@deksden-com/dd-flow-cli 0.9.0-beta.14 → 0.9.0-beta.141

package/dist/services/merge-server.js

@@ -1,11 +1,18 @@
+import { managedInvocationContext, managedLifecycleCommand } from "./lifecycle-invocations.js";
+import { stageLifecycleInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { continueProviderCapacity } from "./provider-capacity.js";
+import { errorRecord } from "./run-controller-state.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
+import { runtimeBudgetForRun } from "./runtime-budget.js";
+import { managedLeaseMonitor } from "./managed-lease-monitor.js";
 import { flowCommand } from "./stage-pause.js";
-import { validateSchema } from "./schema-validation.js";
-import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
+import { adapterSessionId, prepareHarnessFlowExecutable, runHarnessAdapter } from "./harness-adapter.js";
 import { harnessRuntimeArguments, resolveHarnessCommand } from "./harness-config.js";
+import { assertRunMutationAllowed, recoveryGuard } from "./run-recovery.js";
+import { loadAgentProfile, resolveExecutionPolicy, runtimeHarness } from "./execution-policy.js";
 /** A deterministic dispatcher; only the launched harness Session performs agent work. */
 export async function serveMergeRequests(context, input) {
     const running = context.db.get("SELECT server_id, pid FROM merge_servers WHERE status IN ('running','stopping') ORDER BY started_at LIMIT 1");
@@ -58,73 +65,192 @@ export async function serveMergeRequests(context, input) {
 export function mergeServerStatus(context) { return { ok: true, servers: context.db.all("SELECT server_id, profile_id, status, pid, started_at, heartbeat_at, stopped_at, journal_path FROM merge_servers ORDER BY started_at DESC") }; }
 export function stopMergeServer(context, input) { const changed = context.db.run("UPDATE merge_servers SET status = 'stopping', heartbeat_at = ? WHERE server_id = ? AND status = 'running'", [context.now(), input.serverId]); if (changed.changes !== 1)
     throw new AppError("not_found", "Running merge-server was not found", 1, { server_id: input.serverId }); return { ok: true, server_id: input.serverId, status: "stopping" }; }
+/** Both dispatchers enter the same project FIFO before creating any provider Session. */
+export function claimQueuedMergeRequest(context, input) {
+    return context.db.writeTransaction(() => {
+        const request = context.db.get("SELECT merge_request_id, project_id, run_id, executor_work_id, target_workspace, execution_route, status, created_at FROM merge_requests WHERE merge_request_id = ?", [input.requestId]);
+        if (!request)
+            throw new AppError("not_found", "MERGE request was not found", 1);
+        const generation = assertRunMutationAllowed(context, request.project_id, request.run_id, input.expectedGeneration);
+        const earlier = context.db.get("SELECT 1 FROM merge_requests WHERE project_id = ? AND status NOT IN ('completed','failed','cancelled','superseded') AND (created_at < ? OR (created_at = ? AND merge_request_id < ?)) LIMIT 1", [request.project_id, request.created_at, request.created_at, request.merge_request_id]);
+        if (request.status !== "queued" || request.execution_route !== "server" || earlier)
+            return null;
+        const token = crypto.randomUUID();
+        context.db.run("UPDATE merge_requests SET status = 'dispatching', dispatch_owner = ?, dispatch_lease_token = ?, dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'queued'", [input.ownerId, token, new Date(Date.now() + 120_000).toISOString(), context.now(), request.merge_request_id]);
+        return { request, token, generation };
+    });
+}
 async function dispatch(context, input) {
-    const token = crypto.randomUUID();
-    const leaseUntil = new Date(Date.now() + 120_000).toISOString();
-    const claimed = context.db.run("UPDATE merge_requests SET status = 'dispatching', dispatch_owner = ?, dispatch_lease_token = ?, dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'queued' AND execution_route = 'server'", [input.serverId, token, leaseUntil, context.now(), input.request.merge_request_id]);
-    if (claimed.changes !== 1)
+    const run = context.db.get("SELECT index_json, project_root FROM runs WHERE project_id = ? AND id = ?", [input.request.project_id, input.request.run_id]);
+    if (!run)
+        throw new AppError("not_found", "MERGE RUN was not found", 1, { run_id: input.request.run_id });
+    const snapshot = JSON.parse(run.index_json).execution_profile;
+    if (snapshot?.settings?.execution) {
+        if (!snapshot.agent_profiles)
+            throw new AppError("execution_profile_not_frozen", "MERGE dispatch requires frozen RUN agent profiles", 1, { run_id: input.request.run_id });
+        const resolved = resolveExecutionPolicy({ ddFlowHome: context.ddFlowHome, policy: snapshot.settings.execution, profiles: snapshot.agent_profiles, stage: "merge" });
+        input = { ...input, profile: resolved.coordinator };
+    }
+    const claim = claimQueuedMergeRequest(context, { requestId: input.request.merge_request_id, ownerId: input.serverId });
+    if (!claim)
         return;
-    const leaseHeartbeat = setInterval(() => { const now = context.now(); context.db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'dispatching' AND dispatch_owner = ? AND dispatch_lease_token = ?", [new Date(Date.now() + 120_000).toISOString(), now, input.request.merge_request_id, input.serverId, token]); }, 30_000);
-    leaseHeartbeat.unref();
+    const { generation, token } = claim;
     const stateDir = path.join(input.root, input.request.merge_request_id);
     fs.mkdirSync(stateDir, { recursive: true });
     const promptFile = path.join(stateDir, "launch.md");
     const adapterJournal = path.join(stateDir, "adapter.events.jsonl");
-    const stageCommand = `${flowCommand(context)} stage start ${input.request.run_id} --stage merge --project-root ${JSON.stringify(input.request.target_workspace)} --json --progress-jsonl`;
-    fs.writeFileSync(promptFile, `Start the assigned MERGE stage now. Your first tool call must be this exact standalone command:\n\n${stageCommand}\n\nTrust and follow the complete stage packet it returns. Continue through merge apply and stage finish. Stop only when the stage reaches a terminal result or explicitly requests user/operator action.\n`);
