@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/services/interactive-work-start.js

@@ -0,0 +1,155 @@
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { readFlowRunExecutionBundle, assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { readRegisteredInteractiveWork } from "./interactive-work-registration.js";
+import { PreparedInteractiveWorkspaceChanges } from "./interactive-mutation-scope.js";
+import { PreparedInteractiveGitBaseline } from "./interactive-git-baseline.js";
+import { readDescriptorStageInput } from "./descriptor-stage-coordinator.js";
+import { stageGraphScope } from "./stage-work-graph.js";
+import { assertRunMutationAllowed } from "./run-recovery-guard.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+const event = "interactive.work_start";
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function refuse(reason) {
+    throw new AppError("interactive_work_start_invalid", "Interactive Work requires its issued input and actual physical start", 2, { reason, effect: "no_effect" });
+}
+export function readInteractiveWorkGit(bundle) {
+    const git = JSON.parse(bundle.blob("runtime/git-policy.json").toString("utf8"));
+    if (!git || typeof git.git_executable !== "string" || !/^[a-f0-9]{64}$/.test(git.git_sha256)
+        || hash(readBoundedReleaseFile(git.git_executable, 64 * 1024 * 1024)) !== git.git_sha256)
+        refuse("selected_git_changed");
+    return { git_executable: git.git_executable, git_sha256: git.git_sha256 };
+}
+/** Historical SQL-only start custody. Never recapture already edited sources. */
+export function readInteractiveWorkStart(context, scope, bundle, workSessionId) {
+    const assignment = readRegisteredInteractiveWork(context, scope, bundle, scope.workId);
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.work_session_id')=? LIMIT 2", [scope.projectId, event, workSessionId]);
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 33 * 1024 * 1024)
+        refuse("start_custody_missing");
+    const receipt = JSON.parse(rows[0].payload_json);
+    if (!receipt || Object.keys(receipt).sort().join() !== "actor,attempt,bundle_sha256,hook_event_id,hook_event_key,packet_sha256,run_id,schema_id,snapshot,snapshot_sha256,stage,work_id,work_session_id"
+        || receipt.schema_id !== "dd-flow/interactive-work-start@1" || receipt.run_id !== scope.runId || receipt.work_id !== scope.workId
+        || receipt.work_session_id !== workSessionId || receipt.stage !== assignment.packet.stage || receipt.attempt !== assignment.receipt.attempt
+        || receipt.packet_sha256 !== assignment.packet.packet_sha256 || receipt.bundle_sha256 !== bundle.sha256
+        || !receipt.actor || Object.keys(receipt.actor).sort().join() !== "harness,provider_session_id,session_id")
+        refuse("start_binding_changed");
+    const actor = receipt.actor;
+    if (!context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN hook_events h ON h.project_id=w.project_id AND h.event_key=ws.hook_event_id WHERE w.project_id=? AND w.run_id=? AND w.work_id=? AND ws.id=? AND ws.session_id=? AND ws.hook_event_id=? AND h.id=? AND h.status='claimed' AND h.session_id=ws.session_id AND h.harness=? AND h.provider_session_id=?", [scope.projectId, scope.runId, scope.workId, workSessionId, actor.session_id, receipt.hook_event_key, receipt.hook_event_id, actor.harness, actor.provider_session_id]))
+        refuse("physical_start_custody_changed");
+    const baseline = PreparedInteractiveGitBaseline.restore(Buffer.from(JSON.stringify(receipt.snapshot)), receipt.snapshot_sha256);
+    const start = context.db.get("SELECT start_receipt_json FROM work_sessions WHERE id=? AND work_id=?", [workSessionId, scope.workId]);
+    if (!start?.start_receipt_json || Buffer.byteLength(start.start_receipt_json) > 33 * 1024 * 1024)
+        refuse("start_packet_custody_missing");
+    const packetReceipt = JSON.parse(start.start_receipt_json);
+    if (typeof packetReceipt.context !== "string" || hash(Buffer.from(packetReceipt.context)) !== packetReceipt.context_sha256)
+        refuse("start_packet_changed");
+    const startContext = JSON.parse(packetReceipt.context);
+    if (startContext.run_id !== scope.runId || startContext.work_id !== scope.workId
+        || hybridDigest(startContext.interactive_start) !== hybridDigest({ schema_id: "dd-flow/interactive-work-start-binding@1",
+            packet_sha256: assignment.packet.packet_sha256, snapshot_sha256: baseline.sha256 }))
+        refuse("start_snapshot_binding_changed");
+    const frozen = bundle.execution.snapshot().scope;
+    if (baseline.snapshot().project_root !== frozen.projectRoot || baseline.snapshot().workspace !== frozen.workspace)
+        refuse("physical_start_scope_changed");
+    return { receipt, baseline, assignment };
+}
+/** Physical preparation precedes the ordinary hook/Session claim writer.
