@deksden-com/dd-flow-cli 0.9.0-beta.14 → 0.9.0-beta.141

package/dist/harness-runtime/lib/managed-flow-env.mjs

@@ -0,0 +1,15 @@
+/** Final native overlay: launch-bound routing, never inherited invocation authority. */
+export function managedFlowEnv(config, daemonId = config.daemonId) {
+  const managed = !config.noFlow && Boolean(config.ddFlowHome && config.ddFlowBin && daemonId);
+  return {
+    DD_FLOW_DAEMON_ID: managed ? daemonId : undefined,
+    DD_FLOW_HOME: managed ? config.ddFlowHome : undefined,
+    DD_FLOW_BIN: managed ? config.ddFlowBin : undefined,
+    DD_FLOW_RESOURCE_HOME: config.resourceHome ?? undefined,
+    DD_FLOW_RUNTIME_OWNER: managed && config.runtime_owner ? JSON.stringify(config.runtime_owner) : undefined,
+    DD_FLOW_INVOCATION_SCOPE: undefined, DD_FLOW_CURRENT_INVOCATION: undefined,
+    DD_FLOW_SESSION_ID: undefined, DD_FLOW_WORK_ID: undefined, DD_FLOW_CONTROLLER_TOKEN: undefined,
+    DD_FLOW_CONTROL_TOKEN: undefined, DD_FLOW_SCOPE_CONTROL_TOKEN: undefined,
+    DD_FLOW_HOOK_DEADLINE_AT: undefined,
+  };
+}

package/dist/harness-runtime/lib/model-observations.mjs

@@ -0,0 +1,101 @@
+import { createHash } from "node:crypto";
+import { mkdir, open, readFile } from "node:fs/promises";
+import path from "node:path";
+import { withRunnerLock } from "./runner-lock.mjs";
+
+const text = value => typeof value === "string" && value.trim() ? value.trim() : null;
+const fields = ["provider", "model", "reasoning", "mode", "permission_mode"];
+const observationScope = source => JSON.stringify([source?.channel ?? null, source?.scope ?? null, source?.attempt_id ?? null, source?.turn_id ?? null, source?.non_asserting === true]);
+export const observedFields = value => Object.fromEntries(fields.map(key => [key, text(value?.[key])]));
+export const modelObservationFile = journal => path.join(path.dirname(journal), "model-observations.jsonl");
+
+/** Routing is allowed. Permission/autonomy changes remain integrity failures.
+ * Missing native fields are unknown, never proof that the request was applied. */
+export function checkObservedProfile(requested, observed, { strict = false, required = [] } = {}) {
+  const unknown = fields.filter(key => requested?.[key] && !observed?.[key]);
+  const changes = fields.filter(key => requested?.[key] && observed?.[key] && requested[key] !== observed[key]);
+  const violations = changes.filter(key => strict || ["mode", "permission_mode"].includes(key));
+  const missing = required.filter(key => !observed?.[key]);
+  if (violations.length || missing.length) throw Object.assign(new Error("native execution profile integrity is not confirmed"), {
+    code: "profile_integrity_violation", details: { requested: observedFields(requested), observed: observedFields(observed), violations, missing }
+  });
+  return { requested: observedFields(requested), observed: observedFields(observed), status: unknown.length ? "incomplete" : changes.length ? "mixed" : "matched", matched: !unknown.length && !changes.length, unknown, changes };
+}
+
+export async function readModelObservations(journal) {
+  try { const text = await readFile(modelObservationFile(journal), "utf8"); return text.slice(0, text.lastIndexOf("\n") + 1).split("\n").filter(Boolean).map(JSON.parse); }
+  catch (error) { if (error.code === "ENOENT") return []; throw error; }
+}
+
+/** Only adapter-verified native facts enter this file. It records changes,
+ * not every tool or token; reading it never requires replaying native history. */
+export async function observeModel({ journal, harness, sessionId, parentSessionId = null, requested = {}, observed = {}, source, evidence = "configured", reason = null, nativeTimestamp = null, previousModel = null }) {
+  if (!journal || !sessionId) return null;
+  if (!source || !["configured", "request", "response", "unavailable"].includes(evidence)) throw new Error("model observation requires a native source and evidence level");
+  if (typeof source === "string") source = { channel: source, ...(["configured", "response"].includes(evidence) ? { scope: evidence } : {}) };
+  const file = modelObservationFile(journal), profile = observedFields(observed);
+  await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+  return withRunnerLock(file, async () => {
+    const events = await readModelObservations(journal);
+    const replay = source?.event_sha256 ? events.find(item => item.harness === harness && item.session_id === sessionId && observationScope(item.source) === observationScope(source) && item.source?.event_sha256 === source.event_sha256) : null;
+    if (replay) return replay;
+    const previous = events.findLast(item => item.harness === harness && item.session_id === sessionId && observationScope(item.source) === observationScope(source));
+    const normalizedReason = text(reason)?.slice(0, 200) ?? null;
+    if (previous && JSON.stringify(previous.observed) === JSON.stringify(profile) && previous.reason === normalizedReason && previous.evidence === evidence
+      && previous.source?.raw_model === source?.raw_model && previous.source?.raw_provider === source?.raw_provider) return previous;
+    const previousKnown = events.findLast(item => item.harness === harness && item.session_id === sessionId && item.evidence === evidence && item.observed?.model
+      && (item.source?.scope ?? "session") === (source?.scope ?? "session") && (item.source?.attempt_id ?? null) === (source?.attempt_id ?? null));
+    const fromModel = text(previousModel) ?? previousKnown?.observed.model ?? null;
+    const previousRouting = events.findLast(item => item.harness === harness && item.session_id === sessionId && item.evidence === evidence && item.observed?.provider
+      && (item.source?.scope ?? "session") === (source?.scope ?? "session") && (item.source?.attempt_id ?? null) === (source?.attempt_id ?? null));
+    const changed = Boolean(profile.model && fromModel && (profile.model !== fromModel || profile.provider && previousRouting && profile.provider !== previousRouting.observed.provider));
+    const value = { schema_id: "dd-flow/model-observation@1", sequence: events.length + 1,
+      harness, session_id: sessionId, parent_session_id: parentSessionId,
+      kind: changed ? "model_changed" : !profile.model ? "model_observation_unavailable" : "model_observed",
+      previous_model: fromModel, requested: observedFields(requested), observed: profile,
+      source, evidence, reason: normalizedReason, native_timestamp: text(nativeTimestamp), observed_at: new Date().toISOString() };
+    value.id = createHash("sha256").update(JSON.stringify(value)).digest("hex");
+    const handle = await open(file, "a", 0o600);
+    try {
+      const bytes = await readFile(file); const committed = bytes.lastIndexOf(10) + 1;
+      if (committed < bytes.length) await handle.truncate(committed);
+      await handle.write(`${JSON.stringify(value)}\n`); await handle.sync();
+    } finally { await handle.close(); }
+    const directory = await open(path.dirname(file), "r");
+    try { await directory.sync(); } finally { await directory.close(); }
+    return value;
+  });
+}
+
+export function modelAttribution(events, expectedSessions = []) {
+  const sessions = new Map();
+  for (const event of events) {
+    const key = `${event.harness}:${event.session_id}`;
+    const session = sessions.get(key) ?? { harness: event.harness, session_id: event.session_id, parent_session_id: event.parent_session_id, requested: event.requested, observations: [] };
+    session.parent_session_id ??= event.parent_session_id;
+    if (!session.requested || !Object.values(session.requested).some(Boolean)) session.requested = event.requested;
+    session.observations.push(event); sessions.set(key, session);
+  }
+  const observedIds = new Set([...sessions.values()].map(session => session.session_id));
+  const missingSessions = expectedSessions.filter(session => typeof session === "string" ? !observedIds.has(session)
+    : !sessions.has(`${session.harness}:${session.session_id}`));
+  const models = [...new Set(events.map(event => event.observed?.model).filter(Boolean))];
+  const providers = [...new Set(events.map(event => event.observed?.provider).filter(Boolean))];
+  const incomplete = !events.length || missingSessions.length > 0 || [...sessions.values()].some(session => {
+    const known = session.observations.filter(event => event.observed?.model);
+    if (!known.length) return true;
+    const knownScopes = new Set(known.map(event => `${event.evidence}:${event.source?.scope ?? "session"}:${event.source?.attempt_id ?? ""}:${event.source?.turn_id ?? ""}`));
+    return session.observations.some(event => {
+      if (event.source?.non_asserting) return false;
+      if (["configured", "response"].includes(event.evidence) && !event.observed?.model) return true;
+      if (event.evidence !== "unavailable") return false;
+      const scope = event.source?.scope;
+      return !scope || !knownScopes.has(`configured:${scope}:${event.source?.attempt_id ?? ""}:${event.source?.turn_id ?? ""}`)
+        && !knownScopes.has(`response:${scope}:${event.source?.attempt_id ?? ""}:${event.source?.turn_id ?? ""}`);
+    });
+  });
+  return { models, providers, mixed: models.length > 1 || providers.length > 1 || events.some(event => event.observed?.model && event.requested?.model && event.observed.model !== event.requested.model
+    || event.observed?.provider && event.requested?.provider && event.observed.provider !== event.requested.provider),
+    observation_completeness: incomplete ? "incomplete" : "available_native_sources", transitions: events.filter(event => event.kind === "model_changed"),
+    sessions: [...sessions.values()], missing_sessions: missingSessions, usage_attribution: "session_totals_unattributed_to_model", note: "Native settings/events do not prove undisclosed server routing or per-model token costs." };
+}

