@deksden-com/dd-flow-cli 0.9.0-beta.152 → 0.9.0-beta.156

package/dist/harness-runtime/lib/delivery-command.mjs

@@ -0,0 +1,84 @@
+import fs from 'node:fs';
+import process from 'node:process';
+import { spawn } from 'node:child_process';
+
+// Internal transport, not operation authorization. The RUN owner registers and
+// confirms this wrapper's PID/group, then releases stdin after its final fence.
+// fd3 privately carries fixed argv and only permitted environment values; these
+// resolved values never enter policy or persisted configuration. fd4 carries raw stdout to the
+// owner in memory. Public stdout/stderr never contain provider output or env.
+const outputLimit = 1024 * 1024;
+const text = value => typeof value === 'string' && value.length > 0 && value.length <= 16384 && !value.includes('\0');
+const id = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(value);
+const emit = value => process.stdout.write(`${JSON.stringify(value)}\n`);
+process.stdout.on('error', () => {}); // Observer loss is not command completion.
+process.stderr.on('error', () => {});
+async function bounded(stream, limit) {
+  const chunks = []; let bytes = 0;
+  for await (const chunk of stream) {
+    bytes += chunk.length;
+    if (bytes > limit) throw new Error('bounded_input');
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+let config = null, admitted = false, started = false;
+const result = (exitCode, signal, error, outputAvailable = true, truncated = false) => {
+  emit({ schema_id: 'dd-flow/delivery-command-result@1', operation_id: config?.operation_id ?? null,
+    step_id: config?.step_id ?? null, admitted, started, exit_code: exitCode, signal, error,
+    output_available: outputAvailable, stdout_truncated: truncated });
+  process.exitCode = error ? 1 : 0;
+};
+try {
+  const bytes = await bounded(fs.createReadStream('', { fd: 3, autoClose: true }), 3 * outputLimit);
+  const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join() !== 'argv,environment,operation_id,permitted_environment_variables,schema_id,step_id'
+    || value.schema_id !== 'dd-flow/delivery-command@1' || !id(value.operation_id) || !id(value.step_id)
+    || !Array.isArray(value.argv) || !value.argv.length || value.argv.length > 128 || !value.argv.every(text)
+    || !Array.isArray(value.permitted_environment_variables) || value.permitted_environment_variables.length > 128
+    || !value.permitted_environment_variables.every(name => typeof name === 'string' && /^[A-Z_][A-Z0-9_]*$/.test(name))
+    || new Set(value.permitted_environment_variables).size !== value.permitted_environment_variables.length
+    || !value.environment || typeof value.environment !== 'object' || Array.isArray(value.environment)
+    || Object.entries(value.environment).some(([name, content]) => !value.permitted_environment_variables.includes(name)
+      || typeof content !== 'string' || content.includes('\0') || content.length > 16384)) throw new Error('invalid_configuration');
+  // Fail before readiness if the private output channel was not installed.
+  const channel = fs.fstatSync(4);
+  if (!channel.isFIFO() && !channel.isSocket()) throw new Error('private_pipe_required');
+  fs.writeSync(4, Buffer.alloc(0));
+  config = value;
+  emit({ schema_id: 'dd-flow/delivery-command-ready@1', operation_id: config.operation_id, step_id: config.step_id });
+  const admission = await bounded(process.stdin, 32);
+  if (!admission.equals(Buffer.from('admitted\n'))) result(null, null, 'admission_missing');
+  else {
+    admitted = true;
+    const environment = { ...config.environment };
+    environment.DD_FLOW_DELIVERY_OPERATION_ID = config.operation_id;
+    environment.DD_FLOW_DELIVERY_STEP_ID = config.step_id;
+    const output = fs.createWriteStream('', { fd: 4, autoClose: true });
+    let available = true, truncated = false, count = 0;
+    const flushed = new Promise(resolve => { output.once('finish', resolve); output.on('error', () => { available = false; resolve(); }); });
+    const child = spawn(config.argv[0], config.argv.slice(1), { env: environment, shell: false, windowsHide: true,
+      detached: false, stdio: ['ignore', 'pipe', 'pipe'] });
+    started = Boolean(child.pid);
+    let spawnFailed = false;
+    child.once('error', () => { spawnFailed = true; });
+    child.stdout.on('error', () => { available = false; });
+    child.stderr.on('error', () => { available = false; });
+    child.stderr.resume(); // Never persist or echo authenticated stderr.
+    child.stdout.on('data', bytes => {
+      const remaining = Math.max(0, outputLimit - count);
+      if (bytes.length > remaining) truncated = true;
+      if (remaining && available) output.write(bytes.subarray(0, remaining));
+      count += bytes.length;
+    });
+    const completed = await new Promise(resolve => child.once('close', (code, signal) => resolve({ code, signal })));
+    output.end(); await flushed;
+    result(completed.code, completed.signal, spawnFailed ? 'spawn_failed' : !available ? 'private_output_unavailable'
+      : truncated ? 'output_limit_exceeded' : completed.code !== 0 || completed.signal ? 'command_failed' : null, available, truncated);
+  }
+} catch {
+  // Input may contain secrets accidentally. Never print it or an exception
+  // whose message/stack could contain an authenticated argv or raw payload.
+  result(null, null, admitted ? 'transport_failed' : 'configuration_or_admission_invalid', false);
+}

package/dist/harness-runtime/lib/driver-recovery.mjs

@@ -3,8 +3,6 @@ import { readdir, readFile, mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { inspectDaemonOperation } from "./daemon-operations.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
-import { reportedError } from "./operation-errors.mjs";
-import { ObservationClock } from "./observation-clock.mjs";
 import { runtimeProcess } from "./managed-daemon.mjs";
 import { nativeShutdownConfirmed } from "./native-children.mjs";
 
