@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.139

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -13,7 +13,8 @@ import { readNativeLines, streamNativeDiagnostics, nativeObservationError } from
 import { operationProgressReporter } from "./operation-progress.mjs";
 import { publishSetup } from './setup-progress.mjs';
 
-const LATE_RESPONSE_GRACE_MS = 5_000;
+export const CODEX_REQUEST_TIMEOUT_MS = 120_000;
+export const LATE_RESPONSE_GRACE_MS = 5_000;
 const CODEX_SESSION_CONFIG = Object.freeze({
   bypass_hook_trust: true,
   "features.plugins": false,
@@ -280,7 +281,7 @@ export class CodexBridge {
     const correction = isProvenShellCorrection(error);
     error.details = { ...error.details, native_hook_binding: { provider_session_id: threadId, root_provider_session_id: root, turn_id: turnId,
         hook_run_id: run.id, source: "codex.hook/completed" }, provider_session_id: threadId, root_provider_session_id: root, turn_id: turnId,
-        hook_run_id: run.id, effect: correction ? "no_effect" : "unknown", duration_ms: run.durationMs };
+        hook_run_id: run.id, effect: error.details?.effect ?? "unknown", native_turn_items: { observed: false, possible_effects: true, pending: true }, duration_ms: run.durationMs };
     if (correction) {
       try { void Promise.resolve(this.journal.write("native_hook_correction", errorRecord(error))).catch(storage => { error.cleanup_error ??= errorRecord(storage); }); }
       catch (storage) { error.cleanup_error ??= errorRecord(storage); }
@@ -409,7 +410,7 @@ export class CodexBridge {
     this.send({ jsonrpc: "2.0", id: message.id, error });
   }
 
-  request(method, params = {}, timeoutMs = this.options.timeoutMs ?? 120_000) {
+  request(method, params = {}, timeoutMs = this.options.timeoutMs ?? CODEX_REQUEST_TIMEOUT_MS) {
     const turnFloor = method === "turn/start" ? new Set([this.currentTurns?.get(params.threadId), ...[...this.turns].filter(([, value]) => value.threadId === params.threadId).map(([id]) => id)].filter(Boolean)) : null;
     if (method === "turn/start" && params.threadId) {
       // Only one productive root Turn is admitted by the daemon fence. Drop
@@ -576,7 +577,8 @@ export async function promptSessionWithBridge(bridge, options) {
   const started = await bridge.request("turn/start", { threadId: sessionId, input: [{ type: "text", text: prompt }], cwd, model: options.model ?? null, effort: options.reasoning ?? null, approvalPolicy: "never", sandboxPolicy: { type: "dangerFullAccess" } }, 30_000);
   const turn = started?.turn ?? started; const turnId = turn?.id ?? null;
   let completed;
-  try { completed = await waitForTurn(bridge, sessionId, turnId, options.livenessTimeoutMs ?? options.timeoutMs ?? 1_800_000, options, cwd, clock); }
+  try { completed = isTerminalTurnStatus(turn?.status) ? terminalTurn({ turn }, sessionId, turnId, bridge)
+    : await waitForTurn(bridge, sessionId, turnId, options.livenessTimeoutMs ?? options.timeoutMs ?? 1_800_000, options, cwd, clock, turn?.status); }
   catch (error) {
     const retained = bridge.turns?.get(turnId);
     if (retained?.value?.threadId === sessionId && retained.value.turn?.id === turnId && retained.value.turn.status === "completed") {
@@ -624,11 +626,20 @@ async function ensureThreadLoaded(bridge, sessionId, options, cwd) {
   }, 30_000);
 }
 
-async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, clock = new ObservationClock({ timeoutMs, onGap: gap => bridge.journal?.write("observation_gap", { ...gap, session_id: sessionId, turn_id: turnId }) })) {
+async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, clock = new ObservationClock({ timeoutMs, onGap: gap => bridge.journal?.write("observation_gap", { ...gap, session_id: sessionId, turn_id: turnId }) }), startStatus) {
   // app-server can briefly expose the new Turn as `interrupted` between the
   // turn/start response and its turn/started notification. Give that snapshot
   // one event-loop grace window before treating failure as authoritative.
   const failureNotBefore = Date.now() + 1_000;
+  const reconcileSnapshot = async (status, threadStatus) => {
+    if (!isAuthoritativeTerminal(bridge, turnId, status, threadStatus, failureNotBefore)) return false;
+    if (status === "completed" || startStatus !== "inProgress" || bridge.turns.get(turnId)?.status === "completed") return true;
+    // A provisional failure can contradict the accepted start before its
+    // delayed notification arrives. Recheck this Turn, never start another.
+    const current = await readTurn(bridge, sessionId, turnId, true);
+    return bridge.turns.get(turnId)?.status === "completed" || current?.turn?.status === status
+      && isAuthoritativeTerminal(bridge, turnId, status, current.threadStatus, failureNotBefore);
+  };
   let nextStoredReadAt = Date.now();
   while (true) {
     bridge.assertHookHealthy?.(sessionId);
@@ -636,20 +647,20 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, c
     const expired = clock.sample(bridge.activityObservations?.get(sessionId) ?? bridge.activity?.get(sessionId));
     if (expired || Date.now() >= nextStoredReadAt) {
       const stored = await readTurn(bridge, sessionId, turnId, false);
-      if (stored?.turn && isAuthoritativeTerminal(bridge, turnId, stored.turn.status, stored.threadStatus, failureNotBefore)) return terminalTurn({ turn: stored.turn }, sessionId, turnId, bridge);
+      if (stored?.turn && await reconcileSnapshot(stored.turn.status, stored.threadStatus)) return terminalTurn({ turn: stored.turn }, sessionId, turnId, bridge);
       // A loaded app-server can retain a stale `active` Thread state after a
       // provider-side interruption. The persisted turn page is independent of
       // that live subscription and is the compact authority for its terminal
       // status; unlike `includeTurns`, it never hydrates the whole history.
       const persisted = await readPersistedTurn(bridge, sessionId, turnId);
-      if (persisted && isAuthoritativeTerminal(bridge, turnId, persisted.status, stored?.threadStatus, failureNotBefore)) return terminalTurn({ turn: persisted }, sessionId, turnId, bridge);
+      if (persisted && await reconcileSnapshot(persisted.status, stored?.threadStatus)) return terminalTurn({ turn: persisted }, sessionId, turnId, bridge);
       // Desktop may unload an idle Thread immediately after an interrupted
       // Turn. Reload it once before polling again: otherwise the compact
       // status remains `notLoaded` forever and hides the terminal Turn.
       if (stored?.threadStatus === "notLoaded") {
         await ensureThreadLoaded(bridge, sessionId, options, cwd);
         const hydrated = await readTurn(bridge, sessionId, turnId, true);
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
+        if (hydrated?.turn && await reconcileSnapshot(hydrated.turn.status, hydrated.threadStatus)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
       }
       // Some app-server versions correctly omit turns for a compact read.
       // Once the thread is idle, hydrate exactly once to recover the terminal
@@ -660,7 +671,7 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, c
         // an inProgress Turn after emitting the final agent message; treating
         // that stale Turn as terminal incorrectly aborts an otherwise usable
         // worker session.
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
+        if (hydrated?.turn && await reconcileSnapshot(hydrated.turn.status, hydrated.threadStatus)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
       }
       // Some app-server builds emit a final agent message but omit both the
       // terminal event and the compact turn record. Wait briefly, hydrate once,
@@ -671,8 +682,9 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, c
       // app-server reports the Thread idle.
       if (final?.turnId === turnId && stored?.threadStatus === "idle" && Date.now() - final.completedAt >= 1_000) {
         const hydrated = await readTurn(bridge, sessionId, turnId, true);
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
-        return terminalTurn({ turn: { id: turnId, status: "completed", synthetic: true, final_message: final.item } }, sessionId, turnId, bridge);
+        if (hydrated?.turn && await reconcileSnapshot(hydrated.turn.status, hydrated.threadStatus)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
+        if (hydrated?.threadStatus === "idle" && !isTerminalTurnStatus(hydrated.turn?.status))
+          return terminalTurn({ turn: { id: turnId, status: "completed", synthetic: true, final_message: final.item } }, sessionId, turnId, bridge);
       }
       nextStoredReadAt = Date.now() < failureNotBefore ? failureNotBefore : Date.now() + 15_000;
     }
@@ -722,7 +734,7 @@ export function turnItemEvidence(turn, bridge, sessionId) {
     possible_effects: items.some(item => classifyCodexItem(item?.type) !== "non_tool") } : { observed: false };
 }
 
