@deksden-com/dd-flow-cli 0.9.0-beta.37 → 0.9.0-beta.39

package/dist/harness-runtime/lib/daemon-operations.mjs

@@ -4,11 +4,12 @@ import { randomUUID } from "node:crypto";
 import path from "node:path";
 import { hashJson, writeJsonAtomic } from "./runner-events.mjs";
 import { errorRecord, isObservationLoss, reportedError } from "./operation-errors.mjs";
-import { assertDaemonOwnership } from "./managed-daemon.mjs";
+import { assertDaemonOwnership, budgetObservationScope, releaseBudgetObservation, completeBudgetOperation } from "./managed-daemon.mjs";
 import { readModelObservations, modelAttribution } from "./model-observations.mjs";
 
-const productive = new Set(["session.create", "session.prompt", "session.start", "session.fork"]);
+const productive = new Set(["session.create", "session.prompt", "session.start", "session.fork", "session.resume"]);
 const controls = new Map();
+const dispatchGenerations = new Map();
 
 async function controlDispatch(root, request, action) {
   const key = request.operation === "daemon.stop" ? `stop:${request.params?.cancelTree === true}` : `cancel:${request.params?.sessionId ?? ""}`;
@@ -30,6 +31,7 @@ function location(root, id) {
 async function read(file) { try { return JSON.parse(await readFile(file, "utf8")); } catch (error) { if (error.code === "ENOENT") return null; throw error; } }
 
 export async function inspectDaemonOperation(root, id) {
+  if (typeof root !== "string" || !path.isAbsolute(root)) throw Object.assign(new Error("operation observation requires an absolute state directory"), { code: "invalid_path" });
   const directory = location(root, id);
   const requested = await read(path.join(directory, "requested.json"));
   if (!requested) throw Object.assign(new Error("daemon operation is not recorded"), { code: "operation_not_found", details: { operation_id: id } });
@@ -38,7 +40,7 @@ export async function inspectDaemonOperation(root, id) {
 
 /** At-most-once dispatch and a durable terminal reply, including when the socket
  * observer disconnects. Recovery reads this receipt; it never resends a prompt. */
-export async function durableDaemonDispatch(root, request, action) {
+export async function durableDaemonDispatch(root, request, action, observe) {
   if (request.operation === "operation.inspect") return await inspectDaemonOperation(root, request.params?.operationId);
   if (request.operation === "daemon.status") {
     const result = await action();
@@ -46,15 +48,50 @@ export async function durableDaemonDispatch(root, request, action) {
     try { return { ...result, model_attribution: modelAttribution(await readModelObservations(result.config.journal)) }; }
     catch (error) { return { ...result, model_observation_error: errorRecord(error) }; }
   }
-  if (["daemon.stop", "session.cancel"].includes(request.operation)) return await controlDispatch(root, request, action);
-  if (!productive.has(request.operation)) return await action();
-  assertDaemonOwnership();
+  if (request.operation === "session.inspect") {
+    const scope = await budgetObservationScope(root, request.params?.sessionId);
+    const result = await action();
+    await releaseBudgetObservation(scope, result);
+    return result;
+  }
+  const control = ["daemon.stop", "session.cancel"].includes(request.operation);
+  if (!productive.has(request.operation) && !control) return await action();
+  const generation = dispatchGenerations.get(root) ?? 0;
+  if (control) dispatchGenerations.set(root, generation + 1);
+  const assertCurrent = () => { if (generation !== (dispatchGenerations.get(root) ?? 0)) throw Object.assign(new Error("control cancelled a queued productive dispatch"), { code: "operation_cancelled" }); };
+  const result = await journalDispatch(root, request, async () => {
+    // Persist before admission so a racing fence can observe the writer.
+    if (!control) await assertDaemonOwnership(root, { "operation-id": request.id, operation: request.operation, "native-session-id": request.params?.sessionId, "prompt-sha256": typeof request.params?.prompt === "string" ? createHash("sha256").update(request.params.prompt).digest("hex") : undefined }, assertCurrent);
+    if (!control) assertCurrent();
+    return control ? await controlDispatch(root, request, action) : await action();
+  });
+  if (!control) await completeBudgetOperation(root, request, result, observe);
+  return result;
+}
+
+/** Startup has no registered daemon yet. Its existing native implementation
+ * owns registration/admission; only the CLI entrypoint uses this journal path. */
+export async function durableDaemonStart(options, action) {
+  const root = options.stateDir;
+  if (typeof root !== "string" || !path.isAbsolute(root)) throw Object.assign(new Error("daemon startup requires an absolute state directory"), { code: "invalid_path" });
+  // Keep only configuration locations, never inherited credentials. The owned
+  // scope can reuse this exact adapter launch after retiring the old daemon.
+  const launch = { schema_id: "dd-flow/native-launch@1", executable: options.entryPath ?? null, args: process.argv.slice(2), cwd: process.cwd(), runtime_owner: process.env.DD_FLOW_RUNTIME_OWNER ?? null,
+    env: Object.fromEntries(["CODEX_HOME", "DD_FLOW_CONFIG_HOME", "DD_FLOW_HOME", "DD_FLOW_BIN", "DD_FLOW_RESOURCE_HOME"].map(key => [key, process.env[key] ?? null])) };
+  const request = { id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation: "daemon.start", params: { ...options, runtimeOwner: process.env.DD_FLOW_RUNTIME_OWNER ?? null, resourceHome: process.env.DD_FLOW_RESOURCE_HOME ?? null, launch } };
+  return await journalDispatch(root, request, () => action(options));
+}
+
+async function journalDispatch(root, request, action) {
   const directory = location(root, request.id), fingerprint = hashJson({ operation: request.operation, params: request.params ?? {} });
   await mkdir(directory, { recursive: true, mode: 0o700 });
   // Publish a complete request atomically and exclusively. Writing directly with
   // wx exposes a partially written JSON document to a concurrent observer.
   const temporary = path.join(directory, `requested-${randomUUID()}.json`);
-  await writeJsonAtomic(temporary, { schema_id: "dd-flow/daemon-operation@1", operation_id: request.id, operation: request.operation, session_id: request.params?.sessionId ?? null, params_sha256: fingerprint, requested_at: new Date().toISOString() });
+  const daemon = await read(path.join(root, "daemon.json"));
+  const startup = request.operation === "daemon.start";
+  const daemonId = daemon?.daemon_id ?? daemon?.config?.daemonId ?? null;
+  await writeJsonAtomic(temporary, { schema_id: "dd-flow/daemon-operation@1", operation_id: request.id, operation: request.operation, session_id: request.params?.sessionId ?? null, daemon_id: startup ? null : daemonId, ...(startup ? { predecessor_daemon_id: daemonId, launch: request.params?.launch } : {}), params_sha256: fingerprint, requested_at: new Date().toISOString() });
   try {
     await link(temporary, path.join(directory, "requested.json"));
   } catch (error) {
@@ -66,13 +103,15 @@ export async function durableDaemonDispatch(root, request, action) {
     throw Object.assign(new Error("provider operation has no confirmed terminal result; inspect the existing operation instead of resending it"), { code: "operation_observation_lost", details: { operation_id: request.id, receipt_directory: directory } });
   } finally { await unlink(temporary); }
   let result;
-  try { result = await action(); }
+  try {
+    result = await action();
+  }
   catch (error) {
     const unknown = isObservationLoss(error);
     await writeJsonAtomic(path.join(directory, unknown ? "observation-lost.json" : "result.json"), { state: unknown ? "awaiting_provider" : "failed", observed_at: new Date().toISOString(), error: errorRecord(error) });
     throw error;
   }
-  try { await writeJsonAtomic(path.join(directory, "result.json"), { state: "completed", finished_at: new Date().toISOString(), result }); }
+  try { await writeJsonAtomic(path.join(directory, "result.json"), { state: "completed", ...(startup ? { started_daemon_id: result?.daemon_id ?? null } : {}), finished_at: new Date().toISOString(), result }); }
   catch (cause) { throw Object.assign(new Error("provider returned but the durable reply could not be saved; do not resend the operation"), { code: "operation_observation_lost", cause, details: { operation_id: request.id, receipt_directory: directory } }); }
   return result;
 }

