, capacityBackoff, nativeItemsSettled, normalizeCodexFailure, overloadBurst, parseCapacityOperation, refusalObservation, terminalCodexOverload } from "../harness-runtime/lib/codex-capacity-policy.mjs";
+import { CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, capacityBackoff, nativeItemsSettled, normalizeProviderFailure, overloadExhausted, parseCapacityOperation, refusalObservation, terminalProviderOverload } from "../harness-runtime/lib/provider-overload-policy.mjs";
 import { AppError } from "../shared/errors.js";
 import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
-export function eligibleCodexChildOverload(child, parentSessionId) {
+export function providerChildFailure(child) {
+    return child.provider_failure ?? { code: child.native_source ? "provider_capacity_transient" : "turn_interrupted", details: { native_source: child.native_source, provider_session_id: child.session_id, turn_id: child.terminal_turn_id, native_turn_id: child.terminal_turn_id, terminal_status: child.status, observed_at: child.terminal_observed_at ?? null, provider_error: child.provider_error, native_turn_items: child.native_turn_items } };
+}
+export function eligibleProviderChildOverload(child, parentSessionId) {
     return typeof child.session_id === "string" && child.session_id !== parentSessionId && child.parent_session_id === parentSessionId && child.provenance !== "parent_mismatch" && child.status === "failed" && typeof child.terminal_turn_id === "string" && nativeItemsSettled(child.native_turn_items)
-        && terminalCodexOverload({ code: "turn_interrupted", details: { provider_session_id: child.session_id, turn_id: child.terminal_turn_id, native_turn_id: child.terminal_turn_id, terminal_status: "failed", provider_error: child.provider_error } }, child.session_id, child.terminal_turn_id);
+        && terminalProviderOverload(providerChildFailure(child), child.session_id, child.terminal_turn_id);
 }
 /** A terminal root is not a settled tree. Only the daemon's exact owned tree
  * with a settled root and positively live descendants permits waiting. */
@@ -37,7 +40,7 @@ export function assertCapacityOwnerAdmission(context, record, operationId, bindi
         return;
     const root = parseCapacityOperation(operationId).root;
     const childOrdinal = /:child:[a-f0-9]+:followup:(\d+)$/.exec(root)?.[1];
-    if (childOrdinal && (!Number.isSafeInteger(Number(childOrdinal)) || Number(childOrdinal) < 1 || String(Number(childOrdinal)) !== childOrdinal))
+    if (childOrdinal && (!Number.isSafeInteger(Number(childOrdinal)) || Number(childOrdinal) < 1 || Number(childOrdinal) > MAX_OVERLOAD_RETRIES || String(Number(childOrdinal)) !== childOrdinal))
         throw new AppError("capacity_continuation_conflict", "Invalid native child continuation ordinal", 1);
     if (root === operationId && !childOrdinal)
         return;
@@ -71,7 +74,9 @@ export function assertCapacityOwnerAdmission(context, record, operationId, bindi
                 if (intent)
                     break;
             }
-        if (!intent || intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== root || intent.ordinal !== parsed.ordinal
+        if (intent?.policy && intent.policy !== CAPACITY_POLICY)
+            throw new AppError("capacity_policy_mismatch", "Continuation is pinned to another retry policy", 1);
+        if (!intent || parsed.ordinal > MAX_OVERLOAD_RETRIES || intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== root || intent.ordinal !== parsed.ordinal
             || intent.predecessor !== predecessor || intent.operation_id !== operationId || intent.refusal?.turn_id !== intent.turn_id
             || intent.refusal?.ordinal !== parsed.ordinal - 1 || intent.refusal?.session_id !== intent.session_id
             || !Number.isFinite(Date.parse(intent.not_before)) || Date.parse(intent.not_before) > Date.parse(context.now())
@@ -115,9 +120,13 @@ export function capacityDelay(error, ordinal, now = Date.now()) {
     return capacityBackoff(error, ordinal, now);
 }
 /** Continue a confirmed terminal Turn, never replay its completed effects. */
-export async function continueCodexCapacity(input) {
+export async function continueProviderCapacity(input) {
     let { error, operationId } = input;
     const history = [...(input.retainedIntents?.() ?? [])];
+    if (history.some(intent => intent.policy !== CAPACITY_POLICY) || input.retainedFailures?.().some(refusal => refusal.policy !== CAPACITY_POLICY))
+        throw new AppError("capacity_policy_mismatch", "Retained continuation uses another retry policy", 1);
+    if (history.length > MAX_OVERLOAD_RETRIES)
+        throw new AppError("capacity_continuation_conflict", "Retained episode exceeds its retry budget", 1);
     const parsed = parseCapacityOperation(input.operationId);
     const rootId = parsed.root;
     const text = input.continuationText ?? "Continue the same assigned task in this Session. Check current durable RUN, Work and Stage state first. Never repeat an observed lifecycle command, accepted HITL answer, check or merge apply; use only an exact issued successor. Stop at the assigned boundary.";
@@ -217,9 +226,9 @@ export async function continueCodexCapacity(input) {
                 throw new AppError("capacity_continuation_blocked", "Retained completion cannot be reconciled with its owner boundary", 1);
             return boundary === "paused" || boundary === "completed" ? { provider_session_id: input.sessionId, capacity_decision: boundary } : observed.result;