package/dist/harness-runtime/lib/native-children.d.mts

@@ -0,0 +1,16 @@
+export const NATIVE_CHILD_CONTRACT_VERSION: "native-children@1";
+export function settledNativeTree(root: string, children: Record<string, unknown>[], settled: boolean, rootSettled?: boolean): Record<string, unknown>;
+export function safeNativeFailure(value: unknown): Record<string, unknown> | undefined;
+export interface NativeChild {
+  session_id: string;
+  parent_session_id: string;
+  status: "running" | "unknown" | "completed" | "failed" | "cancelled" | "settled_by_root";
+  source: string;
+  provenance?: "root_child" | "parent_mismatch";
+  terminal_turn_id?: string;
+  terminal_observed_at?: string;
+  provider_error?: unknown;
+  native_source?: "opencode.v2.session.execution" | "agy.result" | "acp.error_response" | "droid.agent_turn_outcome" | "grok.subagent.event";
+  native_turn_items?: { observed?: boolean; possible_effects?: boolean; pending?: boolean };
+}
+export function normalizeNativeChildren(receipt: Record<string, unknown>, rootSessionId: string): NativeChild[];

package/dist/harness-runtime/lib/native-children.mjs

@@ -0,0 +1,113 @@
+export const NATIVE_CHILD_CONTRACT_VERSION = "native-children@1";
+import { errorRecord } from "./operation-errors.mjs";
+import { safeProviderError } from "./provider-overload-policy.mjs";
+
+function nativeFailure(code, message, exitCode, details) { return Object.assign(new Error(message), { code, exitCode, details }); }
+
+/** Project a positively settled native tree, never infer it from missing activity. */
+export function settledNativeTree(root, children, settled, rootSettled = false) {
+  if (settled !== true && rootSettled !== true || typeof root !== "string" || !root || !Array.isArray(children)) return {};
+  const ids = children.map(child => child.provider_session_id ?? child.session_id ?? child.childSessionId ?? child.sessionId);
+  if (ids.some(id => typeof id !== "string" || !id || id === root) || new Set(ids).size !== ids.length) return {};
+  const observations = [{ provider_session_id: root, status: "idle", settled: true }, ...children.map((child, index) => {
+    const status = String(child.status ?? child.state ?? "unknown").toLowerCase();
+    const terminal = settled === true || ["completed", "success", "succeeded", "failed", "cancelled", "canceled", "settled_by_root"].includes(status);
+    return { provider_session_id: ids[index], status: terminal ? "idle" : ["running", "active", "inprogress", "pending"].includes(status) ? "running" : "unknown", settled: terminal };
+  })];
+  return { tree_session_ids: [root, ...ids], unsettled_sessions: observations.filter(item => !item.settled).map(item => item.provider_session_id), tree_observations: observations };
+}
+
+/** Retain typed failure facts, never provider headers, request bodies or free-form messages. */
+export function safeNativeFailure(value, depth = 0) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const result = {};
+  for (const key of ["type", "code", "source", "reason", "errorPhase", "exceptionKind", "providerId", "modelId", "providerKind", "transport", "retryable", "willRetry", "statusCode", "resets_at", "retryAfterMs", "resetAt"]) {
+    const scalar = value[key];
+    if (typeof scalar === "boolean" || typeof scalar === "number" && Number.isFinite(scalar)
+      || typeof scalar === "string" && scalar.length <= 256 && /^[\w.:/ -]+$/.test(scalar)) result[key] = scalar;
+  }
+  // Timing metadata is not an identifier: HTTP dates contain commas and an
+  // invalid value must reach the policy as invalid, not disappear into default backoff.
+  const timing = safeProviderError(value);
+  if (Object.hasOwn(timing, "retryAfter")) result.retryAfter = timing.retryAfter;
+  if (typeof value.codexErrorInfo === "string" && /^[\w-]{1,128}$/.test(value.codexErrorInfo)) result.codexErrorInfo = value.codexErrorInfo;
+  else if (value.codexErrorInfo && typeof value.codexErrorInfo.code === "string" && /^[\w-]{1,128}$/.test(value.codexErrorInfo.code)) result.codexErrorInfo = { code: value.codexErrorInfo.code };
+  const attribution = depth === 0 && value.attribution && safeNativeFailure(value.attribution, 1);
+  if (attribution && Object.keys(attribution).length) result.attribution = attribution;
+  return Object.keys(result).length ? result : undefined;
+}
+
+
+/** Normalize provider-observed topology only; never parse assistant prose. */
+export function normalizeNativeChildren(receipt, rootSessionId) {
+  const candidates = [];
+  const object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  receipt = object(receipt);
+  const list = (value) => Array.isArray(value) ? value : [];
+  const text = (value, keys) => { for (const key of keys) if (typeof value[key] === "string" && value[key]) return value[key]; return null; };
+  const settledTree = new Set(
+    list(receipt.tree_observations)
+      .filter(value => object(value).settled === true)
+      .map(value => text(object(value), ["provider_session_id", "session_id"]))
+      .filter(id => id !== null)
+  );
+  const add = (raw, source, scopedParent = null, fallback = "unknown") => {
+    const value = object(raw);
+    const id = text(value, ["provider_session_id", "session_id", "sessionId", "childSessionId", "conversation_id", "conversationId", "id", "subagentId"]);