-export { terminalCodexOverload } from "./codex-capacity-policy.mjs";
+export { terminalProviderOverload as terminalCodexOverload } from "./provider-overload-policy.mjs";
 
 function isTerminalTurnStatus(status) { return ["completed", "failed", "interrupted", "cancelled"].includes(status); }
 function isAuthoritativeTerminal(bridge, turnId, status, threadStatus, failureNotBefore) {

package/dist/harness-runtime/lib/dd-droid-daemon.mjs

@@ -1,6 +1,7 @@
 import { SETUP_STARTUP_MS, startupObserver, observationDetails } from './setup-progress.mjs';
 import { callDaemonObserved } from './daemon-observation.mjs';
 import { admitNativeRequestBuffer, nativeObservationError } from "./native-streams.mjs";
+import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, open, unlink, realpath } from "node:fs/promises";
 import { spawn } from "node:child_process";
@@ -16,7 +17,7 @@ import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmD
 const REQUEST = "dd-droid/daemon-request@1", RESPONSE = "dd-droid/daemon-response@1";
 async function removeSocket(file) { try { if (!(await lstat(file)).isSocket()) throw new DroidError("unsafe_socket", "Refusing to replace non-socket daemon path"); await unlink(file); } catch (error) { if (error.code !== "ENOENT") throw error; } }
 export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000, operationId = process.env.DD_EVAL_OPERATION_ID ?? randomUUID()) {
-  const request = { schema_id: REQUEST, id: operationId, operation, params };
+  const request = prepareDaemonRequest({ schema_id: REQUEST, id: operationId, operation, params });
   return await callDaemonObserved({ stateDir, socket: droidPaths(stateDir).socket, request, responseSchema: RESPONSE, harness: 'droid', timeoutMs });
 }
 function sameConfig(a, b) { return ["cwd", "bin", "model", "reasoning", "mode", "provider", "ddFlowBin", "ddFlowHome", "resourceHome", "projectRoot", "noFlow","inactivityMs"].every(key => a?.[key] === b[key]); }

package/dist/harness-runtime/lib/dd-droid.mjs

@@ -1,3 +1,4 @@
+import { managedFlowEnv } from './managed-flow-env.mjs';
 import { processSnapshot } from "./process-snapshot.mjs";
 import { ToolObservations, droidToolObservations, journalToolObservations } from "./tool-observations.mjs";
 export { processSnapshot } from "./process-snapshot.mjs";
@@ -10,7 +11,7 @@ import path from "node:path";
 import { ObservationClock, observedTimeout, validateObservationDuration } from "./observation-clock.mjs";
 import { operationProgressReporter } from "./operation-progress.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
-import { errorRecord, reportedError, isObservationLoss } from "./operation-errors.mjs";
+import { errorRecord, reportedError, isObservationLoss, isProvenShellCorrection } from "./operation-errors.mjs";
 import { hookBudget, invokeNativeHook } from "./native-hook-command.mjs";
 import { checkObservedProfile, observeModel } from "./model-observations.mjs";
 import { readNativeLines, streamNativeDiagnostics, nativeObservationError } from "./native-streams.mjs";
@@ -20,6 +21,8 @@ const metadataReaders = new Map();
 function metadataReader(factory) { if (!metadataReaders.has(factory)) metadataReaders.set(factory, new DroidMetadataReader(factory)); return metadataReaders.get(factory); }
 import { confirmDaemonProcess, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 import { renderAdapterPolicy, lifecycleRetryInstruction } from "./delegation-instructions.mjs";
+import { classifyProviderError, safeProviderError } from "./provider-overload-policy.mjs";
+import { settledNativeTree } from "./native-children.mjs";
 
 export const DROID_CONTRACT = "dd-droid-harness@1";
 export const DROID_PROTOCOL = "1.201.0";
@@ -44,7 +47,7 @@ export function droidEnvironment(config) {
   // This adapter deliberately uses the operator's existing Factory login.
   // Undefined is a tombstone: downstream env overlays must not resurrect keys.
   for (const key of Object.keys(env)) if (key.endsWith("API_KEY")) env[key] = undefined;
-  return env;
+  return { ...env, ...managedFlowEnv(config) };
 }
 export async function prepareDroidHome(config) {
   const paths = droidPaths(config.stateDir);
@@ -95,6 +98,19 @@ export async function readDroidSession(factory, id) {
 const terminal = value => ["completed", "cancelled", "failed", "process_exit", "error"].includes(value);
 const status = value => value === "completed" ? "completed" : ["cancelled", "process_exit"].includes(value) ? "cancelled" : ["failed", "error"].includes(value) ? "failed" : "unknown";
 
