@deksden-com/dd-flow-cli 0.9.0-beta.151 → 0.9.0-beta.155

package/dist/harness-runtime/lib/dd-codex-daemon.mjs

@@ -4,6 +4,7 @@ import { callDaemonObserved } from './daemon-observation.mjs';
 import { admitNativeRequestBuffer } from "./native-streams.mjs";
 import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mjs";
+import { acceptNativeHookRequest } from "./native-hook-command.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, open, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import net from "node:net";
@@ -138,18 +139,54 @@ export async function prepareCodexStop({ bridge, state, sessions, active, save,
 
 export async function serveDaemon(stateDir) {
   const paths = locations(stateDir); const state = await readState(paths.state); if (!state || state.schema_id !== stateSchema) throw Object.assign(new Error("daemon state missing"), { code: "daemon_state_missing" });
-  const bridge = new CodexBridge({ ...state.config, env: { ...codexBridgeEnv(state.config, state.daemon_id), CODEX_HOME: process.env.CODEX_HOME, DD_FLOW_CODEX_STATE_DIR: paths.dir } }); await startManagedBridge({ config: state.config, state, bridge, kind: "codex-provider", publish: snapshot => writeState(paths.state, snapshot), log: paths.log }); const sessions = new Set(state.sessions ?? []); let active = null; let server; let persist = Promise.resolve();
+  const bridge = new CodexBridge({ ...state.config, env: { ...codexBridgeEnv(state.config, state.daemon_id), CODEX_HOME: process.env.CODEX_HOME, DD_FLOW_CODEX_STATE_DIR: paths.dir } }); await startManagedBridge({ config: state.config, state, bridge, kind: "codex-provider", publish: snapshot => writeState(paths.state, snapshot), log: paths.log }); const sessions = new Set(state.sessions ?? []); let active = null, activePrompt = null; const verifiedHookFacts = new Map(), rootTurnCreators = new Map(); let server; let persist = Promise.resolve();
   scheduleDaemonProcessHeartbeat(state.config, state.resource_process);
   const save = (patch = {}) => { Object.assign(state, patch, { pid: process.pid, updated_at: new Date().toISOString(), sessions: [...sessions] }); const snapshot = structuredClone(state); persist = persist.catch(() => {}).then(() => writeState(paths.state, snapshot)); return persist; };
   bridge.options.onNativeActivity = () => {
     state.native_execution_revision = (state.native_execution_revision ?? 0) + 1;
     if (state.active_tree !== true) void save({ active_tree: true }).catch(error => { bridge.rejectAll(error); });
   };
+  bridge.options.onOwnedRootTurn = (sessionId, turnId) => {
+    if (activePrompt?.sessionId !== sessionId) return;
+    const key = JSON.stringify([sessionId, turnId]), prior = rootTurnCreators.get(key);
+    if (prior && prior !== activePrompt) return;
+    activePrompt.turnGeneration = bridge.hookPromptGenerations?.get(sessionId) ?? 0;
+    rootTurnCreators.set(key, activePrompt);
+  };
   const dispatch = async (operation, params, operationId) => {
     const assertDispatch = captureDispatchGuard(bridge);
     if (operation === "hook.verify") {
       if (params.daemonId !== state.daemon_id) throw Object.assign(new Error("Hook daemon identity differs"), { code: "native_hook_unproven" });
-      return { ...bridge.verifyNativeHook(params), daemonId: state.daemon_id, ddFlowHome: state.config.ddFlowHome, projectRoot: state.config.projectRoot };
+      if (params.requestId) {
+        assertDaemonDispatch(paths.dir);
+        const retained = verifiedHookFacts.get(params.requestId);
+        if (!retained || JSON.stringify(retained.binding) !== JSON.stringify(params.binding)) throw Object.assign(new Error("Hook fact is not bound to a verified native delivery"), { code: "native_hook_unproven" });
+        retained.guard();
+        return { ...retained.binding.codex_proof, verified: true, nativeHookBinding: retained.binding };
+      }
+      const proof = { ...bridge.verifyNativeHook(params), daemonId: state.daemon_id, ddFlowHome: state.config.ddFlowHome, projectRoot: state.config.projectRoot };
+      const childKey = proof.sessionId !== proof.rootSessionId && proof.creatorRootTurnId ? JSON.stringify([proof.rootSessionId, proof.creatorRootTurnId]) : null;
+      const current = proof.sessionId === proof.rootSessionId ? activePrompt : childKey ? rootTurnCreators.get(childKey) : null, payload = params.nativePayload, command = params.nativeCommand;
+      if (current && current.sessionId === proof.rootSessionId && typeof command === "string" && command && payload && typeof payload === "object"
+        && payload.session_id === proof.rootSessionId && (payload.agent_id ?? payload.session_id) === proof.sessionId
+        && payload.tool_use_id === proof.toolCallId && payload.turn_id === params.turnId) {
+        try {
+          const binding = await acceptNativeHookRequest(paths.dir, {
+            daemon_id: state.daemon_id, operation_id: current.operationId, turn_generation: current.turnGeneration ?? bridge.hookPromptGenerations?.get(proof.rootSessionId) ?? 0,
+            provider_session_id: proof.sessionId, root_provider_session_id: proof.rootSessionId,
+            parent_provider_session_id: proof.parentSessionId, tool_call_id: proof.toolCallId, event: "PreToolUse",
+            turn_id: params.turnId, native_cwd: typeof payload.cwd === "string" ? path.resolve(payload.cwd) : state.config.cwd,
+            command_sha256: createHash("sha256").update(command).digest("hex"), native_command: command,
+            source_harness: "codex-desktop", native_payload: payload, codex_proof: { ...proof }
+          }, current);
+          if (proof.sessionId === proof.rootSessionId ? activePrompt === current : childKey && rootTurnCreators.get(childKey) === current) { current.guard(); current.requests.set(binding.request_id, { binding }); verifiedHookFacts.set(binding.request_id, { binding, guard: current.guard }); proof.nativeHookBinding = binding; }
+        } catch (error) {
+          // Legacy hook still handles admission. This optional producer must
+          // not replace its result with a bookkeeping failure.
