@deksden-com/dd-flow-cli 0.9.0-beta.15 → 0.9.0-beta.150

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.15",
+  "version": "0.9.0-beta.150",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
+  "packageManager": "pnpm@10.23.0",
   "bin": {
-    "dd-flow": "./dist/cli.js"
+    "dd-flow": "dist/cli.js",
+    "dd-codex": "dist/harness-runtime/bin/dd-codex.mjs",
+    "dd-zcode": "dist/harness-runtime/bin/dd-zcode.mjs",
+    "dd-grok": "dist/harness-runtime/bin/dd-grok.mjs",
+    "dd-opencode": "dist/harness-runtime/bin/dd-opencode.mjs",
+    "dd-agy": "dist/harness-runtime/bin/dd-agy.mjs",
+    "dd-droid": "dist/harness-runtime/bin/dd-droid.mjs"
   },
   "files": [
     "dist",
@@ -16,32 +23,62 @@
     "node": ">=26.0.0",
     "pnpm": ">=10.0.0"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --max-warnings=0",
+    "test": "pnpm gate:release",
+    "gate:merge": "pnpm typecheck && pnpm lint && pnpm test:fast && pnpm test:hybrid",
+    "gate:release": "node scripts/verify-test-inventory.mjs --profile-start && node scripts/run-test-receipt.mjs hybrid && node scripts/run-test-receipt.mjs canon && node scripts/run-test-receipt.mjs e2 && node scripts/run-test-receipt.mjs e3 && node scripts/run-test-receipt.mjs e4 && node scripts/run-test-receipt.mjs build && node scripts/run-test-receipt.mjs release && node scripts/run-test-receipt.mjs integration && node scripts/run-test-receipt.mjs runtime-sensitive && node scripts/verify-test-inventory.mjs --profile-finish",
+    "test:hybrid": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/hybrid-contracts.test.mjs",
+    "test:hybrid:canon": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/hybrid-canon.test.mjs scripts/hybrid-inventory.test.mjs scripts/hybrid-consumers.test.mjs scripts/hybrid-schema-copies.test.mjs scripts/verify-e3-canon.test.mjs",
+    "test:e2": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e2-*.test.mjs",
+    "test:e2:installed": "node --test scripts/verify-e2-built-cli.test.mjs scripts/verify-e2-installed-cli.test.mjs",
+    "test:e3": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e3-*.test.mjs",
+    "test:e4": "node --import ./scripts/source-test-loader.mjs --test --test-concurrency=1 scripts/e4-*.test.mjs",
+    "test:e3:canon": "node --import ./scripts/source-test-loader.mjs --test scripts/verify-e3-canon.test.mjs",
+    "test:release": "node --test scripts/verify-release-build.test.mjs && vitest run --project=release",
+    "test:release:build": "node --test --test-concurrency=1 scripts/verify-release-build.test.mjs",
+    "test:integration": "vitest run --project='integration-*'",
+    "test:fast": "vitest run --project=integration-fast",
+    "test:core": "vitest run --project='integration-core-*'",
+    "test:flow": "vitest run --project=integration-flow",
+    "test:runtime-sensitive": "vitest run --project=runtime-sensitive",
+    "changeset": "changeset",
+    "version-packages": "changeset version",
+    "release:candidate:pack": "node scripts/release-candidate.mjs pack",
+    "release:candidate:accept": "node scripts/release-candidate.mjs accept",
+    "release:publish": "node scripts/publish-release.mjs",
+    "release:hybrid:produce": "node tools/produce-hybrid-release.mjs",
+    "release:canon:archive": "node tools/create-canon-release.mjs"
+  },
   "devDependencies": {
+    "@bufbuild/protoc-gen-es": "2.16.0",
     "@changesets/cli": "^2.31.0",
     "@eslint/js": "^9.39.1",
+    "@opencode/client": "2.0.28",
+    "@opencode/plugin": "2.0.28",
     "@types/node": "^24.10.1",
+    "@types/semver": "7.8.0",
     "eslint": "^9.39.1",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.47.0",
     "vitest": "^4.0.13"
   },
   "dependencies": {
+    "@bufbuild/protobuf": "2.16.0",
+    "@grpc/grpc-js": "1.14.6",
     "ajv": "^8.20.0",
+    "jsonc-parser": "3.3.1",
+    "semver": "7.8.1",
     "shell-quote": "^1.10.0",
     "smol-toml": "^1.6.1",
+    "tree-sitter": "0.25.1",
+    "tree-sitter-bash": "0.25.1",
     "yaml": "^2.9.0"
   },
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT",
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --max-warnings=0",
-    "test": "vitest run",
-    "changeset": "changeset",
-    "version-packages": "changeset version",
-    "release": "pnpm run build && changeset publish"
-  }
-}
+  "license": "MIT"
+}