+export function droidTerminalFailure(outcome, sessionId, settled) {
+  if (!["failed", "error"].includes(outcome?.reason) || !outcome.error || typeof outcome.error !== "object") return null;
+  const code = classifyProviderError(outcome.error);
+  if (code === "provider_failed") return null;
+  const turnId = outcome.turnId;
+  return Object.assign(new DroidError(code, "Droid native provider request failed", {
+    provider_session_id: sessionId, session_id: sessionId, turn_id: turnId, native_turn_id: turnId,
+    terminal_status: "failed", native_source: "droid.agent_turn_outcome", observed_at: new Date().toISOString(),
+    provider_error: safeProviderError(outcome.error), will_retry: outcome.error.willRetry === true, native_retry_active: outcome.error.willRetry === true,
+    native_turn_items: { observed: settled === true, possible_effects: true, pending: settled !== true }
+  }), { retryable: code === "provider_capacity_transient" || code === "provider_rate_limited" });
+}
+
 
 function descendants(rows, rootPid) { const ids = new Set([rootPid]); for (;;) { const size = ids.size; for (const row of rows) if (ids.has(row.ppid)) ids.add(row.pid); if (size === ids.size) return rows.filter(row => ids.has(row.pid)); } }
 
@@ -360,15 +376,18 @@ export class DroidRuntime {
         });
       }
       const outcome = await completed; await this.draining;
+      let receipt;
       try {
-        const receipt = await this.inspect(id, { ignoreActive: true });
-        return { ...receipt, result: { ...outcome, status: status(outcome.reason) }, assistant_text: current.text, turn_id: turnId };
+        receipt = await this.inspect(id, { ignoreActive: true });
       } catch (error) {
         // A terminal native outcome is durable independently of a later
         // filesystem/topology observation.  Preserve it and let settlement
         // reconcile; do not convert it into a failed prompt.
         return { provider_session_id: id, adapter_session_id: id, result: { ...outcome, status: status(outcome.reason) }, assistant_text: current.text, turn_id: turnId, settled: false, settlement_observation_error: errorRecord(error) };
       }
+      const providerFailure = droidTerminalFailure(outcome, id, receipt.settled);
+      if (providerFailure) throw providerFailure;
+      return { ...receipt, result: { ...outcome, status: status(outcome.reason) }, assistant_text: current.text, turn_id: turnId };
     } catch (error) {
       if (current.outcome && isObservationLoss(error)) error = Object.assign(new Error("Droid completed natively but its dispatch acknowledgement was lost", { cause: error }), {
         code: "native_outcome_observation_failed", details: { native_outcome: { provider_session_id: id, turn_id: turnId, result: current.outcome }, settled: false, observation_error: errorRecord(error) }
@@ -399,6 +418,8 @@ export class DroidRuntime {
     catch (error) {
       receipt = { provider_session_id: binding.provider_session_id, adapter_session_id: binding.provider_session_id, settled: false, settlement_observation_error: errorRecord(error) };
     }
+    const failure = droidTerminalFailure(outcome, binding.provider_session_id, receipt.settled);
+    if (failure) throw failure;
     // Native outcome and tree settlement are independent. Retain the former
     // even while children are running; settled:false keeps capacity reserved.
     const current = this.active;
@@ -448,7 +469,9 @@ export class DroidRuntime {
       const ordered = tasks.toSorted((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0));
       const latest = ordered.at(-1); const running = tasks.some(task => !terminal(task.status));
       const closed = running && prior?.source === "adapter.tree_closed";
-      this.topology.set(id, { provider_session_id: id, parent_provider_session_id: this.rootId, tool_use_id: creationTool, latest_tool_use_id: latest.parentToolUseId, task_id: latest.taskInvocationId, task_invocation_ids: ordered.map(task => task.taskInvocationId), status: closed ? prior.status : running ? "running" : status(latest.status), source: closed ? prior.source : "droid.task_invocations", transcript_path: native.transcript_path });
+      const outcome = native.outcomes.at(-1), nativeTurn = outcome && terminal(outcome.reason) && typeof outcome.turnId === "string" ? outcome.turnId : null;
+      const evidence = !running && nativeTurn ? { terminal_turn_id: nativeTurn, native_source: "droid.agent_turn_outcome", native_turn_items: { observed: native.complete && native.tool_calls.completeness === "complete", possible_effects: native.tool_calls.total > 0, pending: native.tool_calls.pending > 0 }, ...(outcome.error && typeof outcome.error === "object" ? { provider_error: safeProviderError(outcome.error) } : {}) } : {};
+      this.topology.set(id, { provider_session_id: id, parent_provider_session_id: this.rootId, tool_use_id: creationTool, latest_tool_use_id: latest.parentToolUseId, task_id: latest.taskInvocationId, task_invocation_ids: ordered.map(task => task.taskInvocationId), status: closed ? prior.status : running ? "running" : status(latest.status), source: closed ? prior.source : "droid.task_invocations", transcript_path: native.transcript_path, ...evidence });
     }
     return [...this.topology.values()];
   }
@@ -469,7 +492,8 @@ export class DroidRuntime {
     this.requireIdentity(id); await this.captureProcesses(); const children = await this.refreshTopology(); const source = await readDroidSession(this.paths.factory, id);
     const usage = []; for (const sessionId of [id, ...children.map(child => child.provider_session_id)]) usage.push(await this.snapshotUsage(sessionId, { ingest: ingestUsage }));
     const settled = !this.topologyIncomplete && (!this.active || ignoreActive) && (this.closed || this.workingState === "idle") && children.every(child => terminal(child.status));
-    return { harness: "droid-cli", runtime_family: "droid", session: { harness_id: "droid-cli", session_id: id }, provider_session_id: id, adapter_session_id: id, cwd: this.config.cwd, observed_profile: source?.settings ? await this.observeSettings(id, source.settings, { path: source.transcript_path, sha256: source.source_sha256 }) : this.observedProfile, observed_runtime: { droid: this.config.version, factory_protocol: this.protocol ?? DROID_PROTOCOL, dd_harness_contract: DROID_CONTRACT }, status: settled ? "idle" : "running", settled, descendants: children, transcript_path: source?.transcript_path ?? null, usage, result: this.lastResult, provider_pid: this.closed ? null : this.child?.pid ?? null };
+    const rootSettled = (!this.active || ignoreActive) && (this.closed || this.workingState === "idle") && terminal((source?.outcomes?.at(-1) ?? this.lastResult)?.reason);
+    return { harness: "droid-cli", runtime_family: "droid", session: { harness_id: "droid-cli", session_id: id }, provider_session_id: id, adapter_session_id: id, cwd: this.config.cwd, observed_profile: source?.settings ? await this.observeSettings(id, source.settings, { path: source.transcript_path, sha256: source.source_sha256 }) : this.observedProfile, observed_runtime: { droid: this.config.version, factory_protocol: this.protocol ?? DROID_PROTOCOL, dd_harness_contract: DROID_CONTRACT }, status: settled ? "idle" : "running", settled, ...settledNativeTree(id, children, settled, rootSettled && !this.topologyIncomplete), terminal_turn_id: source?.outcomes?.at(-1)?.turnId ?? this.lastResult?.turnId, descendants: children, transcript_path: source?.transcript_path ?? null, usage, result: this.lastResult, provider_pid: this.closed ? null : this.child?.pid ?? null };
   }
   async observeHook(payload, eventId, deadlineAt = null) {
     try { return await this.observeHookChecked(payload, eventId, hookBudget(23_000, deadlineAt)); }
@@ -499,15 +523,14 @@ export class DroidRuntime {
     try {
       return await this.flow("event", "handle", { schema_id: "dd-flow/droid-tool-event@1", phase: event === "PreToolUse" ? "before" : "after", event_id: eventId, daemon_id: this.config.daemonId, session: { provider_session_id: id, parent_provider_session_id: parent, directory: this.config.cwd }, tool: payload.tool_name, input: payload.tool_input, profile, transcript_path: native.transcript_path, outcome: { status: payload.tool_response?.is_error ? "error" : "completed" } }, budget.remaining("admission", 15_000));
     } catch (error) {
-      const details = error.details;
-      if (event === "PreToolUse" && error.code === "lifecycle_shell_syntax_invalid" && details?.phase === "prepare" && details.effect === "no_effect" && details.recoverable === true && details.disposition === "pre_cli_shell_refusal" && (details.refusal_event_key || details.event_key)) {
+      if (event === "PreToolUse" && isProvenShellCorrection(error)) {
         const refusal = errorRecord(error);
         await this.journal("hook_rejected", { error: refusal, event_id: eventId, session_id: id });
         await this.save();
         return { continue: false, stopReason: error.message };
       }
       // Identity is proven above; only this owned admission can fail its turn.
-      this.fatalError ??= Object.assign(error, { details: { ...error.details, provider_session_id: id, event_id: eventId, effect: "unknown" } });
+      this.fatalError ??= Object.assign(error, { details: { ...error.details, provider_session_id: id, event_id: eventId, effect: error.details?.effect ?? "unknown", native_turn_items: { observed: false, possible_effects: true, pending: true } } });
       this.rejectPending(this.fatalError);
       try { await budget.run(async () => { await this.save({ fatal_error: errorRecord(this.fatalError) }); await this.journal("hook_rejected", { error: errorRecord(this.fatalError) }); }, "failure_persistence"); }
       catch (storage) { this.fatalError.details.receipt_error = errorRecord(storage); }

