@deksden-com/dd-flow-cli 0.9.0-beta.152 → 0.9.0-beta.156

package/dist/services/project-flow-source.js

@@ -0,0 +1,195 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { Ajv } from "ajv/dist/ajv.js";
+import semver from "semver";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest, validateHybridShape } from "./hybrid-contracts.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+import { isCanonicalOnlyMemoryPath } from "./memory-layer.js";
+import { localEnvironmentAllowed } from "./workspace-files.js";
+import { admitBundledFlow } from "./stage-handlers.js";
+import { normalizeFlowContract } from "../domain/flow-contract.js";
+const limit = 1024 * 1024, manifestPath = "project-pack/manifest.json";
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function refuse(reason) {
+    throw new AppError("project_flow_source_invalid", "Project-local flow requires its own valid curated pack; use the supported pack upgrade/repair route", 2, { reason, phase: "prepare", effect: "no_effect", next_action: "inspect_project_pack_and_upgrade_or_repair" });
+}
+function safe(name) {
+    return typeof name === "string" && /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(name)
+        && name.split("/").every(part => ![".", "..", ".git", "node_modules", ".dd-flow"].includes(part.toLowerCase()) && localEnvironmentAllowed(part));
+}
+function schema(name) { return JSON.parse(fs.readFileSync(new URL(`../schemas/${name}.schema.json`, import.meta.url), "utf8")); }
+function decoded(bytes) { try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+}
+catch {
+    return refuse("invalid_pack_json");
+} }
+function validate(scope, blobs) {
+    if (!scope || Object.keys(scope).sort().join() !== "flowId,projectRoot,workspace" || scope.flowId !== "interactive"
+        || [scope.projectRoot, scope.workspace].some(value => typeof value !== "string" || !path.isAbsolute(value)))
+        refuse("invalid_project_scope");
+    const manifest = decoded(blobs.get(manifestPath) ?? Buffer.alloc(0));
+    if (!new Ajv({ strict: false, validateFormats: false }).compile(schema("project-flow-pack-manifest"))(manifest)
+        || manifest.schema_id !== "dd-flow/project-flow-pack-manifest@2" || !/^[a-f0-9]{40}$/.test(manifest.source_commit)
+        || !semver.valid(manifest.canon_version_at_source_commit))
+        refuse("invalid_or_legacy_project_manifest");
+    if (manifest.included_files.length > 20_000 || manifest.included_files.some(name => !safe(name) || name === manifestPath
+        || name.startsWith("project-pack/") || isCanonicalOnlyMemoryPath(`dd-flow/${name}`)))
+        refuse("invalid_curated_inventory");
+    const names = [manifestPath, ...manifest.included_files], folded = new Set();
+    let total = 0;
+    if (blobs.size !== names.length)
+        refuse("pack_inventory_changed");
+    for (const name of names) {
+        if (folded.has(name.toLowerCase()))
+            refuse("aliased_pack_path");
+        folded.add(name.toLowerCase());
+        const bytes = blobs.get(name);
+        if (!bytes?.length || bytes.length > limit || (total += bytes.length) > 32 * limit)
+            refuse("missing_or_unbounded_pack_file");
+        if (name !== manifestPath && manifest.file_hashes?.[name] !== undefined && manifest.file_hashes[name] !== hash(bytes))
+            refuse("project_pack_file_changed");
+    }
+    const descriptorPath = `${scope.flowId}/flow-descriptor.json`, descriptor = decoded(blobs.get(descriptorPath) ?? Buffer.alloc(0));
+    if (validateHybridShape("flow-descriptor", descriptor).length || descriptor.id !== scope.flowId || descriptor.origin !== "project")
+        refuse("project_descriptor_required");
+    for (const stage of descriptor.stages)
+        for (const kind of ["instruction", "result_schema"]) {
+            const ref = stage[kind], bytes = blobs.get(ref.path);
+            if (!bytes || ref.path === manifestPath || !manifest.included_files.includes(ref.path) || hash(bytes) !== ref.sha256)
+                refuse("stage_source_not_in_project_pack");
+            try {
+                new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+            }
+            catch {
+                refuse("invalid_stage_source_encoding");
+            }
+            if (kind === "result_schema")
+                decoded(bytes);
+        }
+    const compatibility = decoded(blobs.get("compatibility.json") ?? Buffer.alloc(0));