+ * The original Work snapshot is retained with that claim, never after edits. */
+export class PreparedInteractiveWorkStart {
+    #scope;
+    #bundle;
+    #assignment;
+    #changes;
+    #baseline;
+    #git;
+    constructor(scope, bundle, assignment, changes, git) {
+        this.#scope = { ...scope };
+        this.#bundle = bundle;
+        this.#assignment = assignment;
+        this.#changes = changes;
+        const bytes = Buffer.from(JSON.stringify(changes.currentSnapshot()));
+        this.#baseline = PreparedInteractiveGitBaseline.restore(bytes, hash(bytes));
+        this.#git = { ...git };
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const bundle = readFlowRunExecutionBundle(context, input);
+        if (!bundle)
+            refuse("bundle_required");
+        const assignment = readRegisteredInteractiveWork(context, input, bundle, input.workId), frozen = bundle.execution.snapshot().scope;
+        const git = readInteractiveWorkGit(bundle);
+        const changes = PreparedInteractiveWorkspaceChanges.prepare(context, input, bundle, { projectRoot: frozen.projectRoot,
+            workspace: frozen.workspace, gitExecutable: git.git_executable, env: context.env });
+        const prepared = new PreparedInteractiveWorkStart(input, bundle, assignment, changes, git);
+        const patch = changes.snapshot(), packet = assignment.packet;
+        if (hybridDigest(patch.delta.changes) !== packet.file_changes_sha256 || patch.scope_revision !== packet.scope_revision
+            || patch.user_inputs_sha256 !== packet.user_inputs_sha256)
+            refuse("issued_context_changed_before_start");
+        // Unchanged files are also selected reviewer/writer inputs, not just patch paths.
+        const files = new Map(changes.currentSnapshot().entries.filter(item => item.kind === "file").map(item => [item.path, item.sha256]));
+        if (packet.read_inputs.some(ref => ref.root === "workspace" && files.get(ref.path) !== ref.sha256))
+            refuse("issued_source_changed_before_start");
+        context.db.readSnapshot(() => prepared.assertSelection(context));
+        prepared.revalidate();
+        return prepared;
+    }
+    revalidate() {
+        if (hash(readBoundedReleaseFile(this.#git.git_executable, 64 * 1024 * 1024)) !== this.#git.git_sha256)
+            refuse("selected_git_changed");
+        this.#changes.revalidate();
+    }
+    binding() {
+        return { schema_id: "dd-flow/interactive-work-start-binding@1", packet_sha256: this.#assignment.packet.packet_sha256, snapshot_sha256: this.#baseline.sha256 };
+    }
+    assertSelection(context) {
+        const { projectId, runId, workId } = this.#scope, packet = this.#assignment.packet;
+        const current = readRegisteredInteractiveWork(context, this.#scope, this.#bundle, workId);
+        if (hybridDigest(current.receipt) !== hybridDigest(this.#assignment.receipt)
+            || hybridDigest(current.custody) !== hybridDigest(this.#assignment.custody)
+            || current.packet.packet_sha256 !== this.#assignment.packet.packet_sha256)
+            refuse("assignment_changed_before_start");
+        const run = assertPreparedRunBundleSqlAuthority(context, this.#scope, this.#bundle), index = JSON.parse(run.index_json);
+        const graph = stageGraphScope(context, projectId, runId, packet.owner_stage), stage = readDescriptorStageInput(context, { ...this.#scope, stage: packet.owner_stage }, this.#bundle);