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -8,7 +8,7 @@ import { durableDaemonDispatch } from "./daemon-operations.mjs";
 import path from "node:path";
 import { observeModel } from "./model-observations.mjs";
 import { AgyError, assertProfile, executable, observedProfile, runAgy, usageSnapshot } from "./dd-agy.mjs";
-import { cleanupFailedStart, runtimeProcess, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
+import { prepareRuntimeOwner, cleanupFailedStart, runtimeProcess, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 
 const REQUEST_SCHEMA = "dd-agy/daemon-request@1", RESPONSE_SCHEMA = "dd-agy/daemon-response@1", STATE_SCHEMA = "dd-agy/daemon-state@1";
 class DaemonError extends AgyError {}
@@ -47,13 +47,15 @@ export async function prepare(paths, config) {
   }
   const command = `${shell(process.execPath)} ${shell(config.entryPath)} hook handle --event __EVENT__ --state-dir ${shell(paths.dir)} --project-root ${shell(config.projectRoot)} --dd-flow-bin ${shell(config.ddFlowBin)} --dd-flow-home ${shell(config.ddFlowHome)} --json`;
   const hooks = { "dd-flow": {
-    PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: command.replace("__EVENT__", "PreToolUse"), timeout: 30 }] }],
-    PostToolUse: [{ matcher: "*", hooks: [{ type: "command", command: command.replace("__EVENT__", "PostToolUse"), timeout: 30 }] }],
+    // Only shell lifecycle commands require trusted pre-execution identity.
+    // PostToolUse only recorded observations; native updates and Stop settle work.
+    PreToolUse: [{ matcher: "^run_command$", hooks: [{ type: "command", command: command.replace("__EVENT__", "PreToolUse"), timeout: 30 }] }],
     Stop: [{ type: "command", command: command.replace("__EVENT__", "Stop"), timeout: 30 }]
   } };
-  // Antigravity's process-level configuration is not inherited by native
-  // subagents. Put the same handlers in the isolated workspace discovery
-  // root before the first Session is created, preserving unrelated hooks.
+  // Register in workspace discovery before creating any Session: native root
+  // and children load these named hook definitions without a global duplicate.
+  // Replace our prior handlers, including the obsolete wildcard post hook,
+  // without dropping unrelated commands in a shared matcher group.
   const workspaceConfig = path.join(config.projectRoot, ".agents");
   await mkdir(workspaceConfig, { recursive: true, mode: 0o700 });
   const workspaceHooks = path.join(workspaceConfig, "hooks.json");
@@ -65,14 +67,48 @@ export async function prepare(paths, config) {
   } catch (error) {
     if (error.code !== "ENOENT") throw new DaemonError("workspace_hooks_invalid", `cannot install Antigravity lifecycle hooks: ${error.message}`);
   }
-  const workspace = { ...existing };
-  const isManagedHandler = handler => typeof handler?.command === "string" && handler.command.includes(config.entryPath) && handler.command.includes("hook handle");
+  const isManagedHandler = handler => typeof handler?.command === "string"
+    && handler.command.includes(config.entryPath) && handler.command.includes("hook handle");
+  const events = ["PreToolUse", "PostToolUse", "PreInvocation", "PostInvocation", "Stop"];
+  const retain = handlers => handlers.flatMap(item => {
+    if (!Array.isArray(item?.hooks)) return isManagedHandler(item) ? [] : [item];
+    const remaining = item.hooks.filter(handler => !isManagedHandler(handler));
+    return remaining.length ? [{ ...item, hooks: remaining }] : [];
+  });
+  const workspace = Object.create(null), legacy = Object.create(null);
+  for (const [name, definition] of Object.entries(existing)) {
+    // Migrate the old adapter's event-keyed workspace format.
+    if (events.includes(name) && Array.isArray(definition)) {
+      const remaining = retain(definition);
+      if (remaining.length) legacy[name] = remaining;
+      continue;
+    }
+    if (!definition || Array.isArray(definition) || typeof definition !== "object") {
+      throw new DaemonError("workspace_hooks_invalid", `invalid named hook definition: ${name}`);
+    }
+    const cleaned = { ...definition };
+    for (const event of events) if (Array.isArray(cleaned[event])) {
+      const remaining = retain(cleaned[event]);
+      if (remaining.length || cleaned[event].length === 0) cleaned[event] = remaining;
+      else delete cleaned[event];
+    }
+    workspace[name] = cleaned;
+  }
+  if (Object.keys(legacy).length) {
+    let name = "dd-flow-legacy";
+    while (Object.hasOwn(workspace, name)) name += "-retained";
+    workspace[name] = legacy;
+  }
+  const managed = workspace["dd-flow"] ?? {};
+  if (managed.enabled === false) throw new DaemonError("workspace_hooks_invalid", "dd-flow lifecycle hooks are disabled");
   for (const [event, handlers] of Object.entries(hooks["dd-flow"])) {
-    const retained = Array.isArray(existing[event]) ? existing[event].filter(item => Array.isArray(item?.hooks) ? !item.hooks.some(isManagedHandler) : !isManagedHandler(item)) : [];
-    workspace[event] = [...retained, ...handlers];
+    managed[event] = [...(managed[event] ?? []), ...handlers];
   }
+  workspace["dd-flow"] = managed;
   await writeJson(workspaceHooks, workspace);
-  await writeJson(path.join(paths.config, "hooks.json"), hooks);
+  // Workspace discovery covers root and children. Installing the same handler
+  // globally as well invokes it twice, even under the same hook name.
+  await writeJson(path.join(paths.config, "hooks.json"), {});
   config.hooksSha256 = createHash("sha256").update(JSON.stringify(hooks)).digest("hex");
   config.workspaceHooksPath = workspaceHooks;
 }
@@ -128,6 +164,7 @@ export function retainedAgyState(previous, sessionId) {
 export async function startDaemon(options) {
   const paths = locations(options.stateDir); await mkdir(paths.dir, { recursive: true, mode: 0o700 }); await chmod(paths.dir, 0o700);
   const previous = await readState(paths.dir), noFlow = options.noFlow === true, cwd = await realpath(absolute(options.cwd, "--cwd")), config = { cwd, journal: options.journal ? absolute(options.journal, "--journal") : paths.journal, bin: options.bin ?? process.env.DD_AGY_BIN ?? "agy", provider: String(options.provider ?? "google"), model: String(options.model ?? "gemini-3.1-pro-high"), reasoning: String(options.reasoning ?? "high"), mode: String(options.mode ?? "accept-edits"), projectRoot: noFlow ? cwd : await realpath(absolute(options.projectRoot, "--project-root")), ddFlowBin: noFlow ? null : absolute(options.ddFlowBin, "--dd-flow-bin"), ddFlowHome: noFlow ? null : absolute(options.ddFlowHome, "--dd-flow-home"), resourceHome: noFlow ? null : (process.env.DD_FLOW_RESOURCE_HOME ? absolute(process.env.DD_FLOW_RESOURCE_HOME, "DD_FLOW_RESOURCE_HOME") : null), env: noFlow ? {} : { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home") }, entryPath: absolute(options.entryPath, "dd-agy entry"), daemonId: randomUUID(), resumeSessionId: options.sessionId ?? null, geminiDir: paths.gemini, appDataDir: "runtime", temporary: paths.temporary, noFlow };