package/tools/create-canon-release.mjs

@@ -0,0 +1,33 @@
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { createHash, randomUUID } from "node:crypto";
+import { produceCanonArchive } from "../dist/services/release-provenance.js";
+
+const args = process.argv.slice(2), names = ["canon-root", "commit", "output"];
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write("Usage: node tools/create-canon-release.mjs --canon-root <checkout> --commit <40-hex-commit> --output <new-archive.tgz>\nCreates an immutable Git-object archive with reviewed aliases materialized. Does not publish or qualify a release.\n");
+} else {
+  let temporary;
+  let ownsTemporary = false;
+  try {
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+      const name = args[index]?.slice(2), value = args[index + 1];
+      if (!args[index]?.startsWith("--") || !names.includes(name) || options.has(name) || !value || value.startsWith("--")) throw new Error("invalid arguments");
+      options.set(name, value);
+    }
+    if (names.some(name => !options.has(name))) throw new Error("missing arguments");
+    const bytes = produceCanonArchive(options.get("canon-root"), options.get("commit"));
+    const output = path.resolve(options.get("output"));
+    temporary = path.join(path.dirname(output), `.canon-archive-${randomUUID()}.tmp`);
+    const fd = fs.openSync(temporary, "wx", 0o600);
+    ownsTemporary = true;
+    try { fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    fs.linkSync(temporary, output); // Atomic no-replace publication, including dangling symlink targets.
+    process.stdout.write(`${JSON.stringify({ ok: true, commit: options.get("commit"), output, bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") })}\n`);
+  } catch {
+    process.stderr.write("Canonical archive production refused; check committed source and a new output path.\n");
+    process.exitCode = 1;
+  } finally { if (temporary && ownsTemporary) fs.rmSync(temporary, { force: true }); }
+}

package/tools/probe-codex-history.mjs

@@ -0,0 +1,37 @@
+/* global console */
+// Explicit non-generative contract probe. Never uses the operator's Codex home.
+import { mkdtemp, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { CodexBridge, codexReadPhase, readCodexHistory, readCodexRpc } from "../dist/harness-runtime/lib/dd-codex.mjs";
+import { errorRecord } from "../dist/harness-runtime/lib/operation-errors.mjs";
+
+const bin = process.argv[2];
+if (!bin || !path.isAbsolute(bin)) throw new Error("Usage: node tools/probe-codex-history.mjs /absolute/native/codex");
+const home = await mkdtemp(path.join(os.tmpdir(), "dd-codex-history-"));
+await writeFile(path.join(home, "config.toml"), "[features]\nplugins = false\nremote_models = false\n");
+const bridge = new CodexBridge({ bin, cwd: home, journal: path.join(home, "native.jsonl"),
+  env: { ...Object.fromEntries(Object.keys(process.env).map(key => [key, undefined])),
+    PATH: process.env.PATH, HOME: home, CODEX_HOME: home, CODEX_SQLITE_HOME: home, CODEX_LOG_DIR: home } });
+const report = { home, non_generative: true, reads: [] };
+try {
+  await bridge.start();
+  const created = await bridge.request("thread/start", { cwd: home, ephemeral: false, approvalPolicy: "never", sandbox: "read-only" });
+  report.session_id = created.thread.id;
+  report.history_mode = created.thread.historyMode;
+  const phase = codexReadPhase(bridge);
+  const compact = await readCodexRpc(bridge, "thread/read", { threadId: report.session_id, includeTurns: false }, phase);
+  report.compact = { id: compact.thread.id, status: compact.thread.status };
+  for (const method of ["thread/turns/list", "thread/read"]) {
+    const read = await readCodexHistory(bridge, method, { threadId: report.session_id,
+      ...(method === "thread/read" ? { includeTurns: true } : { limit: 20, itemsView: "summary" }) }, phase);
+    report.reads.push({ method, available: read.available, ...(read.error ? { error: read.error } : {}) });
+  }
+} catch (error) { report.error = errorRecord(error); process.exitCode = 1; }
+finally {
+  try { await bridge.close(); }
+  catch (error) { report.cleanup_error = errorRecord(error); process.exitCode = 1; }
+  await writeFile(path.join(home, "result.json"), JSON.stringify(report, null, 2) + "\n");
+}
+console.log(JSON.stringify(report, null, 2));