@@ -103,23 +101,6 @@ export async function assertDaemonReplaceable(root) {
   }
 }
 
-/** Observe the original operation; never re-send its parameters. */
-export async function recoverDriverReply(root, id, { timeoutMs = 30_000, pollMs = 250 } = {}) {
-  const clock = new ObservationClock({ timeoutMs });
-  do {
-    let receipt;
-    try { receipt = await inspectDaemonOperation(root, id); }
-    catch (error) { if (error.code !== "operation_not_found") throw error; }
-    if (receipt?.state === "completed") return receipt.result;
-    if (receipt?.state === "failed") throw reportedError(receipt.error, "provider operation failed");
-    if (clock.sample()) break;
-    await new Promise(resolve => setTimeout(resolve, pollMs));
-  } while (true);
-  throw Object.assign(new Error("original provider operation has no confirmed reply; reconcile it before starting another Turn"), {
-    code: "operation_observation_lost", details: { operation_id: id, state_dir: root }
-  });
-}
-
 /** Crash recovery barrier. Import late replies into the client ledger before
  * any subsequent productive call, even when a new runner process is used. */
 export async function reconcileDriverReplies(root) {

package/dist/harness-runtime/lib/droid-observation.mjs

@@ -6,10 +6,12 @@ import path from "node:path";
  * New child discovery may walk the directory once; heartbeats never replay it. */
 export class DroidMetadataReader {
   constructor(factory) { this.factory = factory; this.files = new Map(); this.cache = new Map(); }
-  async locate(id) {
+  async locate(id, onProgress = async () => {}) {
     if (this.files.has(id)) return this.files.get(id);
     const visit = async directory => {
-      for (const entry of await readdir(directory, { withFileTypes: true }).catch(error => { if (error.code === "ENOENT") return []; throw error; })) {
+      const entries = await readdir(directory, { withFileTypes: true }).catch(error => { if (error.code === "ENOENT") return []; throw error; });
+      await onProgress(`directory:${createHash('sha256').update(JSON.stringify([directory, entries.map(entry => entry.name)])).digest('hex')}`);
+      for (const entry of entries) {
         const file = path.join(directory, entry.name);
         if (entry.isDirectory()) await visit(file);
         else if (entry.isFile() && entry.name.endsWith(".jsonl")) this.files.set(entry.name.slice(0, -6), file);
@@ -18,22 +20,24 @@ export class DroidMetadataReader {
     await visit(path.join(this.factory, "sessions"));
     return this.files.get(id) ?? null;
   }
-  async read(id) {
-    const file = await this.locate(id); if (!file) return null;
+  async read(id, onProgress = async () => {}) {
+    const file = await this.locate(id, onProgress); if (!file) return null;
     const settingsFile = file.replace(/\.jsonl$/, ".settings.json");
     const info = await stat(settingsFile).catch(error => { if (error.code === "ENOENT") return null; throw error; });
     if (!info || info.size > 1_048_576) return null;
     const identity = `${info.ino}:${info.mtimeMs}:${info.size}`;
-    if (this.cache.get(id)?.identity === identity) return this.cache.get(id).value;
+    if (this.cache.get(id)?.identity === identity) { await onProgress(`metadata:${id}:${identity}`); return this.cache.get(id).value; }
     const handle = await open(file, "r"); const buffer = Buffer.alloc(65_536);
     let header;
     try { const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0); header = JSON.parse(buffer.subarray(0, bytesRead).toString("utf8").split("\n")[0]); }
     finally { await handle.close(); }
+    await onProgress(`header:${id}:${createHash('sha256').update(JSON.stringify(header)).digest('hex')}`);
     if (header.type !== "session_start" || header.id !== id) throw Object.assign(new Error("native metadata Session identity differs"), { code: "session_identity_mismatch" });
     let bytes, settings;
     try { bytes = await readFile(settingsFile, "utf8"); settings = JSON.parse(bytes); }
     catch (error) { if (error instanceof SyntaxError || error.code === "ENOENT") return null; throw error; }
     const value = { header, settings, transcript_path: file, source: { path: settingsFile, sha256: createHash("sha256").update(bytes).digest("hex") } };
+    await onProgress(`metadata:${id}:${identity}`);
     this.cache.set(id, { identity, value }); return value;
   }
 }

package/dist/harness-runtime/lib/lifecycle-contract.d.mts

@@ -3,6 +3,7 @@ export const lifecycleRoutes: {
   readonly "stage pause": "stage_pause"; readonly "stage resume": "stage_resume"; readonly "work start": "work_start";
   readonly "work finish": "work_finish"; readonly "work fail": "work_fail"; readonly "merge apply": "merge_apply";
   readonly "merge repair": "merge_repair"; readonly "run recovery accept": "recovery_accept";
+  readonly "delivery checks": "delivery_checks"; readonly "delivery execute": "delivery_execute"; readonly "delivery reconcile": "delivery_reconcile";
 };
 export type LifecycleOperation = typeof lifecycleRoutes[keyof typeof lifecycleRoutes];
 export const lifecycleInternalOptions: readonly ["invocation-id", "hook-event-id"];