+          process.stderr.write(`${JSON.stringify({ kind: "native_hook_fact_unavailable", code: error.code ?? "hook_fact_write_failed" })}\n`);
+        }
+      }
+      return proof;
     }
     if (operation === "daemon.status") return { daemon_id: state.daemon_id, pid: process.pid, cwd: state.cwd, journal: state.journal, config: state.config, sessions: [...sessions], active_operation: active, active_tree: state.active_tree ?? null, shutdown_state: state.shutdown_state };
     // The runner may need to retire an orphaned daemon after its caller was
@@ -183,7 +220,10 @@ export async function serveDaemon(stateDir) {
         if (/:capacity:[1-9]\d*:session\.prompt$|:child:[a-f0-9]+:followup:[1-9]\d*$/.test(operationId ?? ""))
           await assertDaemonOwnership(paths.dir, { "operation-id": operationId, operation, "native-session-id": params.sessionId, "prompt-sha256": createHash("sha256").update(params.prompt ?? "").digest("hex") }, assertDispatch);
         sessions.add(params.sessionId);
-        await save({ active_operation: active }); return await promptSessionWithBridge(bridge, { ...state.config, ...params, operationId, assertDispatch });
+        await save({ active_operation: active });
+        const promptBinding = { operationId, sessionId: params.sessionId, requests: new Map(), guard: assertDispatch }; activePrompt = promptBinding;
+        try { return await promptSessionWithBridge(bridge, { ...state.config, ...params, operationId, assertDispatch }); }
+        finally { if (activePrompt === promptBinding) activePrompt = null; }
       }
       finally { active = null; await save({ active_operation: null }); }
     }

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -207,6 +207,7 @@ export class CodexBridge {
       this.currentTurns ??= new Map(); const id = message.params?.turn?.id, thread = message.params?.threadId;
       const pendingStart = [...this.pending.values()].find(value => value.method === "turn/start" && value.threadId === thread);
       const dispatching = pendingStart && !pendingStart.turnFloor?.has(id);
+      if (id && dispatching && this.requestedProfiles.has(thread)) this.options.onOwnedRootTurn?.(thread, id);
       const child = this.descendants.get(thread), parentCurrent = child?.parent_turn_id && child.parent_turn_id === this.currentTurns.get(child.parent_provider_session_id);
       if (id && this.turns.get(id)?.status !== "completed" && (dispatching || parentCurrent && child.status === "running" || !this.currentTurns.has(thread) && !this.requestedProfiles.has(thread))) {
         if (this.currentTurns.get(thread) !== id) this.usageMarkers?.delete(thread);
@@ -349,7 +350,20 @@ export class CodexBridge {
         || active.rootGeneration !== (this.hookPromptGenerations?.get(rootSessionId) ?? 0)) {
       fail("No matching active managed native hook", "native_hook_unproven", { provider_session_id: sessionId, tool_call_id: toolCallId });
     }
-    return { rootSessionId, sessionId, toolCallId, parentSessionId: sessionId === rootSessionId ? null : this.descendants.get(sessionId)?.parent_provider_session_id };
+    let creatorRootTurnId = null;
+    if (sessionId !== rootSessionId) {
+      let child = sessionId; const visited = new Set();
+      while (child !== rootSessionId && !visited.has(child)) {
+        visited.add(child);
+        const edge = this.descendants.get(child), parent = edge?.parent_provider_session_id, turn = edge?.parent_turn_id;
+        if (!parent || !turn || this.creatorEdges?.get(child) !== JSON.stringify([parent, turn])) break;
+        if (parent === rootSessionId) { creatorRootTurnId = turn; break; }
+        const observed = this.turns.get(turn);
+        if (!observed || observed.threadId !== parent) break;
+        child = parent;
+      }
+    }
+    return { rootSessionId, sessionId, toolCallId, parentSessionId: sessionId === rootSessionId ? null : this.descendants.get(sessionId)?.parent_provider_session_id, ...(creatorRootTurnId ? { creatorRootTurnId } : {}) };
   }
 
   observeHookFailure(message) {
@@ -387,6 +401,16 @@ export class CodexBridge {
       catch (storage) { error.cleanup_error ??= errorRecord(storage); }
       return;
     }
+    if (["native_hook_timeout", "native_hook_failed"].includes(error.code)) {
+      // Codex reports a failed hook independently of the shell tool: exit 1
+      // does not prove that the real CLI failed or even that it did not run.
+      // Retain the observation without rejecting the productive Turn.
+      const diagnostic = { ...errorRecord(error), root_generation: active.rootGeneration, root_turn_id: active.rootTurnId };
+      this.hookDiagnostics ??= new Map();
+      const notes = this.hookDiagnostics.get(root) ?? []; notes.push(diagnostic); this.hookDiagnostics.set(root, notes);
+      try { void Promise.resolve(this.journal.write("native_hook_observation_failure", diagnostic)).catch(() => {}); } catch { /* optional diagnostic */ }
+      return;
+    }
     this.hookFailures.set(root, error);
     for (const [id, pending] of this.pending) {
       if (ancestors.has(pending.threadId) && pending.method !== "turn/interrupt") {
@@ -427,12 +451,18 @@ export class CodexBridge {
     if (child === parent || this.requestedProfiles.has(child) || previous?.parent_provider_session_id && previous.parent_provider_session_id !== parent) {
       fail("Conflicting native child parent identity", "native_topology_conflict", { child_session_id: child, parent_session_id: parent, retained_parent: previous?.parent_provider_session_id ?? null });
     }
+    const creator = this.creatorEdges?.get(child);
+    if (creator && facts.creator_turn_exact && facts.parent_turn_id && creator !== JSON.stringify([parent, facts.parent_turn_id])) {
+      fail("Conflicting native child creator Turn", "native_topology_conflict", { child_session_id: child, parent_session_id: parent, retained_turn: previous.parent_turn_id, observed_turn: facts.parent_turn_id });
+    }
     const seen = new Set([child]);
     for (let ancestor = parent; ancestor; ancestor = this.descendants.get(ancestor)?.parent_provider_session_id) {
       if (seen.has(ancestor)) fail("Native child ancestry contains a cycle", "native_topology_cycle", { child_session_id: child, parent_session_id: parent });
       seen.add(ancestor);
     }
-    this.descendants.set(child, { ...previous, ...facts, parent_turn_id: facts.parent_turn_id ?? previous?.parent_turn_id ?? null, provider_session_id: child, parent_provider_session_id: parent });
+    if (facts.creator_turn_exact && facts.parent_turn_id) { this.creatorEdges ??= new Map(); this.creatorEdges.set(child, JSON.stringify([parent, facts.parent_turn_id])); }
+    const { creator_turn_exact: _sourceIsExact, ...publicFacts } = facts;
+    this.descendants.set(child, { ...previous, ...publicFacts, parent_turn_id: publicFacts.parent_turn_id ?? previous?.parent_turn_id ?? null, provider_session_id: child, parent_provider_session_id: parent });
   }
 
   // Collaboration child Threads are provider facts.  Keep only objects that
@@ -462,7 +492,7 @@ export class CodexBridge {
       // Parent activity has no child Turn identity on some app-server builds.