package/tools/produce-hybrid-release.mjs

@@ -0,0 +1,41 @@
+import { createPrivateKey } from "node:crypto";
+import { Buffer } from "node:buffer";
+import process from "node:process";
+import { publishReleaseBundle } from "../dist/services/release-producer.js";
+import { readBoundedReleaseFile } from "../dist/services/release-source.js";
+import { createReleaseCompatibility, installedCatalogVersions } from "../dist/services/release-compatibility.js";
+import { getCliVersionReport } from "../dist/services/build-info.js";
+import { verifyProducerSource, verifyCanonArchiveSource } from "../dist/services/release-provenance.js";
+
+const names = ["payload-file", "canon-root", "canon-archive", "engine-archive", "key-file", "output", "channel"];
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(`Produce an immutable local signed release bundle from existing qualification evidence.\nUsage: node tools/produce-hybrid-release.mjs ${names.map(name => `--${name} <value>`).join(" ")}\nThis does not publish remotely or qualify a route. Private keys never enter the output.\n`);
+} else {
+  try {
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+      const name = args[index]?.slice(2), value = args[index + 1];
+      if (!args[index]?.startsWith("--") || !names.includes(name) || options.has(name) || !value || value.startsWith("--")) throw new Error("invalid arguments");
+      options.set(name, value);
+    }
+    if (names.some(name => !options.has(name))) throw new Error("missing arguments");
+    const compatibility = createReleaseCompatibility({ channel: options.get("channel"), catalogVersions: installedCatalogVersions, routerVersion: getCliVersionReport().cli.version });
+    const payload = JSON.parse(readBoundedReleaseFile(options.get("payload-file"), 16 * 1024 * 1024).toString("utf8"));
+    const manifest = JSON.parse(Buffer.from(payload.manifest_base64, "base64").toString("utf8"));
+    verifyProducerSource(options.get("canon-root"), payload.source, manifest.canon.version);
+    const canonArchive = readBoundedReleaseFile(options.get("canon-archive"), 256 * 1024 * 1024);
+    verifyCanonArchiveSource(options.get("canon-root"), payload.source.commit, manifest.canon.archive, canonArchive);
+    const result = publishReleaseBundle(options.get("output"), {
+      payload,
+      privateKey: createPrivateKey(readBoundedReleaseFile(options.get("key-file"), 64 * 1024)), compatibility,
+      canonArchive,
+      engineArchive: readBoundedReleaseFile(options.get("engine-archive"), 256 * 1024 * 1024)
+    });
+    process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`);
+  } catch {
+    // Key/parser/network excerpts must never appear in producer diagnostics.
+    process.stderr.write("Release production refused; check explicit inputs and qualification evidence.\n");
+    process.exitCode = 1;
+  }
+}

