@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.161

package/dist/services/harness-version-probe.js

@@ -0,0 +1,100 @@
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { parse } from "semver";
+import { stopProcessGroup } from "../harness-runtime/lib/managed-daemon.mjs";
+import { AppError } from "../shared/errors.js";
+import { runScopedProbe } from "./harness-probe-effects.js";
+// Even --version runs operator-installed code. Do not infer credential/write
+// isolation from an argument spelling or execute it during static discovery.
+export const versionProbeEffects = Object.freeze({
+    child_process: true, service_process: false, credential_access: "possible",
+    filesystem: "temporary_or_runtime_writes", model_turn: "not_requested",
+    source_owner: "services/harness-version-probe.ts:probeHarnessVersion"
+});
+/** Recognized version fields only; unrelated diagnostic numbers are not facts. */
+export function parseHarnessVersion(harness, stdout) {
+    const normalize = (value) => {
+        const version = parse(value);
+        return version ? `${version.version}${version.build.length ? `+${version.build.join(".")}` : ""}` : null;
+    };
+    if (harness === "grok") {
+        try {
+            const value = JSON.parse(stdout);
+            if (!value || typeof value !== "object" || Array.isArray(value))
+                return null;
+            const reported = value.currentVersion;
+            return typeof reported === "string" ? normalize(reported.trim().split(/\s+/)[0]) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    const labels = {
+        codex: "codex(?:-cli)?", zcode: "zcode", agy: "(?:agy|antigravity)", opencode: "opencode", droid: "droid"
+    };
+    const pattern = new RegExp(`^(?:${labels[harness]}\\s+)?(v?[0-9]+\\.[0-9]+\\.[0-9]+(?:-[A-Za-z0-9.-]+)?(?:\\+[A-Za-z0-9.-]+)?)$`, "i");
+    const versions = new Set(stdout.split(/\r?\n/).flatMap(line => {
+        const matched = line.trim().match(pattern)?.[1];
+        const version = matched ? normalize(matched) : null;
+        return version ? [version] : [];
+    }));
+    return versions.size === 1 ? [...versions][0] : null;
+}
+/** Diagnostic only: a version is not protocol, account or flow qualification. */
+export function probeHarnessVersion(input) {
+    const timeoutMs = input.timeoutMs ?? 3000;
+    if (!["codex", "zcode", "agy", "opencode", "grok", "droid"].includes(input.harness)) {
+        throw new AppError("usage", "Unknown harness family", 2, { effect: "no_effect" });
+    }
+    if (!path.isAbsolute(input.executable) || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60_000) {
+        throw new AppError("usage", "Version probe requires an absolute executable and a timeout of 1–60000 ms", 2, { effect: "no_effect" });
+    }
+    return runScopedProbe(versionProbeEffects, input.scope, () => new Promise((resolve, reject) => {
+        const args = input.harness === "grok" ? ["version", "--json"] : ["--version"];
+        const detached = process.platform !== "win32";
+        const child = spawn(input.executable, args, { env: input.env, detached, stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let bytes = 0;
+        let failure;
+        let cleanup;
+        const stop = (code, message) => {
+            failure ??= new AppError(code, message, 1, { phase: "version_probe", effect: "process_dispatched" });
+            cleanup ??= stopProcessGroup(child, 1000, { detached });
+            // Observe immediately; close may arrive after asynchronous cleanup failure.
+            void cleanup.catch(() => { });
+        };
+        const timer = setTimeout(() => stop("probe_timeout", "Version probe exceeded its deadline"), timeoutMs);
+        child.stdout.setEncoding("utf8").on("data", (chunk) => {
+            bytes += Buffer.byteLength(chunk);
+            if (bytes > 64_000)
+                stop("probe_output_limit", "Version probe exceeded its output limit");
+            else
+                stdout += chunk;
+        });
+        child.stderr.on("data", (chunk) => {
+            bytes += chunk.length;
+            if (bytes > 64_000)
+                stop("probe_output_limit", "Version probe exceeded its output limit");
+        });
+        child.on("error", () => { failure ??= new AppError("probe_launch_failed", "Version probe could not start", 1); });
+        child.on("close", (code, signal) => {
+            clearTimeout(timer);
+            void (async () => {
+                try {
+                    await cleanup;
+                    if (failure)
+                        throw failure;
+                    if (code !== 0 || signal)
+                        throw new AppError("probe_failed", "Version probe did not exit successfully", 1);
+                    // Never expose arbitrary subprocess output: it can contain secrets.