+  await prepareRuntimeOwner(config, paths.dir);
   try { const status = await callDaemon(paths.dir, "daemon.status", {}, 1000); if (!sameConfig(status, config)) throw new DaemonError("daemon_config_mismatch", "a daemon is already running with different configuration"); return { ...status, already_running: true }; } catch (error) { if (!["daemon_not_running","daemon_timeout"].includes(error.code)) throw error; }
   if (previous?.shutdown_state === "clean") await authorizeRetainedDaemonResume(paths.dir, previous, options.sessionId, config);
   if (previous?.shutdown_state === "running" && previous.active_tree) throw new DaemonError("invalid_harness_crash", "previous Antigravity daemon died with an active or unproven tree");
@@ -212,12 +249,16 @@ export class Runtime {
           if (this.active) { this.active.reject(error); this.active = null; }
           const patch = beforeInit ? { shutdown_state: "failed", startup_error: errorPayload(error), provider_exit: { code, signal }, active_tree: false } : { provider_exit: { code, signal }, active_tree: interrupted };
           await providerRegistered;
-          try {
-            await stopProcessGroup(providerChild);
-            await this.persist(patch);
-            await finishDaemonProcess(this.config, providerProcess, beforeInit || interrupted ? "failed" : "stopped", beforeInit || interrupted ? "provider_interrupted" : "provider_stopped");
-          } catch (cleanup) { await this.persist({ shutdown_state: "cleanup_failed", active_tree: true, cleanup_error: errorPayload(cleanup) }); throw cleanup; }
-          finally { if (beforeInit) this.server?.close(); }
+          this.retryProviderFinalization = async (graceMs = 1_000) => {
+            try {
+              await stopProcessGroup(providerChild, graceMs);
+              await this.persist(patch);
+              await finishDaemonProcess(this.config, providerProcess, beforeInit || interrupted ? "failed" : "stopped", beforeInit || interrupted ? "provider_interrupted" : "provider_stopped");
+              this.retryProviderFinalization = null;
+            } catch (cleanup) { await this.persist({ shutdown_state: "cleanup_failed", active_tree: true, cleanup_error: errorPayload(cleanup) }); throw cleanup; }
+            finally { if (beforeInit) this.server?.close(); }
+          };
+          await this.retryProviderFinalization();
         }).then(resolve, reject);
       });
     });
@@ -328,13 +369,25 @@ export class Runtime {
     await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: conversationId, parentSessionId: parent, requested: this.config, observed, source: "native.hook", evidence: payload.model ? "configured" : "unavailable", reason: payload.model ? null : "hook_omits_current_model" });
     const eventId = createHash("sha256").update(JSON.stringify({ daemon: this.config.daemonId, event, conversationId, turn_generation: this.turnGeneration, fully_idle: payload.fullyIdle ?? null, termination_reason: payload.terminationReason ?? null, execution: payload.executionNum ?? null, step: payload.stepIdx ?? null, tool: payload.toolCall?.name ?? null, args: payload.toolCall?.args ?? null })).digest("hex"); await this.persist(completed ? { active_tree: false } : {}); await this.journal("hook", { stale, hook_event: event, event_id: eventId, conversation_id: conversationId, turn_generation: this.turnGeneration, execution_num: execution, step_index: step, termination_reason: payload.terminationReason ?? null, fully_idle: payload.fullyIdle ?? null }); completed?.resolve(settled); return { event_id: eventId, daemon_id: this.config.daemonId, parent_conversation_id: parent, profile: observed, requested_profile: { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode }, project_root: this.config.projectRoot, dd_flow_bin: this.config.ddFlowBin, dd_flow_home: this.config.ddFlowHome };
   }
-  async cancel() { cancelPendingDispatch(this); if (!this.child) return { ...this.receipt(), settled: Boolean(this.exited) }; if (!this.exited) { try { process.kill(-this.child.pid, "SIGINT"); } catch (error) { if (error.code !== "ESRCH") throw error; } const deadline = Date.now() + 5000; while (!this.exited && Date.now() < deadline) await new Promise(resolve => setTimeout(resolve, 100)); if (!this.exited) await stopProcessGroup(this.child, 5_000); } await this.providerFinalization; await this.persist({ active_tree: false }); return { ...this.receipt(), cancelled: true, settled: Boolean(this.exited) };
+  async finalizeProviderForControl() {
+    const pending = this.providerFinalization;
+    try { await pending; }
+    catch (error) {
+      // A leaderless group may have exited naturally since the last check.
+      // Only control may recheck it; startup never retries failed cleanup.
+      if (this.providerFinalization !== pending) return await this.providerFinalization;
+      if (error.code !== "process_group_ownership_unknown" || !this.retryProviderFinalization) throw error;
+      this.providerFinalization = this.retryProviderFinalization(5_000);
+      await this.providerFinalization;
+    }
+  }
+  async cancel() { cancelPendingDispatch(this); if (!this.child) return { ...this.receipt(), settled: Boolean(this.exited) }; if (!this.exited) { try { process.kill(-this.child.pid, "SIGINT"); } catch (error) { if (error.code !== "ESRCH") throw error; } const deadline = Date.now() + 5000; while (!this.exited && Date.now() < deadline) await new Promise(resolve => setTimeout(resolve, 100)); if (!this.exited) await stopProcessGroup(this.child, 5_000); } await this.finalizeProviderForControl(); await this.persist({ active_tree: false }); return { ...this.receipt(), cancelled: true, settled: Boolean(this.exited) };
   }
   async close(cancelTree) { if (cancelTree) cancelPendingDispatch(this); if (!cancelTree && (this.active || this.state.active_tree || this.state.unclaimed_activity || (this.lastResult && !this.receipt().settled))) throw new DaemonError("tree_not_settled", "Antigravity root or child tree is still running"); if (cancelTree) await this.cancel(); else if (this.child && !this.exited) this.child.stdin.end(); const deadline = Date.now() + 5000; while (!this.exited && Date.now() < deadline) await new Promise(resolve => setTimeout(resolve, 100)); if (!this.exited) await this.cancel(); await this.providerFinalization; }
   async abortProvider(reason) {
     const child = this.child, providerProcess = this.providerProcess;
     await stopProcessGroup(child);
-    await this.providerFinalization;
+    await this.finalizeProviderForControl();
     await finishDaemonProcess(this.config, providerProcess, "failed", reason);
   }
   async finishResource(state = "stopped", reason = "daemon_stopped") { await finishDaemonProcess(this.config, this.state.resource_process, state, reason); }
@@ -342,7 +395,7 @@ export class Runtime {
 