+    const flowExecutable = prepareHarnessFlowExecutable(context, stateDir);
+    let runtimeContext = { ...context, env: { ...context.env, DD_FLOW_BIN: flowExecutable } };
+    const runtimeOwner = { schema_id: "dd-flow/runtime-owner@1", owner_id: `run:${input.request.run_id}:merge:${input.request.merge_request_id}`, role: "merge", project_id: input.request.project_id, run_id: input.request.run_id, work_id: input.request.executor_work_id, operation_id: `${input.request.merge_request_id}:${token}`, state_dir: stateDir, dd_flow_home: context.ddFlowHome, dd_flow_bin: flowExecutable, resource_home: context.env.DD_FLOW_RESOURCE_HOME ?? context.ddFlowHome, budget: runtimeBudgetForRun(context, input.request.project_id, input.request.run_id) };
     event(input.journal, { type: "launch_intent", server_id: input.serverId, request_id: input.request.merge_request_id, token, profile: input.profile, prompt_file: promptFile, at: context.now() });
     input.progress?.(`launching ${input.request.merge_request_id} with ${input.profile.id}`);
     const executable = resolveHarnessCommand(context.ddFlowHome, input.profile.harness, "adapter");
-    const common = ["--state-dir", stateDir, "--journal", adapterJournal, "--cwd", input.request.target_workspace, "--provider", input.profile.provider, "--model", input.profile.model, "--reasoning", input.profile.reasoning, "--mode", input.profile.mode, "--permission", input.profile.permission, "--project-root", input.request.target_workspace, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, input.profile.harness), "--json"];
+    const common = ["--dd-flow-bin", flowExecutable, "--state-dir", stateDir, "--journal", adapterJournal, "--cwd", input.request.target_workspace, "--provider", input.profile.provider, "--model", input.profile.model, "--reasoning", input.profile.reasoning, "--mode", input.profile.mode, "--permission", input.profile.permission, "--project-root", run.project_root, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, input.profile.harness), "--json"];
+    const retained = { profile: input.profile, executable, owner: runtimeOwner, session_id: null, state_dir: stateDir, create_operation_id: `${input.request.merge_request_id}:${token}:session.create`, prompt_operation_id: `${input.request.merge_request_id}:${token}:session.prompt` };
+    const retain = () => { const changed = context.db.run("UPDATE merge_requests SET adapter_receipt_json = ?, updated_at = ? WHERE merge_request_id = ? AND dispatch_owner = ? AND dispatch_lease_token = ?", [JSON.stringify(retained), context.now(), input.request.merge_request_id, input.serverId, token]); if (changed.changes !== 1)
+        throw new AppError("capacity_continuation_blocked", "MERGE dispatch owner changed before durable receipt retention", 1); };
+    retain();
+    const lease = managedLeaseMonitor(attemptMs => {
+        const db = context.db.withDeadline(Date.now() + attemptMs);
+        return db.writeTransaction(() => {
+            assertRunMutationAllowed({ ...context, db }, input.request.project_id, input.request.run_id, generation);
+            const expiry = new Date(Date.now() + 120_000).toISOString();
+            const changed = db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status IN ('dispatching','active') AND dispatch_owner = ? AND dispatch_lease_token = ?", [expiry, context.now(), input.request.merge_request_id, input.serverId, token]);
+            return changed.changes === 1 ? { owned: true, lease_expires_at: expiry } : { owned: false };
+        });
+    });
+    const ownership = new AbortController();
+    const leaseHeartbeat = setInterval(() => {
+        lease.background(() => assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation), error => {
+            ownership.abort(error);
+            try {
+                event(input.journal, { type: "dispatch_lease_unconfirmed", request_id: input.request.merge_request_id, error: errorRecord(error), at: context.now() });
+            }
+            catch { /* No unhandled timer exception; the next boundary sees retained monitor failure. */ }
+        });
+    }, 30_000);
+    leaseHeartbeat.unref();
     try {
-        const adapterCall = (args, timeoutMs, progressMessage) => runHarnessAdapter({ executable, args, env: context.env, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), ...(progressMessage ? { progressMessage } : {}), onEvidence: (value) => event(input.journal, { type: "adapter_call", ...value }) });
+        const adapterCall = async (args, timeoutMs, progressMessage, id = `${input.request.merge_request_id}:${token}:${args[0]}.${args[1]}`) => {
+            await lease.ensureConfirmed(() => assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation));
+            try {
+                return await runHarnessAdapter({ executable, args, harness: runtimeHarness(input.profile), env: runtimeContext.env, runtimeOwner, operationId: id, signal: ownership.signal, ...(timeoutMs !== undefined ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), ...(progressMessage ? { progressMessage } : {}), onEvidence: (value) => event(input.journal, { type: "adapter_call", ...value }), onNativeOutcome: value => {
+                        if (args[0] === "session" && args[1] === "create" && adapterSessionId(value)) {
+                            Object.assign(retained, { session_id: adapterSessionId(value), create: value, settlement_pending: true });
+                            retain();
+                        }
+                    } });
+            }
+            catch (error) {
+                if (ownership.signal.aborted)
+                    throw ownership.signal.reason;
+                throw error;
+            }
+        };
         await adapterCall(["daemon", "start", ...common]);
         const created = await adapterCall(["session", "create", ...common]);
         const sessionId = adapterSessionId(created);
         if (!sessionId)
             throw new AppError("merge_adapter_invalid", "Harness adapter did not return a Session id", 1, { harness: input.profile.harness, response: created });