+    if (!new Ajv({ strict: false, validateFormats: false }).compile(schema("compatibility"))(compatibility))
+        refuse("invalid_project_compatibility");
+    const contract = normalizeFlowContract(decoded(blobs.get("flow-contract.json") ?? Buffer.alloc(0)));
+    if (contract.id !== manifest.flow_contract || compatibility.dd_flow_cli.flow_contract !== contract.id
+        || compatibility.memory_bank_version !== manifest.canon_version_at_source_commit)
+        refuse("project_contract_mismatch");
+    return { manifest, descriptorPath, compatibility };
+}
+/** Project pack data, not engine/handler admission. Manifest canon paths are
+ * provenance hints only: never follow them or fall back to global instructions. */
+export class PreparedProjectFlowSource {
+    sha256;
+    #scope;
+    #blobs;
+    #facts;
+    #fresh;
+    constructor(scope, blobs, fresh) {
+        this.#facts = validate(scope, blobs);
+        this.#scope = structuredClone(scope);
+        this.#blobs = new Map([...blobs].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([name, bytes]) => [name, Buffer.from(bytes)]));
+        this.sha256 = hybridDigest({ scope, inventory: [...this.#blobs].map(([name, bytes]) => ({ path: name, sha256: hash(bytes) })) });
+        this.#fresh = fresh;
+        Object.freeze(this);
+    }
+    static fromProject(scope) {
+        try {
+            for (const root of [scope.projectRoot, scope.workspace])
+                if (fs.realpathSync(root) !== root || !fs.lstatSync(root).isDirectory())
+                    refuse("noncanonical_project_root");
+            let root = scope.workspace;
+            for (const name of [".memory-bank", "dd-flow"]) {
+                root = path.join(root, name);
+                if (!fs.lstatSync(root).isDirectory())
+                    refuse("linked_project_pack");
+            }
+            const read = (logical) => {
+                if (!safe(logical))
+                    refuse("unsafe_pack_path");
+                let parent = root;
+                for (const part of logical.split("/").slice(0, -1)) {
+                    parent = path.join(parent, part);
+                    if (!fs.lstatSync(parent).isDirectory())
+                        refuse("linked_project_pack");
+                }
+                return readBoundedReleaseFile(path.join(root, logical), limit);
+            };
+            const raw = read("manifest.json"), manifest = decoded(raw);
+            if (!new Ajv({ strict: false, validateFormats: false }).compile(schema("project-flow-pack-manifest"))(manifest)
+                || manifest.schema_id !== "dd-flow/project-flow-pack-manifest@2")
+                refuse("invalid_or_legacy_project_manifest");
+            const blobs = new Map([[manifestPath, raw]]);
+            if (manifest.included_files.length > 20_000)
+                refuse("unbounded_project_pack");
+            let total = raw.length;
+            for (const name of manifest.included_files) {
+                if (!safe(name) || isCanonicalOnlyMemoryPath(`dd-flow/${name}`) || name.startsWith("project-pack/"))
+                    refuse("invalid_curated_inventory");
+                const bytes = read(name);
+                total += bytes.length;
+                if (total > 32 * limit)
+                    refuse("unbounded_project_pack");
+                blobs.set(name, bytes);
+            }
+            if (!read("manifest.json").equals(raw))
+                refuse("manifest_changed_during_capture");
+            return new PreparedProjectFlowSource(scope, blobs, true);
+        }
+        catch (error) {
+            if (error instanceof AppError && error.code === "project_flow_source_invalid")
+                throw error;
+            return refuse("project_pack_unavailable_or_changed");
+        }
+    }
+    snapshot() { return { schema_id: "dd-flow/project-flow-source@1", scope: structuredClone(this.#scope), blobs: [...this.#blobs].map(([name, bytes]) => ({ path: name, base64: bytes.toString("base64") })) }; }
+    /** Data restoration only. expectedSha256 must come from independent request/
+     * RUN custody. Engine/handler admission is separate and never inferred here. */
+    static restoreRetained(value, expectedSha256) {
+        if (!value || Object.keys(value).sort().join() !== "blobs,schema_id,scope" || value.schema_id !== "dd-flow/project-flow-source@1"
+            || !Array.isArray(value.blobs) || value.blobs.length > 20_001)
+            refuse("invalid_retained_project_source");
