@deksden-com/dd-flow-cli 0.9.0-beta.145 → 0.9.0-beta.149

package/dist/services/work-registry.js

@@ -40,6 +40,8 @@ import { acceptedDecisionPrecedence, loadExternalStageContext, renderRetainedSta
 import { reviewEnvironmentAllowed, reviewExecutionCopyHash, reviewSourceHash, reviewSourcePaths } from "./review-copy.js";
 import { latestRunVerificationMatrix, verificationMatrixInstruction, verificationMatrixContract } from "./verification-matrix.js";
 import { acceptedIntentSourceRole } from "./accepted-intent.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { validateDiagnosticWorkResult } from "./diagnostic-work-results.js";
 const workColumns = "work_id, project_id, run_id, parent_work_id, task, launch_policy, result_schema, payload_json, depends_on_json, status, result, created_at, started_at, updated_at, completed_at";
 export function ensureWorkRegistry(context) { context.db.get("SELECT 1 FROM works LIMIT 1"); context.db.get("SELECT 1 FROM work_sessions LIMIT 1"); }
 function ownsPhysicalWorkSession(context, projectId, owner, identity) {
@@ -189,6 +191,8 @@ export function validateWorkBatch(value) {
 export function assertGenericWorkBatchAllowed(context, parentWorkId) {
     const parent = requireWork(context, parentWorkId);
     const run = context.db.get("SELECT flow_kind FROM runs WHERE project_id=? AND id=?", [parent.project_id, parent.run_id]);
+    if (run && isDiagnosticFlow(run.flow_kind))
+        throw new AppError("diagnostic_work_registration_required", "Diagnostic Stage handlers register the assigned read-only graph; generic allocation is not supported", 2, { phase: "prepare", effect: "no_effect", next_action: "use_issued_stage_entry" });
     if (run && ["mb-init", "mb-upgrade"].includes(run.flow_kind))
         throw new AppError("memory_work_registration_required", "Use the issued memory compose/review/corrections registration, not generic work add-batch", 2, { phase: "prepare", effect: "no_effect", recoverable: true, next_action: "use_issued_memory_registration" });
 }
@@ -752,7 +756,7 @@ function preparedCoordinatorRoute(context, work, input, snapshot) {
         // independently retained RUN authority fences it again without compiling
         // descriptor schemas under this (possibly caller-owned) SQL writer.
         assertPreparedRunBundleSqlAuthority(context, { projectId: work.project_id, runId: work.run_id }, admitted.bundle);
-        if (admitted.bundle.descriptor.descriptor.id === "mb-init") {
+        if (admitted.bundle.descriptor.descriptor.id === "mb-init" || isDiagnosticFlow(admitted.bundle.descriptor.descriptor.id)) {
             const retained = readDescriptorStageInput(context, { projectId: work.project_id, runId: work.run_id, stage: input.stage }, admitted.bundle);
             const payload = retained.input.payload_base64;
             if (typeof payload !== "string")
@@ -1092,7 +1096,7 @@ export function finishStageCoordinatorWork(context, id, result) {
     const link = context.db.get("SELECT * FROM work_sessions WHERE work_id = ? AND status = 'running' ORDER BY created_at DESC LIMIT 1", [id]);
     if (!link)
         throw new AppError("runtime_missing", "Coordinator has no open Work/Session link", 1);
-    validateWorkResult(work, result, run.project_root, run.workspace_root, requireRunHome(run), run.id, link.result_path);
+    validateWorkResult(context, work, result, run.project_root, run.workspace_root, requireRunHome(run), run.id, link.result_path);
     finishFanInWork(context, id, result);
     context.db.run("UPDATE sessions SET status = 'idle', updated_at = ? WHERE project_id = ? AND session_id = ? AND NOT EXISTS (SELECT 1 FROM work_sessions WHERE session_id = ? AND status = 'running')", [context.now(), work.project_id, link.session_id, link.session_id]);
     settleRecoveryWork(context, id, "completed");
@@ -1538,7 +1542,7 @@ async function settle(context, id, status, result, progress, retry, memoryResult
         else {
             if (memoryResult)
                 throw new AppError("memory_work_result_preparation_required", "Prepared memory output cannot settle another Work schema", 1);
-            validateWorkResult(work, result, run.project_root, run.workspace_root, requireRunHome(run), run.id, link?.result_path ?? null);
+            validateWorkResult(context, work, result, run.project_root, run.workspace_root, requireRunHome(run), run.id, link?.result_path ?? null);
         }
         const packet = codePacket(work);
         if (packet) {
@@ -1665,7 +1669,7 @@ function reactivateBoundSession(context, projectId, sessionId, now) {
 }
 export function workResultByteLimit(context, id) {
     const schema = requireWork(context, id).result_schema;
-    return ["dd-flow/memory-composition-work-result@1", "dd-flow/memory-review-work-result@1", "dd-flow/memory-repair-work-result@1"].includes(schema ?? "") ? 1024 * 1024 : undefined;
+    return ["dd-flow/memory-composition-work-result@1", "dd-flow/memory-review-work-result@1", "dd-flow/memory-repair-work-result@1", "dd-flow/diagnostic-work-result@1"].includes(schema ?? "") ? 1024 * 1024 : undefined;
