@deksden-com/dd-flow-cli 0.9.0-beta.138 → 0.9.0-beta.139

package/dist/services/vnext-protocolize.js

@@ -10,7 +10,7 @@ import { projectFeatureWorktreePath, resolveProjectRoot } from "../storage/paths
 import { previewNextEntityId } from "./ids.js";
 import { registerProtocol } from "./protocols.js";
 import { requireProjectByRoot } from "./projects.js";
-import { advanceFlowRun, appendFlowRunTimelineEvent, attachFlowRunStage, completeFlowRunStage, prepareFlowRunStageAttachment, prepareFlowRunStageCompletion, withStageSettlement, gitFacts, rebindFlowRunWorkspace } from "./runs.js";
+import { advanceFlowRun, appendFlowRunTimelineEvent, attachFlowRunStage, completeFlowRunStage, prepareFlowRunStageAttachment, prepareFlowRunStageCompletion, withStageSettlement, gitFacts, rebindFlowRunWorkspace, publishRunProjections } from "./runs.js";
 import { resolveStageTransition, stageExecutionCwd } from "./execution-policy.js";
 import { validateSchema } from "./schema-validation.js";
 import { assertStageStartHookEvent, hookSessionIdentity } from "./hooks.js";
@@ -21,6 +21,8 @@ import { loadVnextWorkspacePolicy, requireVnextWorkspaceRoute, vnextRunBranch }
 import { readVnextSpecifyResult } from "./vnext-specify.js";
 import { flowCommand, stagePauseCommand, stagePauseCommandTemplate } from "./stage-pause.js";
 import { acceptStageReport, prepareStageReport, publishStageReport } from "./stage-report-renderer.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { assertRunMutationAllowed } from "./run-recovery.js";
 import { currentStagePrompt, applyExternalStageContext, prepareExternalStageContext, renderRunOperationalContext } from "./stage-context.js";
 import { prepareJsonSchema, prepareOutputFile } from "../cli/input-preparation.js";
 import { stageLifecycleInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
@@ -202,7 +204,7 @@ export async function finishVnextProtocolize(context, input) {
             throw new AppError("protocolize_intent_conflict", "Completed PROTOCOLIZE result differs from accepted input", 1, { run_id: run.id });
         const currentStage = acceptedIndex.current_stage ?? [...acceptedIndex.stage_runs].reverse().find(item => item.status === "running" || item.status === "done")?.stage;
         const activeReplay = currentStage === stage && acceptedIndex.status === "running";
-        const resolvedPolicy = activeReplay ? requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" }) : accepted.mechanical?.workspace_route;
+        const resolvedPolicy = activeReplay ? requireVnextWorkspaceRoute(context, { projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" }) : accepted.mechanical?.workspace_route;
         if (activeReplay) {
             if (acceptedIndex.verdict !== "protocolized")
                 advanceFlowRun(context, { settlementStage: "protocolize", projectRoot, runId: run.id, status: "running", verdict: "protocolized", nextAction: "start_plan" });
@@ -212,7 +214,7 @@ export async function finishVnextProtocolize(context, input) {
         return { ok: true, outcome: "protocolized", run_id: run.id, protocol_ids: accepted.semantic.acceptance, workspace_root: run.workspace_root, git_policy: resolvedPolicy, next_action: activeReplay ? "await_plan" : acceptedIndex.next_action, ...("command" in next && next.command ? { next_command: next.command } : {}), next,
             artifacts: { result: resultFile, report_json: file, report_markdown: path.join(root, "stage-report.md"), report_html: path.join(root, "stage-report.html"), protocols: accepted.semantic.acceptance.map(id => path.join(run.workspace_root, ".memory-bank/protocol", id, "summary.md")) } };
     }
-    const resolvedPolicy = requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" });
+    const resolvedPolicy = requireVnextWorkspaceRoute(context, { projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" });
     const acceptedObligations = acceptedSpecifyObligations(context, projectRoot, run.id, path.join(requireRunHome(run), "01-specify", "specify.json"));