 export async function serveDaemon(stateDir) {
   const paths = locations(stateDir), state = await readState(paths.dir); if (!state?.config) throw new DaemonError("daemon_state_missing", "Antigravity daemon state is missing");
-  const runtime = new Runtime(paths, state); await removeSocket(paths); const server = net.createServer(socket => { let buffer = ""; socket.setEncoding("utf8"); socket.on("data", chunk => { buffer += chunk; const index = buffer.indexOf("\n"); if (index < 0) return; let request; try { request = JSON.parse(buffer.slice(0, index)); } catch (error) { socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, ok: false, error: errorPayload(error) })}\n`); return; } void durableDaemonDispatch(paths.dir, request, () => dispatch(runtime, request)).then(result => socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: true, result })}\n`), error => socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: false, error: errorPayload(error) })}\n`)); }); }); runtime.server = server;
+  const runtime = new Runtime(paths, state); await removeSocket(paths); const server = net.createServer(socket => { let buffer = ""; socket.setEncoding("utf8"); socket.on("data", chunk => { buffer += chunk; const index = buffer.indexOf("\n"); if (index < 0) return; let request; try { request = JSON.parse(buffer.slice(0, index)); } catch (error) { socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, ok: false, error: errorPayload(error) })}\n`); return; } void durableDaemonDispatch(paths.dir, request, () => dispatch(runtime, request), () => dispatch(runtime, { operation: "session.inspect", params: request.params ?? {} })).then(result => socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: true, result })}\n`), error => socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: false, error: errorPayload(error) })}\n`)); }); }); runtime.server = server;
   await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600);
   try { await runtime.start(state.config.resumeSessionId); runtime.requireSessionIdentity(state.config.resumeSessionId); }
   catch (error) {

package/dist/harness-runtime/lib/dd-codex-daemon.mjs

@@ -9,7 +9,7 @@ import { spawn } from "node:child_process";
 import { waitForSettlement } from "./session-settlement.mjs";
 import { errorRecord } from "./operation-errors.mjs";
 import { CodexBridge, cancelSessionWithBridge, createSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge, startSessionWithBridge } from "./dd-codex.mjs";
-import { cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
+import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 
 const requestSchema = "dd-codex/daemon-request@1";
 const responseSchema = "dd-codex/daemon-response@1";
@@ -29,6 +29,45 @@ export function settledCodexSession(status, latestTurn, active) {
   return status === "systemError" && !active && terminalTurn(latestTurn);
 }
 