-        const prompted = await adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} is still running`);
+        Object.assign(retained, { session_id: sessionId, create: created, settlement_pending: false });
+        retain();
+        runtimeContext = managedInvocationContext(runtimeContext, { harness: runtimeHarness(input.profile), stateDir, sessionId, projectRoot: run.project_root, runId: input.request.run_id, generation });
+        const stageCommand = managedLifecycleCommand(runtimeContext, `${flowCommand(runtimeContext)} stage start ${input.request.run_id} --stage merge --project-root ${JSON.stringify(run.project_root)} --json --progress-jsonl`);
+        fs.writeFileSync(promptFile, `Start the assigned MERGE stage now. Your first tool call must be this exact standalone command:\n\n${stageCommand}\n\nTrust and follow the complete stage packet it returns. Continue through merge apply and stage finish. Stop only when the stage reaches a terminal result or explicitly requests user/operator action.\n\n${stageLifecycleInstruction}\n`);
+        let prompted;
+        retained.progress_policy = "native-inactivity@1";
+        retain();
+        try {
+            prompted = await adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], null, `MERGE ${input.request.merge_request_id} Session ${sessionId} is still running`);
+        }
+        catch (error) {
+            const capacityIntents = (retained.capacity_intents ?? []);
+            const capacityFailures = (retained.capacity_failures ?? []);
+            const resumed = await continueProviderCapacity({ error, sessionId, operationId: String(retained.prompt_operation_id), allowSettledDescendants: true,
+                signal: ownership.signal,
+                continuationText: `Continue only MERGE ${input.request.merge_request_id}, Work ${input.request.executor_work_id}, RUN ${input.request.run_id} in this same Session and target ${input.request.target_workspace}. First inspect current durable Stage/Work/MERGE receipts. Never repeat Stage start, accepted answer, completed apply or checks. Follow only the current exact issued successor and stop at the original boundary.`,
+                retainedIntents: () => capacityIntents,
+                retainedFailures: () => capacityFailures,
+                retainFailure: (_id, refusal) => { capacityFailures.push(refusal); retained.capacity_failures = capacityFailures; retain(); },
+                inspectOperation: id => adapterCall(["daemon", "operation", "--state-dir", stateDir, "--operation-id", id, "--json"], 30_000, undefined, `${id}:capacity-observe`),
+                inspectSession: turnId => adapterCall(["session", "inspect", "--session-id", sessionId, ...(turnId ? ["--turn-id", turnId] : []), ...common], 30_000, undefined, `${input.request.merge_request_id}:${token}:capacity-inspect`),
+                assertCurrent: () => {
+                    assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation);
+                    const current = context.db.get("SELECT status, dispatch_owner, dispatch_lease_token, dispatch_lease_expires_at, target_workspace FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id]);
+                    if (current?.status === "completed" || current?.status === "action_required")
+                        return;
+                    if (!current || !["dispatching", "active"].includes(current.status) || current.dispatch_owner !== input.serverId || current.dispatch_lease_token !== token
+                        || current.dispatch_lease_expires_at <= context.now() || current.target_workspace !== input.request.target_workspace)
+                        throw new AppError("capacity_continuation_blocked", "MERGE dispatch owner or target changed during capacity wait", 1, { request_id: input.request.merge_request_id });
+                    if (!["created", "running", "paused", "completed"].includes(context.db.get("SELECT status FROM works WHERE work_id = ?", [input.request.executor_work_id])?.status ?? ""))
+                        throw new AppError("capacity_continuation_blocked", "MERGE Work has failed or lost its binding", 1);
+                },
+                decision: () => {
+                    const status = context.db.get("SELECT status FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id])?.status;
+                    const workStatus = context.db.get("SELECT status FROM works WHERE work_id = ?", [input.request.executor_work_id])?.status;
+                    return status === "completed" ? "completed" : status === "action_required" || workStatus === "paused" ? "paused" : "continue";
+                },
+                retainIntent: intent => { capacityIntents.push(intent); retained.capacity_intents = capacityIntents; retained.capacity_intent = intent; retain(); },
+                prompt: (id, text, ordinal) => {
+                    const file = path.join(stateDir, `capacity-${ordinal}.md`);
+                    if (fs.existsSync(file)) {
+                        if (fs.readFileSync(file, "utf8") !== text)
+                            throw new AppError("capacity_continuation_conflict", "Retained MERGE continuation prompt differs", 1);
+                    }
+                    else
+                        fs.writeFileSync(file, text, { flag: "wx", mode: 0o600 });
+                    return adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", file, ...common], null, `MERGE ${input.request.merge_request_id} Session ${sessionId} capacity continuation ${ordinal}`, id);
+                } });
+            if (!resumed)
+                throw error;
+            prompted = resumed;
+        }
+        Object.assign(retained, { response: prompted });
+        retain();
+        assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation);
         const request = context.db.get("SELECT status FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id]);
-        context.db.run("UPDATE merge_requests SET adapter_receipt_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ profile: input.profile, executable, session_id: sessionId, response: prompted }), context.now(), input.request.merge_request_id]);