package/dist/harness-runtime/lib/lifecycle-contract.mjs

@@ -2,7 +2,8 @@ export const lifecycleRoutes = {
   "session register": "session_register", "stage start": "stage_start", "stage finish": "stage_finish",
   "stage pause": "stage_pause", "stage resume": "stage_resume", "work start": "work_start",
   "work finish": "work_finish", "work fail": "work_fail", "merge apply": "merge_apply",
-  "merge repair": "merge_repair", "run recovery accept": "recovery_accept"
+  "merge repair": "merge_repair", "run recovery accept": "recovery_accept",
+  "delivery checks": "delivery_checks", "delivery execute": "delivery_execute", "delivery reconcile": "delivery_reconcile"
 };
 export const lifecycleInternalOptions = ["invocation-id", "hook-event-id"];
 export function lifecycleOperationForArgv(argv) {

package/dist/harness-runtime/lib/native-hook-command.d.mts

@@ -1,7 +1,8 @@
 export function invokeNativeHook(input: { bin: string; args: string[]; nodeBin?: string; payload: unknown; home?: string | undefined; cwd?: string; env?: NodeJS.ProcessEnv; timeoutMs?: number }): Promise<Record<string, unknown> & { timing?: Record<string, number> }>;
+export function isStandaloneWorkStart(command: unknown): boolean;
 export function hookBudget(timeoutMs?: number, deadlineAt?: number | null): { deadlineAt: number; remaining(phase: string, maximum?: number): number; run<T>(action: () => T | Promise<T>, phase: string): Promise<T> };
 export function readNativeHookInput(stream: NodeJS.ReadStream, budget: { remaining(phase: string): number }, maxBytes?: number): Promise<string>;
 export function acceptNativeHookRequest(stateDir: string, binding: Record<string, unknown>, current?: { requests: Map<string, { binding: Record<string, unknown> }>; accepting?: Map<string, Promise<Record<string, unknown>>> } | null): Promise<Record<string, unknown>>;
-export function writeNativeHookFailure(stateDir: string, binding: Record<string, unknown> | undefined, error: unknown, budget: ReturnType<typeof hookBudget>): Promise<void>;
-export function readNativeHookFailures(stateDir: string, requests: Map<string, { current: unknown; binding: Record<string, unknown> }>, current: unknown, reject: (error: Error & { code?: string; details?: Record<string, unknown> }) => void): Promise<void>;
+export function writeNativeHookFailure(stateDir: string, binding: Record<string, unknown> | undefined, error: unknown): Promise<void>;
+export function readNativeHookFailures(stateDir: string, requests: Map<string, { current: unknown; binding: Record<string, unknown> }>, current: unknown, reject: (error: Error & { code?: string; details?: Record<string, unknown> }) => void | Promise<void>): Promise<void>;
 export function runBoundedCommand(input: { bin: string; args: string[]; nodeBin?: string; input?: string | null; cwd?: string; env?: NodeJS.ProcessEnv; timeoutMs?: number; timeoutCode?: string; inheritDeadline?: boolean; cleanupWithinBudget?: boolean; maintenanceProgress?: { action: string; processId: string | null; startupMs?: number; inactivityMs: number } | null; signal?: AbortSignal }): Promise<string>;

package/dist/harness-runtime/lib/native-hook-command.mjs

@@ -1,10 +1,43 @@
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { readFile } from "node:fs/promises";
+import { link, mkdir, open, readFile, unlink } from "node:fs/promises";
 import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
 import { reportedFailure } from "./process-json.mjs";
 import { errorRecord, reportedError } from "./operation-errors.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
+import { parseLifecycleCommand } from "./lifecycle-command.mjs";
+
+export function isStandaloneWorkStart(command) {
+  if (typeof command !== "string") return false;
+  const parsed = parseLifecycleCommand(command);
+  return parsed.kind === "standalone" && parsed.supported !== false && !parsed.invocation.wrapped && parsed.invocation.operation === "work_start";
+}
+
+/** Record a native callback, not a grant and not a claim about its creator
+ * prompt. The CLI must match an issued command and ask the owning daemon to
+ * verify physical ancestry before its existing Work CAS can admit execution. */
+export async function retainNativeWorkStart(stateDir, binding, observer, retained) {
+  if (!observer?.operationId || typeof observer.guard !== "function") return null;
+  observer.guard();
+  const prior = [...retained.values()].find(value => value.binding?.provider_session_id === binding.provider_session_id
+    && value.binding.tool_call_id === binding.tool_call_id && value.binding.event === binding.event);
+  if (prior) {
+    if (prior.binding.daemon_id !== binding.daemon_id || prior.binding.root_provider_session_id !== binding.root_provider_session_id
+      || prior.binding.native_command !== binding.native_command || prior.binding.native_cwd !== binding.native_cwd)
+      throw Object.assign(new Error("Native Work callback identity was reused with different input"), { code: "native_hook_identity_conflict" });
+    prior.guard(); return prior.binding;
+  }
+  if (!isStandaloneWorkStart(binding.native_command)) return null;
+  observer.requests ??= new Map();
+  const accepted = await acceptNativeHookRequest(stateDir, { ...binding, operation_id: observer.operationId,
+    turn_generation: observer.generation, native_creator: "unconfirmed", native_admission: "assigned_work_start",
+    native_ancestry: "pending", command_sha256: createHash("sha256").update(binding.native_command).digest("hex") }, observer);
+  observer.guard();
+  observer.requests.set(accepted.request_id, { current: observer, binding: accepted });
+  retained.set(accepted.request_id, { binding: accepted, guard: observer.guard });
+  return accepted;
+}
 