+                    const version = parseHarnessVersion(input.harness, stdout);
+                    resolve({ harness: input.harness, version, status: version ? "observed" : "unrecognized",
+                        compatible: "unknown", protocol: "unknown", auth: "unknown", qualified: "unknown" });
+                }
+                catch (error) {
+                    reject(error instanceof AppError ? error : new AppError("probe_cleanup_unconfirmed", "Version probe cleanup could not be confirmed", 1));
+                }
+            })();
+        });
+    }));
+}

package/dist/services/hook-memory-routing.js

@@ -0,0 +1,188 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-digest.js";
+import { assertRunMutationAllowed } from "./run-recovery-guard.js";
+function repairRefuse(reason) { throw new AppError("memory_repair_native_binding_invalid", "Native repair requires its actual direct-child Hook and independently owned copy", 1, { reason, effect: "no_effect" }); }
+function reviewRefuse(reason) { throw new AppError("memory_native_review_copy_invalid", "Native Memory review requires an independently owned immutable execution copy", 1, { reason, effect: "no_effect" }); }
+export function memoryReviewPhysicalDestination(runRoot, relative) {
+    if (fs.realpathSync(runRoot) !== path.resolve(runRoot) || !fs.lstatSync(runRoot).isDirectory())
+        reviewRefuse("noncanonical_run_root");
+    let current = runRoot;
+    for (const part of relative.split("/")) {
+        if (!part || part === "." || part === "..")
+            reviewRefuse("invalid_copy_path");
+        current = path.join(current, part);
+        const stat = fs.lstatSync(current, { throwIfNoEntry: false });
+        if (stat && !stat.isDirectory())
+            reviewRefuse("linked_or_non_directory_copy_path");
+        if (!stat)
+            break;
+    }
+}
+/** Hook ingress selects only an independently prepared repair copy. This
+ * establishes a command's assigned directory, not claim/repair authority. */
+export function memoryRepairAssignedHookCwd(context, input) {
+    const work = context.db.get("SELECT payload_json,result_schema,status FROM works WHERE project_id=? AND run_id=? AND work_id=?", [input.projectId, input.runId, input.workId]);
+    let payload;
+    try {
+        payload = JSON.parse(work?.payload_json ?? "null");
+    }
+    catch {
+        return null;
+    }
+    if (payload?.kind !== "memory-repair" && work?.result_schema !== "dd-flow/memory-repair-work-result@1")
+        return null;
+    const run = context.db.get("SELECT r.run_root,r.run_dir,r.flow_kind,p.root AS project_root FROM runs r JOIN projects p ON p.id=r.project_id WHERE r.project_id=? AND r.id=?", [input.projectId, input.runId]);
+    if (!run || (run.flow_kind !== "mb-init" && run.flow_kind !== "mb-upgrade") || run.project_root !== input.projectRoot || payload.read_only !== false
+        || ![1, 2].includes(payload.memory_repair?.wave ?? 0) || work?.result_schema !== "dd-flow/memory-repair-work-result@1")
+        repairRefuse("registered_memory_repair_required");
+    const generation = assertRunMutationAllowed(context, input.projectId, input.runId), runRoot = run.run_root ?? run.run_dir;
+    const external = context.db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name='work_launches'")
+        ? context.db.get("SELECT operation_id,status,profile_json,profile_hash,provider_session_id FROM work_launches WHERE work_id=?", [input.workId]) : undefined;
+    const native = !external;
+    const admitted = (root) => {
+        if (native && input.observedCwd !== root && input.literalExecutionCwd !== root)
+            throw new AppError("memory_repair_native_copy_route_unavailable", "Native repair requires a genuinely observed child execution directory inside its owned writer copy", 1, { phase: "prepare", effect: "no_effect", recoverable: false, expected: root, actual: input.observedCwd ?? null,
+                next_action: "Use only a documented native child/tool capability that establishes this exact directory; otherwise stop and select external delegation in a new RUN." });
+        return { root, native };
+    };
+    if (work.status === "created") {
+        // Routing consumes registered copy custody only. Actual Work start owns
+        // physical source/copy/profile admission after the durable native Hook.