         event(input.journal, { type: "adapter_settled", request_id: input.request.merge_request_id, session_id: sessionId, request_status: request?.status ?? null, at: context.now() });
         if (request?.status === "dispatching")
-            context.db.run("UPDATE merge_requests SET status = 'queued', dispatch_owner = NULL, dispatch_lease_token = NULL, dispatch_lease_expires_at = NULL, last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_did_not_start_stage", response: prompted }), context.now(), input.request.merge_request_id]);
+            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'dispatching' AND dispatch_owner = ? AND dispatch_lease_token = ? AND ? = COALESCE((SELECT MAX(generation) FROM run_recovery_guards WHERE project_id = merge_requests.project_id AND run_id = merge_requests.run_id), 0)", [JSON.stringify({ code: "adapter_did_not_start_stage", response: prompted }), context.now(), input.request.merge_request_id, input.serverId, token, generation]);
     }
     catch (error) {
+        if (error instanceof AppError && ["run_recovery_guarded", "run_recovery_generation_stale"].includes(error.code)) {
+            event(input.journal, { type: "recovery_dispatch_blocked", request_id: input.request.merge_request_id, code: error.code, at: context.now() });
+            throw error;
+        }
         const request = context.db.get("SELECT status FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id]);
-        if (request?.status === "dispatching")
-            context.db.run("UPDATE merge_requests SET status = 'queued', dispatch_owner = NULL, dispatch_lease_token = NULL, dispatch_lease_expires_at = NULL, last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_launch_failed", error: String(error) }), context.now(), input.request.merge_request_id]);
-        else if (request?.status === "active")
-            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_lost_after_stage_start", error: String(error) }), context.now(), input.request.merge_request_id]);
+        if (request?.status === "dispatching" || request?.status === "active")
+            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ? AND status = ? AND dispatch_owner = ? AND dispatch_lease_token = ? AND ? = COALESCE((SELECT MAX(generation) FROM run_recovery_guards WHERE project_id = merge_requests.project_id AND run_id = merge_requests.run_id), 0)", [JSON.stringify({ code: request.status === "dispatching" ? "adapter_launch_failed" : "adapter_lost_after_stage_start", error: errorRecord(error) }), context.now(), input.request.merge_request_id, request.status, input.serverId, token, generation]);
         throw error;
     }
     finally {
+        lease.close();
         clearInterval(leaseHeartbeat);
     }
 }
-function nextServerRequests(context, limit) { const selected = new Set(); return context.db.all("SELECT merge_request_id, project_id, run_id, executor_work_id, target_workspace, execution_route, status, created_at FROM merge_requests WHERE status = 'queued' AND execution_route = 'server' ORDER BY created_at, merge_request_id").filter((request) => { if (selected.has(request.project_id) || context.db.get("SELECT 1 FROM merge_requests WHERE project_id = ? AND status NOT IN ('completed','failed','cancelled','superseded') AND (created_at < ? OR (created_at = ? AND merge_request_id < ?)) LIMIT 1", [request.project_id, request.created_at, request.created_at, request.merge_request_id]))
+function nextServerRequests(context, limit) { const selected = new Set(); return context.db.all("SELECT merge_request_id, project_id, run_id, executor_work_id, target_workspace, execution_route, status, created_at FROM merge_requests WHERE status = 'queued' AND execution_route = 'server' ORDER BY created_at, merge_request_id").filter((request) => { if (guarded(context, request) || selected.has(request.project_id) || context.db.get("SELECT 1 FROM merge_requests WHERE project_id = ? AND status NOT IN ('completed','failed','cancelled','superseded') AND (created_at < ? OR (created_at = ? AND merge_request_id < ?)) LIMIT 1", [request.project_id, request.created_at, request.created_at, request.merge_request_id]))
     return false; selected.add(request.project_id); return true; }).slice(0, limit); }
-function reconcileExpiredDispatches(context) { const expired = context.db.all("SELECT merge_request_id, executor_work_id FROM merge_requests WHERE status = 'dispatching' AND dispatch_lease_expires_at < ?", [context.now()]); for (const request of expired) {
-    const work = context.db.get("SELECT status FROM works WHERE work_id = ?", [request.executor_work_id]);
-    if (work?.status === "created")
-        context.db.run("UPDATE merge_requests SET status = 'queued', dispatch_owner = NULL, dispatch_lease_token = NULL, dispatch_lease_expires_at = NULL, last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "expired_dispatch_requeued" }), context.now(), request.merge_request_id]);
-    else
-        context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "expired_dispatch_with_started_work", work_status: work?.status ?? null }), context.now(), request.merge_request_id]);
-} }
-function loadProfile(context, id) { const file = path.join(context.ddFlowHome, "agent-profiles", `${id}.json`); let value; try {
-    value = JSON.parse(fs.readFileSync(file, "utf8"));
+export function reconcileExpiredDispatches(context) {
+    context.db.writeTransaction(() => {
+        const now = context.now();
+        const expired = context.db.all("SELECT merge_request_id, executor_work_id, project_id, run_id, dispatch_owner, dispatch_lease_token, dispatch_lease_expires_at FROM merge_requests WHERE status = 'dispatching' AND dispatch_lease_expires_at < ?", [now]);
+        for (const request of expired) {
+            if (guarded(context, request))
+                continue;
+            const work = context.db.get("SELECT status FROM works WHERE work_id = ?", [request.executor_work_id]);
+            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'dispatching' AND dispatch_owner IS ? AND dispatch_lease_token IS ? AND dispatch_lease_expires_at = ? AND dispatch_lease_expires_at < ?", [JSON.stringify({ code: "expired_dispatch_outcome_unknown", work_status: work?.status ?? null }), now, request.merge_request_id, request.dispatch_owner, request.dispatch_lease_token, request.dispatch_lease_expires_at, now]);