       // It can discover a child, but cannot reopen or close a later known Turn.
       const status = previous?.active_turn_id || previous?.status === "completed" ? previous.status : observed;
-      if (activity.kind === "started") this.bindChild(activity.agentThreadId, activityParent, { status, parent_turn_id: value.params?.turnId === this.currentTurns?.get(activityParent) ? value.params.turnId : null, agent_path: activity.agentPath ?? previous?.agent_path ?? null, source: "codex.app_server.subAgentActivity" });
+      if (activity.kind === "started") this.bindChild(activity.agentThreadId, activityParent, { status, parent_turn_id: value.params?.turnId === this.currentTurns?.get(activityParent) ? value.params.turnId : null, ...(value.params?.turnId && value.params.turnId === this.currentTurns?.get(activityParent) ? { creator_turn_exact: true } : {}), agent_path: activity.agentPath ?? previous?.agent_path ?? null, source: "codex.app_server.subAgentActivity" });
       else if (["completed", "interrupted"].includes(activity.kind) && activity.agentThreadId !== activityParent && !this.requestedProfiles.has(activity.agentThreadId)) {
         this.descendants.set(activity.agentThreadId, { ...previous, provider_session_id: activity.agentThreadId, status });
       }
@@ -474,6 +504,7 @@ export class CodexBridge {
         const previous = this.descendants.get(child);
         this.bindChild(child, value.senderThreadId, {
           parent_turn_id: parentTurn === this.currentTurns?.get(value.senderThreadId) ? parentTurn : null,
+          ...(parentTurn && parentTurn === this.currentTurns?.get(value.senderThreadId) ? { creator_turn_exact: true } : {}),
           status: previous?.status === "completed" || previous?.active_turn_id ? previous.status : value.agentsStates?.[child]?.status ?? previous?.status ?? "unknown", source: "codex.app_server" });
       }
     }
@@ -731,7 +762,8 @@ export async function promptSessionWithBridge(bridge, options) {
       fail("Codex completed but its current output/items remain unavailable", "operation_observation_lost", { history_error: history.error, provider_session_id: sessionId, turn_id: turnId });
     if (!completeHistory && (options.model && !thread.model || options.reasoning && !thread.reasoningEffort))
       fail("Codex completed but its applied profile remains unavailable", "operation_observation_lost", { history_error: history.error, provider_session_id: sessionId, turn_id: turnId });
-    const result = { ...nativeOutcome, ...(thread ? { thread: threadReceipt(thread) } : {}), descendants: await observedChildren(bridge, sessionId, phase), ...(assistantText ? { assistant_text: assistantText } : {}), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread?.model ?? null, reasoning: thread?.reasoningEffort ?? null, provider: thread?.modelProvider ?? null }, "thread/read.after_turn") };
+    const diagnostics = (bridge.hookDiagnostics?.get(sessionId) ?? []).filter(item => item.root_generation === bridge.hookPromptGenerations?.get(sessionId));
+    const result = { ...nativeOutcome, ...(thread ? { thread: threadReceipt(thread) } : {}), descendants: await observedChildren(bridge, sessionId, phase), ...(assistantText ? { assistant_text: assistantText } : {}), ...(diagnostics.length ? { native_hook_diagnostics: diagnostics } : {}), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread?.model ?? null, reasoning: thread?.reasoningEffort ?? null, provider: thread?.modelProvider ?? null }, "thread/read.after_turn") };
     await bridge.journal?.flush?.();
     return result;
   } catch (error) {

package/dist/harness-runtime/lib/dd-droid-daemon.mjs

@@ -16,6 +16,24 @@ import { retainStartupFailure, prepareRuntimeOwner, cleanupFailedStart, confirmD
 
 const REQUEST = "dd-droid/daemon-request@1", RESPONSE = "dd-droid/daemon-response@1";
 async function removeSocket(file) { try { if (!(await lstat(file)).isSocket()) throw new DroidError("unsafe_socket", "Refusing to replace non-socket daemon path"); await unlink(file); } catch (error) { if (error.code !== "ENOENT") throw error; } }
+
+/** Capture native execution settlement before resource retirement. Explicit
+ * cancellation still owns the physical stop needed to settle a live writer. */
+export async function prepareDroidStop(runtime, { cancelTree, busy, stateDir, save }) {
+  if (!cancelTree) {
+    if (busy) throw new DroidError("tree_not_settled", "Droid still owns unfinished work");
+    const observed = runtime.rootId ? await runtime.inspect(runtime.rootId) : null;
+    if (observed && (observed.settled !== true || observed.native_settled !== true)) throw new DroidError("tree_not_settled", "Droid native execution settlement is unproven");
+    commitDaemonShutdown(stateDir);
+    await save({ active_tree: false });
+    return { ...(observed ?? {}), clean: true, settled: true, native_settled: true };
+  }
+  commitDaemonShutdown(stateDir);
+  const cleanup = await runtime.closeTree(true);
+  if (runtime.rootId) try { await runtime.inspect(runtime.rootId, { ignoreActive: true }); } catch (error) { cleanup.inspection_error = errorRecord(error); }
+  const clean = cleanup.native_settled === true && !cleanup.inspection_error;
+  return { clean, settled: cleanup.native_settled === true, native_settled: cleanup.native_settled === true, physical_stopped: cleanup.physical_stopped, cleanup };
+}
 export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000, operationId = process.env.DD_EVAL_OPERATION_ID ?? randomUUID()) {
   const request = prepareDaemonRequest({ schema_id: REQUEST, id: operationId, operation, params });
   return await callDaemonObserved({ stateDir, socket: droidPaths(stateDir).socket, request, responseSchema: RESPONSE, harness: 'droid', timeoutMs });
@@ -61,6 +79,7 @@ export async function serveDaemon(stateDir) {
     const params = request.params ?? {}, operation = request.operation;