 /** Retain accepted native requests in the existing operation hook ledger. */
 export async function acceptNativeHookRequest(stateDir, binding, current = null) {
@@ -25,7 +58,9 @@ export async function acceptNativeHookRequest(stateDir, binding, current = null)
   const requested = JSON.parse(await readFile(path.join(directory, "requested.json"), "utf8"));
   if (requested.operation_id !== binding.operation_id || requested.daemon_id !== binding.daemon_id || !["session.prompt", "session.create", "session.start"].includes(requested.operation)
     || requested.operation === "session.prompt" && requested.session_id && requested.session_id !== binding.root_provider_session_id) throw Object.assign(new Error("Native hook operation does not match its retained owner"), { code: "native_hook_unproven" });
-  const receipt = { ...binding, schema_id: "dd-flow/hook-request@1", request_id: randomUUID() };
+  // The retained in-memory proof must be the same JSON value the CLI reads,
+  // including optional native fields omitted by JSON serialization.
+  const receipt = JSON.parse(JSON.stringify({ ...binding, schema_id: "dd-flow/hook-request@1", request_id: randomUUID() }));
   await writeJsonAtomic(path.join(directory, "hooks", `${receipt.request_id}.json`), receipt);
   return receipt;
   })();
@@ -33,11 +68,31 @@ export async function acceptNativeHookRequest(stateDir, binding, current = null)
   try { return await accepted; } finally { current?.accepting.delete(key); }
 }
 
-export async function writeNativeHookFailure(stateDir, binding, error, budget) {
+export async function writeNativeHookFailure(stateDir, binding, error) {
   if (!binding?.request_id || !/^[A-Za-z0-9-]{1,128}$/.test(binding.request_id)) return;
-  await budget.run(() => writeJsonAtomic(path.join(stateDir, "hook-failures", `${binding.request_id}.json`), {
+  // The observation budget may already have expired. It cannot also govern
+  // the single atomic write that records why that observation failed.
+  const directory = path.join(stateDir, "hook-failures"), file = path.join(directory, `${binding.request_id}.json`);
+  const value = {
     ...errorRecord(error), request_id: binding.request_id, observed_at: new Date().toISOString(), native_hook_binding: binding,
-  }, () => budget.remaining("failure_receipt_commit")), "failure_receipt");
+  };
+  await mkdir(directory, { recursive: true });
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try {
+    const handle = await open(temporary, "wx", 0o600);
+    try { await handle.writeFile(`${JSON.stringify(value)}\n`); await handle.sync(); }
+    finally { await handle.close(); }
+    try { await link(temporary, file); }
+    catch (cause) {
+      if (cause.code !== "EEXIST") throw cause;
+      const retained = JSON.parse(await readFile(file, "utf8"));
+      if (retained.request_id !== binding.request_id || !isDeepStrictEqual(retained.native_hook_binding, binding))
+        throw Object.assign(new Error("Native hook failure receipt conflicts with its retained binding"), { code: "native_hook_identity_conflict" });
+      return; // The first bound failure remains authoritative on retry.
+    }
+    const handleDirectory = await open(directory, "r");
+    try { await handleDirectory.sync(); } finally { await handleDirectory.close(); }
+  } finally { await unlink(temporary).catch(cause => { if (cause.code !== "ENOENT") throw cause; }); }
 }
 
 /** Read only requests accepted for this exact live operation, never scan a mailbox. */
@@ -54,10 +109,10 @@ export async function readNativeHookFailures(stateDir, requests, current, reject
       }
       continue;
     }
-    requests.delete(id);
     const error = reportedError(value, "Native hook failed");
     error.details = { ...error.details, native_hook_binding: accepted.binding };
-    reject(error);
+    await reject(error);
+    requests.delete(id);
   }
 }
 
@@ -188,7 +243,7 @@ export async function runBoundedCommand({ bin, args, nodeBin = process.execPath,
     const abort = () => stop(Object.assign(new Error("Bounded CLI request cancelled"), { code: "process_maintenance_cancelled" }));
     signal?.addEventListener("abort", abort, { once: true });
     if (signal?.aborted) abort();
-    child.stdout.setEncoding("utf8").on("data", chunk => { stdout += chunk; if (stdout.length > 1_048_576) stop(new Error("Native hook response exceeds protocol limit")); });
+    child.stdout.setEncoding("utf8").on("data", chunk => { stdout += chunk; });
     // Match the existing response bound: a legal bounded error tree may exceed
     // 64KiB when pretty-printed, plus maintenance phases preceding the receipt.
     child.stderr.setEncoding("utf8").on("data", chunk => {