+        const rows = (eventType) => context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? LIMIT 2", [input.projectId, eventType, input.runId, input.workId, generation]);
+        const intents = rows("memory.repair_writer_copy_intent"), copies = rows("memory.repair_writer_copy_ready");
+        if (intents.length !== 1 || copies.length !== 1 || Buffer.byteLength(intents[0].payload_json) > 1024 * 1024
+            || Buffer.byteLength(copies[0].payload_json) > 12 * 1024 * 1024)
+            repairRefuse("owned_ready_copy_required");
+        try {
+            const intent = JSON.parse(intents[0].payload_json), ready = JSON.parse(copies[0].payload_json);
+            const workspace_manifest_sha256 = ready.workspace_manifest_sha256, readyIntent = { ...ready };
+            delete readyIntent.workspace_manifest_sha256;
+            delete readyIntent.workspace_manifest_base64;
+            const relative = `works/${input.workId}/writer-workspaces/generation-${generation}`;
+            if (intent.schema_id !== "dd-flow/memory-repair-writer-copy-intent@1" || intent.project_id !== input.projectId || intent.run_id !== input.runId
+                || intent.work_id !== input.workId || intent.generation !== generation || intent.run_root !== runRoot || !path.isAbsolute(runRoot)
+                || intent.copy_relative !== relative || !/^[a-f0-9]{64}$/.test(intent.baseline_registration_sha256)
+                || !/^[a-f0-9]{64}$/.test(workspace_manifest_sha256) || hybridDigest(readyIntent) !== hybridDigest(intent))
+                repairRefuse("owned_ready_copy_required");
+            if (external) {
+                if (external.provider_session_id !== input.providerSessionId)
+                    repairRefuse("foreign_physical_session");
+                const profile = JSON.parse(external.profile_json), metadata = profile.memory_repair_copy;
+                if (profile.delegation?.mode !== "external" || hybridDigest(metadata) !== hybridDigest({ root: relative, copy_intent_sha256: hybridDigest(intent),
+                    workspace_manifest_sha256, baseline_registration_sha256: intent.baseline_registration_sha256 }))
+                    repairRefuse("native_copy_cwd_mismatch");
+            }
+            if (fs.realpathSync(runRoot) !== path.resolve(runRoot))
+                repairRefuse("owned_ready_copy_required");
+            let destination = runRoot;
+            for (const part of relative.split('/')) {
+                destination = path.join(destination, part);
+                if (!fs.lstatSync(destination).isDirectory())
+                    repairRefuse("owned_ready_copy_required");
+            }
+            return admitted(destination);
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return repairRefuse("owned_ready_copy_required");
+        }
+    }
+    // Running writers retain their committed directory, not today's source bytes.
+    let binding = external;
+    let nativeStart;
+    if (!binding) {
+        const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='memory.repair_native_binding' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? LIMIT 2", [input.projectId, input.runId, input.workId]);
+        if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 1024 * 1024)
+            repairRefuse("native_registered_start_changed");
+        try {
+            const retained = JSON.parse(rows[0].payload_json);
+            if (retained.schema_id !== "dd-flow/memory-repair-native-binding@1" || retained.project_id !== input.projectId || retained.run_id !== input.runId || retained.work_id !== input.workId
+                || typeof retained.work_session_id !== "string" || typeof retained.hook_event_key !== "string")
+                repairRefuse("native_registered_start_changed");
+            binding = retained.binding;
+            nativeStart = retained;
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return repairRefuse("native_registered_start_changed");
+        }
+    }
+    const starts = context.db.all("SELECT ws.id,ws.hook_event_id,ws.start_receipt_json FROM work_sessions ws JOIN sessions s ON s.project_id=? AND s.session_id=ws.session_id WHERE ws.work_id=? AND ws.status='running' AND s.run_id=? AND s.worker_id=? AND s.provider_session_id=? LIMIT 2", [input.projectId, input.workId, input.runId, input.workId, input.providerSessionId]);
+    if (work.status !== "running" || !binding || binding.provider_session_id !== input.providerSessionId || starts.length !== 1)
+        repairRefuse("native_registered_start_changed");
+    if (nativeStart && (nativeStart.work_session_id !== starts[0].id || nativeStart.hook_event_key !== starts[0].hook_event_id
+        || binding.operation_id !== `native-hook:${nativeStart.hook_event_key}`