     if (operation === "daemon.status") { let observationError; try { await runtime.refreshTopology(); } catch (error) { observationError = errorRecord(error); } return { observation_error: observationError ?? null, daemon_id: state.daemon_id, pid: process.pid, config: state.config, shutdown_state: state.shutdown_state, provider_ready: Boolean(runtime.child && !runtime.closed), active_operation: busy, active_tree: Boolean(runtime.active || runtime.workingState !== "idle" || runtime.topologyIncomplete || [...runtime.topology.values()].some(child => !["completed", "cancelled", "failed"].includes(child.status))), sessions: runtime.rootId ? [runtime.rootId] : [], provider_pid: runtime.closed ? null : runtime.child?.pid }; }
     if (operation === "hook.observe") return await runtime.observeHook(params.payload, params.eventId, params.deadlineAt);
+    if (operation === "hook.verify") { assertDaemonDispatch(paths.dir); return await runtime.verifyWorkStart(params); }
     if (operation === "session.inspect") return await runtime.inspect(params.sessionId, { ingestUsage: params.noFlow !== true });
     if (operation === "session.cancel") {
       runtime.requireIdentity(params.sessionId); const cleanup = await runtime.closeTree(true); let inspected;
@@ -71,17 +90,12 @@ export async function serveDaemon(stateDir) {
     if (operation === "daemon.stop") {
       stopping = true;
       try {
-        return await completeDaemonShutdown(paths.dir, state, save, async () => {
-        if (!params.cancelTree && (busy || (runtime.rootId && !(await runtime.inspect(runtime.rootId)).settled))) throw new DroidError("tree_not_settled", "Droid still owns unfinished work");
-        commitDaemonShutdown(paths.dir);
-        const cleanup = await runtime.closeTree(params.cancelTree === true);
-        if (runtime.rootId) try { await runtime.inspect(runtime.rootId, { ignoreActive: true }); } catch (error) { cleanup.inspection_error = errorRecord(error); }
-        // Native evidence failures remain visible, but cannot strand copied
-        // credentials or the daemon after the owned process tree is gone.
-        const clean = cleanup.native_settled === true && !cleanup.inspection_error;
-        return { clean, settled: cleanup.native_settled === true, native_settled: cleanup.native_settled === true, physical_stopped: cleanup.physical_stopped, cleanup };
-        }, [
-          ["provider", async () => { if (!runtime.closed) throw new DroidError("provider_process_stop_incomplete", "Droid provider has not closed"); }],
+        return await completeDaemonShutdown(paths.dir, state, save,
+        () => prepareDroidStop(runtime, { cancelTree: params.cancelTree === true, busy, stateDir: paths.dir, save }), [
+          ["provider", async () => {
+            if (!runtime.closed) await runtime.closeTree(false);
+            if (!runtime.closed) throw new DroidError("provider_process_stop_incomplete", "Droid provider has not closed");
+          }],
           ["auth", () => removeDroidAuth(state.config)],
           ["daemon_resource", () => finishDaemonProcess(state.config, state.resource_process)]
         ]);

package/dist/harness-runtime/lib/dd-droid.mjs

@@ -11,8 +11,11 @@ import path from "node:path";
 import { ObservationClock, observedTimeout, validateObservationDuration } from "./observation-clock.mjs";
 import { operationProgressReporter } from "./operation-progress.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
-import { errorRecord, reportedError, isObservationLoss, isProvenShellCorrection } from "./operation-errors.mjs";
-import { hookBudget, invokeNativeHook } from "./native-hook-command.mjs";
+import { errorRecord, reportedError, isObservationLoss, isNativeHookObservationLoss, isProvenShellCorrection } from "./operation-errors.mjs";
+import { hookBudget, invokeNativeHook, retainNativeWorkStart, isStandaloneWorkStart } from "./native-hook-command.mjs";
+import { assertDaemonDispatch } from "./daemon-operations.mjs";
+import { isDeepStrictEqual } from "node:util";
+import { parseLifecycleCommand } from "./lifecycle-command.mjs";
 import { checkObservedProfile, observeModel } from "./model-observations.mjs";
 import { readNativeLines, streamNativeDiagnostics, nativeObservationError } from "./native-streams.mjs";
 import { commandText } from "./process-json.mjs";
@@ -116,7 +119,7 @@ function descendants(rows, rootPid) { const ids = new Set([rootPid]); for (;;) {
 
 export class DroidRuntime {
   constructor(config, state, persist) {
-    this.config = config; this.state = state; this.paths = droidPaths(config.stateDir); this.persist = persist; this.pending = new Map(); this.lateResponses = new Map(); this.active = null; this.child = null; this.closed = true; this.loaded = false; this.ownedProcesses = state.owned_processes ?? []; this.closing = false; this.workingState = "idle"; this.protocol = null; this.rootId = state.root_session_id ?? null; this.topology = new Map(state.descendants?.map(child => [child.provider_session_id, child]) ?? []); this.draining = Promise.resolve(); this.journalling = Promise.resolve(); this.activity = 0; this.providerProcess = null; this.cancelled = false; this.lastResult = state.last_result ?? null; this.metadata = metadataReader(this.paths.factory); this.fatalError = state.fatal_error ? reportedError(state.fatal_error) : null;
+    this.config = config; this.state = state; this.paths = droidPaths(config.stateDir); this.persist = persist; this.pending = new Map(); this.lateResponses = new Map(); this.active = null; this.child = null; this.closed = true; this.loaded = false; this.ownedProcesses = state.owned_processes ?? []; this.closing = false; this.workingState = "idle"; this.protocol = null; this.rootId = state.root_session_id ?? null; this.topology = new Map(state.descendants?.map(child => [child.provider_session_id, child]) ?? []); this.nativeCreatorTurns = new Map(); this.draining = Promise.resolve(); this.journalling = Promise.resolve(); this.activity = 0; this.providerProcess = null; this.cancelled = false; this.lastResult = state.last_result ?? null; this.metadata = metadataReader(this.paths.factory); this.fatalError = state.fatal_error ? reportedError(state.fatal_error) : null;