package/dist/harness-runtime/lib/native-streams.mjs

@@ -1,5 +1,5 @@
 // Async iteration backpressures the native pipe while its existing evidence
-// sink drains. Bound one JSON reply, never lifetime diagnostics.
+// sink drains. The input limit applies to requests, not owned replies.
 export const MAX_NATIVE_LINE_BYTES = 8 * 1024 * 1024;
 export async function readNativeLines(stream, onLine, onError) {
   let buffer = "";
@@ -10,26 +10,19 @@ export async function readNativeLines(stream, onLine, onError) {
       let at;
       while ((at = buffer.indexOf("\n")) >= 0) {
         const line = buffer.slice(0, at); buffer = buffer.slice(at + 1);
-        assertLine(line);
         if (line.trim()) await onLine(line);
       }
-      assertLine(buffer);
     }
-    if (buffer.trim()) { assertLine(buffer); await onLine(buffer); }
+    if (buffer.trim()) await onLine(buffer);
   } catch (cause) { stream.pause(); await observationFailure(cause, onError); }
 }
 export function assertNativeLine(line, phase = "reply") {
-  if (Buffer.byteLength(line) > MAX_NATIVE_LINE_BYTES) throw Object.assign(new Error(`Native JSON ${phase} exceeds the bounded capture limit`), { code: phase === "request" ? "native_request_limit" : "operation_observation_lost", details: { reason: `native_${phase}_limit`, limit_bytes: MAX_NATIVE_LINE_BYTES, ...(phase === "request" ? { effect: "no_effect" } : { native_outcome: "unknown" }) } });
+  if (phase === "request" && Buffer.byteLength(line) > MAX_NATIVE_LINE_BYTES) throw Object.assign(new Error("Native JSON request exceeds the bounded input limit"), { code: "native_request_limit", details: { reason: "native_request_limit", limit_bytes: MAX_NATIVE_LINE_BYTES, effect: "no_effect" } });
 }
-const assertLine = assertNativeLine;
 export function admitNativeRequestBuffer(buffer, socket, schema) {
   try { assertNativeLine(buffer, "request"); return true; }
   catch (error) { socket.pause(); socket.end(`${JSON.stringify({ schema_id: schema, id: null, ok: false, error: { code: error.code, message: error.message, details: error.details } })}\n`, () => socket.destroy()); return false; }
 }
-export function retainNativeReplyBuffer(buffer, finish) {
-  try { assertNativeLine(buffer); return true; }
-  catch (error) { finish(error); return false; }
-}
 export async function streamNativeDiagnostics(stream, onChunk, onError) {
   stream.setEncoding("utf8");
   try { for await (const chunk of stream.iterator({ destroyOnReturn: false })) await onChunk(String(chunk)); }

package/dist/harness-runtime/lib/opencode-plugin.mjs

@@ -3,7 +3,7 @@ import { managedFlowEnv } from './managed-flow-env.mjs';
 import * as Plugin from "../vendor/opencode-plugin.mjs";
 import { hookBudget, invokeNativeHook, writeNativeHookFailure } from "./native-hook-command.mjs";
 import { callDaemon } from "./dd-opencode-daemon.mjs";
-import { errorRecord } from "./operation-errors.mjs";
+import { errorRecord, isNativeHookObservationLoss } from "./operation-errors.mjs";
 