+    const parent = text(value, ["parent_provider_session_id", "parent_session_id", "parentSessionId", "parentID", "parentId"]) ?? scopedParent;
+    if (!id) return;
+    const outcomeError = object(value.outcome_error);
+    if (typeof outcomeError.code === "string") {
+      const record = errorRecord(outcomeError);
+      throw Object.assign(nativeFailure(record.code, record.message, 1, record.details), record, { details: { ...object(record.details), session_id: id, source } });
+    }
+    const state = String(value.status ?? value.state ?? fallback).toLowerCase();
+    if (state === "lost") throw nativeFailure("native_child_outcome_lost", "Native child ended without a recoverable outcome", 1, { session_id: id, parent_session_id: parent, source, native_status: state });
+    // Provider idle means no current activity, not a Work result. Only an
+    // explicit terminal result or a separately proven root settlement may be
+    // terminal here; unknown states stay unknown for reconciliation.
+    const status = ["completed", "complete", "done", "success", "succeeded"].includes(state) ? "completed" : state === "settled_by_root" ? "settled_by_root" : ["failed", "error"].includes(state) ? "failed" : ["cancelled", "canceled", "interrupted"].includes(state) ? "cancelled" : ["running", "active", "pending"].includes(state) ? "running" : fallback;
+    const rootChild = parent === rootSessionId;
+    const settled = rootChild && status === "unknown" && settledTree.has(id) ? "settled_by_root" : status;
+    candidates.push({ session_id: id, parent_session_id: parent ?? "", status: settled, source, ...(rootChild ? {} : { provenance: "parent_mismatch" }),
+      ...(text(value, ["terminal_turn_id"]) ? { terminal_turn_id: text(value, ["terminal_turn_id"]) } : {}),
+      ...(text(value, ["terminal_observed_at"]) ? { terminal_observed_at: text(value, ["terminal_observed_at"]) } : {}),
+      ...(value.provider_error !== undefined ? { provider_error: value.provider_error } : {}),
+      ...(["opencode.v2.session.execution", "agy.result", "acp.error_response", "droid.agent_turn_outcome", "grok.subagent.event"].includes(value.native_source) ? { native_source: value.native_source } : {}),
+      ...(value.native_turn_items && typeof value.native_turn_items === "object" ? { native_turn_items: value.native_turn_items } : {}) });
+  };
+  for (const value of list(receipt.descendants)) add(value, "adapter.descendants");
+  for (const value of list(receipt.children)) add(value, "opencode.session.children");
+  const subagents = object(object(receipt.evidence).subagents ?? receipt.subagents);
+  for (const value of list(subagents.running)) add(value, "zcode/session/subagents", rootSessionId, "running");
+  for (const value of list(subagents.completed)) add(value, "zcode/session/subagents", rootSessionId, "completed");
+  for (const value of list(object(subagents.ended).items)) {
+    const status = String(object(value).status ?? "unknown");
+    if (!["success", "failed", "cancelled", "lost"].includes(status)) throw nativeFailure("native_child_outcome_unavailable", "ZCode ended child has no recognized native outcome", 1, { child: value });
+    add(value, "zcode/session/subagents", rootSessionId);
+  }
+  const unique = new Map();
+  const rank = { unknown: 0, running: 1, settled_by_root: 2, completed: 3, failed: 3, cancelled: 3 };
+  for (const child of candidates) {
+    const previous = unique.get(child.session_id);
+    if (previous && previous.parent_session_id !== child.parent_session_id) {
+      // Keep the contradictory parent visible to the existing provenance gate,
+      // independently of input order or which source happened to say success.
+      const foreign = [previous, child].filter(item => item.parent_session_id !== rootSessionId).sort((a, b) => a.parent_session_id.localeCompare(b.parent_session_id))[0];
+      unique.set(child.session_id, { ...foreign, provenance: "parent_mismatch" });
+      continue;
+    }
+    if (previous && rank[previous.status] === 3 && rank[child.status] === 3 && previous.status !== child.status) throw nativeFailure("native_child_outcome_conflict", "Native child has contradictory terminal outcomes", 1, { session_id: child.session_id, observations: [previous, child] });
+    if (previous && previous.status === child.status && previous.terminal_turn_id && child.terminal_turn_id && previous.terminal_turn_id !== child.terminal_turn_id)
+      throw nativeFailure("native_child_turn_conflict", "Native child has contradictory terminal Turn identities", 1, { session_id: child.session_id, observations: [previous, child] });
+    if (previous && previous.status === child.status) {
+      unique.set(child.session_id, { ...previous, ...child,
+        ...(child.terminal_turn_id ?? previous.terminal_turn_id ? { terminal_turn_id: child.terminal_turn_id ?? previous.terminal_turn_id } : {}),
+        ...(child.provider_error ?? previous.provider_error ? { provider_error: child.provider_error ?? previous.provider_error } : {}),
+        ...(child.native_turn_items ?? previous.native_turn_items ? { native_turn_items: child.native_turn_items ?? previous.native_turn_items } : {}) });
+      continue;
+    }
+    if (!previous || rank[child.status] > rank[previous.status]) unique.set(child.session_id, child);
+  }
+  return [...unique.values()].sort((left, right) => left.session_id.localeCompare(right.session_id));
+}