   }
   async journal(kind, payload) { const line = JSON.stringify({ schema_id: "dd-droid/event@1", observed_at: new Date().toISOString(), kind, ...payload }); this.journalling = this.journalling.then(() => appendFile(this.config.journal, `${line}\n`, { mode: 0o600 })); return await this.journalling; }
   async save(patch = {}) { return await this.persist({ root_session_id: this.rootId, sessions: this.rootId ? [this.rootId] : [], descendants: [...this.topology.values()], working_state: this.workingState, last_activity: this.activity, ...patch }); }
@@ -169,7 +172,9 @@ export class DroidRuntime {
     const fingerprint = createHash("sha256").update(JSON.stringify(event.params)).digest("hex");
     if (sessionId && this.rootId && sessionId !== this.rootId && !this.topology.has(sessionId)) throw new DroidError("session_identity_mismatch", "Unrelated native Session notification");
     const current = this.active;
-    const scoped = current && sessionId && (sessionId === this.rootId || this.topology.get(sessionId)?.operation_id === current.operationId)
+    let currentGuarded = Boolean(current && typeof current.guard === "function");
+    try { if (currentGuarded) current.guard(); } catch { currentGuarded = false; }
+    const scoped = currentGuarded && sessionId && (sessionId === this.rootId || this.topology.get(sessionId)?.operation_id === current.operationId)
       && (!n.turnId || n.turnId === current.turnId) && (!n.requestId || n.requestId === current.requestId);
     let productive = ["assistant_text_delta", "assistant_thought_delta"].includes(n.type) && Boolean(n.textDelta ?? n.thoughtDelta)
       || ["agent_turn_completed", "create_message"].includes(n.type);
@@ -209,7 +214,28 @@ export class DroidRuntime {
     if (n.type === "droid_working_state_changed" && (!sessionId || sessionId === this.rootId)) this.workingState = n.newState;
     if (n.type === "child_session_available") {
       if (!this.rootId || sessionId !== this.rootId || !n.childSessionId || !n.toolUseId) throw new DroidError("droid_child_identity_invalid", "Native child event lacks physical parent or tool identity");
-      this.topology.set(n.childSessionId, { provider_session_id: n.childSessionId, parent_provider_session_id: sessionId, tool_use_id: n.toolUseId, operation_id: current?.operationId ?? null, status: "running", source: "droid.child_session_available" }); await this.save();
+      // A notification may arrive after another prompt starts. Session and
+      // child identity alone do not identify the originating operation.
+      const byTurn = typeof n.turnId === "string" && n.turnId ? this.nativeCreatorTurns.get(`turn:${n.turnId}`) : null;
+      const byRequest = typeof n.requestId === "string" && n.requestId ? this.nativeCreatorTurns.get(`request:${n.requestId}`) : null;
+      const candidate = byTurn ?? byRequest ?? current;
+      const exact = candidate && (typeof n.turnId === "string" && n.turnId && n.turnId === candidate.turnId
+        || typeof n.requestId === "string" && n.requestId && n.requestId === candidate.requestId)
+        && (!n.turnId || n.turnId === candidate.turnId) && (!n.requestId || n.requestId === candidate.requestId)
+        && (!byTurn || !byRequest || byTurn === byRequest);
+      const previous = this.topology.get(n.childSessionId), sameTool = previous?.tool_use_id === n.toolUseId;
+      if (previous && ((previous.parent_provider_session_id && previous.parent_provider_session_id !== sessionId)
+        || previous.tool_use_id && !sameTool))
+        throw new DroidError("droid_child_identity_invalid", "Native child parent or creation tool contradicts the retained identity");
+      const retainedCreator = sameTool ? previous.creator_operation_id ?? previous.operation_id : null;
+      if (retainedCreator && exact && retainedCreator !== candidate.operationId)
+        throw new DroidError("droid_child_identity_invalid", "Native child creator contradicts the retained operation");
+      let proven = Boolean(exact && typeof candidate.guard === "function");
+      try { if (proven) candidate.guard(); } catch { proven = false; }
+      const creator = retainedCreator || (proven ? candidate.operationId : null);
+      this.topology.set(n.childSessionId, { ...(previous ?? {}), provider_session_id: n.childSessionId, parent_provider_session_id: sessionId, tool_use_id: n.toolUseId,
+        creator_operation_id: creator, operation_id: previous?.latest_tool_use_id && previous.latest_tool_use_id !== n.toolUseId ? null : creator,
+        status: "running", source: "droid.child_session_available" }); await this.save();
     }
     if (n.type === "settings_updated" && this.loaded) await this.observeSettings(sessionId ?? this.rootId, n.settings, { kind: "native.settings_updated", event_sha256: fingerprint });
     if (n.type === "create_message" && n.requestId === current?.requestId) {
@@ -354,8 +380,11 @@ export class DroidRuntime {
     const before = await this.inspect(id); if (!before.settled) throw new DroidError("tree_not_settled", "Prior Droid tree has not settled");
     let resolve, reject; const completed = new Promise((a, b) => { resolve = a; reject = b; }); void completed.catch(() => {});
     const requestId = randomUUID(), turnId = randomUUID();
-    const current = { operationId, requestId, turnId, resolve, reject, text: "", publish: operationProgressReporter(), saved: { operation: "session.prompt", provider_session_id: id, request_id: requestId, turn_id: turnId, accepted: false } };