package/tools/repair-paused-run-status.mjs

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+/* global process, console */
+// Explicit repair of legacy fenced RUN projections; no migrations or process control.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { parseArgs } from 'node:util';
+import { createContext } from '../dist/runtime/context.js';
+import { appendFlowRunTimelineEvent, gitFacts, publishRunProjections } from '../dist/services/runs.js';
+import { appendAudit } from '../dist/services/audit.js';
+
+const { values } = parseArgs({ options: { home: { type: 'string' }, run: { type: 'string' }, project: { type: 'string' }, apply: { type: 'boolean', default: false }, 'cancel-abandoned': { type: 'boolean', default: false } } });
+if (!values.home || !values.run || !values.project) throw new Error('Usage: --home <runtime> --project <project-id> --run <run-id> [--apply]');
+const home = fs.realpathSync(values.home);
+const context = createContext({ ...process.env, DD_FLOW_HOME: home }, values.apply ? 'hook' : 'read_existing');
+const db = context.db;
+let runtimePath, original, backup, report;
+try {
+  const run = db.get('SELECT * FROM runs WHERE project_id=? AND id=?', [values.project, values.run]);
+  if (!run) throw new Error('RUN not found');
+  const guard = db.get('SELECT * FROM run_recovery_guards WHERE project_id=? AND run_id=? ORDER BY generation DESC LIMIT 1', [values.project, values.run]);
+  const cancel = values['cancel-abandoned'];
+  if (cancel) {
+    if (fs.existsSync(run.project_root)) throw new Error('Abandoned-fixture cancellation requires an absent project directory');
+    for (const table of ['works', 'sessions', 'run_controllers']) {
+      if (!db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name=?", [table])) continue;
+      if (db.get(`SELECT 1 FROM ${table} WHERE project_id=? AND run_id=? LIMIT 1`, [values.project, values.run])) throw new Error('Abandoned-fixture cancellation requires no Work, Session or controller history');
+    }
+    if (guard) throw new Error('A recovery-owned RUN requires recovery reconciliation');
+  }
+  if (!cancel && !["draining", "sealed", "resuming"].includes(guard?.status)) throw new Error("Repair requires the current recovery to fence productive admission");
+  if (run.status !== 'running') {
+    report = { run_id: run.id, status: run.status, changed: false };
+  } else {
+    runtimePath = fs.realpathSync(run.runtime_path);
+    const relative = path.relative(home, runtimePath);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) throw new Error('Runtime file is outside the selected home');
+    original = fs.readFileSync(runtimePath);
+    if (JSON.parse(original).status !== 'running' || JSON.parse(run.index_json).status !== 'running') throw new Error('RUN projections disagree; manual review required');
+    if (values.apply) {
+      backup = `${runtimePath}.status-repair-${crypto.randomUUID()}.json`;
+      fs.writeFileSync(backup, JSON.stringify({ recovery_id: guard?.recovery_id ?? null, row: run, runtime: original.toString('utf8') }), { flag: 'wx', mode: 0o600 });
+      const git = cancel ? gitFacts(run.workspace_root) : null;
+      db.writeTransaction(() => {
+        const current = db.get('SELECT * FROM runs WHERE project_id=? AND id=?', [values.project, values.run]);
+        const currentGuard = db.get('SELECT * FROM run_recovery_guards WHERE project_id=? AND run_id=? ORDER BY generation DESC LIMIT 1', [values.project, values.run]);
+        if (!current || current.status !== 'running' || current.index_json !== run.index_json || current.runtime_path !== run.runtime_path) throw new Error('RUN changed after repair preparation');
+        if (cancel) {
+          if (currentGuard) throw new Error('A recovery-owned RUN requires recovery reconciliation');
+          for (const table of ['works', 'sessions', 'run_controllers']) {
+            if (db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name=?", [table]) && db.get(`SELECT 1 FROM ${table} WHERE project_id=? AND run_id=? LIMIT 1`, [values.project, values.run])) throw new Error('Abandoned-fixture cancellation requires no Work, Session or controller history');
+          }
+        } else if (!currentGuard || currentGuard.recovery_id !== guard.recovery_id || currentGuard.generation !== guard.generation || currentGuard.status !== guard.status) throw new Error('Recovery guard changed after repair preparation');
+        const index = JSON.parse(current.index_json), now = context.now();
+        if (index.status !== 'running') throw new Error('RUN index changed after repair preparation');
+        index.status = cancel ? 'cancelled' : 'paused';
+        index.updated_at = now;
+        index.runtime_revision = (index.runtime_revision ?? 0) + 1;
+        if (cancel) {
+          for (const stage of index.stage_runs) if (['running', 'pending', 'paused', 'blocked'].includes(stage.status)) {
+            stage.status = 'skipped'; stage.updated_at = now; stage.completed_at = now;
+            const elapsed = Date.parse(now) - Date.parse(stage.started_at ?? '');
+            stage.duration_ms = Number.isFinite(elapsed) && elapsed >= 0 ? elapsed : null;
+          }
+          if (!['vnext_specify', 'vnext_protocolize'].includes(index.flow_kind)) index.attempts = index.stage_runs.map(stage => ({ stage: stage.stage, attempt_number: Number((stage.attempt ?? 'try-001').replace('try-', '')) || 1, root: stage.dir, archive: null, status: stage.status, started_at: stage.started_at ?? now, finished_at: stage.completed_at ?? null }));
+          index.verdict = 'cancelled'; index.next_action = null; index.completed_at = now; index.finished_at = now;
+          const elapsed = Date.parse(now) - Date.parse(index.started_at ?? current.created_at);
+          index.duration_ms = Number.isFinite(elapsed) && elapsed >= 0 ? elapsed : null;
+          index.execution = { project_root: index.execution?.project_root ?? current.project_root, workspace_root: index.execution?.workspace_root ?? current.workspace_root, git };
+        }
+        const updated = db.run('UPDATE runs SET status=?, verdict=?, next_action=?, index_json=?, updated_at=?, completed_at=? WHERE project_id=? AND id=? AND status=? AND index_json=?', [index.status, index.verdict, index.next_action, JSON.stringify(index), now, index.completed_at ?? null, values.project, values.run, 'running', current.index_json]);
+        if (updated.changes !== 1) throw new Error('RUN changed before repair commit');
+        if (cancel) {
+          const reason = 'Operator requested cleanup of abandoned fixture: project removed; no Work, Session or controller history.';
+          appendAudit(context, { projectId: values.project, eventType: 'flow_run.manual_override', payload: { run_id: run.id, status: 'cancelled', verdict: 'cancelled', next_action: null, reason } });
+          appendFlowRunTimelineEvent(context, values.project, run.id, { at: now, type: 'run_manual_override', status: 'cancelled', reason });
+        }
+        if (!cancel) db.afterCommit(() => publishRunProjections(context, values.project, run.id));
+      }, 'repair-paused-run-status');
+    }
+    report = { run_id: run.id, from: 'running', to: cancel ? 'cancelled' : 'paused', recovery_id: guard?.recovery_id ?? null, applied: values.apply, backup };
+  }
+  console.log(JSON.stringify(report));
+} finally { db.close(); }