package/dist/harness-runtime/lib/dd-grok-daemon.mjs

@@ -1,7 +1,9 @@
+import { managedFlowEnv } from './managed-flow-env.mjs';
 import { SETUP_STARTUP_MS, startupObserver, observationDetails } from './setup-progress.mjs';
 import { callDaemonObserved } from './daemon-observation.mjs';
 import { canonicalNativeOperation } from './adapter-timeouts.mjs';
 import { admitNativeRequestBuffer } from "./native-streams.mjs";
+import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mjs";
 import { errorRecord, isProvenShellCorrection } from "./operation-errors.mjs";
 import { ToolObservations, acpToolObservation } from "./tool-observations.mjs";
@@ -18,6 +20,8 @@ import os from "node:os";
 import path from "node:path";
 
 import { AcpBridge } from "./dd-zcode.mjs";
+import { safeProviderError } from "./provider-overload-policy.mjs";
+import { settledNativeTree } from "./native-children.mjs";
 import { observeModel, readModelObservations } from "./model-observations.mjs";
 import { cancelSessionWithBridge, createSessionWithBridge, doctor, forkSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge } from "./dd-grok.mjs";
 import { prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
@@ -39,7 +43,7 @@ const errorPayload = errorRecord;
 function shellQuote(value) { return `'${String(value).replace(/'/g, "'\\''")}'`; }
 
 function executable(command, args = []) { const resolved = command ?? process.env.DD_GROK_BIN ?? "grok"; return /\.[cm]?js$/.test(resolved) ? { command: process.execPath, args: [resolved, ...args] } : { command: resolved, args }; }
-export function isolatedEnv(config) { const env = { ...process.env, HOME: config.grokHome, GROK_HOME: config.grokHome, ...(config.ddFlowHome ? { DD_FLOW_HOME: config.ddFlowHome } : {}), ...(config.resourceHome ? { DD_FLOW_RESOURCE_HOME: config.resourceHome } : {}), ...(config.authPath ? { GROK_AUTH_PATH: config.authPath } : {}) }; env.DD_FLOW_DAEMON_ID = undefined; if (config.ddFlowHome && config.daemonId) env.DD_FLOW_DAEMON_ID = config.daemonId; return env; }
+export function isolatedEnv(config) { return { ...process.env, HOME: config.grokHome, GROK_HOME: config.grokHome, ...(config.authPath ? { GROK_AUTH_PATH: config.authPath } : {}), ...managedFlowEnv(config) }; }
 function within(candidate, root) { const resolved = path.resolve(candidate); const parent = path.resolve(root); return resolved === parent || resolved.startsWith(`${parent}${path.sep}`); }
 
 async function writeIsolatedConfig(paths) {
@@ -151,7 +155,7 @@ async function materializeSessionArchive(paths, archiveDir) {
 
 export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000) {
   operation = canonicalNativeOperation('grok', operation);
-  const request = { schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params };
+  const request = prepareDaemonRequest({ schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params });
   return await callDaemonObserved({ stateDir, socket: locations(stateDir).socket, request, responseSchema: RESPONSE_SCHEMA, harness: 'grok', timeoutMs });
 }
 