+async function observeCodexSessions(bridge, options, sessions, active, remember = () => {}) {
+  // Expand trusted native topology before profile/history diagnostics: an
+  // unavailable root must not hide its already discovered siblings/children.
+  for (const id of sessions) for (const child of bridge.directChildren?.(id) ?? []) {
+    if (typeof child.provider_session_id !== "string" || !child.provider_session_id.trim()) throw Object.assign(new Error("Codex child has no native identity"), { code: "invalid_session_topology" });
+    sessions.add(child.provider_session_id); remember(child.provider_session_id);
+  }
+  const unsettled = [], observations = [];
+  for (const sessionId of sessions) {
+    const observed = await inspectSessionWithBridge(bridge, { ...options, sessionId });
+    for (const child of observed.descendants ?? []) { sessions.add(child.provider_session_id); remember(child.provider_session_id); }
+    const status = observed.status?.type ?? observed.status;
+    const stored = ["notLoaded", "systemError"].includes(status) ? await bridge.request("thread/turns/list", { threadId: sessionId, limit: 1, sortDirection: "desc", itemsView: "summary" }, 5_000) : null;
+    const settled = settledCodexSession(status, stored?.data?.[0] ?? null, active());
+    if (!settled) unsettled.push(sessionId);
+    observations.push({ ...observed, settled });
+  }
+  return { sessions: unsettled.reverse(), active: Boolean(active()), observations };
+}
+
+export async function inspectCodexTree(bridge, options, { remember = () => {}, active = () => null } = {}) {
+  const sessions = new Set([options.sessionId]);
+  const observed = await observeCodexSessions(bridge, options, sessions, active, remember);
+  return { ...observed.observations[0], settled: !observed.active && !observed.sessions.length, unsettled_sessions: observed.sessions, tree_session_ids: [...sessions], tree_observations: observed.observations.map(item => ({ provider_session_id: item.provider_session_id, status: item.status, settled: item.settled })) };
+}
+
+export async function cancelCodexTree(bridge, options, { remember = () => {}, active = () => null, timeoutMs = 5_000 } = {}) {
+  const sessions = new Set([options.sessionId]);
+  const settlement = await waitForSettlement({
+    timeoutMs, knownSessions: () => [...sessions],
+    cancel: async sessionId => {
+      try { await cancelSessionWithBridge(bridge, { ...options, sessionId, turnId: null }); }
+      catch (error) { if (error.code !== "turn_not_active") throw error; }
+    },
+    observe: () => observeCodexSessions(bridge, options, sessions, active, remember)
+  });
+  return { harness: "codex-desktop", provider_session_id: options.sessionId, adapter_session_id: options.sessionId, cancelled: true, settled: true, tree_session_ids: [...sessions], cleanup_errors: settlement.cleanup_errors, tree_observations: settlement.observations.map(item => ({ provider_session_id: item.provider_session_id, status: item.status, settled: item.settled })) };
+}
+
 export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000) {
   const target = locations(stateDir); const request = { schema_id: requestSchema, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params };
   return await new Promise((resolve, reject) => {
@@ -43,6 +82,7 @@ export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 3
 