+        const blobs = new Map();
+        let total = 0;
+        for (const item of value.blobs) {
+            if (!item || Object.keys(item).sort().join() !== "base64,path" || !safe(item.path) || typeof item.base64 !== "string" || item.base64.length > 2 * limit || blobs.has(item.path))
+                refuse("invalid_retained_project_source");
+            const bytes = Buffer.from(item.base64, "base64");
+            total += bytes.length;
+            if (!bytes.length || bytes.length > limit || total > 32 * limit || bytes.toString("base64") !== item.base64)
+                refuse("invalid_retained_project_source");
+            blobs.set(item.path, bytes);
+        }
+        const result = new PreparedProjectFlowSource(value.scope, blobs, false);
+        if (result.sha256 !== expectedSha256)
+            refuse("retained_project_source_changed");
+        return result;
+    }
+    blobs() { return new Map([...this.#blobs].map(([name, bytes]) => [name, Buffer.from(bytes)])); }
+    scope() { return structuredClone(this.#scope); }
+    descriptorReference() { const name = this.#facts.descriptorPath; return { path: name, sha256: hash(this.#blobs.get(name)) }; }
+    projectPackProvenance() { return { sha256: hybridDigest([...this.#blobs].map(([name, bytes]) => ({ path: name === manifestPath ? "dd-flow/manifest.json" : `dd-flow/${name}`, sha256: hash(bytes) })).sort((a, b) => a.path.localeCompare(b.path, "en"))), source_commit: this.#facts.manifest.source_commit }; }
+    canonSource() { return { version: this.#facts.manifest.canon_version_at_source_commit, commit: this.#facts.manifest.source_commit }; }
+    /** Declared project base, not a claim that customized instructions are bytes
+     * from an installed canonical archive. Actual data identity is the pack hash. */
+    canonProvenance() { return { ...this.canonSource(), archive_sha256: null }; }
+    resolveRegisteredFlow() { const ref = this.descriptorReference(); return admitBundledFlow(this.#blobs.get(ref.path), ref.sha256, this.#blobs); }
+    assertEngineCompatibility(engine) {
+        const value = this.#facts.compatibility;
+        if (engine.package_name !== value.engine.package_name || engine.package_name !== value.dd_flow_cli.package_name
+            || !semver.valid(engine.package_version) || !semver.valid(engine.engine_version)
+            || !semver.validRange(value.engine.version_range) || !semver.valid(value.dd_flow_cli.min_version)
+            || !semver.satisfies(engine.engine_version, value.engine.version_range, { includePrerelease: true })
+            || !semver.gte(engine.package_version, value.dd_flow_cli.min_version))
+            refuse("project_pack_engine_incompatible");
+    }
+    revalidate() {
+        if (!this.#fresh) {
+            validate(this.#scope, this.#blobs);
+            return;
+        }
+        if (PreparedProjectFlowSource.fromProject(this.#scope).sha256 !== this.sha256)
+            refuse("project_source_changed_before_retention");
+    }
+}

package/dist/services/project-git-integration.js

@@ -0,0 +1,92 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { interactiveWorkPathAllowed } from "./interactive-work-batch.js";
+import { ObservedMemorySources } from "./memory-source-observations.js";
+import { memorySourceKey } from "./memory-stage-results.js";
+import { assertMemoryGitRemovalSources } from "./memory-git-integration.js";
+function refuse(reason) {
+    throw new AppError("project_git_integration_invalid", "Reviewed project files lack exact local Git integration", 2, { reason, effect: "no_effect" });
+}
+export function assertReviewedProjectGitInventory(references, removals) {
+    const valid = (ref) => ref?.root === "workspace" && interactiveWorkPathAllowed(ref.path)
+        && /^[a-f0-9]{64}$/.test(ref.sha256) && (Object.keys(ref).sort().join() === "path,root,sha256"
+        || Object.keys(ref).sort().join() === "git_mode,path,root,sha256" && ["100644", "100755"].includes(ref.git_mode));
+    if (!Array.isArray(references) || !Array.isArray(removals) || !references.length && !removals.length
+        || references.length + removals.length > 4096 || [...references, ...removals].some(ref => !valid(ref))
+        || new Set([...references, ...removals].map(ref => ref.path)).size !== references.length + removals.length)
+        refuse("invalid_reviewed_project_inventory");
+}
+/** Physical selected-file readback only, not review, policy or commit authority.