 /** Launch-bound server plugin; never uses a process-global 'last Session'. */
 export function makeOpenCodePlugin(binding, invoke = invokeNativeHook, resolve = callDaemon) {
@@ -14,7 +14,21 @@ export function makeOpenCodePlugin(binding, invoke = invokeNativeHook, resolve =
       const input = event.input;
       if (!input || typeof input !== "object" || typeof input.command !== "string") throw new Error("OpenCode shell input is unavailable");
       const identity = await budget.run(() => resolve(binding.stateDir, "hook.resolve", { sessionId: event.sessionID,
-        payload: { phase, message_id: event.messageID, tool_call_id: event.id, input } }, budget.remaining("identity")), "identity");
+        payload: { phase, message_id: event.messageID, tool_call_id: event.id, input }, ...(binding.nativeWorkStartAdmission ? { deferWorkStart: true } : {}) }, budget.remaining("identity")), "identity");
+      if (identity.observationOnly === true) {
+        if (!binding.nativeWorkStartAdmission || identity.daemonId !== binding.daemonId || identity.sessionId !== event.sessionID
+          || identity.messageId !== event.messageID || identity.toolCallId !== event.id || identity.command !== input.command)
+          throw Object.assign(new Error("Ordinary native callback binding differs"), { code: "native_hook_unproven" });
+        return { observationOnly: true };
+      }
+      if (phase === "before" && identity.fastAck === true) {
+        const proof = identity.nativeHookBinding;
+        if (!binding.nativeWorkStartAdmission || proof?.native_admission !== "assigned_work_start" || proof.source_harness !== "opencode-server"
+          || proof.daemon_id !== binding.daemonId || proof.provider_session_id !== event.sessionID
+          || proof.tool_call_id !== `${event.messageID}:${event.id}` || proof.native_command !== input.command)
+          throw Object.assign(new Error("Deferred native callback binding differs"), { code: "native_hook_unproven" });
+        return { fastAck: true };
+      }
       const info = identity?.nativeSession;
       if (!identity?.nativeHookBinding || info?.id !== event.sessionID || !info.directory) throw Object.assign(new Error("OpenCode Session identity is unavailable"), { code: "native_hook_unproven" });
       const cwd = path.resolve(info.directory, input.workdir ?? ".");
@@ -28,23 +42,26 @@ export function makeOpenCodePlugin(binding, invoke = invokeNativeHook, resolve =
         profile: { provider: info.model?.providerID, model: info.model?.id, variant: info.model?.variant ?? "default", agent: event.agent },
         input: { ...input, workdir: cwd }, ...(outcome ? { outcome } : {}) };
     };
-    const deliver = async (payload, budget) => {
+    const deliver = async (payload, budget, verified = false) => {
       const identity = { nativeHookBinding: payload.native_hook_binding };
       try {
         const result = await invoke({ bin: binding.ddFlowBin, nodeBin: binding.nodeBin,
           args: ["opencode", "event", "handle", "--project-root", binding.projectRoot, "--json"],
           payload: { ...payload, native_hook_binding: identity.nativeHookBinding }, home: binding.ddFlowHome, timeoutMs: budget.remaining("admission") });
-        await budget.run(() => resolve(binding.stateDir, "hook.verify", { binding: identity.nativeHookBinding }, budget.remaining("generation")), "generation");
+        if (!verified) await budget.run(() => resolve(binding.stateDir, "hook.verify", { binding: identity.nativeHookBinding, retain_after: result?.observed === true }, budget.remaining("generation")), "generation");
         if (result?.permissionDecision === "deny" || result?.hookSpecificOutput?.permissionDecision === "deny") throw Object.assign(new Error("dd-flow denied native shell admission"), { code: "native_hook_rejected" });
         return result;
       } catch (error) {
         error.details = { ...error.details, native_hook_binding: identity.nativeHookBinding, ...(payload.phase === "after" ? { effect: "unknown", tool_outcome: payload.outcome } : {}) };
-        try { await writeNativeHookFailure(binding.stateDir, identity.nativeHookBinding, error, budget); await resolve(binding.stateDir, "hook.failed", {}, budget.remaining("failure_notification")); }
+        let storageError;
+        try { await writeNativeHookFailure(binding.stateDir, identity.nativeHookBinding, error); }
         catch (storage) {
+          storageError = storage;
           error.details.receipt_error = { code: storage.code ?? "hook_receipt_write_failed", message: storage.message };
-          try { await resolve(binding.stateDir, "hook.failed", { binding: identity.nativeHookBinding, failure: errorRecord(error) }, budget.remaining("failure_notification")); }
-          catch (notify) { error.details.receipt_error.notification_error = notify.code ?? "hook_notification_failed"; }
         }
+        if (storageError?.code !== "native_hook_identity_conflict") try {
+          await resolve(binding.stateDir, "hook.failed", storageError ? { binding: identity.nativeHookBinding, failure: errorRecord(error) } : {}, storageError ? 5_000 : budget.remaining("failure_notification"));
+        } catch (notify) { if (storageError) error.details.receipt_error.notification_error = notify.code ?? "hook_notification_failed"; }
         throw error;
       }
     };
@@ -57,6 +74,7 @@ export function makeOpenCodePlugin(binding, invoke = invokeNativeHook, resolve =
       if (event.input.timeout === undefined) event.input.timeout = 0;
       if (!binding.ddFlowBin) return;
       const budget = hookBudget(), payload = await envelope("before", event, budget);
+      if (payload.fastAck === true || payload.observationOnly === true) return;
       event.input = { ...event.input, workdir: payload.session.directory };
       const result = await deliver({ ...payload, input: event.input }, budget);
       if (result?.observed) {
@@ -75,8 +93,17 @@ export function makeOpenCodePlugin(binding, invoke = invokeNativeHook, resolve =
       const success = event.status === "completed" && output?.status !== "running" && output?.exit === 0 && !output?.timeout && !output?.signal;
       const outcome = { status: success ? "completed" : output?.status === "running" ? "running" : "failed",
         exit_code: output?.exit ?? null, signal: output?.signal ?? null, shell_id: output?.shellID ?? null };
-      const payload = await envelope("after", event, budget, outcome);
-      await deliver({ ...payload, ...(original ? { event_id: original.event_id } : {}) }, budget);
+      // Use the exact admitted before delivery. A later prompt may already be
+      // active; resolving against that prompt would misattribute this result.
+      try {
+        await budget.run(() => resolve(binding.stateDir, "hook.verify", { binding: original.native_hook_binding, phase: "after" }, budget.remaining("generation")), "generation");
+        await deliver({ ...original, phase: "after", outcome }, budget, true);
+      } catch (error) {
+        if (!isNativeHookObservationLoss(error)) throw error;
+        // An observation timeout is not the already-finished tool's outcome.
+        process.stderr.write(`${JSON.stringify({ kind: "native_hook_observation_unavailable", code: error.code, event_id: original.event_id })}\n`);
+        return; // Retain the original binding for a later exact observation.
+      }
       participating.delete(key(event));
       await ctx.storage.remove(key(event));
     });