+        || !context.db.get("SELECT 1 FROM hook_events WHERE project_id=? AND event_key=? AND status='claimed' AND provider_session_id=?", [input.projectId, nativeStart.hook_event_key, input.providerSessionId])))
+        repairRefuse("native_registered_start_changed");
+    try {
+        const text = starts[0].start_receipt_json;
+        if (typeof text !== "string" || Buffer.byteLength(text) > 16 * 1024 * 1024)
+            repairRefuse("native_registered_start_changed");
+        const start = JSON.parse(text), packet = JSON.parse(start.context), profile = JSON.parse(binding.profile_json), metadata = profile.memory_repair_copy;
+        if (profile.delegation?.mode !== (native ? "native" : "external") || start.version !== 2 || createHash("sha256").update(start.context).digest("hex") !== start.context_sha256
+            || typeof metadata?.root !== "string" || metadata.root !== `works/${input.workId}/writer-workspaces/generation-${start.generation}`
+            || packet.work_id !== input.workId || packet.run_id !== input.runId || packet.workspace_root !== path.join(runRoot, metadata.root)
+            || packet.memory_repair_input?.provider_session_id !== input.providerSessionId
+            || packet.memory_repair_input?.launch_operation_id !== binding.operation_id)
+            repairRefuse("native_registered_start_changed");
+        return admitted(packet.workspace_root);
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return repairRefuse("native_registered_start_changed");
+    }
+}
+/** Routing is not fresh source admission: an already claimed reviewer retains
+ * its committed private directory even after a later correction changes MB. */
+export function memoryNativeReviewAssignedHookCwd(context, input) {
+    const work = context.db.get("SELECT status,payload_json FROM works WHERE project_id=? AND run_id=? AND work_id=?", [input.projectId, input.runId, input.workId]);
+    const payload = JSON.parse(work?.payload_json ?? "null");
+    if (!["memory-review", "interactive-review"].includes(payload?.kind) || payload?.read_only !== true)
+        return null;
+    const ready = context.db.get("SELECT 1 FROM audit_events WHERE project_id=? AND event_type='memory.native_review_copy_ready' AND json_extract(payload_json,'$.intent.run_id')=? AND json_extract(payload_json,'$.intent.work_id')=?", [input.projectId, input.runId, input.workId]);
+    if (!ready)
+        return null;
+    if (work?.status === "created") {
+        // Hook ingress routes an already allocated copy. Source admission belongs
+        // to the actual work-start owner, not a second physical graph in the Hook.
+        const generation = assertRunMutationAllowed(context, input.projectId, input.runId);
+        const run = context.db.get("SELECT run_root,run_dir FROM runs WHERE project_id=? AND id=?", [input.projectId, input.runId]);
+        if (!run)
+            reviewRefuse("owned_run_required");
+        const rows = (event) => context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND COALESCE(json_extract(payload_json,'$.run_id'),json_extract(payload_json,'$.intent.run_id'))=? AND COALESCE(json_extract(payload_json,'$.work_id'),json_extract(payload_json,'$.intent.work_id'))=? AND COALESCE(json_extract(payload_json,'$.generation'),json_extract(payload_json,'$.intent.generation'))=? LIMIT 2", [input.projectId, event, input.runId, input.workId, generation]);
+        const intents = rows("memory.native_review_copy_intent"), copies = rows("memory.native_review_copy_ready");
+        if (intents.length !== 1 || copies.length !== 1)
+            reviewRefuse("registered_copy_required");
+        const intent = JSON.parse(intents[0].payload_json), copy = JSON.parse(copies[0].payload_json);
+        const relative = `works/${input.workId}/native-review-workspaces/generation-${generation}`, runRoot = run.run_root ?? run.run_dir;
+        if (intent.schema_id !== "dd-flow/memory-native-review-copy@1" || intent.project_id !== input.projectId || intent.run_id !== input.runId
+            || intent.work_id !== input.workId || intent.generation !== generation || intent.root !== relative
+            || !/^[a-f0-9]{64}$/.test(intent.input_sha256) || !/^[a-f0-9]{64}$/.test(intent.source_sha256)
+            || hybridDigest(copy.intent) !== hybridDigest(intent) || !/^[a-f0-9]{64}$/.test(copy.sha256))
+            reviewRefuse("registered_copy_changed");
+        memoryReviewPhysicalDestination(runRoot, relative);
+        const root = path.join(runRoot, relative);
+        if (!fs.lstatSync(root, { throwIfNoEntry: false })?.isDirectory())
+            reviewRefuse("registered_copy_required");
+        return root;
+    }