@@ -239,6 +243,10 @@ export class Runtime {
       parent_provider_session_id: parent,
       status,
       source,
+      ...(terminal(status) && typeof attempt === "string" && attempt ? { terminal_turn_id: attempt,
+        ...(typeof value.observed_at === "string" ? { terminal_observed_at: value.observed_at } : {}),
+        ...(value.provider_error && typeof value.provider_error === "object" ? { provider_error: safeProviderError(value.provider_error), native_source: "grok.subagent.event" } : {}),
+        ...(value.native_turn_items && typeof value.native_turn_items === "object" ? { native_turn_items: value.native_turn_items } : {}) } : {}),
       ...(attempt || descendant?.attempt_id ? { attempt_id: attempt ?? descendant.attempt_id } : {}),
       ...(newAttempt && descendant?.attempt_id ? { retired_attempt_ids: [...retired, descendant.attempt_id] } : retired.length ? { retired_attempt_ids: retired } : {}),
       ...(!newAttempt && !terminal(status) && descendant?.outcome_error ? { outcome_error: descendant.outcome_error } : {})
@@ -408,7 +416,7 @@ export class Runtime {
     if (operation === "session.create") return await this.productive(operation, async () => { const result = await createSessionWithBridge(this.bridge, { ...this.options(params), onSessionCreated: async (session) => { this.track(session); this.loadedSessionId = session.provider_session_id; await this.persist(); } }, this.initialized); this.loadedSessionId = result.provider_session_id; return result; }, null, operationId);
     if (operation === "session.prompt") { await this.requireSettled(); return await this.productive(operation, async () => { const result = await promptSessionWithBridge(this.bridge, { ...this.options(params), assertDispatch, operationId }); this.loadedSessionId = params.sessionId; return result; }, params.sessionId, operationId); }
     if (operation === "session.fork") { await this.requireSettled(); return await this.productive(operation, async () => { const result = await forkSessionWithBridge(this.bridge, this.options(params)); this.loadedSessionId = params.sessionId; return result; }); }
-    if (operation === "session.inspect" || operation === "session.resume") { const before = new Map(this.descendants); const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result, before); await this.persist(); return { ...result, settled: !this.active && !this.treeRunning(result), descendants: this.topology(result.provider_session_id) }; }
+    if (operation === "session.inspect" || operation === "session.resume") { const before = new Map(this.descendants); const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result, before); await this.persist(); const settled = !this.active && !this.treeRunning(result); const descendants = this.topology(result.provider_session_id); const terminal = this.sessions.get(result.provider_session_id)?.native_root_receipt; return { ...result, settled, descendants, ...settledNativeTree(result.provider_session_id, descendants, settled, !this.active && !this.rootRunning(result)), ...(terminal?.kind === "failed" && terminal.request_id !== undefined ? { terminal_turn_id: String(terminal.request_id) } : {}) }; }
     if (operation === "session.cancel") { if (!this.sessions.has(params.sessionId)) throw new DaemonError("session_identity_mismatch", "cancellation Session is not owned by this daemon"); cancelPendingDispatch(this); const result = await cancelSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); await this.persist({ active_tree: Boolean(this.active) || !result.settled }); return result; }
     if (operation === "session.archive") { await this.requireSettled(); return await this.productive(operation, async () => { let session = this.sessions.get(params.sessionId); if (!session?.cwd) { const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result); session = this.sessions.get(result.provider_session_id); } return await exportSessionArchive(this.paths, session.provider_session_id, absolute(session.cwd, "Grok Build session cwd"), params.archiveDir, this.state.versions); }); }
     if (operation === "daemon.stop") {

package/dist/harness-runtime/lib/dd-opencode-daemon.mjs

@@ -1,6 +1,8 @@
+import { managedFlowEnv } from './managed-flow-env.mjs';
 import { SETUP_STARTUP_MS, startupObserver, observationDetails } from './setup-progress.mjs';
 import { callDaemonObserved } from './daemon-observation.mjs';
 import { admitNativeRequestBuffer } from "./native-streams.mjs";
+import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mjs";
 import { openCodeToolObservation, journalToolObservations } from "./tool-observations.mjs";
 import { ObservationClock } from "./observation-clock.mjs";
@@ -10,13 +12,15 @@ import { spawn } from "node:child_process";
 import net from "node:net";
 import { durableDaemonDispatch, completeDaemonShutdown, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon, assertDaemonDispatch, assertDaemonRestartable } from "./daemon-operations.mjs";
 import { waitForSettlement } from "./session-settlement.mjs";
-import { errorRecord } from "./operation-errors.mjs";
+import { errorRecord, isProvenShellCorrection, reportedError } from "./operation-errors.mjs";
 import { checkObservedProfile, observeModel } from "./model-observations.mjs";
 import os from "node:os";
 import path from "node:path";
 import { parse as parseJsonc } from "jsonc-parser";
 import { writeJsonAtomic } from "./runner-events.mjs";
 import { OpenCodeClient, OpenCodeError, historyDigest, usageSnapshot, nativeModel } from "./dd-opencode.mjs";
+import { safeProviderError } from "./provider-overload-policy.mjs";
+import { acceptNativeHookRequest, hookBudget, readNativeHookFailures } from "./native-hook-command.mjs";
 import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 
 const REQUEST_SCHEMA = "dd-opencode/daemon-request@1", RESPONSE_SCHEMA = "dd-opencode/daemon-response@1", STATE_SCHEMA = "dd-opencode/daemon-state@2", ARCHIVE_SCHEMA = "dd-opencode/session-archive@2";
@@ -40,13 +44,13 @@ const writeJson = writeJsonAtomic;
 async function readState(dir) { try { return JSON.parse(await readFile(locations(dir).state, "utf8")); } catch (error) { if (error.code === "ENOENT") return null; throw error; } }
 async function removeSocket(paths) { try { if (!(await lstat(paths.socket)).isSocket()) throw new DaemonError("unsafe_socket", "refusing to replace non-socket daemon path"); await unlink(paths.socket); } catch (error) { if (error.code !== "ENOENT") throw error; } }
 function executable(bin, args = []) { return /\.[cm]?js$/.test(bin) ? { command: process.execPath, args: [bin, ...args] } : { command: bin, args }; }
-function isolatedEnv(config) {
+export function isolatedEnv(config) {
   const env = { ...process.env };
   for (const name of ["OPENCODE_CONFIG", "OPENCODE_CONFIG_CONTENT", "OPENCODE_PASSWORD", "OPENCODE_PTY_HANDOFF", "OPENCODE_SERVER", "OPENCODE_SIMULATE"]) delete env[name];
   return { ...env, XDG_DATA_HOME: config.dataHome, XDG_CONFIG_HOME: config.configHome, XDG_CACHE_HOME: config.cacheHome,
     XDG_STATE_HOME: config.stateHome, OPENCODE_DB: config.database, OPENCODE_CONFIG_DIR: config.adapterDir,
     OPENCODE_CONFIG_PROJECT_DISABLE: "1", OPENCODE_SERVER_PASSWORD: config.password,
-    ...(config.ddFlowHome ? { DD_FLOW_HOME: config.ddFlowHome } : {}), ...(config.resourceHome ? { DD_FLOW_RESOURCE_HOME: config.resourceHome } : {}),
+    ...managedFlowEnv(config),
     DD_OPENCODE_PLUGIN_SHA256: config.pluginSha256 ?? "none" };
 }
 export async function run(bin, args, config, options = {}) {
@@ -63,7 +67,7 @@ const errorPayload = errorRecord;
 