+    const current = { operationId, requestId, turnId, sessionId: id, generation: (this.state.hook_generation ?? 0) + 1, resolve, reject, guard: assertDispatch, text: "", publish: operationProgressReporter(), saved: { operation: "session.prompt", provider_session_id: id, request_id: requestId, turn_id: turnId, accepted: false } };
+    this.state.hook_generation = current.generation; this.lastNativeHookOperation = current;
     this.active = current; this.cancelled = false; await this.saveBinding(current); await this.save({ active_tree: true });
+    const creator = { operationId, turnId, requestId, guard: assertDispatch };
+    this.nativeCreatorTurns.set(`turn:${turnId}`, creator); this.nativeCreatorTurns.set(`request:${requestId}`, creator);
     const clock = new ObservationClock({ timeoutMs: livenessTimeoutMs, onGap: gap => { void this.journal("observation_gap", { gap }).catch(() => {}); } });
     let checkingTerminal = false;
     const timer = setInterval(() => {
@@ -387,11 +416,11 @@ export class DroidRuntime {
         // A terminal native outcome is durable independently of a later
         // filesystem/topology observation.  Preserve it and let settlement
         // reconcile; do not convert it into a failed prompt.
-        return { provider_session_id: id, adapter_session_id: id, result: { ...outcome, status: status(outcome.reason) }, assistant_text: current.text, turn_id: turnId, settled: false, settlement_observation_error: errorRecord(error) };
+        return { provider_session_id: id, adapter_session_id: id, result: { ...outcome, status: status(outcome.reason) }, assistant_text: current.text, turn_id: turnId, settled: false, settlement_observation_error: errorRecord(error), ...(current.hookDiagnostics?.length ? { native_hook_diagnostics: current.hookDiagnostics } : {}) };
       }
       const providerFailure = droidTerminalFailure(outcome, id, receipt.settled);
       if (providerFailure) throw providerFailure;
-      return { ...receipt, result: { ...outcome, status: status(outcome.reason) }, assistant_text: current.text, turn_id: turnId };
+      return { ...receipt, result: { ...outcome, status: status(outcome.reason) }, assistant_text: current.text, turn_id: turnId, ...(current.hookDiagnostics?.length ? { native_hook_diagnostics: current.hookDiagnostics } : {}) };
     } catch (error) {
       if (current.outcome && isObservationLoss(error)) error = Object.assign(new Error("Droid completed natively but its dispatch acknowledgement was lost", { cause: error }), {
         code: "native_outcome_observation_failed", details: { native_outcome: { provider_session_id: id, turn_id: turnId, result: current.outcome }, settled: false, observation_error: errorRecord(error) }
@@ -508,7 +537,14 @@ export class DroidRuntime {
         ...(exactTurn ? { terminal_turn_id: nativeTurn } : {}), native_source: "droid.agent_turn_outcome",
         native_turn_items: { observed: native.complete && native.tool_calls.completeness === "complete", possible_effects: native.tool_calls.total > 0, pending: native.tool_calls.pending > 0 },
         ...(exactTurn && outcome.error && typeof outcome.error === "object" ? { provider_error: safeProviderError(outcome.error) } : {}) } : {};
-      this.topology.set(id, { provider_session_id: id, parent_provider_session_id: parentId, tool_use_id: creationTool, latest_tool_use_id: latest.parentToolUseId, task_id: latest.taskInvocationId, task_invocation_ids: ordered.map(task => task.taskInvocationId), status: running ? "running" : status(latest.status), source: "droid.task_invocations", transcript_path: native.transcript_path, ...evidence });
+      const previous = this.topology.get(id);
+      if (previous && (previous.parent_provider_session_id && previous.parent_provider_session_id !== parentId
+        || previous.tool_use_id && previous.tool_use_id !== creationTool))
+        throw new DroidError("droid_child_identity_invalid", "Native task inventory contradicts the retained child creation edge");
+      const creator = previous?.creator_operation_id ?? (previous?.latest_tool_use_id && previous.latest_tool_use_id !== creationTool ? null : previous?.operation_id) ?? null;
+      this.topology.set(id, { provider_session_id: id, parent_provider_session_id: parentId, tool_use_id: creationTool, latest_tool_use_id: latest.parentToolUseId,
+        creator_operation_id: creator, operation_id: latest.parentToolUseId === creationTool ? creator : null,
+        task_id: latest.taskInvocationId, task_invocation_ids: ordered.map(task => task.taskInvocationId), status: running ? "running" : status(latest.status), source: "droid.task_invocations", transcript_path: native.transcript_path, ...evidence });
     }
     return [...this.topology.values()];
   }
@@ -530,16 +566,82 @@ export class DroidRuntime {
     const usage = []; for (const sessionId of [id, ...children.map(child => child.provider_session_id)]) usage.push(await this.snapshotUsage(sessionId, { ingest: ingestUsage }));
     const settled = !this.topologyIncomplete && (!this.active || ignoreActive) && (this.closed || this.workingState === "idle") && source?.tool_calls.pending === 0 && children.every(child => terminal(child.status) && child.native_turn_items?.observed === true && child.native_turn_items.pending === false);
     const rootSettled = source?.complete && source.tool_calls.completeness === "complete" && source.tool_calls.pending === 0 && (!this.active || ignoreActive) && (this.closed || this.workingState === "idle") && terminal((source?.outcomes?.at(-1) ?? this.lastResult)?.reason);