+        }
+    });
 }
-catch (error) {
-    throw new AppError("agent_profile_missing", "Merge-server agent profile is unavailable", 1, { id, file, cause: String(error) });
-} validateSchema({ schemaName: "agent-profile", file }); if (value.id !== id)
-    throw new AppError("agent_profile_invalid", "Agent profile id does not match its requested filename", 2, { file, expected: id, actual: value.id ?? null }); return value; }
+function loadProfile(context, id) { return loadAgentProfile(context.ddFlowHome, id); }
 function event(file, value) { fs.appendFileSync(file, `${JSON.stringify(value)}\n`); }
+function guarded(context, request) { const guard = recoveryGuard(context, request.project_id, request.run_id); return Boolean(guard && ["draining", "sealed", "resuming"].includes(guard.status)); }
 function delay(ms) { return new Promise((resolve) => setTimeout(resolve, ms)); }
 function processAlive(pid) { if (!pid)
     return false; try {
     process.kill(pid, 0);
     return true;
 }
-catch {
-    return false;
+catch (error) {
+    return error.code !== "ESRCH";
 } }

package/dist/services/migrations.js

@@ -6,10 +6,12 @@ import { requireProjectByRoot } from "./projects.js";
 import { getProjectVersionStatus, resolveStatusProjectRoot } from "./version-status.js";
 import { resolveCanonRoot } from "./canon.js";
 import { getDatabase } from "../storage/database.js";
+import { cleanupScopeWriters } from "./scope-writer-cleanup.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { classifyCliOperation } from "./cli-operation-classifier.js";
 import { compatibilityContexts, selectEngine } from "./engines.js";
 import { getCliBuildInfo } from "./build-info.js";
+import { prepareJsonFile } from "../cli/input-preparation.js";
 export function assessMigrationImpact(context, input) {
     const root = resolveStatusProjectRoot({ requestedRoot: input.projectRoot, cwd: process.cwd() });
     if (!root.root)
@@ -147,7 +149,7 @@ export function planMigration(context, input) {
         }
     };
 }
-export function applyMigration(context, input) {
+export function prepareMigrationApply(context, input) {
     const classification = input.classification ?? classifyCliOperation(["migration", "apply"], context.env);
     if (classification.mode !== "mb_upgrade") {
         throw new AppError("upgrade_authorization_required", "Migration apply requires explicit mb-upgrade authorization", 1, {
@@ -197,7 +199,33 @@ export function applyMigration(context, input) {
         });
     }
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const current = activeStateSummary(context, project.id);
+    if (activeStateBlockers(current).length)
+        throw new AppError("migration_active_state", "Migration apply requires a quiescent shared home", 1, { active_state: current });
+    return { project, sourceVersion, targetVersion, verifiedBackup, reportEngine, chain };
+}
+export function applyMigration(context, input, prepared = prepareMigrationApply(context, input)) {
     const writeDb = getDatabase(context.ddFlowHome, "migrate");
+    let result, primary, failed = false;
+    try {
+        result = applyPreparedMigration(context, prepared, writeDb);
+    }
+    catch (error) {
+        primary = error;
+        failed = true;
+    }
+    const cleanup = cleanupScopeWriters([{ name: writeDb.path, db: writeDb, rollback: false, close: "always" }]);
+    if (failed) {
+        if (primary instanceof AppError && cleanup.length)
+            primary.details.migration_cleanup_errors = cleanup;
+        throw primary;
+    }
+    if (cleanup.length)
+        throw new AppError("migration_cleanup_failed", "Migration receipt is available but its connection could not be closed", 1, { effect: result?.changed ? "committed" : "no_effect", migration_cleanup_errors: cleanup });
+    return result;
+}
+function applyPreparedMigration(context, prepared, writeDb) {
+    const { project, sourceVersion, targetVersion, verifiedBackup, reportEngine, chain } = prepared;
     const already = writeDb.get("SELECT value_json FROM runtime_config WHERE key = ?", [applyKey(project.id, sourceVersion, targetVersion)]);
     if (already) {
         return { ok: true, schema_id: "dd-flow/mb-upgrade-migration-apply@1", status: "verified_noop", changed: false, backup: verifiedBackup, recovery: JSON.parse(already.value_json) };
@@ -217,15 +245,14 @@ export function applyMigration(context, input) {
         chain: chain.steps.map((step) => ({ ...step, status: "applied" }))
     };
     try {
-        writeDb.exec("BEGIN IMMEDIATE");
-        writeDb.run(`INSERT INTO runtime_config (key, value_json, created_at, updated_at) VALUES (?, ?, ?, ?)`, [applyKey(project.id, sourceVersion, targetVersion), JSON.stringify(result), context.now(), context.now()]);
-        writeDb.exec("COMMIT");
+        writeDb.writeTransaction(() => {
+            const current = activeStateSummary({ ...context, db: writeDb }, project.id);
+            if (activeStateBlockers(current).length)
+                throw new AppError("migration_active_state", "Migration apply requires a quiescent shared home", 1, { active_state: current });
+            writeDb.run(`INSERT INTO runtime_config (key, value_json, created_at, updated_at) VALUES (?, ?, ?, ?)`, [applyKey(project.id, sourceVersion, targetVersion), JSON.stringify(result), context.now(), context.now()]);
+        });
     }
     catch (error) {
-        try {
-            writeDb.exec("ROLLBACK");
-        }
-        catch { /* preserve the original failure */ }
         throw new AppError("migration_apply_failed", "Migration apply failed before upgrade RUN creation or canon sync", 1, {
             recovery: {
                 status: "required",
@@ -235,7 +262,7 @@ export function applyMigration(context, input) {
                 rollback_route: "restore the verified backup before retrying mb-upgrade apply",
                 next_action: "inspect the failed apply and retry only with the same pinned target contract"
             },
-            cause: String(error)
+            cause: error instanceof AppError ? { code: error.code, message: error.message, details: error.details } : String(error)