 export async function startDaemon(options) {
   const paths = locations(options.stateDir); const cwd = absolute(options.cwd, "--cwd"); const config = { cwd, journal: absolute(options.journal, "--journal"), bin: options.bin ?? null, ddFlowBin: options.ddFlowBin ? absolute(options.ddFlowBin, "--dd-flow-bin") : null, ddFlowHome: options.ddFlowHome ? absolute(options.ddFlowHome, "--dd-flow-home") : null, projectRoot: options.projectRoot ? absolute(options.projectRoot, "--project-root") : cwd, resourceHome: process.env.DD_FLOW_RESOURCE_HOME ? absolute(process.env.DD_FLOW_RESOURCE_HOME, "DD_FLOW_RESOURCE_HOME") : null, env: options.ddFlowHome ? { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home") } : {} };
+  await prepareRuntimeOwner(config, paths.dir);
   await mkdir(paths.dir, { recursive: true, mode: 0o700 }); await chmod(paths.dir, 0o700);
   try { const status = await callDaemon(paths.dir, "daemon.status", {}, 1_000); if (JSON.stringify(status.config) !== JSON.stringify(config)) throw Object.assign(new Error("running daemon has a different configuration"), { code: "daemon_config_mismatch" }); return { ...status, already_running: true }; } catch (error) { if (!["daemon_not_running", "daemon_timeout"].includes(error.code)) throw error; }
   const previous = await readState(paths.state); if (previous?.shutdown_state === "running") throw Object.assign(new Error("previous dd-codex daemon died; do not reuse its state directory"), { code: "invalid_harness_crash" });
@@ -70,31 +110,32 @@ export async function serveDaemon(stateDir) {
       if (active && !params.cancelTree) throw Object.assign(new Error("productive operation is running"), { code: "tree_not_settled" });
       await waitForSettlement({
         knownSessions: () => [...sessions],
-        observe: async () => {
-          const unsettled = [];
-          // Set iteration also visits descendants discovered during this pass.
-          for (const sessionId of sessions) {
-            const observed = await inspectSessionWithBridge(bridge, { ...state.config, sessionId });
-            for (const child of observed.descendants ?? []) sessions.add(child.provider_session_id);
-            const status = observed.status?.type ?? observed.status;
-            const stored = ["notLoaded", "systemError"].includes(status) ? await bridge.request("thread/turns/list", { threadId: sessionId, limit: 1, sortDirection: "desc", itemsView: "summary" }, 5_000) : null;
-            if (!settledCodexSession(status, stored?.data?.[0] ?? null, active)) unsettled.push(sessionId);
-          }
-          return { sessions: unsettled.reverse(), active: Boolean(active), active_operation: active };
-        },
+        observe: () => observeCodexSessions(bridge, state.config, sessions, () => active),
         ...(params.cancelTree ? { cancel: async sessionId => { try { await cancelSessionWithBridge(bridge, { ...state.config, sessionId }); } catch (error) { if (error.code !== "turn_not_active") throw error; } } } : {})
       });
+      await save({ active_tree: false });
       return { stopped: true, clean: true, _shutdown: true };
     }
     if (active && !["session.inspect", "session.cancel"].includes(operation)) throw Object.assign(new Error(`${active} is in progress`), { code: "operation_busy", retryable: true });
     if (operation === "session.create") { active = operation; try { await save({ active_operation: active }); const result = await createSessionWithBridge(bridge, { ...state.config, ...params }); sessions.add(result.provider_session_id); return result; } finally { active = null; await save({ active_operation: null }); } }
     if (operation === "session.prompt") { sessions.add(params.sessionId); active = operation; try { await save({ active_operation: active }); return await promptSessionWithBridge(bridge, { ...state.config, ...params, assertDispatch }); } finally { active = null; await save({ active_operation: null }); } }
     if (operation === "session.start") { sessions.add(params.sessionId); active = operation; try { await save({ active_operation: active }); return await startSessionWithBridge(bridge, { ...state.config, ...params, assertDispatch }); } finally { active = null; await save({ active_operation: null }); } }
-    if (operation === "session.inspect") return await inspectSessionWithBridge(bridge, { ...state.config, ...params });
-    if (operation === "session.cancel") { if (!sessions.has(params.sessionId)) throw Object.assign(new Error("cancellation Session is not owned by this daemon"), { code: "session_identity_mismatch" }); cancelPendingDispatch(bridge); return await cancelSessionWithBridge(bridge, { ...state.config, ...params }); }
+    if (operation === "session.inspect" || operation === "session.resume") {
+      const owned = new Set(sessions);
+      for (const id of owned) for (const child of bridge.directChildren?.(id) ?? []) owned.add(child.provider_session_id);
+      if (!owned.has(params.sessionId)) throw Object.assign(new Error("inspection Session is not owned by this daemon"), { code: "session_identity_mismatch" });
+      try { return await inspectCodexTree(bridge, { ...state.config, ...params }, { remember: id => sessions.add(id), active: () => active }); }
+      finally { await save(); }
+    }
+    if (operation === "session.cancel") {
+      if (!sessions.has(params.sessionId)) throw Object.assign(new Error("cancellation Session is not owned by this daemon"), { code: "session_identity_mismatch" });
+      cancelPendingDispatch(bridge);
+      try { return await cancelCodexTree(bridge, { ...state.config, ...params }, { remember: id => sessions.add(id), active: () => active }); }
+      finally { await save(); }
+    }
     throw Object.assign(new Error(`unknown operation: ${operation}`), { code: "unknown_operation" });
   };
-await removeSocket(paths.socket); server = net.createServer((connection) => { connection.setEncoding("utf8"); let buffer = ""; connection.on("data", (chunk) => { buffer += chunk; const at = buffer.indexOf("\n"); if (at < 0) return; const line = buffer.slice(0, at); buffer = buffer.slice(at + 1); void (async () => { let request; try { request = JSON.parse(line); if (request.schema_id !== requestSchema || !request.id || !request.operation) throw Object.assign(new Error("invalid daemon request"), { code: "daemon_protocol" }); const result = await durableDaemonDispatch(paths.dir, request, () => dispatch(request.operation, request.params ?? {})); connection.end(`${JSON.stringify({ schema_id: responseSchema, id: request.id, ok: true, result: { ...result, _shutdown: undefined } })}\n`); if (result._shutdown) { await bridge.close(); await save({ shutdown_state: "clean", stopped_at: new Date().toISOString() }); await finishDaemonProcess(state.config, state.resource_process); server.close(() => process.exit(0)); await removeSocket(paths.socket); } } catch (error) { if (connection.writableEnded) { await save({ shutdown_state: "cleanup_failed", cleanup_error: errorPayload(error) }); return; } connection.end(`${JSON.stringify({ schema_id: responseSchema, id: request?.id ?? null, ok: false, error: errorPayload(error) })}\n`); } })(); }); });
+await removeSocket(paths.socket); server = net.createServer((connection) => { connection.setEncoding("utf8"); let buffer = ""; connection.on("data", (chunk) => { buffer += chunk; const at = buffer.indexOf("\n"); if (at < 0) return; const line = buffer.slice(0, at); buffer = buffer.slice(at + 1); void (async () => { let request; try { request = JSON.parse(line); if (request.schema_id !== requestSchema || !request.id || !request.operation) throw Object.assign(new Error("invalid daemon request"), { code: "daemon_protocol" }); const result = await durableDaemonDispatch(paths.dir, request, () => dispatch(request.operation, request.params ?? {}), () => dispatch("session.inspect", request.params ?? {})); connection.end(`${JSON.stringify({ schema_id: responseSchema, id: request.id, ok: true, result: { ...result, _shutdown: undefined } })}\n`); if (result._shutdown) { await bridge.close(); await save({ shutdown_state: "clean", stopped_at: new Date().toISOString() }); await finishDaemonProcess(state.config, state.resource_process); server.close(() => process.exit(0)); await removeSocket(paths.socket); } } catch (error) { if (connection.writableEnded) { await save({ shutdown_state: "cleanup_failed", cleanup_error: errorPayload(error) }); return; } connection.end(`${JSON.stringify({ schema_id: responseSchema, id: request?.id ?? null, ok: false, error: errorPayload(error) })}\n`); } })(); }); });
   await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600); await save({ shutdown_state: "running", active_operation: null }); return await new Promise(() => {});
 }
 import { authorizeRetainedDaemonResume } from "./driver-recovery.mjs";

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -103,11 +103,19 @@ export class CodexBridge {
   }
 
   // Collaboration child Threads are provider facts.  Keep only objects that
-  // explicitly carry both a thread id and parent-thread id; this deliberately
-  // ignores model prose and unrelated turn/item identifiers.
+  // explicitly carry a parent relationship, including native spawn receipts.
+  // A wait/send receiver is not necessarily a child of its sender.
   observeTopology(value, depth = 0) {
     if (!value || typeof value !== "object" || depth > 8) return;
     if (Array.isArray(value)) { for (const item of value) this.observeTopology(item, depth + 1); return; }
+    if (value.type === "collabAgentToolCall" && value.tool === "spawnAgent" &&
+        typeof value.senderThreadId === "string" && value.senderThreadId && Array.isArray(value.receiverThreadIds)) {
+      for (const child of value.receiverThreadIds) {
+        if (typeof child !== "string" || !child || child === value.senderThreadId) continue;
+        this.descendants.set(child, { provider_session_id: child, parent_provider_session_id: value.senderThreadId,
+          status: value.agentsStates?.[child]?.status ?? "unknown", source: "codex.app_server" });
+      }
+    }
     const id = value.threadId ?? value.id ?? null;
     const parent = value.parentThreadId ?? value.parent_thread_id ?? null;
     if (typeof id === "string" && id && typeof parent === "string" && parent) {

package/dist/harness-runtime/lib/dd-droid-daemon.mjs

@@ -8,7 +8,7 @@ import { durableDaemonDispatch, inspectDaemonOperation } from "./daemon-operatio
 import { observedTimeout } from "./observation-clock.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
 import { errorRecord } from "./operation-errors.mjs";
-import { cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess } from "./managed-daemon.mjs";
+import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess } from "./managed-daemon.mjs";
 
 const REQUEST = "dd-droid/daemon-request@1", RESPONSE = "dd-droid/daemon-response@1";
 async function removeSocket(file) { try { if (!(await lstat(file)).isSocket()) throw new DroidError("unsafe_socket", "Refusing to replace non-socket daemon path"); await unlink(file); } catch (error) { if (error.code !== "ENOENT") throw error; } }
@@ -29,6 +29,7 @@ function sameConfig(a, b) { return ["cwd", "bin", "model", "reasoning", "mode",
 export async function startDaemon(options) {
   const paths = droidPaths(options.stateDir), noFlow = options.noFlow === true || (!options.ddFlowBin && !options.ddFlowHome);
   const config = { stateDir: paths.dir, home: paths.home, bin: options.bin ?? process.env.DD_DROID_BIN ?? "droid", cwd: absolute(options.cwd, "--cwd"), projectRoot: absolute(options.projectRoot ?? options.cwd, "--project-root"), journal: absolute(options.journal ?? `${paths.dir}/events.jsonl`, "--journal"), entryPath: absolute(options.entryPath, "adapter entry"), authHome: absolute(options.authHome ?? os.homedir(), "auth home"), model: options.model ?? "gpt-5.6-sol", reasoning: options.reasoning ?? "high", mode: options.mode ?? "auto-high", provider: options.provider ?? "openai", noFlow, ddFlowBin: noFlow ? null : absolute(options.ddFlowBin, "--dd-flow-bin"), ddFlowHome: noFlow ? null : absolute(options.ddFlowHome, "--dd-flow-home"), resourceHome: noFlow ? null : process.env.DD_FLOW_RESOURCE_HOME ?? null, inactivityMs: options.timeoutMs ?? 600_000 };
+  await prepareRuntimeOwner(config, paths.dir);
   config.cwd = await realpath(config.cwd); config.projectRoot = await realpath(config.projectRoot);
   if (config.mode !== "auto-high") throw new DroidError("droid_mode_unsupported", "The qualified Droid profile requires auto-high");
   await mkdir(paths.dir, { recursive: true, mode: 0o700 }); await chmod(paths.dir, 0o700);
@@ -107,7 +108,7 @@ export async function serveDaemon(stateDir) {
             result = { ...result, ...terminal };
           }
         }
-      } else result = await durableDaemonDispatch(paths.dir, request, () => dispatch(request)); const { _shutdown, ...receipt } = result;
+      } else result = await durableDaemonDispatch(paths.dir, request, () => dispatch(request), () => dispatch({ operation: "session.inspect", params: request.params ?? {} })); const { _shutdown, ...receipt } = result;
       // Close the listening endpoint before replying. `server.close()` keeps
       // this already accepted connection alive, so the caller receives its
       // durable stop receipt while the Unix pathname is atomically retired.

