@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/services/managed-daemon-binding.js

@@ -0,0 +1,129 @@
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { managedProcessRuntimeHome, managedProcessStatus, processTreeIsAlive } from "./managed-processes.js";
+function retainedResourceStopped(resource, daemonId) {
+    if (resource.state !== "stopped" || resource.observation_conflict)
+        return false;
+    if (resource.native_retirement?.method)
+        return true;
+    // Completed native tasks retain an ordered terminal envelope, not a later
+    // stop-RPC receipt. Requiring that RPC after provider exit loses valid proof.
+    const source = resource.native_source, terminal = resource.terminal_source;
+    return Boolean(daemonId && resource.owner_daemon_id === daemonId
+        && resource.provider_session_id && resource.resource_id?.startsWith(`${resource.provider_session_id}/task-`)
+        && source?.locator && source.locator === terminal?.locator
+        && /^[a-f0-9]{64}$/.test(source.sha256 ?? "") && /^[a-f0-9]{64}$/.test(terminal?.sha256 ?? "")
+        && Number.isSafeInteger(source.step_index) && source.step_index >= 0
+        && Number.isSafeInteger(terminal?.step_index) && terminal.step_index > source.step_index);
+}
+/** Native execution and AGY's potentially scheduled writers are separate facts. */
+export function managedExecutionReusable(state, harness) {
+    const shutdown = state.shutdown, result = shutdown?.result;
+    if (state.active_tree !== false || state.unclaimed_activity === true || shutdown?.phases?.execution !== true
+        || result?.native_settled !== true || result.settled !== true || result.native_settlement?.confirmed === false
+        || state.native_execution_revision !== undefined && state.native_execution_revision !== result.native_settlement?.revision)
+        return false;
+    // These adapters do not yet publish a revision for every possible late
+    // child/tool event. A completed native observation alone cannot exclude a
+    // newly scheduled writer; the caller can still use physical absence.
+    if (["zcode-acp", "droid-cli"].includes(harness))
+        return false;
+    if (harness !== "antigravity-cli")
+        return true;
+    const daemon = state.daemon_id ?? state.config?.daemonId, proof = shutdown.native_resource_reconciliation, resources = result.native_resources;
+    return Boolean(daemon && shutdown.phases.native_resources_reconciled === true && proof?.daemon_id === daemon
+        && proof.dispatch_generation === shutdown.generation && Number.isSafeInteger(proof.dispatch_generation)
+        && proof.native_revision === state.native_execution_revision && Number.isSafeInteger(proof.native_revision)
+        && resources?.schema_id === "native-resources@1" && resources.owner_daemon_id === daemon
+        && resources.revision === proof.native_revision && Number.isSafeInteger(resources.generation)
+        && result.native_settlement?.owner_daemon_id === daemon && result.native_settlement.generation === resources.generation
+        && Array.isArray(resources.entries)
+        && resources.entries.every(item => item.owner_daemon_id === daemon && item.generation === resources.generation && item.state === "stopped"));
+}
+export function readNativeDaemonState(stateDir) {
+    if (!path.isAbsolute(stateDir))
+        throw new AppError("daemon_owner_mismatch", "Native state directory must be absolute", 1);
+    return JSON.parse(fs.readFileSync(path.join(stateDir, "daemon.json"), "utf8"));
+}
+/** A shared directory or logical owner is not a physical provider binding. */
+export function managedProviderBelongsToDaemon(provider, daemon, state) {
+    const child = JSON.parse(provider.metadata_json), parent = JSON.parse(daemon.metadata_json);
+    return provider.kind === daemon.kind.replace(/-daemon$/, "-provider")
+        && state.provider_process?.id === provider.id && state.provider_process.lease_token === provider.lease_token
+        && Boolean(provider.pid && provider.pid_started_at && daemon.pid && daemon.pid_started_at)
+        && state.provider_pid === provider.pid && child.owner_pid === daemon.pid && child.owner_pid_started_at === daemon.pid_started_at
+        && provider.owner_id === daemon.owner_id && provider.project_id === daemon.project_id && provider.run_id === daemon.run_id && provider.work_id === daemon.work_id
+        && child.state_dir === parent.state_dir && child.role === parent.role && child.dd_flow_home === parent.dd_flow_home && child.adapter_executable === parent.adapter_executable
+        && child.dispatch_barrier === "run-generation@1" && child.budget?.scope_id === parent.budget?.scope_id;
+}
+/** Identity proof only. Liveness and clean shutdown are separate caller decisions. */
+export function requireManagedDaemonBinding(context, input) {