+        if (run.status !== "running" || index.current_stage !== packet.owner_stage
+            || !index.stage_runs?.some((item) => item.stage === packet.owner_stage && item.status === "running" && item.attempt === graph.attempt)
+            || graph.attempt !== current.custody.scope.attempt || graph.cycle !== current.custody.scope.cycle
+            || stage.attempt !== graph.attempt || stage.inputSha256 !== packet.input_sha256)
+            refuse("active_assignment_required");
+        assertRunMutationAllowed(context, projectId, runId);
+    }
+    assertCustody(context) {
+        if (!context.db.isOwnedWriteTransaction?.())
+            refuse("owned_writer_required");
+        this.assertSelection(context);
+        this.#changes.assertCustody(context);
+    }
+    recordStart(context, workSessionId, hookEventKey, identity) {
+        this.assertCustody(context);
+        const { projectId, runId, workId } = this.#scope;
+        const link = context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN sessions s ON s.project_id=w.project_id AND s.session_id=ws.session_id JOIN hook_events h ON h.project_id=w.project_id AND h.event_key=ws.hook_event_id WHERE w.project_id=? AND w.run_id=? AND w.work_id=? AND w.status='running' AND ws.id=? AND ws.status='running' AND ws.session_id=? AND ws.hook_event_id=? AND h.status='claimed' AND h.id=? AND h.session_id=ws.session_id AND s.harness=? AND s.provider_session_id=? AND h.harness=s.harness AND h.provider_session_id=s.provider_session_id", [projectId, runId, workId, workSessionId, identity.sessionId, hookEventKey, identity.hookEventId, identity.harness, identity.providerSessionId]);
+        if (!link)
+            refuse("claimed_work_session_required");
+        if (this.#assignment.retained.body.work_history.works.some(prior => prior.actor?.harness === identity.harness
+            && prior.actor.provider_session_id === identity.providerSessionId))
+            refuse("independent_physical_session_required");
+        if (context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN sessions s ON s.project_id=w.project_id AND s.session_id=ws.session_id WHERE w.project_id=? AND w.run_id=? AND ws.id<>? AND s.harness=? AND s.provider_session_id=? LIMIT 1", [projectId, runId, workSessionId, identity.harness, identity.providerSessionId]))
+            refuse("independent_physical_session_required");
+        if (context.db.get("SELECT 1 FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.work_session_id')=?", [projectId, event, workSessionId]))
+            refuse("start_already_retained");
+        const packet = this.#assignment.packet;
+        const receipt = { schema_id: "dd-flow/interactive-work-start@1", run_id: runId, work_id: workId, work_session_id: workSessionId,
+            hook_event_key: hookEventKey, hook_event_id: identity.hookEventId, stage: packet.stage, attempt: this.#assignment.receipt.attempt,
+            packet_sha256: packet.packet_sha256, bundle_sha256: this.#bundle.sha256,
+            actor: { session_id: identity.sessionId, harness: identity.harness, provider_session_id: identity.providerSessionId },
+            snapshot_sha256: this.#baseline.sha256, snapshot: this.#baseline.snapshot() };
+        // Same bounded snapshot as the RUN baseline; SQL custody is not worker transport.