+ * Unrelated dirty files/index entries are deliberately neither committed nor
+ * treated as failures. The terminal owner must admit the original dirty input. */
+export function observeReviewedProjectGitIntegration(input, environment, references, removals = []) {
+    assertReviewedProjectGitInventory(references, removals);
+    for (const root of [input.projectRoot, input.workspaceRoot]) {
+        if (!path.isAbsolute(root) || fs.realpathSync(root) !== root || !fs.lstatSync(root).isDirectory())
+            refuse("canonical_repository_root_required");
+    }
+    if (!path.isAbsolute(input.gitExecutable) || typeof input.integrationBranch !== "string" || !input.integrationBranch)
+        refuse("explicit_git_selection_required");
+    const env = { ...Object.fromEntries(Object.entries(environment).filter(([key]) => !key.startsWith("GIT_"))), GIT_OPTIONAL_LOCKS: "0", GIT_LITERAL_PATHSPECS: "1" };
+    const git = (root, args) => {
+        const result = spawnSync(input.gitExecutable, ["-c", "core.fsmonitor=false", "-C", root, ...args], { env, timeout: 10000, maxBuffer: 16 * 1024 * 1024, shell: false, windowsHide: true });
+        if (result.error || result.signal || result.status !== 0)
+            refuse("git_readback_failed");
+        return result.stdout;
+    };
+    const text = (root, args) => git(root, args).toString("utf8").trim();
+    const source = input.workspaceRoot, target = input.projectRoot, integrationRef = `refs/heads/${input.integrationBranch}`;
+    git(target, ["check-ref-format", integrationRef]);
+    const common = (root) => fs.realpathSync(path.resolve(root, text(root, ["rev-parse", "--git-common-dir"])));
+    const repository = common(source);
+    if (common(target) !== repository || [source, target].some(root => text(root, ["rev-parse", "--show-toplevel"]) !== root))
+        refuse("foreign_repository");
+    const workspaceBranch = text(source, ["symbolic-ref", "--short", "HEAD"]);
+    if (text(target, ["symbolic-ref", "--short", "HEAD"]) !== input.integrationBranch)
+        refuse("integration_branch_changed");
+    const head = text(source, ["rev-parse", "--verify", "HEAD^{commit}"]), integrated = text(target, ["rev-parse", "--verify", `${integrationRef}^{commit}`]);
+    git(target, ["merge-base", "--is-ancestor", head, integrated]);
+    const paths = [...references, ...removals].map(ref => ref.path);
+    const observations = [...new Set([source, target])].map(root => {
+        const visibility = git(root, ["ls-files", "-v", "-z", "--", ...paths]).toString("utf8");
+        if (visibility.split("\0").filter(Boolean).some(entry => !entry.startsWith("H ")))
+            refuse("selected_index_visibility_override");
+        git(root, ["diff", "--cached", "--exit-code", "--", ...paths]);
+        assertMemoryGitRemovalSources(root, removals);
+        const observed = ObservedMemorySources.capture({ workspace: root }, references.map(({ root, path }) => ({ root, path })));
+        const hashes = observed.hashes();
+        for (const ref of references) {
+            if (hashes.get(memorySourceKey("workspace", ref.path)) !== ref.sha256)
+                refuse("reviewed_workspace_bytes_changed");
+            if (process.platform !== "win32" && ((fs.lstatSync(path.join(root, ref.path)).mode & 0o111) !== 0) !== (ref.git_mode === "100755"))
+                refuse("reviewed_workspace_mode_changed");
+        }
+        return observed;
+    });
+    // ponytail: at most 4096 selected paths; batch Git reads if real interactive
+    // inventories make per-file subprocess latency material.