     let obligations;
     try {
@@ -699,6 +701,11 @@ function renderPrompt(input) {
     return ["<work_context>", `- RUN: ${input.runId}`, `- Work: ${input.workId}`, `- Accepted SPECIFY JSON: ${input.specifyPath}`, `- Handoff: ${input.handoff.stage_handoff.effective}`, "</work_context>", "", "<accepted_obligations>", obligationList, "</accepted_obligations>", "", "<frozen_git_policy>", `- route: ${input.policy.route}`, `- integration branch: ${input.policy.integration_branch ?? "not applicable"}`, `- base ref: ${input.policy.base_ref ?? "not applicable"}`, `- feature branch: ${input.policy.feature_branch ?? "not applicable"}`, `- service worktree: ${input.policy.worktree_path ?? "not applicable"}`, `- bootstrap: ${input.policy.bootstrap_status}`, `- decision: ${input.policy.reason}`, "The CLI already created and bootstrapped this workspace at PROTOCOLIZE start. Do not create branches, worktrees, protocol files or Git commits yourself. This transition Work may run from the stable session; edit only the supplied RUN result file.", "</frozen_git_policy>", "", "<catalog>", input.catalog.length ? input.catalog.map((x) => `- ${x}`).join("\n") : "- inactive", "</catalog>", "", "<stage_instructions>", input.template.trim(), "</stage_instructions>", "", "<output_contract>", `Edit only ${input.resultPath}. Keep this exact JSON shape; CLI allocates ids and writes PRT/PSET/feature documents in the already provisioned workspace:\n\n\`\`\`json\n${JSON.stringify(resultTemplate(input.obligations), null, 2)}\n\`\`\``, "obligation_id values and their one-per-obligation entries are prefilled by the CLI. Preserve those IDs exactly; change only member_keys when semantic ownership requires it. The CLI rejects unknown, duplicate or missing obligations, and every member must own at least one AC-*.", "If PROTOCOLIZE itself exposes a material user decision with no reasonable default, do not finish and do not return to SPECIFY. Write the question packet to the named text file, then run the separate standalone lifecycle command below. Do not combine file creation and dd-flow in one shell command:", "```sh", input.pauseCommandTemplate, "```", "Ask the returned user_message and stop. Resume this same PROTOCOLIZE Work using the exact command returned by pause.", `When the answer is incorporated and the result is protocolized, finish:\n\n${input.finishCommand}`, stageLifecycleInstruction, "</output_contract>", ""].join("\n");
 }
 function prepareWorkspaceForProtocolize(context, projectRoot, projectId, run, stageRoot) {
+    // A committed rebind may have survived a projection crash. Repair only from
+    // its SQL authority before considering physical creation again.
+    const stored = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, run.id]);
+    if (stored && JSON.parse(stored.index_json).workspace_route)
+        publishRunProjections(context, projectId, run.id);
     const receiptPath = path.join(stageRoot, "workspace-route.json");
     if (fs.existsSync(receiptPath))
         return { kind: "retained", policy: readWorkspaceRouteReceipt(stageRoot).policy };
@@ -727,7 +734,9 @@ function prepareWorkspaceForProtocolize(context, projectRoot, projectId, run, st
         throw error;
     }
     prepareManagedWorktreeBootstrapSources(projectRoot);
-    return { kind: "feature", receiptPath, config, stableFacts, sessionMode, branch, create };
+    return { kind: "feature", receiptPath, config, stableFacts, sessionMode, branch, create,
+        expectedRevision: stored ? JSON.parse(stored.index_json).runtime_revision ?? 0 : 0,
+        expectedGeneration: assertRunMutationAllowed(context, projectId, run.id) };
 }
 async function provisionWorkspaceForProtocolize(context, projectRoot, run, prepared) {
     if (prepared.kind === "retained")
@@ -740,9 +749,14 @@ async function provisionWorkspaceForProtocolize(context, projectRoot, run, prepa
     const { config, stableFacts, sessionMode, branch, create } = prepared;
     const created = await createManagedWorktree(context, create, create);