         });
     }
     return { ok: true, schema_id: "dd-flow/mb-upgrade-migration-apply@1", status: "applied", changed: true, backup: verifiedBackup, recovery: result };
@@ -513,13 +540,7 @@ function activeStateBlockers(active) {
     return blockers;
 }
 function readJsonObject(filePath) {
-    let parsed;
-    try {
-        parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
-    }
-    catch (error) {
-        throw new AppError("invalid_json", `Cannot read migration report: ${filePath}`, 2, { cause: String(error) });
-    }
+    const { value: parsed } = prepareJsonFile(filePath, "Migration report");
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         throw new AppError("validation", "Migration report must be a JSON object", 2, { file: filePath });
     }

package/dist/services/model-catalog.js

@@ -0,0 +1,109 @@
+import { AppError } from "../shared/errors.js";
+import { validateHybridContract } from "./hybrid-contracts.js";
+import { mergeModelListing } from "./model-discovery.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+// Reviewed adapter fallbacks and retained eval configurations, not vendor
+// availability promises or recommended defaults. Missing facts stay unknown;
+// historical eval qualification/capacity claims are deliberately not imported.
+const seed = {
+    schema_id: "dd-flow/model-catalog@1", version: "1.1.0",
+    entries: [{ harness: "agy", provider: "google", model: "gemini-3.1-pro-high",
+            settings: { reasoning: ["unknown"], mode: ["unknown"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-flow-cli/blob/2ba2ce2364705cf59fdc48bdd5dc5b37fb7cd784/src/harness-runtime/lib/dd-agy.mjs#L7",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "grok", provider: "xai", model: "grok-4.6",
+            settings: { reasoning: ["high"], mode: ["bypassPermissions"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-flow-cli/blob/2ba2ce2364705cf59fdc48bdd5dc5b37fb7cd784/src/harness-runtime/lib/dd-grok.mjs#L48",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "codex", provider: "unknown", model: "gpt-6.1-sol",
+            settings: { reasoning: ["high"], mode: ["unknown"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/codex-desktop-gpt-6-1-sol-high.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "zcode", provider: "builtin:zai-coding-plan", model: "GLM-5.3",
+            settings: { reasoning: ["high"], mode: ["yolo"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/zcode-acp-zai-glm-5-3-high.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "opencode", provider: "opencode", model: "big-pickle",
+            settings: { reasoning: ["default"], mode: ["build"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/opencode-server-opencode-big-pickle-default.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } },
+        { harness: "droid", provider: "openai", model: "gpt-5.6-sol",
+            settings: { reasoning: ["high"], mode: ["auto-high"] },
+            provenance: { kind: "reviewed-seed", source: "https://github.com/deksden-com/dd-eval/blob/9715970544096fc0288ac8e18f95d4e35997be54/profiles/droid-cli-openai-gpt-5-6-sol-high.json",
+                reviewed_at: "2026-10-07T00:00:00Z" }, availability: "not-observed", qualification: { scope: "seed-only", evidence: null } }]
+};
+const families = ["codex", "zcode", "agy", "opencode", "grok", "droid"];
+const identifier = (value, max = 128) => typeof value === "string" && value.length <= max && /^[A-Za-z0-9][A-Za-z0-9._:/+-]*$/.test(value);
+const providerId = (value) => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value);
+function invalid() {
+    throw new AppError("model_catalog_input", "Model catalog input requires reviewed seed data and an explicit observation scope; see dd-flow models --help", 2, { effect: "no_effect", help: "models" });
+}
+function readJson(file) {
+    let bytes;
+    try {
+        bytes = readBoundedReleaseFile(file, 4 * 1024 * 1024);
+    }
+    catch {
+        throw new AppError("model_input_unavailable", "Model input must be a bounded readable regular file; see dd-flow models --help", 1, { effect: "no_effect", help: "models" });
+    }
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return invalid();
+    }
+}
+export function readModelSeed(file) {
+    const input = file === undefined ? structuredClone(seed) : readJson(file);
+    if (validateHybridContract("model-catalog", input).length)
+        invalid();
+    const catalog = input;
+    if (catalog.entries.length > 10_000 || catalog.entries.some(entry => {
+        let source;
+        try {
+            source = new URL(entry.provenance.source);
+        }
+        catch {
+            return true;
+        }
+        const reviewed = entry.provenance.reviewed_at;
+        return entry.qualification.scope !== "seed-only" || !providerId(entry.provider) || !identifier(entry.model, 256)
+            || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(reviewed) || !Number.isFinite(Date.parse(reviewed))
+            || new Date(reviewed).toISOString() !== reviewed.replace(/Z$/, reviewed.includes(".") ? "Z" : ".000Z")
+            || source.protocol !== "https:" || source.username !== "" || source.password !== "" || source.search !== ""
+            || entry.provenance.source.length > 2048
+            || [...entry.settings.reasoning, ...entry.settings.mode].some(value => !identifier(value, 64));
+    }))
+        invalid();
+    return structuredClone(catalog);
+}
+/** Offline reader only. A supplied snapshot is an observation, not account authorization. */
+export function listOperatorModels(input) {
+    if (input.harness !== undefined && !families.includes(input.harness) || input.provider !== undefined && !providerId(input.provider)
+        || input.model !== undefined && !identifier(input.model, 256)
+        || input.accountSha256 !== undefined && !/^[a-f0-9]{64}$/.test(input.accountSha256)
+        || (input.accountSha256 !== undefined || input.observationFile !== undefined) && (!input.harness || !input.provider || !input.accountSha256))
+        invalid();
+    // Validate all selectors before opening operator files.