+    for (const [root, revision] of [[source, head], [target, integrated]]) {
+        for (const ref of references) {
+            const entry = git(root, ["ls-tree", "-z", revision, "--", ref.path]).toString("utf8");
+            if (!entry.startsWith(`${ref.git_mode ?? "100644"} blob `) || !entry.endsWith(`\t${ref.path}\0`))
+                refuse("reviewed_regular_git_blob_required");
+            if (createHash("sha256").update(git(root, ["cat-file", "blob", `${revision}:${ref.path}`])).digest("hex") !== ref.sha256)
+                refuse("reviewed_git_bytes_changed");
+        }
+        for (const ref of removals)
+            if (git(root, ["ls-tree", "-z", revision, "--", ref.path]).length)
+                refuse("removed_file_still_committed");
+    }
+    for (const observation of observations)
+        observation.revalidate();
+    if (text(source, ["rev-parse", "HEAD"]) !== head || text(target, ["rev-parse", integrationRef]) !== integrated)
+        refuse("integration_changed_during_observation");
+    return { schema_id: "dd-flow/project-git-integration-observation@1", project_root: target, workspace_root: source,
+        repository, workspace_branch: workspaceBranch, integration_ref: integrationRef, workspace_head: head, integration_head: integrated,
+        reviewed_files_sha256: hybridDigest([...references].sort((a, b) => a.path.localeCompare(b.path, "en"))),
+        removed_files_sha256: hybridDigest([...removals].sort((a, b) => a.path.localeCompare(b.path, "en"))) };
+}

package/dist/services/repair-intents.js

@@ -2,15 +2,10 @@ import crypto from "node:crypto";
 import { stageAttempt, stageCycle, bindStageWork } from "./stage-work-graph.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
 import { AppError } from "../shared/errors.js";
-import { assertSourceRepairEligible } from "./code-checks.js";
+import { assertCheckDiagnosisEligible } from "./code-checks.js";
 /** Checks finish before entering this synchronous registration transaction. */
 export function ensureAggregateRepair(context, input, create) {
-    if (!input.failures.length)
-        throw new AppError("repair_intent_invalid", "Repair requires candidate-source-backed failed receipts", 1);
-    const workspace = context.db.get("SELECT workspace_root FROM runs WHERE project_id=? AND id=?", [input.projectId, input.runId]);
-    if (!workspace?.workspace_root && input.failures.some(receipt => receipt.candidate_library_inputs?.length))
-        throw new AppError("repair_intent_invalid", "Library-backed repair requires the current RUN workspace", 1);
-    assertSourceRepairEligible(input.failures, workspace?.workspace_root);
+    assertCheckDiagnosisEligible(input.failures);
     const causes = input.failures.map(receipt => ({ id: receipt.id, epoch: receipt.verification_epoch, fingerprint: receipt.fingerprint_scope === "check_inputs" ? receipt.before_fingerprint : receipt.workspace_fingerprint })).sort((a, b) => a.id.localeCompare(b.id));
     return ensureRepairIntent(context, { ...input, causes: { receipts: causes, origins: [...(input.origins ?? [])].sort() } }, create);
 }

package/dist/services/retained-native-hook.js

@@ -0,0 +1,274 @@
+import crypto from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open, readdir } from "node:fs/promises";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { canonicalPath } from "../storage/paths.js";
+import { lifecycleCommandFromPayload } from "./lifecycle-command.js";
+import { matchesIssuedNativeCommand, observedLifecycleInvocation } from "./lifecycle-invocations.js";
+import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
+import { requireProjectByRoot } from "./project-registry.js";
+import { handleAgyEvent, handleCodexHook, handleDroidEvent, handleOpenCodeEvent, handleGrokEvent, handleZcodeEvent } from "./hooks.js";
+import { withDaemonProgressObserver } from "../harness-runtime/lib/daemon-observation.mjs";
+const object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const diagnostics = new WeakMap();
+async function regularJson(file) {
+    try {
+        const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            if (!(await handle.stat()).isFile())
+                return null;
+            return object(JSON.parse(await handle.readFile("utf8")));
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        if (["ENOENT", "ELOOP", "ENOTDIR"].includes(error.code ?? "") || error instanceof SyntaxError)
+            return null;
+        throw error;
+    }
+}
+async function realDirectory(directory) {
+    try {
+        const info = await lstat(directory);
+        return info.isDirectory() && !info.isSymbolicLink();
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+function payloadCommand(binding) {
+    const payload = object(binding.native_payload);
+    if (!payload)
+        return undefined;
+    if (binding.source_harness === "codex-desktop")
+        return lifecycleCommandFromPayload(payload) ?? undefined;
+    if (binding.source_harness === "grok-acp") {
+        const native = object(payload.tool_input ?? payload.toolInput);
+        const command = native?.command ?? native?.cmd ?? payload.command;
+        return typeof command === "string" ? command : undefined;
+    }
+    if (binding.source_harness === "zcode-acp") {
+        const update = object(object(payload.params)?.update), native = object(update?.rawInput);
+        const command = native?.command ?? native?.cmd;
+        return typeof command === "string" ? command : undefined;
+    }
+    const input = object(payload.input);
+    const command = input?.command ?? input?.cmd ?? input?.CommandLine;
+    return typeof command === "string" ? command : undefined;
+}
+/** The directory is only a locator. The owning daemon must attest the exact
+ * binding from its verified native-delivery map before it becomes a receipt. */
+export async function reconcileRetainedNativeHook(context, input) {
+    const { scope, invocationId } = input;
+    const diagnostic = (phase, error, binding) => {
+        if (!input.onDiagnostic)
+            return;
+        const supplied = error instanceof Error || object(error) ? error.code : undefined;
+        const code = typeof supplied === "string" && /^[A-Za-z][A-Za-z0-9_]{0,95}$/.test(supplied) ? supplied : "native_hook_verification_unavailable";
+        // Diagnostics never become execution authority or activity. Keep identifiers
+        // and a typed cause, not native messages/configs that can contain credentials.