package/dist/harness-runtime/lib/native-hook-command.d.mts

@@ -0,0 +1,7 @@
+export function invokeNativeHook(input: { bin: string; args: string[]; nodeBin?: string; payload: unknown; home?: string | undefined; cwd?: string; env?: NodeJS.ProcessEnv; timeoutMs?: number }): Promise<Record<string, unknown> & { timing?: Record<string, number> }>;
+export function hookBudget(timeoutMs?: number, deadlineAt?: number | null): { deadlineAt: number; remaining(phase: string, maximum?: number): number; run<T>(action: () => T | Promise<T>, phase: string): Promise<T> };
+export function readNativeHookInput(stream: NodeJS.ReadStream, budget: { remaining(phase: string): number }, maxBytes?: number): Promise<string>;
+export function acceptNativeHookRequest(stateDir: string, binding: Record<string, unknown>, current?: { requests: Map<string, { binding: Record<string, unknown> }>; accepting?: Map<string, Promise<Record<string, unknown>>> } | null): Promise<Record<string, unknown>>;
+export function writeNativeHookFailure(stateDir: string, binding: Record<string, unknown> | undefined, error: unknown, budget: ReturnType<typeof hookBudget>): Promise<void>;
+export function readNativeHookFailures(stateDir: string, requests: Map<string, { current: unknown; binding: Record<string, unknown> }>, current: unknown, reject: (error: Error & { code?: string; details?: Record<string, unknown> }) => void): Promise<void>;
+export function runBoundedCommand(input: { bin: string; args: string[]; nodeBin?: string; input?: string | null; cwd?: string; env?: NodeJS.ProcessEnv; timeoutMs?: number; timeoutCode?: string; inheritDeadline?: boolean; cleanupWithinBudget?: boolean; maintenanceProgress?: { action: string; processId: string | null; startupMs?: number; inactivityMs: number } | null; signal?: AbortSignal }): Promise<string>;