 }
 export function prepareWorkResult(context, id, result, progress) {
     try {
@@ -1685,16 +1689,23 @@ export function prepareWorkResult(context, id, result, progress) {
             memoryResult.assertSettlementScope(context, link.session_id, link.id);
             return;
         }
-        validateWorkResult(work, result, run.project_root, run.workspace_root, requireRunHome(run), run.id, link?.result_path ?? null);
+        validateWorkResult(context, work, result, run.project_root, run.workspace_root, requireRunHome(run), run.id, link?.result_path ?? null);
     }
     catch (error) {
         prepareError(error, { work_id: id, input_sha256: sha256(result) });
     }
 }
-function validateWorkResult(work, result, projectRoot, workspaceRoot, runHome, runId, resultPath) {
+function validateWorkResult(context, work, result, projectRoot, workspaceRoot, runHome, runId, resultPath) {
     assertMemoryRepairWritePrepared(work);
     if (!work.result_schema)
         return;
+    if (work.result_schema === "dd-flow/diagnostic-work-result@1") {
+        const { bundle, packet } = diagnosticWorkAuthority(context, work, projectRoot);
+        if (typeof packet.aspect_id !== "string" || !["aspect", "critic"].includes(String(packet.role)))
+            throw new AppError("diagnostic_work_input_invalid", "Diagnostic Work has no assigned role/aspect", 1, { effect: "no_effect" });
+        validateDiagnosticWorkResult(Buffer.from(result), bundle.blob("schemas/diagnostic-work-result.schema.json"), workspaceRoot, packet, { workId: work.work_id, aspectId: packet.aspect_id, role: packet.role });
+        return;
+    }
     if (["dd-flow/memory-composition-work-result@1", "dd-flow/memory-review-work-result@1"].includes(work.result_schema ?? ""))
         throw new AppError("memory_work_result_preparation_required", "Memory Work completion requires admitted registered output, not a mutable schema lookup", 1);
     if (!resultPath)
@@ -1829,9 +1840,29 @@ export function validateReviewResolutions(workId, assigned, resolutions) {
     if (missing.length || unexpected.length || duplicate)
         throw new AppError("review_repair_incomplete", "Review repair must include exactly one resolution for each assigned finding reference", 2, { work_id: workId, missing, unexpected, duplicate });
 }
+function diagnosticWorkAuthority(context, work, projectRoot) {
+    const custody = readWorkBatchCustody(context, work.work_id);
+    const bundle = readFlowRunExecutionBundle(context, { projectRoot, runId: work.run_id });
+    const payload = parsePayload(work), packet = payload?.diagnostic;
+    if (!bundle || !isDiagnosticFlow(bundle.manifest.flow_id) || !packet || payload?.read_only !== true
+        || !["diagnostic-aspect", "diagnostic-critic"].includes(String(payload.kind))
+        || packet.flow_id !== bundle.manifest.flow_id || packet.run_id !== work.run_id || packet.stage !== custody.scope.stage
+        || packet.key !== custody.item_key || packet.packet_sha256 !== hybridDigest({ ...packet, packet_sha256: undefined }))
+        throw new AppError("diagnostic_work_input_invalid", "Diagnostic Work requires its immutable registered assignment", 1, { effect: "no_effect" });
+    assertPreparedRunBundleSqlAuthority(context, { projectId: work.project_id, runId: work.run_id }, bundle);
+    return { bundle, packet };
+}
 function renderWorkerPrompt(context, work, run, dependencies, commands, workspaceView, reviewInput) {
     const payload = parsePayload(work);
     const runIndex = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id=? AND id=?", [work.project_id, work.run_id]).index_json);
+    if (isDiagnosticFlow(runIndex.execution_bundle?.flow_id)) {
+        assertRunBundleSqlAuthority(context, { projectId: work.project_id, runId: work.run_id }, runIndex.execution_bundle);
+        const { bundle, packet } = diagnosticWorkAuthority(context, work, run.project_root);
+        return ["<diagnostic_work_packet>", JSON.stringify(packet, null, 2), "</diagnostic_work_packet>", "",
+            "<frozen_work_result_schema>", bundle.blob("schemas/diagnostic-work-result.schema.json").toString("utf8"), "</frozen_work_result_schema>", "",
+            "The packet is the assigned read-only diagnostic task, not an SDLC CODE or repair task. Report uncertainty and all assigned candidate decisions without editing the snapshot or original project.",
+            renderWorkerPromptBody(context, work, run, dependencies, commands)].join("\n");
+    }
     if (["mb-init", "mb-upgrade"].includes(runIndex.execution_bundle?.flow_id) && (payload?.memory_composition || payload?.kind === "memory-review" || payload?.kind === "memory-repair")) {
         assertRunBundleSqlAuthority(context, { projectId: work.project_id, runId: work.run_id }, runIndex.execution_bundle);
         // Memory Work owns a descriptor packet, not a missing SDLC SPECIFY or PLAN.