     const bootstrap = await bootstrapManagedWorktree(context, { projectRoot, worktreePath: created.worktreePath });
-    rebindFlowRunWorkspace(context, { projectRoot, runId: run.id, workspaceRoot: created.worktreePath, reason: "PROTOCOLIZE start provisioned the configured feature-worktree route" });
     const policy = { route: "feature_worktree", integration_branch: config.workspace.integration_branch, base_ref: stableFacts.head, feature_branch: branch, worktree_path: created.worktreePath, reason: "Project workspace configuration requires a managed feature worktree before durable protocol documents exist.", provision_stage: "protocolize_start", stage_session_mode: sessionMode, provisioned: true, bootstrap_status: bootstrap.status };
-    writeJson(receiptPath, { schema_id: "dd-flow/vnext-workspace-route@1", policy, created, bootstrap });
+    const receipt = { schema_id: "dd-flow/vnext-workspace-route@1", policy,
+        created: { worktreePath: created.worktreePath, worktrunk: created.worktrunk, command: [], result: { exit_code: 0, stdout: "", stderr: "" }, response: { workspace_path: created.worktreePath } },
+        bootstrap: { status: bootstrap.status, commands: [] },
+        proof: { creation_sha256: hybridDigest(created), bootstrap_sha256: hybridDigest(bootstrap) } };
+    rebindFlowRunWorkspace(context, { projectRoot, runId: run.id, workspaceRoot: created.worktreePath, routeReceipt: receipt,
+        expectedRevision: prepared.expectedRevision, expectedGeneration: prepared.expectedGeneration,
+        reason: "PROTOCOLIZE start provisioned the configured feature-worktree route" });
     return policy;
 }
 function readWorkspaceRouteReceipt(root) {

package/dist/services/vnext-workspace-policy.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { AppError } from "../shared/errors.js";
-import { gitFacts } from "./runs.js";
+import { gitFacts, publishRunProjections } from "./runs.js";
 const configRelativePath = path.join(".memory-bank", "dd-flow", "project-workspace.json");
 /** The runtime reads explicit configuration; it never attempts to infer route from policy prose. */
 export function loadVnextWorkspacePolicy(projectRoot) {
@@ -53,8 +53,13 @@ export function vnextRunBranch(policy, run) {
  * The route receipt is the single source of truth after PROTOCOLIZE provisions
  * the workspace. Every later mutating vNext stage calls this before it opens.
  */
-export function requireVnextWorkspaceRoute(input) {
+export function requireVnextWorkspaceRoute(context, input) {
     const file = path.join(input.runHome, "02-protocolize", "workspace-route.json");
+    const stored = context.db.get("SELECT project_id,index_json FROM runs WHERE project_root = ? AND id = ?", [input.projectRoot, input.runId]);
+    // Productive lifecycle readback repairs only SQL-committed projections. The
+    // status command never calls this path and cannot mutate historical files.
+    if (stored && JSON.parse(stored.index_json).workspace_route)
+        publishRunProjections(context, stored.project_id, input.runId);
     let receipt;
     try {
         receipt = JSON.parse(fs.readFileSync(file, "utf8"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.138",
+  "version": "0.9.0-beta.139",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",

package/dist/harness-runtime/lib/codex-capacity-policy.d.mts

@@ -1,10 +0,0 @@
-export const CAPACITY_POLICY: "codex-overload-burst@1";
-export const OVERLOAD_WINDOW_MS: number;
-export type CapacityRefusal = { policy: string; ordinal: number; session_id: string; turn_id: string; first_observed_at: string; native_terminal_at?: string; native_terminal_basis?: string };
-export function parseCapacityOperation(id: string): { root: string; ordinal: number };
-export function normalizeCodexFailure(error: unknown, sessionId?: string, turnId?: string): null | { code: string; session_id: string; turn_id: string; native_error: Record<string, unknown>; observed_at: unknown; terminal_at: unknown; native_turn_items: unknown; primary_error: { details?: Record<string, unknown> } };