+        const json = JSON.stringify(receipt);
+        if (Buffer.byteLength(json) > 33 * 1024 * 1024)
+            refuse("unbounded_start_receipt");
+        context.db.run("INSERT INTO audit_events(project_id,event_type,payload_json,created_at) VALUES(?,?,?,?)", [projectId, event, json, context.now()]);
+        readInteractiveWorkStart(context, this.#scope, this.#bundle, workSessionId);
+    }
+}

package/dist/services/lanes.js

@@ -1,6 +1,4 @@
 import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { AppError } from "../shared/errors.js";
 import { appendAudit } from "./audit.js";
@@ -8,6 +6,31 @@ import { requireProjectByRoot } from "./projects.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 const defaultTtlSeconds = 300;
 const defaultPollIntervalSeconds = 10;
+export function prepareLaneWaitTiming(input) {
+    return {
+        timeoutSeconds: normalizeNonNegativeNumber(input.timeoutSeconds, 0, "timeout"),
+        pollIntervalSeconds: normalizePositiveNumber(input.pollIntervalSeconds, defaultPollIntervalSeconds, "poll-interval")
+    };
+}
+export function prepareLaneLock(context, input, action) {
+    if (typeof input.workerId !== "string" || !input.workerId.trim())
+        throw new AppError("validation", "Lane lock requires a nonempty worker ID", 2);
+    if (["acquire", "release", "wait-acquire"].includes(action) && (typeof input.reason !== "string" || !input.reason.trim()))
+        throw new AppError("validation", "Lane lock requires a nonempty reason", 2);
+    if (input.leaseToken !== undefined && (typeof input.leaseToken !== "string" || !input.leaseToken.trim()))
+        throw new AppError("validation", "Lease token must be nonempty text", 2);
+    const ttlSeconds = normalizePositiveNumber(input.ttlSeconds, defaultTtlSeconds, "ttl");
+    const { timeoutSeconds, pollIntervalSeconds } = prepareLaneWaitTiming(input);
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const lane = normalizeLane(input.lane);
+    const workspace = input.workspacePath !== undefined ? requireMatchingLaneWorkspace(context, project.id, lane, input.workspacePath) : undefined;
+    if (input.workspacePath === undefined && ["acquire", "wait", "wait-acquire"].includes(action))
+        throw new AppError("validation", "Lane lock requires a workspace path", 2);
+    if (action === "acquire" || action === "wait-acquire")
+        assertWorkerMayAcquireLaneLock(context, project.id, lane, input.workerId);
+    const lock = action === "heartbeat" || action === "release" ? requireOwnedActiveLock(context, project.id, lane, input.workerId, input.leaseToken) : undefined;
+    return { project, lane, ttlSeconds, timeoutSeconds, pollIntervalSeconds, lock, workspace };
+}
 export function getLaneStatus(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     return {
@@ -23,10 +46,16 @@ export function expireProjectLaneLocks(context, projectId) {
 export function expireProjectLaneWaiters(context, projectId) {
     expireStaleWaiters(context, projectId);
 }
-export function setLaneWorkspace(context, input) {
+export function prepareLaneWorkspace(context, input) {
+    if (input.branch !== undefined && (typeof input.branch !== "string" || !input.branch.trim()))
+        throw new AppError("validation", "Expected branch must be nonempty text", 2);
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const lane = normalizeLane(input.lane);
     const workspacePath = resolveExistingPath(input.workspacePath);
+    return { project, lane, workspacePath };
+}
+export function setLaneWorkspace(context, input) {
+    const { project, lane, workspacePath } = prepareLaneWorkspace(context, input);
     const now = context.now();
     const existing = laneRecord(context, project.id, lane);
     context.db.run(`INSERT INTO lanes
@@ -69,11 +98,12 @@ export function checkLaneWorkspace(context, input) {
     };
 }
 export function acquireLaneLock(context, input) {
-    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
-    const lane = normalizeLane(input.lane);
-    requireMatchingLaneWorkspace(context, project.id, lane, input.workspacePath);
-    assertWorkerMayAcquireLaneLock(context, project.id, lane, input.workerId);
-    const ttlSeconds = normalizePositiveNumber(input.ttlSeconds, defaultTtlSeconds, "ttl");
+    const prepared = prepareLaneLock(context, input, "acquire");