 async function writePlugin(paths, config) {
   const directory = path.join(paths.config, "opencode", "plugins"); await mkdir(directory, { recursive: true, mode: 0o700 });
-  const source = `import { makeOpenCodePlugin } from ${JSON.stringify(new URL("./opencode-plugin.mjs", import.meta.url).href)};\nexport default makeOpenCodePlugin(${JSON.stringify({ daemonId: config.daemonId, version: config.version, ddFlowBin: config.ddFlowBin, nodeBin: process.execPath, ddFlowHome: config.ddFlowHome, projectRoot: config.projectRoot })});\n`;
+  const source = `import { makeOpenCodePlugin } from ${JSON.stringify(new URL("./opencode-plugin.mjs", import.meta.url).href)};\nexport default makeOpenCodePlugin(${JSON.stringify({ stateDir: paths.dir, daemonId: config.daemonId, version: config.version, ddFlowBin: config.ddFlowBin, nodeBin: process.execPath, ddFlowHome: config.ddFlowHome, projectRoot: config.projectRoot, resourceHome: config.resourceHome })});\n`;
   const checksum = createHash("sha256").update(source).digest("hex"); await writeFile(path.join(directory, "dd-flow.js"), source, { mode: 0o600 }); return checksum;
 }
 async function prepare(paths, config, authSource) {
@@ -136,7 +140,7 @@ async function importArchive(config, client) {
 export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000) {
   const state = await readState(stateDir);
   if (state && state.schema_id !== STATE_SCHEMA) throw new DaemonError("legacy_opencode_state", "Use archive/opencode-v1-final-beta134 for v1 states; the v2 adapter cannot dispatch to a legacy daemon", false, { effect: "no_effect" });
-  const request = { schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params };
+  const request = prepareDaemonRequest({ schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params });
   return await callDaemonObserved({ stateDir, socket: locations(stateDir).socket, request, responseSchema: RESPONSE_SCHEMA, harness: 'opencode', timeoutMs });
 }
 function sameConfig(state, config) { return ["cwd","journal","bin","provider","model","variant","agent","projectRoot","ddFlowBin","ddFlowHome","sessionArchive","resourceHome","noFlow","configSource","authSource"].every(key => (state.config?.[key] ?? null) === (config[key] ?? null)); }
@@ -187,13 +191,15 @@ export class Runtime {
   }
   async describe(id) {
     const [info, messages, children, statuses] = await Promise.all([this.client.inspect(id), this.client.messages(id), this.childTree(id), this.client.statuses()]);
-    if (!info.directory || path.resolve(info.directory) !== path.resolve(this.state.config.cwd)) throw new DaemonError("foreign_session", "OpenCode Session directory is outside the controlled workspace");
     const parent = info.fork ? null : info.parentID ?? null, existing = this.sessions.get(id);
+    if (info.id !== id || !existing && (!parent || !this.sessions.has(parent) || info.fork)
+      || existing && (existing.parent_provider_session_id ?? null) !== parent) throw new DaemonError("foreign_session", "OpenCode Session is not in the retained owned tree");
     const record = { provider_session_id: id, adapter_session_id: id, parent_provider_session_id: parent,
       root_provider_session_id: parent ? this.sessions.get(parent)?.root_provider_session_id ?? parent : existing?.root_provider_session_id ?? id, cwd: info.directory };
     this.sessions.set(id, record);
     for (const child of children) {
-      if (!child.directory || path.resolve(child.directory) !== path.resolve(this.state.config.cwd)) throw new DaemonError("foreign_session", "OpenCode child has another workspace");
+      const retained = this.sessions.get(child.id);
+      if (child.fork || retained && retained.parent_provider_session_id !== child.parentID) throw new DaemonError("session_identity_mismatch", "OpenCode child ancestry changed");
       this.sessions.set(child.id, { provider_session_id: child.id, parent_provider_session_id: child.parentID, root_provider_session_id: record.root_provider_session_id, cwd: child.directory });
     }
     const pending = new Map();
@@ -202,6 +208,18 @@ export class Runtime {
       pending.set(session, { ...value, shells: this.client.shells ? (await this.client.shells(session)).filter(shell => shell.status === "running") : [] });
     }
     const busy = session => Boolean(statuses[session] && statuses[session].type !== "idle") || Object.values(pending.get(session)).some(items => items.length > 0);
+    for (const child of children) {
+      const history = await this.client.messages(child.id);
+      const index = history.findLastIndex(message => message.info.role === "user" && message.info.sessionID === child.id);
+      const terminal = index >= 0 && history.slice(index + 1).findLast(message => message.info.role === "idle" && message.info.sessionID === child.id);
+      if (!terminal || busy(child.id)) continue;
+      const outcome = terminal.info.outcome;
+      if (!["succeeded", "failed", "interrupted"].includes(outcome)) continue;
+      Object.assign(child, { status: outcome === "succeeded" ? "completed" : outcome === "failed" ? "failed" : "cancelled",
+        terminal_turn_id: history[index].info.id, native_source: "opencode.v2.session.execution",
+        native_turn_items: { observed: true, possible_effects: true, pending: false },
+        ...(terminal.info.error ? { provider_error: safeProviderError(terminal.info.error) } : {}) });
+    }
     const unsettledChildren = children.filter(child => busy(child.id)).map(child => child.id), status = busy(id) ? "busy" : "idle";
     const lastAssistant = messages.findLast(message => message.info?.role === "assistant");
     const inputIndex = messages.findLastIndex(message => message.info.role === "user");
@@ -212,6 +230,8 @@ export class Runtime {
     if (this.state.config.journal) journalToolObservations(this.state.config.journal, messages.flatMap(message => (message.parts ?? []).map(part => openCodeToolObservation(part, id, message.info?.id))), this.journaledTools);
     return { ...record, observed_profile: { provider: lastAssistant?.info?.providerID ?? info.model?.providerID ?? null, model: lastAssistant?.info?.modelID ?? info.model?.id ?? null, reasoning: lastAssistant?.info?.variant ?? info.model?.variant ?? "default", mode: info.agent ?? null },
       assistant_text: (lastAssistant?.parts ?? []).filter(part => part.type === "text").map(part => part.text ?? "").join(""), info, status,
+      route_conformance: { matches: [info, ...children].every(session => session.directory && path.resolve(session.directory) === path.resolve(this.state.config.cwd)), expected: this.state.config.cwd, actual: info.directory ?? null, actual_provenance: "native_session_readback" },
+      route_violations: [info, ...children].filter(session => !session.directory || path.resolve(session.directory) !== path.resolve(this.state.config.cwd)).map(session => ({ provider_session_id: session.id, expected: this.state.config.cwd, actual: session.directory ?? null, actual_provenance: "native_session_readback" })),
       settled: status === "idle" && !unsettledChildren.length, unsettled_children: unsettledChildren,
       tree_session_ids: treeIds, unsettled_sessions: treeIds.filter(busy),
       tree_observations: treeIds.map(session => ({ provider_session_id: session, status: busy(session) ? "running" : "idle", settled: !busy(session) })),
@@ -235,6 +255,7 @@ export class Runtime {
   }
   async requireSettled(id) {