package/dist/harness-runtime/lib/native-hook-command.mjs

@@ -0,0 +1,251 @@
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { reportedFailure } from "./process-json.mjs";
+import { errorRecord, reportedError } from "./operation-errors.mjs";
+import { writeJsonAtomic } from "./runner-events.mjs";
+
+/** Retain accepted native requests in the existing operation hook ledger. */
+export async function acceptNativeHookRequest(stateDir, binding, current = null) {
+  if (["operation_id", "daemon_id", "tool_call_id", "root_provider_session_id", "provider_session_id"].some(key => typeof binding[key] !== "string" || !binding[key])
+    || !Number.isSafeInteger(binding.turn_generation) || binding.turn_generation < 0
+    || !/^[a-f0-9]{64}$/.test(binding.command_sha256 ?? "")) throw Object.assign(new Error("Native hook has no current owned operation"), { code: "native_hook_unproven" });
+  const key = JSON.stringify([binding.provider_session_id, binding.tool_call_id, binding.event]);
+  const existing = current && [...current.requests.values()].find(value => JSON.stringify([value.binding.provider_session_id, value.binding.tool_call_id, value.binding.event]) === key)?.binding;
+  const same = value => {
+    if (value.command_sha256 !== binding.command_sha256 || value.native_cwd !== binding.native_cwd) throw Object.assign(new Error("Native tool identity was reused with changed hook input"), { code: "native_hook_identity_conflict" });
+    return value;
+  };
+  if (existing) return same(existing);
+  current && (current.accepting ??= new Map());
+  if (current?.accepting.has(key)) return same(await current.accepting.get(key));
+  const accepted = (async () => {
+  const directory = path.join(stateDir, "operations", createHash("sha256").update(binding.operation_id).digest("hex"));
+  const requested = JSON.parse(await readFile(path.join(directory, "requested.json"), "utf8"));
+  if (requested.operation_id !== binding.operation_id || requested.daemon_id !== binding.daemon_id || !["session.prompt", "session.create", "session.start"].includes(requested.operation)
+    || requested.operation === "session.prompt" && requested.session_id && requested.session_id !== binding.root_provider_session_id) throw Object.assign(new Error("Native hook operation does not match its retained owner"), { code: "native_hook_unproven" });
+  const receipt = { ...binding, schema_id: "dd-flow/hook-request@1", request_id: randomUUID() };
+  await writeJsonAtomic(path.join(directory, "hooks", `${receipt.request_id}.json`), receipt);
+  return receipt;
+  })();
+  current?.accepting.set(key, accepted);
+  try { return await accepted; } finally { current?.accepting.delete(key); }
+}
+
+export async function writeNativeHookFailure(stateDir, binding, error, budget) {
+  if (!binding?.request_id || !/^[A-Za-z0-9-]{1,128}$/.test(binding.request_id)) return;
+  await budget.run(() => writeJsonAtomic(path.join(stateDir, "hook-failures", `${binding.request_id}.json`), {
+    ...errorRecord(error), request_id: binding.request_id, observed_at: new Date().toISOString(), native_hook_binding: binding,
+  }), "failure_receipt");
+}
+
+/** Read only requests accepted for this exact live operation, never scan a mailbox. */
+export async function readNativeHookFailures(stateDir, requests, current, reject) {
+  for (const [id, accepted] of requests) {
+    if (accepted.current !== current) continue;
+    let value;
+    try { value = JSON.parse(await readFile(path.join(stateDir, "hook-failures", `${id}.json`), "utf8")); }
+    catch (error) { if (error.code === "ENOENT") continue; value = { code: "native_hook_receipt_invalid", message: error.message }; }
+    if (value.request_id !== id || !value.native_hook_binding || JSON.stringify(value.native_hook_binding) !== JSON.stringify(accepted.binding) || typeof value.code !== "string" || typeof value.message !== "string") {
+      if (!accepted.diagnostic) {
+        accepted.diagnostic = { code: "native_hook_receipt_invalid", message: "Accepted hook request has an unreadable or unbound failure receipt", request_id: id, operation_id: accepted.binding.operation_id, effect: "unknown", receipt_bound: false };
+        process.stderr.write(`${JSON.stringify({ native_hook_diagnostic: accepted.diagnostic })}\n`);
+      }
+      continue;
+    }
+    requests.delete(id);
+    const error = reportedError(value, "Native hook failed");
+    error.details = { ...error.details, native_hook_binding: accepted.binding };
+    reject(error);
+  }
+}
+
+/** The caller supplies its qualified native limit; phases share that deadline. */
+export function hookBudget(timeoutMs = 25_000, deadlineAt = process.env.DD_FLOW_HOOK_DEADLINE_AT ? Number(process.env.DD_FLOW_HOOK_DEADLINE_AT) : null) {
+  if (deadlineAt !== null && (!Number.isSafeInteger(deadlineAt) || deadlineAt < 0)) throw Object.assign(new Error("Invalid native hook deadline"), { code: "hook_deadline_invalid", details: { effect: "unknown" } });
+  const started = performance.now();
+  const duration = Math.max(0, Math.min(timeoutMs, Number.isFinite(deadlineAt) ? deadlineAt - Date.now() : timeoutMs));
+  const remaining = (phase, maximum = duration) => {
+    const value = duration - (performance.now() - started);
+    if (value <= 0) throw Object.assign(new Error(`Native hook deadline exceeded during ${phase}`), { code: "native_hook_timeout", details: { phase, elapsed_ms: Math.round(performance.now() - started), effect: "unknown" } });
+    return Math.max(1, Math.floor(Math.min(maximum, value)));
+  };
+  return { deadlineAt: Math.floor(Date.now() + duration), remaining, async run(action, phase) {
+    const timeoutMs = remaining(phase);
+    let timer;
+    try { return await Promise.race([Promise.resolve().then(action), new Promise((_, reject) => { timer = setTimeout(() => reject(Object.assign(new Error(`Native hook deadline exceeded during ${phase}`), { code: "native_hook_timeout", details: { phase, effect: "unknown" } })), timeoutMs); })]); }
+    finally { clearTimeout(timer); }
+  } };
+}
+