package/dist/harness-runtime/lib/dd-grok-daemon.mjs

@@ -11,7 +11,7 @@ import path from "node:path";
 
 import { AcpBridge } from "./dd-zcode.mjs";
 import { cancelSessionWithBridge, createSessionWithBridge, doctor, forkSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge } from "./dd-grok.mjs";
-import { cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
+import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 
 const REQUEST_SCHEMA = "dd-grok/daemon-request@1";
 const RESPONSE_SCHEMA = "dd-grok/daemon-response@1";
@@ -168,6 +168,7 @@ export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 3
 function sameConfig(state, config) { return ["cwd", "journal", "bin", "authSource", "model", "reasoning", "mode", "ddFlowBin", "ddFlowHome", "projectRoot", "sessionArchive", "resourceHome", "noFlow"].every((key) => (state.config?.[key] ?? null) === (config[key] ?? null)); }
 export async function startDaemon(options) {
   const paths = locations(options.stateDir); const archive = options.sessionArchive ? await readSessionArchiveManifest(options.sessionArchive) : null; const archiveCwd = archive ? absolute(archive.manifest.source_cwd, "Grok Build archive source cwd") : null; const cwd = options.cwd ? absolute(options.cwd, "--cwd") : archiveCwd; if (!cwd) throw new DaemonError("invalid_path", "--cwd must be an absolute path when no session archive is supplied"); if (archiveCwd && cwd !== archiveCwd) throw new DaemonError("session_archive_cwd_mismatch", "Grok Build session archives must start from their recorded source cwd", false, { archive_cwd: archiveCwd, requested_cwd: cwd }); const noFlow = options.noFlow === true; const authSource = options.authPath ? absolute(options.authPath, "--auth-path") : path.join(os.homedir(), ".grok", "auth.json"); const config = { cwd, journal: absolute(options.journal, "--journal"), bin: options.bin ?? process.env.DD_GROK_BIN ?? "grok", authSource, authPath: path.join(paths.home, "auth.json"), model: String(options.model ?? ""), reasoning: String(options.reasoning ?? ""), mode: options.mode ?? "bypassPermissions", ddFlowBin: noFlow ? null : absolute(options.ddFlowBin, "--dd-flow-bin"), ddFlowHome: noFlow ? null : absolute(options.ddFlowHome, "--dd-flow-home"), projectRoot: noFlow ? cwd : absolute(options.projectRoot, "--project-root"), resourceHome: noFlow ? null : (process.env.DD_FLOW_RESOURCE_HOME ? absolute(process.env.DD_FLOW_RESOURCE_HOME, "DD_FLOW_RESOURCE_HOME") : null), env: noFlow ? {} : { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home") }, sessionArchive: archive?.source ?? null, grokHome: paths.home, noFlow };
+  await prepareRuntimeOwner(config, paths.dir);
   if (!config.model || !config.reasoning) throw new DaemonError("profile_required", "--model and --reasoning are required");
   await mkdir(paths.dir, { recursive: true, mode: 0o700 }); await chmod(paths.dir, 0o700);
   try { const status = await callDaemon(paths.dir, "daemon.status", {}, 1000); if (!sameConfig(status, config)) throw new DaemonError("daemon_config_mismatch", "a daemon is already running with different configuration"); return { ...status, already_running: true }; } catch (error) { if (error.code !== "daemon_not_running" && error.code !== "daemon_timeout") throw error; }
@@ -214,6 +215,11 @@ export class Runtime {
   topology(root) { return [...this.descendants.values()].filter((child) => child.parent_provider_session_id === root); }
   observeToolCall(message) { const sessionId = message?.params?.sessionId; const update = message?.params?.update; const id = update?.toolCallId; if (!sessionId || !id) return; this.toolEvents ??= new Map(); const events = this.toolEvents.get(sessionId) ?? { calls: new Map(), failed: new Set() }; if (update.sessionUpdate === "tool_call") events.calls.set(id, update?._meta?.["x.ai/tool"]?.name ?? update?._meta?.claudeCode?.toolName ?? update.title?.split(":", 1)[0] ?? "unknown"); if (update.sessionUpdate === "tool_call_update" && ["failed", "error"].includes(update.status)) events.failed.add(id); this.toolEvents.set(sessionId, events); const by_tool = {}; for (const name of events.calls.values()) by_tool[name] = (by_tool[name] ?? 0) + 1; this.toolUsage.set(sessionId, { total: events.calls.size, failures: events.failed.size, by_tool }); }
   running(result) { return result?.evidence?.subagents?.subagents ?? result?.subagents?.subagents ?? []; }
+  treeRunning(result) {
+    const evidence = result?.evidence ?? result;
+    const children = evidence?.subagents?.subagents;
+    return this.rootRunning({ ...result, ...evidence }) || !Array.isArray(children) || children.length > 0 || Boolean(evidence?.subagents?.observation_error);
+  }
   rootRunning(result) {
     const status = String(result?.info?.status ?? result?.info?.state ?? result?.info?.data?.status ?? "unknown").toLowerCase();
     // Grok 1.0.17 omits status from session/info. Only a durable native
@@ -230,18 +236,18 @@ export class Runtime {
       let observed = await inspectSessionWithBridge(this.bridge, this.options({ sessionId: id, liveSession: true }));
       this.track(observed);
       const rootActive = Boolean(this.active);
-      if (cancel && (rootActive || this.rootRunning(observed) || this.running(observed).length)) {
+      if (cancel && (rootActive || this.treeRunning(observed))) {
         await cancelSessionWithBridge(this.bridge, this.options({ sessionId: id, liveSession: true }));
         observed = await inspectSessionWithBridge(this.bridge, this.options({ sessionId: id, liveSession: true }));
         this.track(observed);
       }
-      if (this.active || this.rootRunning(observed) || this.running(observed).length) running.push(id);
+      if (this.active || this.treeRunning(observed)) running.push(id);
     }
     await this.persist({ active_tree: running.length > 0 || Boolean(this.active) });
     return running;
   }
   async requireSettled() { const running = await this.refreshTree(); if (running.length) throw new DaemonError("tree_not_settled", "daemon still owns a running Session tree", false, { sessions: running }); }
-  async productive(name, task) { if (this.active) throw new DaemonError("operation_busy", `${this.active} is already running`, true); this.active = name; for (const session of this.sessions.values()) session.native_root_receipt = null; try { await this.persist({ active_tree: true, active_operation: name }); const result = await task(); this.track(result); const session = this.sessions.get(result.provider_session_id); if (session && (["session.create", "session.fork"].includes(name) || ["end_turn", "cancelled"].includes(result.turn?.stopReason))) session.native_root_receipt = { kind: name === "session.prompt" ? result.turn.stopReason : "created", daemon_id: this.state.daemon_id }; await this.persist({ active_tree: this.rootRunning(result) || this.running(result).length > 0, active_operation: null }); return { ...result, descendants: this.topology(result.provider_session_id) }; } catch (error) { await this.persist({ active_tree: true, active_operation: null }); throw error; } finally { this.active = null; } }
+  async productive(name, task) { if (this.active) throw new DaemonError("operation_busy", `${this.active} is already running`, true); this.active = name; for (const session of this.sessions.values()) session.native_root_receipt = null; try { await this.persist({ active_tree: true, active_operation: name }); const result = await task(); this.track(result); const session = this.sessions.get(result.provider_session_id); if (session && (["session.create", "session.fork"].includes(name) || ["end_turn", "cancelled"].includes(result.turn?.stopReason))) session.native_root_receipt = { kind: name === "session.prompt" ? result.turn.stopReason : "created", daemon_id: this.state.daemon_id }; await this.persist({ active_tree: this.treeRunning(result), active_operation: null }); return { ...result, descendants: this.topology(result.provider_session_id) }; } catch (error) { await this.persist({ active_tree: true, active_operation: null }); throw error; } finally { this.active = null; } }
   async dispatch(operation, params) {
     const assertDispatch = captureDispatchGuard(this);
     if (operation === "daemon.status") { let observationError; if (!this.active) try { await this.refreshTree(); } catch (error) { observationError = errorPayload(error); } return { observation_error: observationError ?? null, daemon_id: this.state.daemon_id, pid: process.pid, socket: this.paths.socket, versions: this.state.versions, config_isolation: this.state.config_isolation, shutdown_state: this.state.shutdown_state, recovery_status: this.state.recovery_status, auth_status: this.state.auth_status, active_tree: this.state.active_tree, active_operation: this.active, sessions: [...this.sessions.values()], config: this.state.config }; }
@@ -249,7 +255,7 @@ export class Runtime {
     if (operation === "session.create") return await this.productive(operation, async () => { const result = await createSessionWithBridge(this.bridge, { ...this.options(params), onSessionCreated: async (session) => { this.track(session); this.loadedSessionId = session.provider_session_id; await this.persist(); } }, this.initialized); this.loadedSessionId = result.provider_session_id; return result; });
     if (operation === "session.prompt") { await this.requireSettled(); return await this.productive(operation, async () => { const result = await promptSessionWithBridge(this.bridge, { ...this.options(params), assertDispatch }); this.loadedSessionId = params.sessionId; return result; }); }
     if (operation === "session.fork") { await this.requireSettled(); return await this.productive(operation, async () => { const result = await forkSessionWithBridge(this.bridge, this.options(params)); this.loadedSessionId = params.sessionId; return result; }); }
-    if (operation === "session.inspect") { const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result); await this.persist(); return { ...result, descendants: this.topology(result.provider_session_id) }; }
+    if (operation === "session.inspect" || operation === "session.resume") { const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result); await this.persist(); return { ...result, settled: !this.active && !this.treeRunning(result), descendants: this.topology(result.provider_session_id) }; }
     if (operation === "session.cancel") { if (!this.sessions.has(params.sessionId)) throw new DaemonError("session_identity_mismatch", "cancellation Session is not owned by this daemon"); cancelPendingDispatch(this); const result = await cancelSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); await this.persist({ active_tree: Boolean(this.active) || !result.settled }); return result; }
     if (operation === "session.archive") { await this.requireSettled(); return await this.productive(operation, async () => { let session = this.sessions.get(params.sessionId); if (!session?.cwd) { const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result); session = this.sessions.get(result.provider_session_id); } return await exportSessionArchive(this.paths, session.provider_session_id, absolute(session.cwd, "Grok Build session cwd"), params.archiveDir, this.state.versions); }); }
     if (operation === "daemon.stop") {
@@ -277,6 +283,6 @@ export async function serveDaemon(stateDir) {
     const rootProviderSessionId = session?.root_provider_session_id ?? sessionId;
     await observeAcpToolCall(state.config, { daemonId: state.daemon_id, rootProviderSessionId, parentProviderSessionId: session?.parent_provider_session_id ?? null, observedProfile: bridge.modelProfiles?.get(sessionId) ?? {} }, message);
   } }); const initialized = await bridge.start(); runtime = new Runtime(paths, state, bridge, initialized);
-  await removeSocket(paths.socket, paths.dir); const server = net.createServer((connection) => { connection.setEncoding("utf8"); let buffer = ""; connection.on("data", (chunk) => { buffer += chunk; const newline = buffer.indexOf("\n"); if (newline < 0) return; const line = buffer.slice(0, newline); buffer = buffer.slice(newline + 1); void (async () => { let request; try { request = JSON.parse(line); if (request.schema_id !== REQUEST_SCHEMA || !request.id || !request.operation) throw new DaemonError("daemon_protocol_mismatch", "invalid daemon request"); const result = await durableDaemonDispatch(paths.dir, request, () => runtime.dispatch(request.operation, request.params ?? {})); connection.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: true, result: { ...result, _shutdown: undefined } })}\n`); if (result?._shutdown) setImmediate(() => void runtime.shutdown().then(() => process.exit(0)).catch(error => runtime.persist({ shutdown_state: "cleanup_failed", cleanup_error: errorPayload(error) }))); } catch (error) { connection.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request?.id ?? null, ok: false, error: errorPayload(error) })}\n`); } })(); }); }); runtime.server = server; await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600); await runtime.persist({ shutdown_state: "running", active_tree: false }); return await new Promise(() => {});
+  await removeSocket(paths.socket, paths.dir); const server = net.createServer((connection) => { connection.setEncoding("utf8"); let buffer = ""; connection.on("data", (chunk) => { buffer += chunk; const newline = buffer.indexOf("\n"); if (newline < 0) return; const line = buffer.slice(0, newline); buffer = buffer.slice(newline + 1); void (async () => { let request; try { request = JSON.parse(line); if (request.schema_id !== REQUEST_SCHEMA || !request.id || !request.operation) throw new DaemonError("daemon_protocol_mismatch", "invalid daemon request"); const result = await durableDaemonDispatch(paths.dir, request, () => runtime.dispatch(request.operation, request.params ?? {}), () => runtime.dispatch("session.inspect", request.params ?? {})); connection.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: true, result: { ...result, _shutdown: undefined } })}\n`); if (result?._shutdown) setImmediate(() => void runtime.shutdown().then(() => process.exit(0)).catch(error => runtime.persist({ shutdown_state: "cleanup_failed", cleanup_error: errorPayload(error) }))); } catch (error) { connection.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request?.id ?? null, ok: false, error: errorPayload(error) })}\n`); } })(); }); }); runtime.server = server; await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600); await runtime.persist({ shutdown_state: "running", active_tree: false }); return await new Promise(() => {});
 }
 import { authorizeRetainedDaemonResume } from "./driver-recovery.mjs";