+    const state = readNativeDaemonState(input.stateDir);
+    const owner = state.config?.runtime_owner;
+    const record = managedProcessStatus(context).find(record => record.id === state.resource_process?.id);
+    const metadata = record && JSON.parse(record.metadata_json);
+    if (!record || !owner || !record.kind.endsWith("-daemon")
+        || record.lease_token !== state.resource_process?.lease_token
+        || !record.pid || record.pid !== state.pid || !record.pid_started_at
+        || record.owner_id !== owner.owner_id || input.ownerId !== undefined && record.owner_id !== input.ownerId
+        || record.project_id !== input.projectId || owner.project_id !== input.projectId
+        || record.run_id !== input.runId || owner.run_id !== input.runId
+        || metadata?.state_dir !== input.stateDir || owner.state_dir !== input.stateDir
+        || owner.dd_flow_home !== context.ddFlowHome || managedProcessRuntimeHome(record, context) !== context.ddFlowHome) {
+        throw new AppError("daemon_owner_mismatch", "Native daemon has no proven physical ownership in this RUN and runtime home", 1);
+    }
+    return { state, process: record };
+}
+/** A dead bridge is not enough: its provider may own a detached process group. */
+export function managedDaemonExecutionAbsent(context, input) {
+    const binding = requireManagedDaemonBinding(context, input);
+    const records = managedProcessStatus(context).filter(record => {
+        try {
+            return JSON.parse(record.metadata_json).state_dir === input.stateDir;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (!records.length || records.some(record => {
+        const group = JSON.parse(record.metadata_json).process_group_id;
+        // A dead leader without its retained tree boundary cannot exclude surviving
+        // children. Fall back to strict native reconciliation, not assumed absence.
+        return record.project_id !== input.projectId || record.run_id !== input.runId
+            || managedProcessRuntimeHome(record, context) !== context.ddFlowHome || !record.pid || !record.pid_started_at
+            || !Number.isSafeInteger(group) || group <= 0 || processTreeIsAlive(record);
+    }))
+        return false;
+    if (binding.state.provider_process || binding.state.provider_pid) {
+        const provider = records.find(record => record.id === binding.state.provider_process?.id);
+        if (!provider || !managedProviderBelongsToDaemon(provider, binding.process, binding.state))
+            return false;
+    }
+    // The registry leaders are not the entire native inventory: retain detached
+    // tools and schedules even after their provider endpoint disappears.
+    if (binding.state.native_topology_error || binding.state.native_retirement_notifications?.some(notice => notice.disposition !== "after_owned_native_stop" || notice.owner_daemon_id !== (binding.state.daemon_id ?? binding.state.config?.daemonId)
+        || !Number.isSafeInteger(notice.generation) || notice.revision !== binding.state.native_execution_revision))
+        return false;
+    const nativeResources = [...(binding.state.native_resources_entries ?? []), ...(binding.state.shutdown?.result?.native_resources?.entries ?? [])];
+    const retained = [...(binding.state.owned_processes ?? []), ...(binding.state.shutdown?.owned_processes ?? []),
+        ...nativeResources.filter(resource => resource.pid !== undefined || !retainedResourceStopped(resource, binding.state.daemon_id ?? binding.state.config?.daemonId))];
+    if (nativeResources.some(resource => resource.observation_conflict || resource.owner_daemon_id !== undefined
+        && resource.owner_daemon_id !== (binding.state.daemon_id ?? binding.state.config?.daemonId)))
+        return false;
+    for (const process of retained) {
+        if (!Number.isSafeInteger(process.pid) || process.pid <= 0 || typeof process.started !== "string" || !process.started.trim())
+            return false;
+        if (records.some(record => record.pid === process.pid && record.pid_started_at === process.started))
+            continue;
+        try {
+            globalThis.process.kill(process.pid, 0);
+            return false;
+        }
+        catch (error) {
+            if (error.code !== "ESRCH")
+                return false;
+        }
+    }
+    return true;
+}

package/dist/services/managed-lease-monitor.js

@@ -0,0 +1,133 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { AppError } from "../shared/errors.js";
+import { createRenewalState, maintenanceRetryable, renewalConfirmed, renewalDelay, renewalFailure, renewalRemaining, RENEWAL_POLICY } from "../harness-runtime/lib/lease-renewal.mjs";
+/** Registry renewals happen outside RUN writers. Assertions never renew. */
+export function managedLeaseMonitor(renew, leaseExpiresAt = null) {