+/** Bound native hook ingress before parsing or opening adapter state. */
+export function readNativeHookInput(stream, budget, maxBytes = 1_048_576) {
+  return new Promise((resolve, reject) => {
+    const chunks = []; let bytes = 0, done = false;
+    const cleanup = () => { clearTimeout(timer); stream.off("data", onData); stream.off("end", onEnd); stream.off("error", onError); };
+    const finish = (error, value) => { if (done) return; done = true; cleanup(); if (error) { stream.destroy(); reject(error); } else resolve(value); };
+    const onData = chunk => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      bytes += buffer.length;
+      if (bytes > maxBytes) finish(Object.assign(new Error("Native hook input exceeds 1 MiB"), { code: "native_hook_input_too_large" }));
+      else chunks.push(buffer);
+    };
+    const onEnd = () => finish(null, Buffer.concat(chunks).toString("utf8"));
+    const onError = error => finish(error);
+    let timeoutMs;
+    try { timeoutMs = budget.remaining("input"); } catch (error) { reject(error); return; }
+    const timer = setTimeout(() => finish(Object.assign(new Error("Native hook deadline exceeded during input"), { code: "native_hook_timeout", details: { phase: "input", effect: "unknown" } })), timeoutMs);
+    stream.on("data", onData).once("end", onEnd).once("error", onError);
+    stream.resume();
+  });
+}
+
+export async function terminateCommandTree(child, { platform = process.platform, launch = spawn, timeoutMs = 400 } = {}) {
+  if (!child.pid) return;
+  if (platform !== "win32") { process.kill(-child.pid, "SIGKILL"); return; }
+  // Node's child.kill on Windows only terminates the leader. taskkill is the
+  // native subtree primitive; bound its own lifetime as well as the request.
+  await new Promise((resolve, reject) => {
+    const killer = launch("taskkill", ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
+    let settled = false, timer;
+    const finish = error => { if (settled) return; settled = true; clearTimeout(timer); error ? reject(error) : resolve(); };
+    timer = setTimeout(() => { killer.kill("SIGKILL"); killer.unref(); finish(Object.assign(new Error("Windows subtree cleanup timed out"), { code: "process_cleanup_timeout" })); }, timeoutMs);
+    killer.once("error", finish);
+    killer.once("close", code => finish(code === 0 ? null : Object.assign(new Error(`taskkill exited ${code}`), { code: "process_cleanup_failed" })));
+  });
+}
+
+/** Preserve the native hook protocol across the CLI process boundary. */
+export async function runBoundedCommand({ bin, args, nodeBin = process.execPath, input = null, cwd, env = {}, timeoutMs = 15_000, timeoutCode = "native_hook_timeout", inheritDeadline = true, cleanupWithinBudget = false, maintenanceProgress = null, signal }) {
+  if (signal?.aborted) throw Object.assign(new Error("Bounded CLI request cancelled before launch"), { code: "process_maintenance_cancelled", details: { effect: "no_effect" } });
+  const inherited = inheritDeadline ? env.DD_FLOW_HOOK_DEADLINE_AT ?? process.env.DD_FLOW_HOOK_DEADLINE_AT : undefined;
+  if (inherited !== undefined) {
+    const deadline = Number(inherited);
+    if (!Number.isSafeInteger(deadline) || deadline < 0) throw Object.assign(new Error("Invalid native hook deadline"), { code: "hook_deadline_invalid", details: { effect: "no_effect" } });
+    timeoutMs = Math.min(timeoutMs, deadline - Date.now());
+  }
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw Object.assign(new Error("Native hook budget exhausted before subprocess launch"), { code: timeoutCode, details: { phase: "subprocess", effect: "no_effect" } });
+  if (maintenanceProgress && (!Number.isFinite(maintenanceProgress.inactivityMs) || maintenanceProgress.inactivityMs <= 0
+    || maintenanceProgress.startupMs !== undefined && (!Number.isFinite(maintenanceProgress.startupMs) || maintenanceProgress.startupMs <= 0)
+    || typeof maintenanceProgress.action !== "string" || !(maintenanceProgress.processId === null || typeof maintenanceProgress.processId === "string")))
+    throw Object.assign(new Error("Invalid maintenance progress budget"), { code: "process_maintenance_timeout", details: { effect: "no_effect", native_dispatch_started: false } });
+  const started = performance.now();
+  // Transport/physical cleanup has its own small tail inside the outer limit.
+  const cleanupMs = Math.min(500, timeoutMs / 5);
+  const commandMs = cleanupWithinBudget ? Math.max(1, timeoutMs - cleanupMs) : timeoutMs;
+  const deadlineAt = Math.floor(Date.now() + Math.max(0, commandMs - Math.min(250, commandMs / 10)));
+  const script = /\.[cm]?js$/.test(bin);
+  const output = await new Promise((resolve, reject) => {
+    const child = spawn(script ? nodeBin : bin, [...(script ? [bin] : []), ...args], {
+      cwd, env: { ...process.env, ...env, DD_FLOW_HOOK_DEADLINE_AT: String(deadlineAt) }, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "", stderr = "", failure, cleanupTimer, settled = false, termination;
+    let timer, phaseBuffer = "", lastProgress = started;
+    const progressPhases = new Set();
+    let importsReady = maintenanceProgress?.startupMs === undefined;
+    const silenceMs = () => importsReady ? maintenanceProgress?.inactivityMs : maintenanceProgress.startupMs;
+    const commandDeadline = started + commandMs;
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true; clearTimeout(timer); clearTimeout(cleanupTimer); signal?.removeEventListener("abort", abort);
+      if (error) {
+        const diagnostics = hookDiagnostics(stderr);
+        if (diagnostics.length) error.details = { ...error.details, hook_diagnostics: diagnostics };
+        reject(error);
+      } else resolve(value);
+    };
+    const stop = error => {
+      if (termination || settled) return;
+      failure ??= error;
+      clearTimeout(timer);
+      failure.details = { ...failure.details, failure_at: new Date().toISOString(), elapsed_ms: Math.round(performance.now() - started), effect: "unknown", subprocess_pid: child.pid ?? null };