package/dist/harness-runtime/lib/operation-errors.mjs

@@ -1,5 +1,18 @@
 // An observer losing its response does not establish that a provider Turn failed.
 export const OPERATION_ERROR_CONTRACT_VERSION = "operation-errors@2";
+// A lost hook response does not prove that the issued CLI or Turn failed.
+// Do not downgrade a structured rejection merely because a transport wrapped it.
+export function isNativeHookObservationLoss(error) {
+  if (!["native_hook_timeout", "native_hook_failed"].includes(error?.code)) return false;
+  const details = error?.details;
+  const transport = code => ["ETIMEDOUT", "ECONNRESET", "ECONNREFUSED", "EPIPE", "native_hook_timeout", "native_hook_failed"].includes(code) || isObservationLoss({ code });
+  if (details?.decision === "deny" || details?.permissionDecision === "deny"
+    || details?.hookSpecificOutput?.permissionDecision === "deny" || details?.lifecycle_outcome?.effect === "no_effect"
+    || details?.disposition === "pre_cli_shell_refusal"
+    || typeof details?.primary_error?.code === "string" && !transport(details.primary_error.code)
+    || typeof error?.cause?.code === "string" && !transport(error.cause.code)) return false;
+  return true;
+}
 export function redactDiagnostic(value) {
   return value.replace(/\b(Bearer|Basic)\s+[^\s"']+/gi, "$1 <redacted>")
     .replace(/(^|[^\w-])([\w-]+)(["']?\s*[=:]\s*["']?)([^\s"',;&}]+)/g,

package/dist/harness-runtime/lib/operation-progress.mjs

@@ -8,7 +8,7 @@ import { writeJsonAtomic } from './runner-events.mjs';
 export const OPERATION_PROGRESS_CONTRACT = 'dd-flow/operation-progress@1';
 const context = new AsyncLocalStorage(), flights = new Map();
 const fields = ['operation_id', 'daemon_id', 'operation', 'params_sha256', 'owner_id', 'generation'];
-const phases = new Set(['accepted','ownership_confirmed','admission_confirmed','native_dispatched','native_progress','native_outcome_retained','settlement_started','settlement_completed','settlement_pending']);
+const phases = new Set(['accepted','ownership_confirmed','admission_confirmed','native_dispatched','native_progress','verification_progress','native_outcome_retained','settlement_started','settlement_completed','settlement_pending']);
 export function operationDirectory(root,id) {
   if (typeof root!=='string' || !path.isAbsolute(root) || typeof id!=='string' || !id || id.length>1_024) throw Object.assign(new Error('invalid operation observation binding'),{code:'operation_progress_invalid'});
   return path.join(root, 'operations', createHash('sha256').update(id).digest('hex'));
@@ -43,6 +43,7 @@ export async function readOperationProgress(root, id, expected = {}) {
     || ['daemon_id','owner_id'].some(field=>progress[field]!==null && (typeof progress[field]!=='string' || !progress[field] || progress[field].length>1_024))
     || progress.generation!==null && (!Number.isSafeInteger(progress.generation) || progress.generation<0)
     || !Number.isSafeInteger(progress.sequence) || progress.sequence < 1 || !phases.has(progress.phase)
+    || progress.phase === 'verification_progress' && (typeof progress.native_request_id !== 'string' || !progress.native_request_id || progress.native_request_id.length > 256)
     || !Number.isFinite(Date.parse(requested.requested_at))
     || !Number.isFinite(Date.parse(progress.observed_at)) || Date.parse(progress.observed_at) > Date.now()
     || Date.parse(progress.observed_at) < Date.parse(requested.requested_at)
@@ -65,7 +66,10 @@ export function publishOperationProgress(root, id, phase, metadata = {}) {
     const observedAt = metadata.observed_at ?? new Date().toISOString();
     if (prior && Date.parse(observedAt)<Date.parse(prior.observed_at)) return prior;
     // A later successful ownership gate is fresh liveness evidence while admission waits.
-    if (prior && phase === prior.phase && phase !== 'native_progress'
+    if (phase === 'verification_progress' && (typeof metadata.native_request_id !== 'string' || !metadata.native_request_id || metadata.native_request_id.length > 256))
+      throw Object.assign(new Error('verification progress requires an actual checkpoint'), { code: 'operation_progress_invalid' });
+    if (prior && phase === 'verification_progress' && prior.phase === phase && prior.native_request_id === metadata.native_request_id) return prior;
+    if (prior && phase === prior.phase && !['native_progress', 'verification_progress'].includes(phase)
       && (phase !== 'ownership_confirmed' || Date.parse(observedAt) <= Date.parse(prior.observed_at))) return prior;
     if (prior && phase === 'native_progress' && Date.parse(observedAt) - Date.parse(prior.observed_at) < 1_000) return prior;
     const value = { schema_id: OPERATION_PROGRESS_CONTRACT,

package/dist/harness-runtime/lib/process-json.mjs

@@ -52,9 +52,9 @@ async function command(bin, args, json, { cwd, env = {}, input = null, onProgres
   return await new Promise((resolve, reject) => {
     const child = spawn(target.command, target.args, { cwd, env: { ...process.env, ...env },
       detached: process.platform !== "win32", stdio: [input === null ? "ignore" : "pipe", "pipe", "pipe"] });
-    const maxOutput = 8 * 1024 * 1024, maxTail = 64 * 1024, maxLine = 1024 * 1024;
+    const maxTail = 64 * 1024, maxLine = 1024 * 1024;
     let stdout = "", stderr = "", pendingStderr = "", settled = false, primary = null, cursor = 0, droppingStructured = false;
-    let outputBytes = 0, cleanupTimer = null, inputError = null, termination = null, retainedError = null, prettyError = "";
+    let cleanupTimer = null, inputError = null, termination = null, retainedError = null, prettyError = "";
     const phases = new Set();
     const clock = timeoutMs === null ? null : new ObservationClock({ timeoutMs: startupMs ?? timeoutMs });
     const observeSetup = setupObserver(env.DD_EVAL_OPERATION_ID ?? process.env.DD_EVAL_OPERATION_ID);
@@ -144,9 +144,8 @@ async function command(bin, args, json, { cwd, env = {}, input = null, onProgres
     signal?.addEventListener("abort", abort, { once: true });
     child.stdout.setEncoding("utf8").on("data", data => {
       productive();
-      diagnostic(data, "stdout"); outputBytes += Buffer.byteLength(data);
-      if (outputBytes > maxOutput) stop(failure("command final output exceeds 8 MiB", "command_output_limit"));
-      else stdout += data;
+      diagnostic(data, "stdout");
+      stdout += data;
     });
     child.stderr.setEncoding("utf8").on("data", data => {
       diagnostic(data, "stderr"); stderr = (stderr + data).slice(-maxTail);