         }
-        if (observed.state === "failed" && observed.error && !terminalCodexOverload(observed.error, input.sessionId))
+        if (observed.state === "failed" && observed.error && !terminalProviderOverload(observed.error, input.sessionId))
             throw observed.error;
-        if (observed.state !== "failed" || !terminalCodexOverload(observed.error, input.sessionId))
+        if (observed.state !== "failed" || !terminalProviderOverload(observed.error, input.sessionId))
             throw new AppError("operation_observation_lost", "Retained successor outcome is not proven; do not resend", 1, { operation_id: intent.operation_id, primary_error: error, observed });
         operationId = intent.operation_id;
         error = observed.error;
@@ -240,7 +249,7 @@ export async function continueCodexCapacity(input) {
     for (;; ordinal += 1) {
         if (!Number.isSafeInteger(ordinal))
             conflict("Continuation ordinal overflow");
-        if (!terminalCodexOverload(error, input.sessionId)) {
+        if (!terminalProviderOverload(error, input.sessionId)) {
             if (ordinal === 1)
                 return null;
             throw error;
@@ -250,14 +259,14 @@ export async function continueCodexCapacity(input) {
             return completed;
         const prior = await observe(() => input.inspectOperation(operationId));
         const failure = prior.error;
-        const confirmed = normalizeCodexFailure(failure, input.sessionId);
+        const confirmed = normalizeProviderFailure(failure, input.sessionId);
         const turnId = confirmed?.turn_id;
         input.signal?.throwIfAborted();
         input.assertCurrent();
         if (prior.primary_error)
             throw prior.primary_error;
         if (prior.operation_id !== operationId || prior.operation !== "session.prompt" || prior.session_id !== input.sessionId
-            || prior.state !== "failed" || prior.primary_error || !turnId || !terminalCodexOverload(failure, input.sessionId, turnId)) {
+            || prior.state !== "failed" || prior.primary_error || !turnId || !terminalProviderOverload(failure, input.sessionId, turnId)) {
             throw blocked("Retained predecessor does not prove the exact terminal overloaded Turn");
         }
         const readiness = async () => {
@@ -272,7 +281,7 @@ export async function continueCodexCapacity(input) {
         const ready = await readiness();
         if (ready === "unproven")
             throw blocked("Native predecessor readiness is unproven; do not cancel or replay to manufacture proof");
-        const native = normalizeCodexFailure(failure, input.sessionId, turnId);
+        const native = normalizeProviderFailure(failure, input.sessionId, turnId);
         let refusal = refusals.find(item => item.ordinal === ordinal - 1);
         if (refusal && (refusal.turn_id !== turnId || refusal.session_id !== input.sessionId || refusal.policy !== CAPACITY_POLICY))
             conflict("Failure ordinal identifies a different native Turn");
@@ -293,17 +302,26 @@ export async function continueCodexCapacity(input) {
                 input.retainFailure?.(operationId, refusal);
             refusals.push(refusal);
         }
-        const burst = overloadBurst(refusals);
-        if (burst) {
+        const exhausted = overloadExhausted(refusals);
+        if (exhausted) {
             if (input.atomicIntent)
                 input.retainFailure?.(operationId, refusal);
-            throw new AppError("provider_overload_burst", "Two consecutive continuation Turns were overloaded within two minutes", 1, { ...burst, root_operation_id: rootId, provider_session_id: input.sessionId, continuation_count: ordinal - 1, primary_error: failure });
+            throw new AppError("provider_unavailable", "Provider overload retry episode exhausted", 1, { ...exhausted, root_operation_id: rootId, provider_session_id: input.sessionId, continuation_count: ordinal - 1, primary_error: refusals.length ? input.error : failure, last_error: failure });
         }
         const nextId = `${rootId}:capacity:${ordinal}:session.prompt`;
         const existing = history.find(item => item.operation_id === nextId);
         if (existing && (existing.predecessor !== operationId || existing.turn_id !== turnId || existing.prompt_sha256 !== promptSha || existing.ordinal !== ordinal))
             throw error;
-        const wait = existing ? Math.max(0, Date.parse(existing.not_before) - Date.now()) : capacityDelay(failure, ordinal);
+        let wait;
+        try {
+            wait = existing ? Math.max(0, Date.parse(existing.not_before) - Date.now()) : capacityDelay(failure, ordinal);
+        }
+        catch (cause) {
+            if (input.atomicIntent)
+                input.retainFailure?.(operationId, refusal);
+            const metadata = cause;
+            throw new AppError(metadata.code ?? "capacity_retry_metadata_invalid", metadata.message ?? "Invalid provider retry metadata", 1, { ...metadata.details, policy: CAPACITY_POLICY, attempts: refusals.length, root_operation_id: rootId, primary_error: input.error, last_error: failure });
+        }
         if (!Number.isFinite(wait) || Date.now() + wait > 8.64e15 || input.deadline !== undefined && Date.now() + wait >= input.deadline) {
             if (input.atomicIntent)
                 input.retainFailure?.(operationId, refusal);