package/dist/services/workspace-bootstrap.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
+import { retainedBrowserEnvironment } from "./check-environment.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
 import { codeExecutionEnvironment, reconcileWorkspaceOwnership, runCheck, workspaceOperationId } from "./code-checks.js";
 import { confirmManagedProcess, finishManagedProcess, renewManagedProcess, managedOwnerIsAlive, managedProcessStatus, processTreeIsAlive, registerManagedProcess } from "./managed-processes.js";
@@ -56,7 +57,7 @@ export async function runWorkspaceBootstrap(context, input) {
             finishManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, state: "failed", reason: "dispatch_fenced_before_spawn" });
             throw error;
         }
-        const completed = await runCheck(input.command, input.workspaceRoot, { ...codeExecutionEnvironment(input.workspaceRoot), DD_FLOW_CHECK_COMPLETION_FILE: completionPath }, stdout, stderr, elapsed => input.progress?.(`workspace bootstrap still running (${elapsed}s); logs: ${directory}; next report in 15s`), pid => confirmManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, pid, processGroupId: process.platform === "win32" ? null : pid }), attemptMs => renewManagedProcess({ ...context, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: Date.now() + attemptMs }, { id: managed.id, leaseToken: managed.lease_token }));
+        const completed = await runCheck(input.command, input.workspaceRoot, { ...codeExecutionEnvironment(input.workspaceRoot, retainedBrowserEnvironment(context.env)), DD_FLOW_CHECK_COMPLETION_FILE: completionPath }, stdout, stderr, elapsed => input.progress?.(`workspace bootstrap still running (${elapsed}s); logs: ${directory}; next report in 15s`), pid => confirmManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, pid, processGroupId: process.platform === "win32" ? null : pid }), attemptMs => renewManagedProcess({ ...context, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: Date.now() + attemptMs }, { id: managed.id, leaseToken: managed.lease_token }));
         const current = managedProcessStatus(context).find(item => item.id === managed.id);
         if (processTreeIsAlive(current))
             throw new AppError("bootstrap_tree_not_settled", "Bootstrap shell exited but still owns live processes; resources were retained for inspection", 2, { process_id: managed.id, stdout_path: stdoutPath, stderr_path: stderrPath });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.145",
+  "version": "0.9.0-beta.149",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",
@@ -53,10 +53,11 @@
     "release:canon:archive": "node tools/create-canon-release.mjs"
   },
   "devDependencies": {
-    "@opencode/client": "2.0.28",
-    "@opencode/plugin": "2.0.28",
+    "@bufbuild/protoc-gen-es": "2.16.0",
     "@changesets/cli": "^2.31.0",
     "@eslint/js": "^9.39.1",
+    "@opencode/client": "2.0.28",
+    "@opencode/plugin": "2.0.28",
     "@types/node": "^24.10.1",
     "@types/semver": "7.8.0",
     "eslint": "^9.39.1",
@@ -65,6 +66,8 @@
     "vitest": "^4.0.13"
   },
   "dependencies": {
+    "@bufbuild/protobuf": "2.16.0",
+    "@grpc/grpc-js": "1.14.6",
     "ajv": "^8.20.0",
     "jsonc-parser": "3.3.1",
     "semver": "7.8.1",