package/dist/harness-runtime/lib/tool-observations.mjs

@@ -162,14 +162,22 @@ export function agyToolObservation(step, rootSessionId) {
 /** Native AGY JSONL records have planner tool invocations, not matching live
  * step IDs. GENERIC result text is deliberately not guessed into success. */
 export function agyTranscriptObservations(text, sessionId, parentSessionId, source = {}) {
-  const events = [], lines = text.split("\n"); let recognized = false;
-  const session = identity("antigravity-cli", sessionId);
+  const reducer = createAgyTranscriptObserver(sessionId, parentSessionId, source), lines = text.split("\n");
   for (const [line, bytes] of lines.entries()) {
     if (!bytes.trim()) continue;
-    let record; try { record = JSON.parse(bytes); } catch { events.push({ session, reason: line === lines.length - 1 ? "agy_transcript_partial_tail" : "agy_transcript_invalid_record" }); continue; }
-    if (!record || typeof record !== "object" || Array.isArray(record)) { events.push({ session, reason: "agy_transcript_shape_unsupported" }); continue; }
-    if (record.conversation_id && record.conversation_id !== sessionId) { events.push({ session, reason: "agy_transcript_session_mismatch" }); continue; }
-    if (!["SYSTEM_MESSAGE", "USER_INPUT", "PLANNER_RESPONSE", "GENERIC", "TOOL_RESPONSE", "CHECKPOINT"].includes(record.type)) { events.push({ session, reason: "agy_transcript_shape_unsupported" }); continue; }
+    try { reducer.add(JSON.parse(bytes), line + 1); }
+    catch { reducer.gap(line === lines.length - 1 ? "agy_transcript_partial_tail" : "agy_transcript_invalid_record"); }
+  }
+  return reducer.finish();
+}
+
+export function createAgyTranscriptObserver(sessionId, parentSessionId, source = {}) {
+  const events = []; let recognized = false;
+  const session = identity("antigravity-cli", sessionId);
+  function add(record, line) {
+    if (!record || typeof record !== "object" || Array.isArray(record)) { events.push({ session, reason: "agy_transcript_shape_unsupported" }); return; }
+    if (record.conversation_id && record.conversation_id !== sessionId) { events.push({ session, reason: "agy_transcript_session_mismatch" }); return; }
+    if (!["SYSTEM_MESSAGE", "USER_INPUT", "PLANNER_RESPONSE", "GENERIC", "TOOL_RESPONSE", "CHECKPOINT"].includes(record.type)) { events.push({ session, reason: "agy_transcript_shape_unsupported" }); return; }
     recognized = true;
     if (record.tool_calls !== undefined && !Array.isArray(record.tool_calls)) events.push({ session, reason: "agy_transcript_shape_unsupported" });
     if (record.truncated || record.truncation || typeof record.content === "string" && /\[.*truncat|<.*truncat/i.test(record.content)) events.push({ session, reason: "agy_transcript_truncated" });
@@ -177,12 +185,14 @@ export function agyTranscriptObservations(text, sessionId, parentSessionId, sour
       if (!Number.isInteger(record.step_index) || !call || typeof call.name !== "string" || !call.name) { events.push({ session, reason: "agy_transcript_tool_identity_missing" }); continue; }
       const id = call.id ?? call.tool_call_id;
       events.push({ session, parent_session: identity("antigravity-cli", parentSessionId), epoch: "native_transcript", call_id: id ?? `${record.step_index}:${index}`, name: call.name,
-        status: "unknown", reason: "agy_transcript_tool_outcome_unproven", source: { ...source, channel: "agy.native_transcript", line: line + 1, step_index: record.step_index } });
+        status: "unknown", reason: "agy_transcript_tool_outcome_unproven", source: { ...source, channel: "agy.native_transcript", line, step_index: record.step_index } });
     }
   }
-  if (!recognized) events.push({ session, reason: "agy_transcript_shape_unsupported" });
-  else events.push({ session, parent_session: identity("antigravity-cli", parentSessionId), source_observed: true, source: { ...source, channel: "agy.native_transcript" } });
-  return events;
+  return { add, gap: reason => events.push({ session, reason }), finish: () => {
+    if (!recognized) events.push({ session, reason: "agy_transcript_shape_unsupported" });
+    else events.push({ session, parent_session: identity("antigravity-cli", parentSessionId), source_observed: true, source: { ...source, channel: "agy.native_transcript" } });
+    return events;
+  } };
 }
 
 /** Read-only replay, shared by accounting and offline diagnosis. A journal