+        const value = { phase, code, invocation_id: invocationId,
+            ...(typeof binding?.request_id === "string" ? { request_id: binding.request_id } : {}),
+            ...(typeof binding?.operation_id === "string" ? { operation_id: binding.operation_id } : {}) };
+        const seen = diagnostics.get(context) ?? new Set(), key = JSON.stringify(value);
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        diagnostics.set(context, seen);
+        input.onDiagnostic(value);
+    };
+    if (!scope.runId || context.env.DD_FLOW_DAEMON_ID !== scope.daemonId)
+        return false;
+    let owner = null;
+    try {
+        owner = object(JSON.parse(context.env.DD_FLOW_RUNTIME_OWNER ?? "null"));
+    }
+    catch {
+        return false;
+    }
+    const stateDir = owner?.state_dir || context.env.DD_FLOW_CODEX_STATE_DIR || context.env.DD_AGY_STATE_DIR || context.env.DD_GROK_STATE_DIR || context.env.DD_ZCODE_STATE_DIR;
+    if (typeof stateDir !== "string" || !path.isAbsolute(stateDir) || !await realDirectory(stateDir))
+        return false;
+    // This is an optional additional observation source. A missing, retiring or
+    // unbound daemon must leave the existing hook path intact, never grant it
+    // authority and never turn an otherwise valid legacy delivery into a failure.
+    let owned;
+    let metadata;
+    try {
+        const state = readNativeDaemonState(stateDir);
+        if ((state.daemon_id ?? state.config?.daemonId) !== scope.daemonId) {
+            diagnostic("owner", { code: "daemon_owner_mismatch" });
+            return false;
+        }
+        const project = requireProjectByRoot(context, scope.projectRoot);
+        owned = requireManagedDaemonBinding(context, { stateDir, projectId: project.id, runId: scope.runId });
+        metadata = JSON.parse(owned.process.metadata_json);
+    }
+    catch (error) {
+        diagnostic("owner", error);
+        return false;
+    }
+    if (metadata.run_generation !== scope.generation) {
+        diagnostic("owner", { code: "run_generation_mismatch" });
+        return false;
+    }
+    const operations = path.join(stateDir, "operations");
+    if (!await realDirectory(operations))
+        return false;
+    const candidates = [];
+    for (const entry of await readdir(operations, { withFileTypes: true })) {
+        if (!entry.isDirectory() || !/^[a-f0-9]{64}$/.test(entry.name))
+            continue;
+        const directory = path.join(operations, entry.name), hooks = path.join(directory, "hooks");
+        if (!await realDirectory(hooks))
+            continue;
+        const requested = await regularJson(path.join(directory, "requested.json"));
+        if (!requested || requested.schema_id !== "dd-flow/daemon-operation@1" || typeof requested.operation_id !== "string"
+            || sha256(requested.operation_id) !== entry.name || requested.daemon_id !== scope.daemonId
+            || requested.owner_id !== owned.process.owner_id || !["session.create", "session.start", "session.prompt"].includes(String(requested.operation))
+            || requested.session_id && requested.session_id !== scope.rootSessionId)
+            continue;
+        for (const hook of await readdir(hooks, { withFileTypes: true })) {
+            if (!hook.isFile() || !/^[A-Za-z0-9-]{1,128}\.json$/.test(hook.name))
+                continue;
+            const binding = await regularJson(path.join(hooks, hook.name));
+            if (!binding || binding.schema_id !== "dd-flow/hook-request@1" || binding.request_id !== hook.name.slice(0, -5)
+                || binding.daemon_id !== scope.daemonId || binding.operation_id !== requested.operation_id
+                || binding.root_provider_session_id !== scope.rootSessionId || !["codex-desktop", "antigravity-cli", "grok-acp", "zcode-acp", "opencode-server", "droid-cli"].includes(String(binding.source_harness))
+                || typeof binding.provider_session_id !== "string" || !binding.provider_session_id
+                || !(binding.parent_provider_session_id === null || typeof binding.parent_provider_session_id === "string")
+                || typeof binding.tool_call_id !== "string" || !binding.tool_call_id || binding.event !== "PreToolUse"
+                || typeof binding.native_command !== "string" || binding.command_sha256 !== sha256(binding.native_command)
+                || payloadCommand(binding) !== binding.native_command || !matchesIssuedNativeCommand(context, invocationId, binding.native_command))
+                continue;
+            candidates.push(binding);
+        }
+    }
+    const verified = [];
+    for (const binding of candidates) {
+        try {
+            const module = binding.source_harness === "codex-desktop"
+                ? await import("../harness-runtime/lib/dd-codex-daemon.mjs")
+                : binding.source_harness === "grok-acp" ? await import("../harness-runtime/lib/dd-grok-daemon.mjs")
+                    : binding.source_harness === "zcode-acp" ? await import("../harness-runtime/lib/dd-zcode-daemon.mjs")
+                        // @ts-expect-error Executable adapter assets have no duplicate typed API.