-export function terminalCodexOverload(error: unknown, sessionId?: string, turnId?: string): boolean;
-export function nativeItemsSettled(items: unknown): boolean;
-export function capacityBackoff(error: unknown, ordinal: number, now?: number): number;
-export function refusalObservation(error: unknown, ordinal: number, firstObservedAt: string): CapacityRefusal;
-export function overloadBurst(refusals: CapacityRefusal[]): null | { policy: string; basis: string; elapsed_ms: number; refusals: CapacityRefusal[] };

package/dist/harness-runtime/lib/codex-capacity-policy.mjs

@@ -1,102 +0,0 @@
-/** Pure policy shared by the controller and pinned-engine EVAL consumers. */
-export const CAPACITY_POLICY = "codex-overload-burst@1";
-export const OVERLOAD_WINDOW_MS = 120_000;
-
-function policyError(code, message, details = {}) { return Object.assign(new Error(message), { code, details }); }
-
-export function parseCapacityOperation(id) {
-  if (typeof id !== "string" || !id) throw policyError("capacity_continuation_conflict", "Missing capacity operation identity");
-  const match = /^(.*):capacity:(\d+):session\.prompt$/.exec(id);
-  if (!match) return { root: id, ordinal: 0 };
-  const ordinal = Number(match[2]);
-  if (!Number.isSafeInteger(ordinal) || ordinal < 1 || String(ordinal) !== match[2]) throw policyError("capacity_continuation_conflict", "Capacity ordinal is not a canonical positive safe integer", { operation_id: id });
-  return { root: match[1], ordinal };
-}
-
-export function normalizeCodexFailure(error, expectedSessionId, expectedTurnId) {
-  let current = error;
-  for (let depth = 0; depth < 4 && current && typeof current === "object"; depth++) {
-    // The same continuation authority applies to a proven v2 execution
-    // refusal. Never classify transport loss or an active native retry here.
-    if (current.code === "provider_capacity_transient") {
-      const details = current.details ?? {};
-      if (details.native_source !== "opencode.v2.session.execution" || details.terminal_status !== "failed"
-        || typeof details.provider_session_id !== "string" || !details.provider_session_id
-        || typeof details.turn_id !== "string" || !details.turn_id || details.native_turn_id !== details.turn_id
-        || expectedSessionId !== undefined && details.provider_session_id !== expectedSessionId
-        || expectedTurnId !== undefined && details.turn_id !== expectedTurnId) return null;
-      return { code: "serverOverloaded", session_id: details.provider_session_id, turn_id: details.turn_id,
-        native_error: { type: details.native_error_type, status: details.http_status }, observed_at: details.observed_at,
-        terminal_at: null, terminal_basis: null, native_turn_items: details.native_turn_items ?? null, primary_error: current };
-    }
-    if (current.code === "turn_interrupted") {
-      const details = current.details ?? {}, native = details.provider_error;
-      const code = typeof native?.codexErrorInfo === "string" ? native.codexErrorInfo : native?.codexErrorInfo?.code;
-      if (details.terminal_status !== "failed" || typeof details.provider_session_id !== "string" || !details.provider_session_id
-        || expectedSessionId !== undefined && details.provider_session_id !== expectedSessionId
-        || typeof details.turn_id !== "string" || !details.turn_id || details.native_turn_id !== details.turn_id
-        || expectedTurnId !== undefined && details.turn_id !== expectedTurnId || typeof code !== "string") return null;
-      return { code, session_id: details.provider_session_id, turn_id: details.turn_id, native_error: native,
-        observed_at: details.observed_at ?? null, terminal_at: details.terminal_at ?? null, terminal_basis: details.terminal_basis ?? null,
-        native_turn_items: details.native_turn_items ?? null, primary_error: current };
-    }
-    // No arbitrary recursive cause search: an ownership/hook/lifecycle error wins.