+    const episode = createRenewalState({ leaseExpiresAt });
+    let expiry = 0;
+    let failure = null;
+    let lost = false;
+    let fatal = null;
+    let closing = false;
+    let pending;
+    const shutdown = new AbortController();
+    const retainAuthority = (leaseExpiresAt) => {
+        if (!renewalConfirmed(episode, performance.now(), leaseExpiresAt))
+            throw new AppError("managed_lease_receipt_invalid", "Confirmation has no current persisted expiry", 1);
+        expiry = Date.parse(leaseExpiresAt);
+    };
+    const uncertain = () => new AppError("controller_lease_unconfirmed", "Managed lease requires confirmation outside the writer", 1, { cause: failure, exhausted: episode.exhausted, closing });
+    const assertNoRenewal = () => {
+        if (closing)
+            throw uncertain();
+        if (fatal)
+            throw fatal;
+        if (lost)
+            throw new AppError("controller_lease_lost", "Managed owner was replaced or retired", 1);
+        if (failure || Date.now() >= expiry)
+            throw uncertain();
+    };
+    const tick = () => {
+        if (closing)
+            throw uncertain();
+        if (fatal)
+            throw fatal;
+        if (lost || failure && !renewalRemaining(episode) || episode.exhausted)
+            return;
+        try {
+            episode.uncertainSince ??= performance.now();
+            const remaining = renewalRemaining(episode);
+            if (!remaining) {
+                failure = uncertain();
+                return;
+            }
+            const receipt = renew(Math.min(RENEWAL_POLICY.attemptMs, remaining));
+            if (!receipt.owned) {
+                lost = true;
+                return;
+            }
+            const value = Date.parse(receipt.lease_expires_at);
+            if (!Number.isFinite(value))
+                throw new AppError("managed_lease_receipt_invalid", "Renewal has no valid persisted expiry", 1);
+            if (value <= Date.now())
+                throw new AppError("controller_lease_unconfirmed", "Renewal receipt has already expired", 1);
+            if (renewalConfirmed(episode, performance.now(), receipt.lease_expires_at)) {
+                expiry = value;
+                failure = null;
+            }
+            else
+                failure = uncertain();
+        }
+        catch (error) {
+            failure = error;
+            if (maintenanceRetryable(error) || error instanceof AppError && error.code === "controller_lease_unconfirmed")
+                renewalFailure(episode);
+            else {
+                fatal = error;
+                throw error;
+            }
+        }
+    };
+    const assertConfirmed = () => { tick(); assertNoRenewal(); };
+    const runConfirmation = async (assertCurrent) => {
+        for (;;) {
+            if (closing)
+                throw uncertain();
+            assertCurrent();
+            tick();
+            try {
+                assertNoRenewal();
+                return;
+            }
+            catch (error) {
+                if (lost || episode.exhausted || !renewalRemaining(episode))
+                    throw error;
+                try {
+                    await delay(Math.min(renewalDelay(episode), renewalRemaining(episode)), undefined, { signal: shutdown.signal });
+                }
+                catch (cause) {
+                    if (closing)
+                        throw uncertain();
+                    throw cause;
+                }
+            }
+        }
+    };
+    const ensureConfirmed = async (assertCurrent = () => { }) => {
+        if (closing)
+            throw uncertain();
+        if (pending)
+            assertCurrent();
+        pending ??= runConfirmation(assertCurrent).finally(() => { pending = undefined; });
+        await pending;
+        if (closing)
+            throw uncertain();
+        assertCurrent();
+        assertNoRenewal();
+    };
+    const background = (assertCurrent, onFailure, onConfirmed = () => { }) => {
+        void ensureConfirmed(assertCurrent).then(() => {
+            if (closing)
+                return;
+            try {
+                onConfirmed();
+            }
+            catch (error) {
+                fatal = failure = error;
+                throw error;
+            }
+        }).catch(error => {
+            if (closing)
+                return;
+            try {
+                onFailure(error);
+            }
+            catch (reporting) {
+                fatal = failure = reporting;
+            }
+        });
+    };
+    return { tick, assertNoRenewal, assertConfirmed, ensureConfirmed, background, retainAuthority,
+        close: () => { closing = true; shutdown.abort(); },
+        isConfirmed: () => !closing && !lost && !failure && Date.now() < expiry };
+}