+                        : binding.source_harness === "opencode-server" ? await import("../harness-runtime/lib/dd-opencode-daemon.mjs")
+                            // @ts-expect-error Executable adapter assets have no duplicate typed API.
+                            : binding.source_harness === "droid-cli" ? await import("../harness-runtime/lib/dd-droid-daemon.mjs")
+                                : await import("../harness-runtime/lib/dd-agy-daemon.mjs");
+            const proof = await withDaemonProgressObserver(progress => {
+                if (typeof progress.native_request_id === 'string' && typeof progress.observed_at === 'string')
+                    input.onProgress?.({ cursor: `${binding.request_id}:${progress.native_request_id}`, observed_at: Date.parse(progress.observed_at) });
+            }, () => module.callDaemon(stateDir, "hook.verify", { daemonId: scope.daemonId, requestId: binding.request_id, binding }, 5_000));
+            if (binding.native_admission === "assigned_work_start") {
+                const resolved = object(proof.nativeHookBinding);
+                if (proof.verified !== true || JSON.stringify(proof.registeredHookBinding) !== JSON.stringify(binding) || !resolved
+                    || !["antigravity-cli", "opencode-server", "droid-cli"].includes(String(binding.source_harness))
+                    || resolved.native_ancestry !== "confirmed" || typeof resolved.native_cwd !== "string" || !path.isAbsolute(resolved.native_cwd)
+                    || !(resolved.parent_provider_session_id === null || typeof resolved.parent_provider_session_id === "string")
+                    || ["request_id", "operation_id", "daemon_id", "turn_generation", "source_harness", "root_provider_session_id", "provider_session_id",
+                        "tool_call_id", "event", "native_command", "command_sha256", "native_creator", "native_admission"].some(key => resolved[key] !== binding[key])
+                    || payloadCommand(resolved) !== binding.native_command) {
+                    diagnostic("verify", { code: "native_hook_unproven" }, binding);
+                    continue;
+                }
+                verified.push(resolved);
+            }
+            else if (proof.verified === true && JSON.stringify(proof.nativeHookBinding) === JSON.stringify(binding))
+                verified.push(binding);
+            else
+                diagnostic("verify", { code: "native_hook_unproven" }, binding);
+        }
+        catch (error) {
+            diagnostic("verify", error, binding);
+        }
+    }
+    // Exact old tool delivery belongs to its immutable prior attempt. A public
+    // command may be identical in a fresh no-effect successor; do not repeatedly
+    // select its predecessor and starve the new native callback.