+    const rows = context.db.all("SELECT ws.start_receipt_json,r.run_root,r.run_dir,s.cwd FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN runs r ON r.project_id=w.project_id AND r.id=w.run_id JOIN sessions s ON s.project_id=w.project_id AND s.session_id=ws.session_id WHERE w.project_id=? AND w.run_id=? AND w.work_id=? AND s.provider_session_id=? AND s.worker_id=w.work_id AND EXISTS(SELECT 1 FROM audit_events a WHERE a.project_id=w.project_id AND a.event_type='memory.native_review_binding' AND json_extract(a.payload_json,'$.work_session_id')=ws.id AND json_extract(a.payload_json,'$.run_id')=w.run_id AND json_extract(a.payload_json,'$.work_id')=w.work_id) LIMIT 2", [input.projectId, input.runId, input.workId, input.providerSessionId]);
+    if (rows.length !== 1)
+        reviewRefuse("registered_session_required");
+    const row = rows[0];
+    if (typeof row.start_receipt_json !== "string" || Buffer.byteLength(row.start_receipt_json) > 16 * 1024 * 1024)
+        reviewRefuse("registered_copy_required");
+    const receipt = JSON.parse(row.start_receipt_json), packet = JSON.parse(receipt.context);
+    const relative = `works/${input.workId}/native-review-workspaces/generation-${receipt.generation}`, root = path.join(row.run_root ?? row.run_dir, relative);
+    if (receipt.version !== 2 || createHash("sha256").update(receipt.context).digest("hex") !== receipt.context_sha256
+        || packet.work_id !== input.workId || packet.run_id !== input.runId || packet.workspace_root !== root
+        || packet.review_copy?.root !== relative || row.cwd !== root)
+        reviewRefuse("registered_copy_changed");
+    return root;
+}

package/dist/services/hook-recovery-guard.js

@@ -0,0 +1,14 @@
+import { AppError } from "../shared/errors.js";
+import { assertRunMutationAllowed } from "./run-recovery-guard.js";
+/** A recovered RUN never grants the retired process a new execution segment. */
+export function assertRecoveryHookCurrent(context, projectId, runId, identity) {
+    const generation = assertRunMutationAllowed(context, projectId, runId);
+    if (!generation)
+        return;
+    const current = identity.daemonId && context.db.get("SELECT b.recovery_id FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND g.run_id = ? AND g.generation = ? AND g.status = 'recovered' AND b.status = 'accepted' AND b.daemon_id = ? LIMIT 1", [projectId, runId, generation, identity.daemonId]);
+    if (current)
+        return;
+    const retired = identity.daemonId && (context.db.get(`SELECT ws.id FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id JOIN hook_events he ON he.project_id = w.project_id AND he.event_key = ws.hook_event_id WHERE w.project_id = ? AND w.run_id = ? AND he.daemon_id = ? LIMIT 1`, [projectId, runId, identity.daemonId]) || context.db.get("SELECT b.recovery_id FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND g.run_id = ? AND b.daemon_id = ? AND (g.generation <> ? OR b.status = 'abandoned') LIMIT 1", [projectId, runId, identity.daemonId, generation]));
+    if (!identity.daemonId || retired)
+        throw new AppError("recovery_daemon_stale", "Lifecycle receipt belongs to an unidentified or retired recovery daemon", 1, { run_id: runId, generation, daemon_id: identity.daemonId });
+}

package/dist/services/hook-session-observation.js

@@ -0,0 +1,24 @@
+export function recordFlowSessionObservation(context, input) {
+    const duplicate = context.db.get("SELECT id FROM flow_session_segments WHERE project_id = ? AND event_key = ?", [input.projectId, input.eventKey]);
+    if (duplicate)
+        return { changed: false, segment_id: duplicate.id };
+    const open = context.db.get(`SELECT id, run_id, protocol_id FROM flow_session_segments
+     WHERE project_id = ? AND session_id = ? AND ended_at IS NULL ORDER BY started_at DESC, id DESC LIMIT 1`, [input.projectId, input.sessionId]);
+    const now = context.now();
+    const runId = input.runId === undefined ? open?.run_id ?? null : input.runId;
+    const protocolId = input.protocolId === undefined ? open?.protocol_id ?? null : input.protocolId;
+    if (open && open.run_id === runId && open.protocol_id === protocolId) {
+        return { changed: false, segment_id: open.id };
+    }
+    if (open)
+        context.db.run("UPDATE flow_session_segments SET ended_at = ? WHERE id = ? AND ended_at IS NULL", [now, open.id]);
+    const result = context.db.run(`INSERT INTO flow_session_segments
+      (project_id, session_id, run_id, protocol_id, started_at, ended_at, cwd, tool_name, event_key)
+     VALUES (?, ?, ?, ?, ?, NULL, ?, ?, ?)`, [input.projectId, input.sessionId, runId, protocolId, now, input.cwd ?? null, input.toolName ?? null, input.eventKey]);
+    return { changed: true, segment_id: Number(result.lastInsertRowid) };
+}
+export function activeFlowSessionsForProject(context, projectId) {
+    return context.db.all(`SELECT * FROM sessions
+     WHERE project_id = ? AND status IN ('pending', 'active', 'waiting_user', 'blocked', 'stopping')
+     ORDER BY updated_at DESC`, [projectId]);
+}