+      termination = terminateCommandTree(child).catch(cleanup => {
+        if (cleanup.code === "ESRCH") return;
+        failure.details.cleanup_error = { code: cleanup.code, message: cleanup.message };
+        failure.details.cleanup_unconfirmed = true;
+        child.kill("SIGKILL");
+      });
+      cleanupTimer ??= setTimeout(() => {
+        failure.details.cleanup_unconfirmed = true;
+        child.stdin.destroy(); child.stdout.destroy(); child.stderr.destroy(); child.unref();
+        finish(failure);
+      }, cleanupWithinBudget ? cleanupMs : 500);
+    };
+    // A useful, request-bound phase advances the silence window, not ownership
+    // authority. The child storage deadline and parent uncertainty horizon stay
+    // fixed; repeated phases, logging and polling cannot keep a writer alive.
+    const arm = () => {
+      clearTimeout(timer);
+      const now = performance.now();
+      const remaining = Math.min(commandDeadline - now, maintenanceProgress ? lastProgress + silenceMs() - now : Infinity);
+      if (remaining <= 0) { stop(Object.assign(new Error("Bounded CLI request timed out"), { code: timeoutCode,
+        details: maintenanceProgress ? { phase: importsReady ? "storage" : "startup", inactivity_ms: silenceMs(),
+          ownership_horizon_ms: commandMs } : {} })); return; }
+      timer = setTimeout(arm, Math.ceil(remaining));
+    };
+    arm();
+    const abort = () => stop(Object.assign(new Error("Bounded CLI request cancelled"), { code: "process_maintenance_cancelled" }));
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+    child.stdout.setEncoding("utf8").on("data", chunk => { stdout += chunk; if (stdout.length > 1_048_576) stop(new Error("Native hook response exceeds protocol limit")); });
+    // Match the existing response bound: a legal bounded error tree may exceed
+    // 64KiB when pretty-printed, plus maintenance phases preceding the receipt.
+    child.stderr.setEncoding("utf8").on("data", chunk => {
+      stderr = (stderr + chunk).slice(-1_048_576);
+      if (!maintenanceProgress || termination || settled) return;
+      phaseBuffer += chunk;
+      const lines = phaseBuffer.split("\n"); phaseBuffer = lines.pop().slice(-16_384);
+      for (const line of lines) {
+        if (line.length > 16_384) continue;
+        let phase; try { phase = JSON.parse(line); } catch { continue; }
+        if (phase?.kind !== "process_maintenance_phase" || phase.action !== maintenanceProgress.action
+          || (phase.process_id ?? null) !== maintenanceProgress.processId || phase.native_dispatch_started !== false
+          || !["request", "imports_ready", "store_open", "store_validation", "lookup", "writer_reservation", "writer_reserved", "write", "commit", "committed", "ack"].includes(phase.phase)
+          || phase.store_kind !== undefined && !["run", "resource"].includes(phase.store_kind)) continue;
+        const key = `${phase.store_kind ?? ""}:${phase.phase}`;
+        if (progressPhases.has(key)) continue;
+        // Delayed observation cannot revive an already-expired silence window.
+        const now = performance.now();
+        if (now >= commandDeadline || now - lastProgress >= silenceMs()) { arm(); return; }
+        // Cold imports are not a stalled storage operation. Readiness is an
+        // actual boundary, never a timer heartbeat; the ownership horizon stays fixed.
+        if (["imports_ready", "store_open"].includes(phase.phase)) importsReady = true;
+        progressPhases.add(key); lastProgress = now; arm();
+      }
+    });
+    child.stdin.on("error", error => { failure ??= error; });
+    child.on("error", error => finish(failure ?? error));
+    child.on("close", code => {
+      if (failure) { void (termination ?? Promise.resolve()).then(() => finish(failure)); return; }
+      if (code !== 0) {
+        return finish(reportedFailure(stdout, stderr, "Native hook admission failed", "native_hook_failed"));
+      }
+      finish(null, stdout);
+    });
+    child.stdin.end(input);
+  });
+  return output;
+}
+
+/** Only our structured phase allowlist crosses a timeout, never raw stderr/env. */
+function hookDiagnostics(stderr) {
+  return stderr.split("\n").flatMap(line => {
+    try {
+      const value = JSON.parse(line);
+      if (!["native_hook_phase", "process_maintenance_phase"].includes(value?.kind)) return [];
+      const phase = typeof value.phase === "string" && /^[a-z_]{1,48}$/.test(value.phase) ? value.phase : null;
+      if (!phase) return [];
+      return [{ phase, ...Object.fromEntries(["elapsed_ms", "remaining_ms", "sqlite_extended_code"].filter(key => Number.isFinite(value[key])).map(key => [key, value[key]])), ...(value.kind === "process_maintenance_phase" ? { ...Object.fromEntries(["action", "process_id", "operation_id", "lease_expires_at", "store_kind", "maintenance_effect", "attempt_kind", "role"].filter(key => typeof value[key] === "string" && /^[A-Za-z0-9:._-]{1,128}$/.test(value[key])).map(key => [key, value[key]])), ...(typeof value.native_dispatch_started === "boolean" ? { native_dispatch_started: value.native_dispatch_started } : {}) } : {}) }];
+    } catch { return []; }
+  }).slice(-16);
+}
+
+export async function invokeNativeHook({ bin, args, nodeBin, payload, home, cwd, env, timeoutMs = 15_000 }) {
+  const output = await runBoundedCommand({ bin, args, nodeBin, input: `${JSON.stringify(payload)}\n`, cwd, env: { ...env, DD_FLOW_HOME: home }, timeoutMs });
+  let result;
+  try { result = JSON.parse(output); } catch { throw Object.assign(new Error("Invalid native hook JSON response"), { code: "native_hook_response_invalid" }); }
+  if (result?.ok === false && typeof result.error?.code === "string") throw Object.assign(new Error(result.error.message ?? "Native hook failed"), { code: result.error.code, details: result.error.details });
+  if (!result || typeof result !== "object" || Array.isArray(result) || result.ok === false) throw Object.assign(new Error("Native hook did not return a successful protocol object"), { code: "native_hook_response_invalid" });
+  return result;
+}