+    return context.db.writeTransaction(() => acquirePreparedLaneLock(context, input, prepared));
+}
+function acquirePreparedLaneLock(context, input, prepared) {
+    const { project, lane, ttlSeconds } = prepared;
+    assertPreparedLaneLock(context, prepared, input.workerId);
     expireStaleLocks(context, project.id);
     const active = activeLaneLock(context, project.id, lane);
     if (active) {
@@ -115,14 +145,15 @@ export function acquireLaneLock(context, input) {
         ...(expired ? { expired_lock_id: expired.id } : {})
     };
 }
+function assertPreparedLaneLock(context, prepared, workerId) {
+    if (JSON.stringify(laneRecord(context, prepared.project.id, prepared.lane)) !== JSON.stringify(prepared.workspace)
+        || context.db.get("SELECT root FROM projects WHERE id = ?", [prepared.project.id])?.root !== prepared.project.root)
+        throw new AppError("lane_workspace_changed", "Lane registration changed after workspace preparation", 1);
+    assertWorkerMayAcquireLaneLock(context, prepared.project.id, prepared.lane, workerId);
+}
 export function heartbeatLaneLock(context, input) {
-    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
-    const lane = normalizeLane(input.lane);
-    if (input.workspacePath) {
-        requireMatchingLaneWorkspace(context, project.id, lane, input.workspacePath);
-    }
-    const lock = requireOwnedActiveLock(context, project.id, lane, input.workerId, input.leaseToken);
-    const ttlSeconds = normalizePositiveNumber(input.ttlSeconds, defaultTtlSeconds, "ttl");
+    const { project, lock: preparedLock, ttlSeconds } = prepareLaneLock(context, input, "heartbeat");
+    const lock = preparedLock;
     const now = context.now();
     context.db.run(`UPDATE lane_locks SET heartbeat_at = ?, expires_at = ?, updated_at = ? WHERE id = ?`, [now, expiresAt(now, ttlSeconds), now, lock.id]);
     appendAudit(context, {
@@ -133,12 +164,8 @@ export function heartbeatLaneLock(context, input) {
     return { ok: true, lock: activeLaneLock(context, project.id, lock.lane) };
 }
 export function releaseLaneLock(context, input) {
-    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
-    const lane = normalizeLane(input.lane);
-    if (input.workspacePath) {
-        requireMatchingLaneWorkspace(context, project.id, lane, input.workspacePath);
-    }
-    const lock = requireOwnedActiveLock(context, project.id, lane, input.workerId, input.leaseToken);
+    const { project, lock: preparedLock } = prepareLaneLock(context, input, "release");
+    const lock = preparedLock;
     const now = context.now();
     context.db.run(`UPDATE lane_locks
      SET status = 'released', released_at = ?, reason = ?, updated_at = ?
@@ -152,11 +179,7 @@ export function releaseLaneLock(context, input) {
     return { ok: true, lock: laneLockById(context, lock.id) };
 }
 export async function waitForLaneLock(context, input) {
-    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
-    const lane = normalizeLane(input.lane);
-    requireMatchingLaneWorkspace(context, project.id, lane, input.workspacePath);
-    const timeoutSeconds = normalizeNonNegativeNumber(input.timeoutSeconds, 0, "timeout");
-    const pollIntervalSeconds = normalizePositiveNumber(input.pollIntervalSeconds, defaultPollIntervalSeconds, "poll-interval");
+    const { project, lane, timeoutSeconds, pollIntervalSeconds } = prepareLaneLock(context, input, "wait");
     const start = Date.now();
     while (true) {
         expireStaleLocks(context, project.id);
@@ -186,13 +209,18 @@ export function getLaneWaiters(context, input) {
         }))
     };
 }
-export function cancelLaneWaiter(context, input) {
+export function prepareLaneWaiterCancellation(context, input) {
+    if (typeof input.workerId !== "string" || !input.workerId.trim())
+        throw new AppError("validation", "Lane waiter requires a nonempty worker ID", 2);
+    if (typeof input.reason !== "string" || !input.reason.trim())
+        throw new AppError("validation", "lane waiter cancel requires --reason", 2);
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const lane = normalizeLane(input.lane);
     const reason = input.reason.trim();
-    if (!reason) {
-        throw new AppError("validation", "lane waiter cancel requires --reason", 2);
-    }
+    return { project, lane, reason };
+}
+export function cancelLaneWaiter(context, input) {