     const value = await this.describe(id);
+    if (!value.route_conformance.matches) throw new DaemonError("invocation_directory_mismatch", "Owned OpenCode Session has an unexpected workspace", false, { effect: "no_effect", ...value.route_violations[0], native_outcome: value.terminal_status, settled: value.settled });
     if (!value.settled) throw new DaemonError("tree_not_settled", "OpenCode Session is not idle", false, { session_id: id, status: value.status });
     const config = this.state.config;
     if (config.provider && config.model) checkObservedProfile({ ...config, reasoning: config.variant, mode: value.parent_provider_session_id ? "dd-flow-worker" : config.agent }, value.observed_profile);
@@ -254,30 +275,87 @@ export class Runtime {
     } catch (cause) {
       const error = completed ? new DaemonError("operation_observation_lost", "OpenCode returned but its durable observation could not be saved; do not resend", false, { result, cause: errorPayload(cause) }) : cause;
       const failures = [];
-      try { await this.persist({ active_tree: error.details?.effect === "no_effect" ? priorActive : true, active_operation: null }); } catch (secondary) { failures.push(errorPayload(secondary)); }
+      try { await this.persist({ active_tree: error.details?.effect === "no_effect" && error.details?.native_turn_items?.possible_effects !== true ? priorActive : true, active_operation: null }); } catch (secondary) { failures.push(errorPayload(secondary)); }
       try { await this.journal(`${name}.failed`, null); } catch (secondary) { failures.push(errorPayload(secondary)); }
       if (failures.length) error.details = { ...error.details, observation_errors: failures };
       throw error;
     } finally { this.active = null; }
   }
   async cancelTree(id, seen = new Set()) {
+    if (!this.sessions.has(id)) throw new DaemonError("foreign_session", "cannot cancel a Session without daemon ownership");
     if (seen.has(id)) return [];
+    const native = await this.client.inspect(id), retained = this.sessions.get(id);
+    if (native.id !== id || (retained.parent_provider_session_id ?? null) !== (native.fork ? null : native.parentID ?? null)) throw new DaemonError("session_identity_mismatch", "OpenCode cancellation Session ancestry changed");
     seen.add(id);
     const errors = []; let children = [];
     try { children = await this.client.children(id); } catch (error) { errors.push({ session_id: id, phase: "children", ...errorPayload(error) }); }
     for (const child of children) {
-      if (child.parentID !== id || !child.directory || path.resolve(child.directory) !== path.resolve(this.state.config.cwd)) {
+      if (child.parentID !== id || child.fork || this.sessions.has(child.id) && this.sessions.get(child.id).parent_provider_session_id !== id) {
         errors.push({ session_id: child.id, phase: "identity", code: "session_identity_mismatch" }); continue;
       }
-      errors.push(...await this.cancelTree(child.id, seen));
+      this.sessions.set(child.id, { provider_session_id: child.id, parent_provider_session_id: id, root_provider_session_id: this.sessions.get(id)?.root_provider_session_id ?? id, cwd: child.directory });
+      try { errors.push(...await this.cancelTree(child.id, seen)); }
+      catch (error) { errors.push({ session_id: child.id, phase: "cancel_child", ...errorPayload(error) }); }
     }
     try { await this.client.abort(id); } catch (error) { errors.push({ session_id: id, phase: "abort", ...errorPayload(error) }); }
     return errors;
   }
+  async observeHookFailures(current = this.nativeHookOperation) {
+    if (!current || this.nativeHookOperation !== current) return;
+    if (current.reading) return await current.reading;
+    current.reading = readNativeHookFailures(this.paths.dir, current.requests, current, error => this.retainHookFailure(current, error));
+    try { await current.reading; } finally { current.reading = null; }
+  }
+  retainHookFailure(current, error) {
+    if (this.nativeHookOperation !== current || isProvenShellCorrection(error)) return;
+    error.details = { ...error.details, provider_session_id: current.sessionId, native_outcome: "unknown", native_turn_items: { observed: true, possible_effects: true, pending: true } };
+    current.failure ??= error;
+  }
   async dispatch(operation, params, operationId = null) {
     const assertDispatch = captureDispatchGuard(this);
     if (["session.create", "session.prompt", "session.start", "session.fork", "session.resume", "session.archive"].includes(operation)) assertDaemonDispatch(this.paths.dir);
     if (operation === "daemon.status") { const { password, ...config } = this.state.config; return { daemon_id: this.state.daemon_id, pid: process.pid, socket: this.paths.socket, versions: this.state.versions, auth_status: this.state.auth_status, shutdown_state: this.state.shutdown_state, active_tree: this.state.active_tree, active_operation: this.active, sessions: [...this.sessions.values()], config }; }
+    if (operation === "hook.resolve") {
+      const current = this.nativeHookOperation, sessionId = params.sessionId, payload = params.payload;
+      if (!current || !sessionId || typeof payload?.input?.command !== "string" || typeof payload.tool_call_id !== "string" || !payload.tool_call_id || typeof payload.message_id !== "string" || !payload.message_id || !["before", "after"].includes(payload.phase))
+        throw new DaemonError("native_hook_unproven", "OpenCode hook has no exact active operation");
+      let owned = sessionId === current.sessionId || this.sessions.get(sessionId)?.root_provider_session_id === current.sessionId;
+      try {
+        const tree = await this.childTree(current.sessionId);
+        if (sessionId !== current.sessionId && !tree.some(child => child.id === sessionId && !child.fork)) throw new DaemonError("foreign_session", "OpenCode hook Session is outside the owned native tree");
+        owned = true;
+        const native = await this.client.inspect(sessionId), retained = this.sessions.get(sessionId), child = tree.find(item => item.id === sessionId);
+        if (native.id !== sessionId || child && (native.parentID !== child.parentID || native.fork) || retained && (retained.parent_provider_session_id ?? null) !== (native.fork ? null : native.parentID ?? null)) throw new DaemonError("native_hook_identity_conflict", "OpenCode hook Session ancestry changed");
+        if (!native.directory) throw new DaemonError("native_hook_unproven", "OpenCode hook Session directory is unavailable");
+        if (payload.input.workdir !== undefined && typeof payload.input.workdir !== "string") throw new DaemonError("native_hook_unproven", "OpenCode hook workdir must be a string");
+        if (this.nativeHookOperation !== current) throw new DaemonError("native_hook_unproven", "OpenCode operation changed during hook identity observation");
+        const accepted = await acceptNativeHookRequest(this.paths.dir, { daemon_id: this.state.daemon_id, operation_id: current.operationId, turn_generation: current.generation,
+          provider_session_id: sessionId, root_provider_session_id: current.sessionId, tool_call_id: `${payload.message_id}:${payload.tool_call_id}`, event: payload.phase === "after" ? "PostToolUse" : "PreToolUse",
+          command_sha256: createHash("sha256").update(payload.input.command).digest("hex"), native_cwd: path.resolve(native.directory, payload.input.workdir ?? ".") }, current);