+    const catalog = readModelSeed(input.seedFile);
+    let entries, reason, observedAt = null;
+    if (input.accountSha256) {
+        const scope = { harness: input.harness, provider: input.provider, account_sha256: input.accountSha256 };
+        const observation = input.observationFile === undefined ? undefined : readJson(input.observationFile);
+        const merged = mergeModelListing(catalog, scope, observation);
+        entries = merged.entries.map(entry => ({ harness: scope.harness, provider: scope.provider, ...entry }));
+        reason = merged.reason;
+        observedAt = merged.observed_at;
+    }
+    else {
+        entries = catalog.entries.filter(entry => (!input.harness || entry.harness === input.harness) && (!input.provider || entry.provider === input.provider))
+            .map(entry => ({ harness: entry.harness, provider: entry.provider, model: entry.model, seed: structuredClone(entry),
+            availability: "unknown", account_access: "unknown", qualified: "unknown" }));
+        reason = "account_scope_not_selected";
+    }
+    if (input.model)
+        entries = entries.filter(entry => entry.model === input.model);
+    return { catalog_version: catalog.version, observed_at: observedAt, reason, entries,
+        families: families.map(harness => ({ harness, seed_status: catalog.entries.some(entry => entry.harness === harness) ? "reviewed_entries" : "not_curated",
+            account_access: "unknown", qualified: "unknown" })) };
+}

package/dist/services/model-discovery.js

@@ -0,0 +1,46 @@
+import { AppError } from "../shared/errors.js";
+import { validateHybridContract } from "./hybrid-contracts.js";
+const invalid = () => new AppError("model_discovery_input", "Model discovery input does not match its scoped contract", 2, { effect: "no_effect" });
+export function validateModelScope(scope) {
+    if (!scope || typeof scope !== "object" || Array.isArray(scope)
+        || ["harness", "provider", "account_sha256"].some(key => !Object.hasOwn(scope, key))
+        || Object.keys(scope).some(key => !["harness", "provider", "account_sha256"].includes(key))
+        || !["codex", "zcode", "agy", "opencode", "grok", "droid"].includes(scope.harness)
+        || typeof scope.provider !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(scope.provider)
+        || typeof scope.account_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(scope.account_sha256))
+        throw invalid();
+}
+/** Merge only a matching account/provider snapshot. Listed is not authorized or qualified. */
+export function mergeModelListing(seed, scope, observation) {
+    validateModelScope(scope);
+    if (validateHybridContract("model-catalog", seed).length)
+        throw invalid();
+    if (observation !== undefined) {
+        if (!observation || typeof observation !== "object" || Array.isArray(observation)
+            || ["scope", "observed_at", "status", "complete", "models"].some(key => !Object.hasOwn(observation, key)))
+            throw invalid();
+        validateModelScope(observation.scope);
+        if (Object.keys(observation).some(key => !["scope", "observed_at", "status", "complete", "models"].includes(key))
+            || typeof observation.observed_at !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(observation.observed_at)
+            || !Number.isFinite(Date.parse(observation.observed_at))
+            || new Date(observation.observed_at).toISOString() !== observation.observed_at.replace(/Z$/, observation.observed_at.includes(".") ? "Z" : ".000Z")
+            || !["listed", "unavailable"].includes(observation.status)
+            || typeof observation.complete !== "boolean" || !Array.isArray(observation.models)
+            || observation.models.length > 10_000 || observation.models.some(model => typeof model !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,255}$/.test(model))
+            || new Set(observation.models).size !== observation.models.length
+            || observation.status === "unavailable" && (observation.models.length > 0 || observation.complete))
+            throw invalid();
+    }
+    const matches = observation && observation.scope.harness === scope.harness && observation.scope.provider === scope.provider
+        && observation.scope.account_sha256 === scope.account_sha256;
+    const listing = matches && observation.status === "listed" ? observation : undefined;
+    const entries = seed.entries.filter(entry => entry.harness === scope.harness && entry.provider === scope.provider);
+    const seeded = new Map(entries.map(entry => [entry.model, entry]));
+    const names = new Set([...seeded.keys(), ...(listing?.models ?? [])]);
+    return { scope: { ...scope }, observed_at: matches ? observation.observed_at : null,
+        reason: !observation ? "not_observed" : !matches ? "foreign_scope_ignored" : !listing ? "listing_unavailable" : "scoped_listing",
+        entries: [...names].sort().map(model => ({ model,
+            seed: seeded.has(model) ? structuredClone(seeded.get(model)) : null,
+            availability: listing?.models.includes(model) ? "listed" : listing?.complete ? "not_listed" : "unknown",
+            account_access: "unknown", qualified: "unknown" })) };
+}

package/dist/services/native-daemon-history.js