+    const { project, lane, reason } = prepareLaneWaiterCancellation(context, input);
     expireStaleWaiters(context, project.id);
     const now = context.now();
     const waiter = activeLaneWaiterForWorker(context, project.id, lane, input.workerId);
@@ -245,13 +273,7 @@ export function expireLaneWaiterById(context, input) {
     return { ok: true, expired: result.changes === 1, waiter_id: input.waiterId };
 }
 export async function waitAcquireLaneLock(context, input) {
-    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
-    const lane = normalizeLane(input.lane);
-    requireMatchingLaneWorkspace(context, project.id, lane, input.workspacePath);
-    assertWorkerMayAcquireLaneLock(context, project.id, lane, input.workerId);
-    const timeoutSeconds = normalizeNonNegativeNumber(input.timeoutSeconds, 0, "timeout");
-    const pollIntervalSeconds = normalizePositiveNumber(input.pollIntervalSeconds, defaultPollIntervalSeconds, "poll-interval");
-    const ttlSeconds = normalizePositiveNumber(input.ttlSeconds, defaultTtlSeconds, "ttl");
+    const { project, lane, timeoutSeconds, pollIntervalSeconds, ttlSeconds } = prepareLaneLock(context, input, "wait-acquire");
     const startedAt = Date.now();
     const waiterDeadline = timeoutSeconds > 0 ? new Date(startedAt + timeoutSeconds * 1000).toISOString() : null;
     while (true) {
@@ -375,10 +397,9 @@ function laneWaitersForProject(context, projectId, lane) {
      LIMIT 100`, [projectId]);
 }
 function activeLaneLock(context, projectId, lane) {
-    expireStaleLocks(context, projectId);
     return context.db.get(`SELECT * FROM lane_locks
-     WHERE project_id = ? AND lane = ? AND status = 'active'
-     ORDER BY updated_at DESC, id DESC LIMIT 1`, [projectId, lane]);
+     WHERE project_id = ? AND lane = ? AND status = 'active' AND expires_at > ?
+     ORDER BY updated_at DESC, id DESC LIMIT 1`, [projectId, lane, context.now()]);
 }
 function activeLaneWaiterForWorker(context, projectId, lane, workerId) {
     return context.db.get(`SELECT * FROM lane_waiters
@@ -513,13 +534,15 @@ function ensureQueuedLaneWaiter(context, input) {
     return waiter;
 }
 function tryAcquireQueuedLaneLock(context, input) {
-    expireStaleLocks(context, input.projectId);
-    expireStaleWaiters(context, input.projectId);
-    context.db.exec("BEGIN IMMEDIATE");
-    try {
+    const prepared = prepareLaneLock(context, input, "wait-acquire");
+    if (prepared.project.id !== input.projectId || prepared.lane !== input.lane)
+        throw new AppError("lane_workspace_changed", "Lane identity changed while waiting", 1);
+    return context.db.writeTransaction(() => {
+        assertPreparedLaneLock(context, prepared, input.workerId);
+        expireStaleLocks(context, input.projectId);
+        expireStaleWaiters(context, input.projectId);
         const existingLock = activeLaneLock(context, input.projectId, input.lane);
         if (existingLock?.worker_id === input.workerId) {
-            context.db.exec("COMMIT");
             return {
                 acquired: true,
                 payload: {
@@ -537,7 +560,6 @@ function tryAcquireQueuedLaneLock(context, input) {
         }
         const latest = latestLaneWaiterForWorker(context, input.projectId, input.lane, input.workerId);
         if (latest && ["cancelled", "expired"].includes(latest.status) && latest.updated_at >= input.invocationStartedAt) {
-            context.db.exec("COMMIT");
             return {
                 acquired: false,
                 payload: {
@@ -561,14 +583,14 @@ function tryAcquireQueuedLaneLock(context, input) {
         });
         const head = firstQueuedLaneWaiter(context, input.projectId, input.lane);
         if (!existingLock && head?.id === waiter.id) {
-            const lockResult = acquireLaneLock(context, {
+            const lockResult = acquirePreparedLaneLock(context, {
                 projectRoot: input.projectRoot,
                 lane: input.lane,
                 workerId: input.workerId,
                 workspacePath: input.workspacePath,
                 ttlSeconds: input.ttlSeconds,
                 reason: input.reason
-            });
+            }, prepared);
             const now = context.now();
             context.db.run(`UPDATE lane_waiters
          SET status = 'acquired', acquired_at = ?, updated_at = ?