package/dist/harness-runtime/lib/dd-opencode-daemon.mjs

@@ -10,7 +10,7 @@ import { checkObservedProfile, observeModel } from "./model-observations.mjs";
 import os from "node:os";
 import path from "node:path";
 import { OpenCodeClient, OpenCodeError, canonicalHistory, historyDigest, usageSnapshot } from "./dd-opencode.mjs";
-import { cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
+import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 
 const REQUEST_SCHEMA = "dd-opencode/daemon-request@1", RESPONSE_SCHEMA = "dd-opencode/daemon-response@1", STATE_SCHEMA = "dd-opencode/daemon-state@1", ARCHIVE_SCHEMA = "dd-opencode/session-archive@1";
 const OPENCODE_BASELINE = Object.freeze({ version: "1.18.25", api_fingerprint: "dfb7d42a555389f0c662fa2b4a8af1d61633c96710cf54bce3ff2404e2e7d896" });
@@ -50,6 +50,7 @@ function sameConfig(state, config) { return ["cwd","journal","bin","provider","m
 export async function startDaemon(options) {
   const paths = locations(options.stateDir); await mkdir(paths.dir, { recursive: true, mode: 0o700 }); await chmod(paths.dir, 0o700);
   const previous = await readState(paths.dir), daemonId = randomUUID(), noFlow = options.noFlow === true, cwd = await realpath(absolute(options.cwd, "--cwd")); const config = { cwd, journal: options.journal ? absolute(options.journal, "--journal") : paths.journal, bin: options.bin ?? process.env.DD_OPENCODE_BIN ?? "opencode", provider: String(options.provider ?? ""), model: String(options.model ?? ""), variant: String(options.variant ?? "default"), agent: String(options.agent ?? "build"), projectRoot: noFlow ? cwd : await realpath(absolute(options.projectRoot, "--project-root")), ddFlowBin: noFlow ? null : absolute(options.ddFlowBin, "--dd-flow-bin"), ddFlowHome: noFlow ? null : absolute(options.ddFlowHome, "--dd-flow-home"), resourceHome: noFlow ? null : (process.env.DD_FLOW_RESOURCE_HOME ? absolute(process.env.DD_FLOW_RESOURCE_HOME, "DD_FLOW_RESOURCE_HOME") : null), env: noFlow ? {} : { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home") }, sessionArchive: options.sessionArchive ? absolute(options.sessionArchive, "--session-archive") : null, dataHome: paths.data, configHome: paths.config, cacheHome: paths.cache, adapterDir: path.join(paths.config, "opencode"), password: randomBytes(24).toString("hex"), daemonId, noFlow };
+  await prepareRuntimeOwner(config, paths.dir);
   if (!config.provider || !config.model) throw new DaemonError("profile_required", "--provider and --model are required");
   try { const status = await callDaemon(paths.dir, "daemon.status", {}, 1000); if (!sameConfig(status, config)) throw new DaemonError("daemon_config_mismatch", "a daemon is already running with different configuration"); return { ...status, already_running: true }; } catch (error) { if (!["daemon_not_running","daemon_timeout"].includes(error.code)) throw error; }
   if (previous?.shutdown_state === "clean") await authorizeRetainedDaemonResume(paths.dir, previous, options.sessionId, config); if (previous?.shutdown_state === "running" && previous.active_tree) throw new DaemonError("invalid_harness_crash", "previous daemon died with an active or unproven Session tree");
@@ -102,7 +103,7 @@ export class Runtime {
     if (operation === "daemon.status") { const { password, ...config } = this.state.config; return { daemon_id: this.state.daemon_id, pid: process.pid, socket: this.paths.socket, versions: this.state.versions, auth_status: this.state.auth_status, shutdown_state: this.state.shutdown_state, active_tree: this.state.active_tree, active_operation: this.active, sessions: [...this.sessions.values()], config }; }
     if (operation === "daemon.doctor") { const doc = await this.client.request("GET", "/doc", undefined, { directory: null, timeoutMs: 5_000 }); const apiFingerprint = createHash("sha256").update(typeof doc === "string" ? doc : JSON.stringify(doc)).digest("hex"); if (apiFingerprint !== OPENCODE_BASELINE.api_fingerprint) throw new DaemonError("api_fingerprint_mismatch", "OpenCode API differs from the qualified baseline", false, { expected: OPENCODE_BASELINE.api_fingerprint, actual: apiFingerprint }); return { compatible: true, versions: this.state.versions, api_fingerprint: apiFingerprint, plugin_sha256: this.state.config.pluginSha256, auth_status: this.state.auth_status }; }
     if (operation === "session.create") return this.productive(operation, async () => { const info = await this.client.create(params.title); this.sessions.set(info.id, { provider_session_id: info.id, adapter_session_id: info.id, parent_provider_session_id: info.parentID ?? null, root_provider_session_id: info.id, cwd: info.directory }); const result = await this.describe(info.id); await this.reconcileUsage(result); return result; });
-    if (operation === "session.inspect") { const result = await this.describe(params.sessionId); await this.persist(); return result; }
+    if (operation === "session.inspect" || operation === "session.resume") { const result = await this.describe(params.sessionId); await this.persist(); return result; }
     if (operation === "session.prompt") { await this.requireSettled(params.sessionId); return this.productive(operation, async () => { assertDispatch(); const reply = await this.client.prompt(params.sessionId, { prompt: params.prompt, provider: this.state.config.provider, model: this.state.config.model, variant: this.state.config.variant, agent: this.state.config.agent,
       assertDispatch,
       onModelMessages: (id, messages, parent) => this.observeModels(id, messages, parent),
@@ -154,7 +155,7 @@ export async function serveDaemon(stateDir) {
     child = spawn(target.command, target.args, { cwd: state.config.cwd, env: isolatedEnv(state.config), detached: true, stdio: ["ignore", "inherit", "inherit"] });
     await confirmDaemonProcess(state.config, providerProcess, child);
     state.provider_process = providerProcess; state.provider_pid = child.pid; await writeJson(paths.state, state);
-    const client = new OpenCodeClient({ baseUrl: `http://127.0.0.1:${port}`, password: state.config.password, directory: state.config.cwd }); const deadline = Date.now() + 15_000; while (Date.now() < deadline) { try { await client.health(); break; } catch { await new Promise(resolve => setTimeout(resolve, 100)); } } await client.health(); const runtime = new Runtime(paths, state, client, child, providerProcess); await removeSocket(paths); const server = net.createServer(connection => { connection.setEncoding("utf8"); let buffer = ""; connection.on("data", chunk => { buffer += chunk; const i = buffer.indexOf("\n"); if (i < 0) return; void (async () => { let request; try { request = JSON.parse(buffer.slice(0, i)); const result = await durableDaemonDispatch(paths.dir, request, () => runtime.dispatch(request.operation, request.params ?? {})); connection.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: true, result: { ...result, _shutdown: undefined } })}\n`); if (result?._shutdown) setImmediate(() => runtime.shutdown().then(() => process.exit(0)).catch(error => runtime.persist({ shutdown_state: "cleanup_failed", cleanup_error: errorPayload(error) }))); } catch (error) { connection.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request?.id ?? null, ok: false, error: errorPayload(error) })}\n`); } })(); }); }); runtime.server = server; await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600); await runtime.persist({ shutdown_state: "running", active_tree: false, server_port: port }); return await new Promise(() => {});
+    const client = new OpenCodeClient({ baseUrl: `http://127.0.0.1:${port}`, password: state.config.password, directory: state.config.cwd }); const deadline = Date.now() + 15_000; while (Date.now() < deadline) { try { await client.health(); break; } catch { await new Promise(resolve => setTimeout(resolve, 100)); } } await client.health(); const runtime = new Runtime(paths, state, client, child, providerProcess); await removeSocket(paths); const server = net.createServer(connection => { connection.setEncoding("utf8"); let buffer = ""; connection.on("data", chunk => { buffer += chunk; const i = buffer.indexOf("\n"); if (i < 0) return; void (async () => { let request; try { request = JSON.parse(buffer.slice(0, i)); const result = await durableDaemonDispatch(paths.dir, request, () => runtime.dispatch(request.operation, request.params ?? {}), () => runtime.dispatch("session.inspect", request.params ?? {})); connection.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: true, result: { ...result, _shutdown: undefined } })}\n`); if (result?._shutdown) setImmediate(() => runtime.shutdown().then(() => process.exit(0)).catch(error => runtime.persist({ shutdown_state: "cleanup_failed", cleanup_error: errorPayload(error) }))); } catch (error) { connection.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request?.id ?? null, ok: false, error: errorPayload(error) })}\n`); } })(); }); }); runtime.server = server; await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600); await runtime.persist({ shutdown_state: "running", active_tree: false, server_port: port }); return await new Promise(() => {});
   } catch (error) {
     await cleanupFailedStart(state.config, providerProcess, child, error); throw error;
   }