-    if (current.code !== "harness_adapter_failed") return null;
-    current = current.details?.cause ?? current.cause;
-  }
-  return null;
-}
-
-export function terminalCodexOverload(error, expectedSessionId, expectedTurnId) {
-  return normalizeCodexFailure(error, expectedSessionId, expectedTurnId)?.code === "serverOverloaded";
-}
-
-export function nativeItemsSettled(items) {
-  return items?.observed === true && typeof items.possible_effects === "boolean" && items.pending !== true
-    && (items.possible_effects === false || items.pending === false);
-}
-
-export function capacityBackoff(error, ordinal, now = Date.now()) {
-  if (!Number.isSafeInteger(ordinal) || ordinal < 1 || !Number.isFinite(now)) throw policyError("capacity_continuation_conflict", "Invalid capacity timing identity");
-  const native = normalizeCodexFailure(error)?.native_error ?? error?.details?.provider_error ?? error;
-  const header = Object.entries(native?.headers ?? {}).find(([key]) => key.toLowerCase() === "retry-after")?.[1];
-  const value = header ?? native?.retryAfter ?? native?.retry_after;
-  let retry = 0;
-  if (value !== undefined && value !== null) {
-    retry = typeof value === "number" || typeof value === "string" && /^\d+(\.\d+)?$/.test(value.trim()) ? Number(value) * 1000 : typeof value === "string" ? Math.max(0, Date.parse(value) - now) : NaN;
-    if (!Number.isFinite(retry) || retry < 0 || !Number.isFinite(now + retry) || now + retry > 8.64e15)
-      throw policyError("capacity_retry_metadata_invalid", "Retry-After cannot be represented safely", { retry_after: value });
-  }
-  return Math.max(ordinal === 1 ? 5_000 : 15_000, retry);
-}
-
-export function refusalObservation(error, ordinal, firstObservedAt) {
-  const failure = normalizeCodexFailure(error);
-  const observed = Date.parse(firstObservedAt);
-  if (!failure || !Number.isSafeInteger(ordinal) || ordinal < 0 || !Number.isFinite(observed))
-    throw policyError("capacity_continuation_conflict", "Refusal lacks an immutable native identity/time");
-  if (failure.observed_at !== null && (typeof failure.observed_at !== "string" || !Number.isFinite(Date.parse(failure.observed_at)) || Date.parse(failure.observed_at) !== observed))
-    throw policyError("capacity_continuation_conflict", "Native refusal observation time is invalid or changed");
-  const native = failure.terminal_at && Date.parse(failure.terminal_at);
-  return { policy: CAPACITY_POLICY, ordinal, session_id: failure.session_id, turn_id: failure.turn_id,
-    first_observed_at: firstObservedAt, ...(Number.isFinite(native) && typeof failure.terminal_basis === "string" && failure.terminal_basis ? { native_terminal_at: failure.terminal_at, native_terminal_basis: failure.terminal_basis } : {}) };
-}
-
-export function overloadBurst(refusals) {
-  for (const [index, refusal] of refusals.entries()) {
-    const previous = refusals[index - 1];
-    if (typeof refusal.first_observed_at !== "string" || !Number.isFinite(Date.parse(refusal.first_observed_at))
-      || previous && Date.parse(refusal.first_observed_at) < Date.parse(previous.first_observed_at))
-      throw policyError("capacity_continuation_conflict", "Refusal observation clock reversed or is invalid");
-  }
-  const continuations = refusals.filter(item => item.ordinal > 0);
-  const pair = continuations.slice(-2);
-  if (pair.length !== 2) return null;
-  const [previous, current] = pair;
-  if (previous.session_id !== current.session_id || previous.turn_id === current.turn_id || current.ordinal !== previous.ordinal + 1)
-    throw policyError("capacity_continuation_conflict", "Refusal chain identity is inconsistent");
-  const basis = previous.native_terminal_at && current.native_terminal_at && previous.native_terminal_basis && previous.native_terminal_basis === current.native_terminal_basis ? "native_terminal_at" : "first_observed_at";
-  const elapsed = Date.parse(current[basis]) - Date.parse(previous[basis]);
-  if (!Number.isFinite(elapsed) || elapsed < 0) throw policyError("capacity_continuation_conflict", "Refusal clock reversed or is invalid");
-  return elapsed <= OVERLOAD_WINDOW_MS ? { policy: CAPACITY_POLICY, basis, elapsed_ms: elapsed, refusals: pair } : null;
-}