-    return nativeExecutionReceipt({ harness: "droid-cli", runtime_family: "droid", session: { harness_id: "droid-cli", session_id: id }, provider_session_id: id, adapter_session_id: id, cwd: this.config.cwd, observed_profile: source?.settings ? await this.observeSettings(id, source.settings, { path: source.transcript_path, sha256: source.source_sha256 }) : this.observedProfile, observed_runtime: { droid: this.config.version, factory_protocol: this.protocol ?? DROID_PROTOCOL, dd_harness_contract: DROID_CONTRACT }, status: settled ? "idle" : "running", settled, ...settledNativeTree(id, children, settled, rootSettled && !this.topologyIncomplete), terminal_turn_id: source?.outcomes?.at(-1)?.turnId ?? this.lastResult?.turnId, descendants: children, transcript_path: source?.transcript_path ?? null, usage, result: this.lastResult, provider_pid: this.closed ? null : this.child?.pid ?? null,
+    const neverPrompted = source?.complete && !this.active && !this.lastResult && source.records.every(record => record.type === "session_start");
+    const nativeSettled = Boolean(settled && (rootSettled || neverPrompted));
+    return nativeExecutionReceipt({ harness: "droid-cli", runtime_family: "droid", session: { harness_id: "droid-cli", session_id: id }, provider_session_id: id, adapter_session_id: id, cwd: this.config.cwd, observed_profile: source?.settings ? await this.observeSettings(id, source.settings, { path: source.transcript_path, sha256: source.source_sha256 }) : this.observedProfile, observed_runtime: { droid: this.config.version, factory_protocol: this.protocol ?? DROID_PROTOCOL, dd_harness_contract: DROID_CONTRACT }, status: settled ? "idle" : "running", settled, native_settled: nativeSettled, ...settledNativeTree(id, children, settled, rootSettled && !this.topologyIncomplete), terminal_turn_id: source?.outcomes?.at(-1)?.turnId ?? this.lastResult?.turnId, descendants: children, transcript_path: source?.transcript_path ?? null, usage, result: this.lastResult, provider_pid: this.closed ? null : this.child?.pid ?? null,
       ...(this.topologyIncomplete ? { native_settlement: { confirmed: false, state: "unproven", reason: "native_task_inventory_incomplete" } } : {}) }, { daemonId: this.config.daemonId });
   }
   async observeHook(payload, eventId, deadlineAt = null) {
+    if (!this.config.noFlow && this.config.runtime_owner && this.config.ddFlowBin && this.rootId
+      && ["PreToolUse", "PostToolUse"].includes(payload.hook_event_name)
+      && typeof payload.tool_name === "string" && payload.tool_name && typeof payload.session_id === "string" && payload.session_id
+      && typeof eventId === "string" && eventId) {
+      if (payload.tool_name !== "Execute") return {}; // Read/Edit/etc. never carry lifecycle commands.
+      const analysis = typeof payload.tool_input?.command === "string" ? parseLifecycleCommand(payload.tool_input.command) : null;
+      // No RUN/Work receipt or native ancestry is needed for ordinary shell.
+      // Real notification progress remains source-bound in observe().
+      if (analysis?.participation === "none" && !analysis.unresolved) return {};
+    }
+    if (payload.hook_event_name === "PreToolUse" && payload.tool_name === "Execute" && this.config.runtime_owner && this.config.ddFlowBin
+      && typeof payload.session_id === "string" && payload.session_id && typeof eventId === "string" && eventId && this.rootId
+      && isStandaloneWorkStart(payload.tool_input?.command)) {
+      assertDaemonDispatch(this.paths.dir);
+      this.retainedWorkStarts ??= new Map();
+      const command = payload.tool_input?.command;
+      const accepted = await retainNativeWorkStart(this.paths.dir, { daemon_id: this.config.daemonId, source_harness: "droid-cli",
+        root_provider_session_id: this.rootId, provider_session_id: payload.session_id, parent_provider_session_id: null,
+        tool_call_id: payload.tool_use_id ?? eventId, native_tool_identity: payload.tool_use_id ? "native" : "callback_request",
+        event: "PreToolUse", native_command: command, native_cwd: payload.cwd ?? null,
+        native_payload: { schema_id: "dd-flow/droid-tool-event@1", phase: "before", event_id: eventId, tool_call_id: payload.tool_use_id ?? eventId,
+          daemon_id: this.config.daemonId, session: { provider_session_id: payload.session_id }, tool: "Execute", input: payload.tool_input,
+          transcript_path: payload.transcript_path, callback_cwd: payload.cwd } }, this.active ?? this.lastNativeHookOperation, this.retainedWorkStarts);
+      if (accepted) return {};
+    }
     try { return await this.observeHookChecked(payload, eventId, hookBudget(23_000, deadlineAt)); }
     catch (error) { if (error.details?.scope !== "foreign_hook") await this.handleObservationError(error); throw error; }
   }
+  async verifyWorkStart(params) {
+    const retained = this.retainedWorkStarts?.get(params.requestId);
+    if (!retained || !isDeepStrictEqual(retained.binding, params.binding)) throw new DroidError("native_hook_unproven", "Unknown native Work start callback");
+    retained.guard();
+    const binding = retained.binding, id = binding.provider_session_id, payload = binding.native_payload;
+    if (binding.root_provider_session_id !== this.rootId) throw new DroidError("droid_hook_identity_invalid", "Native Work start root changed");
+    const report = operationProgressReporter();
+    const checkpoint = cursor => report('verification_progress', { native_request_id: cursor, session_id: id });
+    const native = await this.metadata.read(id, checkpoint);
+    if (!native || !path.isAbsolute(payload.callback_cwd ?? "") || path.resolve(payload.callback_cwd) !== this.config.cwd
+      || path.resolve(native.header.cwd) !== this.config.cwd || await realpath(payload.transcript_path) !== await realpath(native.transcript_path))
+      throw new DroidError("droid_hook_identity_invalid", "Native Work start has no verified physical Session/workspace");
+    const parent = native.header.callingSessionId ?? null, seen = new Set([id]);
+    let ancestor = parent;
+    while (ancestor && ancestor !== this.rootId) {
+      if (seen.has(ancestor)) throw new DroidError("droid_hook_identity_invalid", "Native Work start ancestry contains a cycle");