@@ -0,0 +1,49 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { managedProcessBinding, managedProcessStatus, processTreeIsAlive, resourceHome, retainedResourceHomeMatches } from "./managed-processes.js";
+import { retainedDaemonOperations } from "./run-control.js";
+import { managedProviderBelongsToDaemon } from "./managed-daemon-binding.js";
+/** A replaced daemon is a settled resource, never another Session to resume. */
+export function historicalDaemonSettlement(context, scopeId, record) {
+    const metadata = JSON.parse(record.metadata_json);
+    if (!record.kind.endsWith("-daemon") || !metadata.state_dir || !path.isAbsolute(metadata.state_dir))
+        throw new AppError("runtime_scope_owner_unknown", "Native history requires an absolute daemon directory", 1);
+    const current = JSON.parse(fs.readFileSync(path.join(metadata.state_dir, "daemon.json"), "utf8"));
+    if (current.resource_process?.id === record.id)
+        return null;
+    if (record.state !== "stopped" || record.termination_reason !== "daemon_stopped" || !record.pid || !record.pid_started_at || processTreeIsAlive(record))
+        throw new AppError("runtime_scope_owner_unknown", "Previous daemon has no physical completion proof", 1);
+    const directory = path.join(metadata.state_dir, "daemon-history");
+    const matches = fs.readdirSync(directory).filter(name => /^[a-zA-Z0-9-]+\.json$/.test(name)).map(name => {
+        const file = path.join(directory, name);
+        if (!fs.lstatSync(file).isFile())
+            throw new AppError("runtime_scope_owner_unknown", "Daemon history must contain regular receipts", 1);
+        const bytes = fs.readFileSync(file, "utf8");
+        return { file, bytes, state: JSON.parse(bytes) };
+    }).filter(candidate => candidate.state.resource_process?.id === record.id);
+    if (matches.length !== 1)
+        throw new AppError("runtime_scope_owner_unknown", "Previous daemon has no unique retained receipt", 1);
+    const { file, bytes, state } = matches[0], owner = state.config?.runtime_owner;
+    if (!state.daemon_id || path.basename(file) !== `${state.daemon_id}.json` || !owner || owner.budget?.scope_id !== scopeId || owner.owner_id !== record.owner_id || owner.role !== metadata.role || owner.state_dir !== metadata.state_dir || owner.adapter_executable !== metadata.adapter_executable || owner.dd_flow_home !== metadata.dd_flow_home || !retainedResourceHomeMatches(context, owner.resource_home) || (owner.project_id ?? null) !== record.project_id || (owner.run_id ?? null) !== record.run_id || (owner.work_id ?? null) !== record.work_id || !record.operation_id?.startsWith(`${owner.operation_id}:`) || state.resource_process?.lease_token !== record.lease_token || state.pid !== record.pid)
+        throw new AppError("runtime_scope_owner_unknown", "Archived daemon does not match its registration", 1);
+    const closed = state.shutdown_state === "clean" && state.active_tree === false
+        ? retainedDaemonOperations(metadata.state_dir).find(operation => operation.daemon_id === state.daemon_id && operation.operation === "daemon.stop" && operation.state === "completed" && operation.result?.stopped === true && operation.result?.clean === true) : undefined;
+    const fresh = managedProcessStatus(context).find(item => item.id === record.id);
+    if (!closed || !fresh || fresh.lease_token !== record.lease_token || fresh.pid !== record.pid || fresh.pid_started_at !== record.pid_started_at || fresh.metadata_json !== record.metadata_json || fresh.state !== "stopped" || fresh.termination_reason !== "daemon_stopped" || processTreeIsAlive(fresh) || fs.readFileSync(file, "utf8") !== bytes)
+        throw new AppError("runtime_scope_outcome_unknown", "Previous daemon lacks stable clean shutdown evidence", 1);
+    const providers = managedProcessStatus(context).filter(item => managedProviderBelongsToDaemon(item, fresh, state));
+    if (state.provider_process && (providers.length !== 1 || providers[0].state !== "stopped" || providers[0].termination_reason !== "daemon_stopped" || !providers[0].operation_id?.startsWith(`${owner.operation_id}:`) || processTreeIsAlive(providers[0])))
+        throw new AppError("runtime_scope_outcome_unknown", "Archived provider lacks its exact physical completion proof", 1);
+    return { historical: true, process_id: record.id, role: metadata.role, state_dir: metadata.state_dir, daemon_id: state.daemon_id,
+        processes: providers.map(item => ({ process_id: item.id, native_settled: true, binding: managedProcessBinding(item, resourceHome(context)) })),
+        settled: true, native_settled: true, operation_id: String(closed.operation_id), owner_operation_id: owner.operation_id,
+        inventory_version: crypto.createHash("sha256").update(JSON.stringify([bytes, closed])).digest("hex") };
+}
+export function assertHistoricalDaemonSettlement(context, scopeId, proof) {
+    const record = managedProcessStatus(context).find(item => item.id === proof.process_id);
+    const fresh = record && historicalDaemonSettlement(context, scopeId, record);
+    if (!fresh || proof.historical !== true || proof.native_settled !== true || fresh.inventory_version !== proof.inventory_version)
+        throw new AppError("runtime_scope_inventory_changed", "Archived daemon settlement changed after observation", 1);
+}