+    const eligible = verified.filter(binding => observedLifecycleInvocation(context, binding.native_command, scope, { identity: {
+            daemonId: scope.daemonId, rootSessionId: scope.rootSessionId, sessionId: binding.provider_session_id,
+            parentSessionId: binding.parent_provider_session_id, toolCallId: binding.tool_call_id
+        } })?.id === invocationId);
+    if (!eligible.length)
+        return false;
+    const identity = (binding) => JSON.stringify([binding.source_harness, binding.daemon_id, binding.root_provider_session_id,
+        binding.provider_session_id, binding.parent_provider_session_id, binding.native_cwd]);
+    if (new Set(eligible.map(identity)).size !== 1)
+        throw new AppError("invocation_ambiguous", "More than one native executor supplied this issued Work command", 1, { effect: "no_effect", invocation_id: invocationId });
+    const binding = eligible[0], payload = object(binding.native_payload);
+    if (binding.source_harness === "codex-desktop") {
+        const proof = object(binding.codex_proof);
+        if (!proof || proof.daemonId !== scope.daemonId || proof.rootSessionId !== scope.rootSessionId
+            || proof.sessionId !== binding.provider_session_id || proof.parentSessionId !== binding.parent_provider_session_id
+            || proof.toolCallId !== binding.tool_call_id || typeof proof.projectRoot !== "string"
+            || canonicalPath(proof.projectRoot) !== canonicalPath(scope.projectRoot) || typeof proof.ddFlowHome !== "string"
+            || canonicalPath(proof.ddFlowHome) !== canonicalPath(context.ddFlowHome))
+            return false;
+        const prior = context.codexHookProof;
+        try {
+            context.codexHookProof = { daemonId: scope.daemonId, rootSessionId: scope.rootSessionId,
+                sessionId: binding.provider_session_id, parentSessionId: binding.parent_provider_session_id,
+                toolCallId: binding.tool_call_id, projectRoot: proof.projectRoot, command: binding.native_command };
+            handleCodexHook(context, { event: "PreToolUse", projectRoot: scope.projectRoot, stdin: JSON.stringify(payload) });
+        }
+        finally {
+            if (prior)
+                context.codexHookProof = prior;
+            else
+                delete context.codexHookProof;
+        }
+    }
+    else if (binding.source_harness === "grok-acp") {
+        const identity = object(object(payload._meta)?.ddGrok);
+        if (!identity || identity.daemonId !== scope.daemonId || identity.rootProviderSessionId !== scope.rootSessionId
+            || identity.parentProviderSessionId !== binding.parent_provider_session_id
+            || (payload.session_id ?? payload.sessionId) !== binding.provider_session_id
+            || (payload.tool_use_id ?? payload.toolUseId ?? payload.tool_call_id) !== binding.tool_call_id)
+            return false;
+        handleGrokEvent(context, { projectRoot: scope.projectRoot, stdin: JSON.stringify(payload) });
+    }
+    else if (binding.source_harness === "zcode-acp") {
+        const controlled = object(object(payload._meta)?.ddZcode), update = object(object(payload.params)?.update), native = object(object(update?._meta)?.zcodeRuntime);
+        if (!controlled || controlled.daemonId !== scope.daemonId || controlled.rootProviderSessionId !== scope.rootSessionId
+            || controlled.parentProviderSessionId !== binding.parent_provider_session_id || native?.source !== "subagent"
+            || native.childSessionId !== binding.provider_session_id || native.childToolCallId !== binding.tool_call_id
+            || typeof update?.toolCallId !== "string" || !update.toolCallId || typeof native.nativeTurnId !== "string" || !native.nativeTurnId)
+            return false;
+        handleZcodeEvent(context, { projectRoot: scope.projectRoot, stdin: JSON.stringify(payload) });
+    }
+    else if (binding.native_admission === "assigned_work_start") {
+        const harness = binding.source_harness, session = object(payload.session);
+        if (payload.daemon_id !== scope.daemonId || (harness === "antigravity-cli" ? payload.conversation_id !== binding.provider_session_id
+            || (payload.parent_conversation_id ?? null) !== binding.parent_provider_session_id || payload.event_id !== binding.tool_call_id
+            : !session || session.provider_session_id !== binding.provider_session_id || (session.parent_provider_session_id ?? null) !== binding.parent_provider_session_id
+                || payload.tool_call_id !== binding.tool_call_id))
+            return false;
+        const prior = context.nativeHookProof;
+        try {
+            context.nativeHookProof = { harness, daemonId: scope.daemonId, rootSessionId: scope.rootSessionId, sessionId: binding.provider_session_id,
+                toolCallId: binding.tool_call_id };
+            const handle = harness === "antigravity-cli" ? handleAgyEvent : harness === "droid-cli" ? handleDroidEvent : handleOpenCodeEvent;
+            handle(context, { projectRoot: scope.projectRoot, stdin: JSON.stringify(payload) });
+        }
+        finally {
+            if (prior)
+                context.nativeHookProof = prior;
+            else
+                delete context.nativeHookProof;
+        }
+    }
+    else {
+        if (payload.daemon_id !== scope.daemonId || payload.conversation_id !== binding.provider_session_id
+            || (payload.parent_conversation_id ?? null) !== binding.parent_provider_session_id || payload.event_id !== binding.tool_call_id)
+            return false;
+        handleAgyEvent(context, { projectRoot: scope.projectRoot, stdin: JSON.stringify(payload) });
+    }
+    return true;
+}