+        if (this.nativeHookOperation !== current) throw new DaemonError("native_hook_unproven", "OpenCode operation changed during hook acceptance");
+        current.requests.set(accepted.request_id, { current, binding: accepted }); return { nativeHookBinding: accepted, nativeSession: {
+          id: native.id, directory: native.directory, parentID: native.parentID, projectID: native.projectID,
+          model: { providerID: native.model?.providerID, id: native.model?.id, variant: native.model?.variant }
+        } };
+      } catch (error) {
+        if (owned) this.retainHookFailure(current, error);
+        throw error;
+      }
+    }
+    if (operation === "hook.verify") {
+      const current = this.nativeHookOperation, binding = params.binding;
+      if (!current || binding?.operation_id !== current.operationId || binding?.turn_generation !== current.generation
+        || JSON.stringify(current.requests.get(binding?.request_id)?.binding) !== JSON.stringify(binding)) throw new DaemonError("native_hook_unproven", "OpenCode hook generation is no longer current");
+      return { current: true };
+    }
+    if (operation === "hook.failed") {
+      if (params.failure) {
+        await this.dispatch("hook.verify", { binding: params.binding });
+        if (JSON.stringify(params.failure.details?.native_hook_binding) !== JSON.stringify(params.binding) || !params.failure.details?.receipt_error || typeof params.failure.code !== "string" || typeof params.failure.message !== "string") throw new DaemonError("native_hook_receipt_invalid", "OpenCode fallback hook error is not bound");
+        this.retainHookFailure(this.nativeHookOperation, reportedError(params.failure, "Native hook failed"));
+      }
+      await this.observeHookFailures(); return { observed: true };
+    }
     if (operation === "daemon.doctor") {
       const info = await this.client.health();
       await this.client.call("model.list", { location: { directory: this.state.config.cwd } });
@@ -309,26 +387,33 @@ export class Runtime {
     if (operation === "session.inspect" || operation === "session.resume") { const result = await this.describe(params.sessionId); await this.persist(); return result; }
     if (operation === "session.prompt") { await this.requireSettled(params.sessionId); return this.productive(operation, async () => {
       this.state.operations ??= {}; const key = operationId ?? randomUUID(), retained = this.state.operations[key];
-      assertDispatch(); const reply = await this.client.prompt(params.sessionId, { prompt: params.prompt, messageId: retained?.message_id ?? `msg_${randomUUID().replaceAll("-", "")}`, retained,
+      const current = { operationId: key, sessionId: params.sessionId, generation: (this.state.hook_generation ?? 0) + 1, requests: new Map(), failure: null };
+      this.state.hook_generation = current.generation; this.nativeHookOperation = current;
+      const checkHookFailures = async () => { await this.observeHookFailures(current); if (this.nativeHookOperation !== current) throw new DaemonError("native_hook_unproven", "OpenCode prompt generation changed"); if (current.failure) throw current.failure; };
+      let reply;
+      try { assertDispatch(); reply = await this.client.prompt(params.sessionId, { prompt: params.prompt, messageId: retained?.message_id ?? `msg_${randomUUID().replaceAll("-", "")}`, retained,
       save: async receipt => { this.state.operations[key] = receipt; await this.persist(); },
-      assertDispatch, livenessTimeoutMs: params.livenessTimeoutMs ?? this.client.timeoutMs,
+      assertDispatch, checkHookFailures, livenessTimeoutMs: params.livenessTimeoutMs ?? this.client.timeoutMs,
       onDispatched: () => this.journal("native_dispatch", { operation_id: operationId, provider_session_id: params.sessionId }),
       onModelMessages: (id, messages, parent) => this.observeModels(id, messages, parent),
       onObservationError: error => observeModel({ journal: this.state.config.journal ?? this.paths.journal, harness: "opencode-server", sessionId: params.sessionId, requested: this.state.config, source: "native.message_observer", evidence: "unavailable", reason: error.code ?? "observation_unavailable" })
-    }); const assistant_text = reply.parts.filter(part => part.type === "text").map(part => part.text ?? "").join("");
+    }); await checkHookFailures(); }
+      finally { current.requests.clear(); if (this.nativeHookOperation === current) this.nativeHookOperation = null; }
+      const assistant_text = reply.parts.filter(part => part.type === "text").map(part => part.text ?? "").join("");
       const expectedAgent = this.sessions.get(params.sessionId)?.parent_provider_session_id ? "dd-flow-worker" : this.state.config.agent;
       const reply_profile = { provider: reply.info.providerID ?? null, model: reply.info.modelID ?? null, reasoning: reply.info.variant ?? null, mode: reply.info.mode ?? null };
       checkObservedProfile({ ...this.state.config, reasoning: this.state.config.variant, mode: expectedAgent }, reply_profile);
       let result;
       try { result = await this.describe(params.sessionId); }
-      catch (error) { return { provider_session_id: params.sessionId, adapter_session_id: params.sessionId, assistant_text, response_message_id: reply.info.id, observed_profile: reply_profile, settled: false, settlement_observation_error: errorPayload(error) }; }
+      catch (error) { return { provider_session_id: params.sessionId, adapter_session_id: params.sessionId, assistant_text, response_message_id: reply.info.id, terminal_turn_id: reply.admission_message_id, terminal_status: "completed", native_outcome: "succeeded", observed_profile: reply_profile, settled: false, settlement_observation_error: errorPayload(error) }; }
       result.assistant_text = assistant_text;
+      if (!result.route_conformance.matches) throw new DaemonError("invocation_directory_mismatch", "Owned OpenCode Session moved during execution", false, { ...result.route_violations[0], native_outcome: result.terminal_status, settled: result.settled, result });
       result.response_message_id = reply.info.id;
       result.observed_profile = { ...reply_profile, mode: result.info.agent ?? reply_profile.mode };
       checkObservedProfile({ ...this.state.config, reasoning: this.state.config.variant, mode: expectedAgent }, result.observed_profile); result.usage_ingest_errors = await this.reconcileUsage(result); return result; }); }
     if (operation === "session.fork") { const source = await this.requireSettled(params.sessionId); return this.productive(operation, async () => {
       const info = await this.client.fork(params.sessionId, params.messageId);
-      const created = { provider_session_id: info.id, adapter_session_id: info.id, parent_provider_session_id: info.parentID ?? params.sessionId, root_provider_session_id: this.sessions.get(params.sessionId)?.root_provider_session_id ?? params.sessionId, cwd: info.directory };
+      const created = { provider_session_id: info.id, adapter_session_id: info.id, parent_provider_session_id: info.fork ? null : info.parentID ?? params.sessionId, root_provider_session_id: info.fork ? info.id : this.sessions.get(params.sessionId)?.root_provider_session_id ?? params.sessionId, cwd: info.directory };
       this.sessions.set(info.id, created);
       try {
         const fork = await this.describe(info.id);