@@ -580,7 +602,6 @@ function tryAcquireQueuedLaneLock(context, input) {
                 reason: input.reason,
                 payload: { project_id: input.projectId, lane: input.lane, worker_id: input.workerId, waiter_id: waiter.id }
             });
-            context.db.exec("COMMIT");
             return {
                 acquired: true,
                 payload: {
@@ -597,7 +618,6 @@ function tryAcquireQueuedLaneLock(context, input) {
             };
         }
         const position = queuedWaiterPosition(context, input.projectId, input.lane, waiter.id);
-        context.db.exec("COMMIT");
         return {
             acquired: false,
             payload: {
@@ -611,18 +631,10 @@ function tryAcquireQueuedLaneLock(context, input) {
                 position
             }
         };
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 function resolveExistingPath(value) {
-    const absolute = path.resolve(value);
-    if (!fs.existsSync(absolute)) {
-        throw new AppError("not_found", `Workspace path does not exist: ${absolute}`, 1);
-    }
-    return fs.realpathSync(absolute);
+    return resolveProjectRoot(value);
 }
 function detectBranch(workspacePath) {
     const result = spawnSync("git", ["-C", workspacePath, "rev-parse", "--abbrev-ref", "HEAD"], { encoding: "utf8" });
@@ -635,7 +647,7 @@ function expiresAt(now, ttlSeconds) {
     return new Date(new Date(now).getTime() + ttlSeconds * 1000).toISOString();
 }
 function normalizeLane(value) {
-    const normalized = value.trim().toLowerCase();
+    const normalized = typeof value === "string" ? value.trim().toLowerCase() : "";
     if (!normalized || !/^[a-z0-9._-]+$/.test(normalized)) {
         throw new AppError("validation", "Lane name must contain only lowercase letters, numbers, dot, underscore, or hyphen", 2);
     }
@@ -643,15 +655,16 @@ function normalizeLane(value) {
 }
 function normalizePositiveNumber(value, fallback, label) {
     const normalized = value ?? fallback;
-    if (!Number.isFinite(normalized) || normalized <= 0) {
-        throw new AppError("validation", `--${label} must be a positive number`, 2);
+    if (!Number.isFinite(normalized) || normalized <= 0 ||
+        (label === "poll-interval" ? normalized * 1000 > 2 ** 31 - 1 : !Number.isFinite(new Date(Date.now() + normalized * 1000).getTime()))) {
+        throw new AppError("validation", `--${label} must be a positive number within the supported timer/date range`, 2);
     }
     return normalized;
 }
 function normalizeNonNegativeNumber(value, fallback, label) {
     const normalized = value ?? fallback;
-    if (!Number.isFinite(normalized) || normalized < 0) {
-        throw new AppError("validation", `--${label} must be zero or a positive number`, 2);
+    if (!Number.isFinite(normalized) || normalized < 0 || !Number.isFinite(new Date(Date.now() + normalized * 1000).getTime())) {
+        throw new AppError("validation", `--${label} must be zero or a positive number within the supported date range`, 2);
     }
     return normalized;
 }