package/dist/harness-runtime/lib/native-request-proof.d.mts

@@ -0,0 +1,2 @@
+export function nativeCommandFingerprint(input: { executable: string; args: string[]; cwd: string; env: Record<string, string | undefined>; operationId: string }): string;
+export function prepareDaemonRequest<T extends { id: string; operation: string; params?: Record<string, unknown> }>(request: T): T & { invocation_sha256?: string };

package/dist/harness-runtime/lib/native-request-proof.mjs

@@ -0,0 +1,65 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { randomUUID } from 'node:crypto';
+import { hashJson } from './runner-events.mjs';
+
+const environmentKeys = ['HOME', 'CODEX_HOME', 'DD_FLOW_CONFIG_HOME', 'DD_FLOW_RESOURCE_HOME', 'DD_FLOW_HOME', 'DD_FLOW_BIN', 'DD_FLOW_ENGINE_HOME'];
+const fail = reason => { throw Object.assign(new Error('Native request proof does not match its prepared command'), {
+  code: 'native_request_proof_conflict', details: { reason, effect: 'no_effect' }
+}); };
+
+/** Independent transport identity: prepared by the caller before launching
+ * the adapter, and recomputed by the adapter's shared request builder. */
+export function nativeCommandFingerprint({ executable, args, cwd, env, operationId }) {
+  return hashJson({ executable, args, cwd, operation_id: operationId,
+    environment: Object.fromEntries(environmentKeys.map(key => [key, env[key] ?? null])) });
+}
+
+/** Called after the adapter's own argument preparation but before its RPC or
+ * daemon-start action. No provider response can supply this fingerprint. */
+export function prepareDaemonRequest(request) {
+  const file = process.env.DD_FLOW_NATIVE_REQUEST_PROOF_FILE;
+  const expected = process.env.DD_FLOW_NATIVE_COMMAND_SHA256;
+  const operation = process.env.DD_FLOW_NATIVE_REQUEST_OPERATION;
+  if (file === undefined && expected === undefined) return request;
+  // Control helpers may inspect status before their owned stop RPC. Status
+  // cannot consume the productive/control request's independently bound proof.
+  if (operation && request.operation !== operation) {
+    if (request.operation === 'daemon.status' && operation === 'daemon.stop') return request;
+    fail('operation_changed');
+  }
+  const ownerText = process.env.DD_FLOW_NATIVE_REQUEST_PROOF_OWNER;
+  // Never forward caller proof authority into the daemon/provider process.
+  delete process.env.DD_FLOW_NATIVE_REQUEST_PROOF_FILE;
+  delete process.env.DD_FLOW_NATIVE_COMMAND_SHA256;
+  delete process.env.DD_FLOW_NATIVE_REQUEST_OPERATION;
+  delete process.env.DD_FLOW_NATIVE_REQUEST_PROOF_OWNER;
+  if (!file || !path.isAbsolute(file) || !/^[a-f0-9]{64}$/.test(expected ?? '')
+    || typeof request.id !== 'string' || !request.id || typeof request.operation !== 'string' || request.operation !== operation) fail('invalid_owner');
+  const command = nativeCommandFingerprint({ executable: process.argv[1], args: process.argv.slice(2),
+    cwd: process.cwd(), env: process.env, operationId: request.id });
+  if (command !== expected || fs.realpathSync(path.dirname(file)) !== path.dirname(file)) fail('command_changed');
+  let owner;
+  try { owner = JSON.parse(ownerText ?? 'null'); } catch { fail('invalid_parent_owner'); }
+  const parent = fs.lstatSync(path.dirname(file));
+  if (!parent.isDirectory() || parent.dev !== owner?.dev || parent.ino !== owner?.ino) fail('proof_parent_changed');
+  const proof = { schema_id: 'dd-flow/native-request-proof@1', operation_id: request.id, operation: request.operation,
+    command_sha256: command, params_sha256: hashJson({ operation: request.operation, params: request.params ?? {} }),
+    session_id: request.params?.sessionId ?? null };
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  const fd = fs.openSync(temporary, 'wx', 0o600);
+  try {
+    fs.writeFileSync(fd, JSON.stringify(proof)); fs.fsyncSync(fd);
+    const current = fs.lstatSync(path.dirname(file));
+    if (parent.dev !== current.dev || parent.ino !== current.ino || !current.isDirectory()) fail('proof_parent_changed');
+    try { fs.linkSync(temporary, file); }
+    catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      const stat = fs.lstatSync(file);
+      if (!stat.isFile() || stat.nlink !== 1 || stat.size > 16 * 1024
+        || hashJson(JSON.parse(fs.readFileSync(file, 'utf8'))) !== hashJson(proof)) fail('retained_request_changed');
+    }
+  } finally { fs.closeSync(fd); fs.unlinkSync(temporary); }
+  return { ...request, invocation_sha256: command };
+}