+      seen.add(ancestor);
+      const owner = await this.metadata.read(ancestor, checkpoint);
+      if (!owner || path.resolve(owner.header.cwd) !== this.config.cwd) throw new DroidError("droid_hook_identity_invalid", "Native Work start ancestry is unproven");
+      ancestor = owner.header.callingSessionId ?? null;
+    }
+    if (id !== this.rootId && ancestor !== this.rootId || id === this.rootId && parent)
+      throw new DroidError("droid_hook_identity_invalid", "Native Work start belongs to another root");
+    const previous = this.topology.get(id);
+    if (previous && (previous.parent_provider_session_id !== parent || previous.tool_use_id && previous.tool_use_id !== native.header.callingToolUseId))
+      throw new DroidError("droid_hook_identity_invalid", "Native Work start contradicts retained ancestry");
+    const profile = await this.observeSettings(id, native.settings, { path: native.transcript_path, sha256: native.source_sha256 ?? native.source?.sha256 });
+    retained.guard();
+    return { verified: true, registeredHookBinding: binding, nativeHookBinding: { ...binding, parent_provider_session_id: parent,
+      native_ancestry: "confirmed", native_payload: { ...payload, session: { provider_session_id: id, parent_provider_session_id: parent, directory: this.config.cwd }, profile } } };
+  }
   async observeHookChecked(payload, eventId, budget = hookBudget(23_000)) {
     const id = payload.session_id, event = payload.hook_event_name;
     if (!id || !event || !eventId) throw new DroidError("droid_hook_invalid", "Hook lacks native identity or event ID");
+    // SessionStart can be invoked synchronously by initialize/load before the
+    // provider creates its transcript. Acknowledge only the outstanding owned
+    // root request; this is not evidence that initialization succeeded.
+    const initPending = [...this.pending.values()].some(item => ["droid.initialize_session", "droid.load_session"].includes(item.method));
+    if (event === "SessionStart" && initPending && id === this.rootId && typeof payload.cwd === "string" && path.resolve(payload.cwd) === this.config.cwd && typeof payload.transcript_path === "string") {
+      const sessions = path.join(this.paths.factory, "sessions"), transcript = path.resolve(payload.transcript_path), relative = path.relative(sessions, transcript);
+      if (path.isAbsolute(payload.transcript_path) && relative && !relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative) && path.basename(transcript) === `${id}.jsonl`) return {};
+    }
     // Hooks can precede the root initialize response or the child notification.
     const deadline = Date.now() + 3_000; let native;
     do { native = ["PreToolUse", "PostToolUse"].includes(event) ? await this.metadata.read(id) : await readDroidSession(this.paths.factory, id); if (native) break; await sleep(25); } while (Date.now() < deadline);
@@ -550,7 +652,11 @@ export class DroidRuntime {
     if (parent && (id === parent || this.topology.has(id) && this.topology.get(id).parent_provider_session_id !== parent)) throw foreign("Hook child ancestry changed");
     if (!parent && this.rootId && id !== this.rootId) throw foreign("Hook came from an unrelated root");
     if (path.resolve(native.header.cwd) !== this.config.cwd) throw new DroidError("droid_hook_identity_invalid", "Owned native Session workspace changed");
-    if (parent && !terminal(this.topology.get(id)?.status)) this.topology.set(id, { ...(this.topology.get(id) ?? {}), provider_session_id: id, parent_provider_session_id: parent, tool_use_id: native.header.callingToolUseId, status: "running", source: "droid.session_start" });
+    if (parent && !terminal(this.topology.get(id)?.status)) {
+      const previous = this.topology.get(id), creationTool = native.header.callingToolUseId;
+      if (previous?.tool_use_id && previous.tool_use_id !== creationTool) throw foreign("Hook child creation tool contradicts retained native identity");
+      this.topology.set(id, { ...(previous ?? {}), provider_session_id: id, parent_provider_session_id: parent, tool_use_id: creationTool, status: "running", source: "droid.session_start" });
+    }
     this.activity += 1; await this.journal("hook", { event_id: eventId, event, session_id: id, parent_session_id: parent }); await this.save();
     if (!["PreToolUse", "PostToolUse"].includes(event)) return {};
     if (this.fatalError) return { continue: false, stopReason: this.fatalError.message };
@@ -568,6 +674,13 @@ export class DroidRuntime {
         await this.save();
         return { continue: false, stopReason: error.message };
       }
+      if (isNativeHookObservationLoss(error)) {
+        // A lost hook observation does not establish the tool or CLI outcome.
+        // Do not authorize this pre-tool request, but do not poison the Turn.
+        if (this.active) (this.active.hookDiagnostics ??= []).push(errorRecord(error));
+        try { await this.journal("native_hook_observation_unavailable", { event_id: eventId, session_id: id, error: errorRecord(error) }); } catch { /* optional diagnostic */ }
+        return event === "PreToolUse" ? { continue: false, stopReason: "Lifecycle observation unavailable; retry the command." } : {};
+      }
       // Identity is proven above; only this owned admission can fail its turn.
       this.fatalError ??= Object.assign(error, { details: { ...error.details, provider_session_id: id, event_id: eventId, effect: error.details?.effect ?? "unknown", native_turn_items: { observed: false, possible_effects: true, pending: true } } });
       this.rejectPending(this.fatalError);

package/dist/harness-runtime/lib/dd-grok-daemon.d.mts

@@ -0,0 +1 @@
+export function callDaemon(stateDir: string, operation: string, params?: Record<string, unknown>, timeoutMs?: number): Promise<Record<string, unknown>>;