@deksden-com/dd-flow-cli 0.9.0-beta.38 → 0.9.0-beta.40

package/dist/services/execution-policy.js

@@ -3,9 +3,57 @@ import fs from "node:fs";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
 import { harnessKey } from "./harness-config.js";
+import { vnextStages } from "../domain/stage-catalog.js";
+/** Read once so the frozen policy and its provenance describe the same bytes. */
+export function loadExecutionRoutingInput(file) {
+    const source_path = path.resolve(file);
+    let bytes;
+    let value;
+    try {
+        bytes = fs.readFileSync(source_path);
+        value = JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        throw new AppError("execution_profile_invalid", "Execution routing input must be a readable JSON file", 2, { source_path });
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new AppError("execution_profile_invalid", "Execution routing input must be an object", 2, { source_path });
+    }
+    const input = value;
+    if (input.schema_id !== "dd-flow/execution-routing@1"
+        || Object.keys(input).some(key => key !== "schema_id" && key !== "execution")
+        || !isExecutionRouting(input.execution)) {
+        throw new AppError("execution_profile_invalid", "Execution routing input does not match dd-flow/execution-routing@1", 2, { source_path });
+    }
+    return { execution: input.execution, bytes, source_path, source_checksum: crypto.createHash("sha256").update(bytes).digest("hex") };
+}
+/** One routing validator for project defaults and explicit RUN inputs. */
+export function isExecutionRouting(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const { stage_overrides: stages, ...root } = value;
+    if (typeof root.agent_profile_id !== "string")
+        return false;
+    try {
+        validateExecutionOverride(root);
+        if (stages !== undefined) {
+            if (!stages || typeof stages !== "object" || Array.isArray(stages))
+                return false;
+            for (const [stage, override] of Object.entries(stages)) {
+                if (!vnextStages.some(item => item.id === stage))
+                    return false;
+                validateExecutionOverride(override);
+            }
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** Reads one complete profile.  A policy selects profiles; it never field-merges them. */
 export function loadAgentProfile(ddFlowHome, id) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(id))
+    if (typeof id !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(id))
         throw new AppError("agent_profile_invalid", "Agent profile id is invalid", 2, { id });
     const file = path.join(ddFlowHome, "agent-profiles", `${id}.json`);
     let value;
@@ -19,26 +67,57 @@ export function loadAgentProfile(ddFlowHome, id) {
         throw new AppError("agent_profile_invalid", "Agent profile must be an object", 2, { id, file });
     const profile = value;
     if (profile.schema_id !== "dd-flow/agent-profile@1" || profile.id !== id
+        || Object.keys(profile).some(key => !["schema_id", "id", "harness", "provider", "model", "reasoning", "mode", "permission"].includes(key))
         || !["codex", "zcode", "agy", "opencode", "grok", "droid"].includes(String(profile.harness))
         || !nonempty(profile.provider) || !nonempty(profile.model) || !nonempty(profile.reasoning) || !nonempty(profile.mode)
         || (profile.permission !== "allow" && profile.permission !== "deny")) {
         throw new AppError("agent_profile_invalid", "Agent profile does not match dd-flow/agent-profile@1", 2, { id, file });
     }
-    return profile;
+    // Only execution settings enter RUN evidence; never copy arbitrary profile fields.
+    return { schema_id: profile.schema_id, id, harness: profile.harness, provider: profile.provider, model: profile.model, reasoning: profile.reasoning, mode: profile.mode, permission: profile.permission };
+}
+export function snapshotAgentProfiles(ddFlowHome, policy) {
+    if (!isExecutionRouting(policy))
+        throw new AppError("execution_profile_invalid", "Execution routing contains an invalid stage, profile or delegation policy", 2);
+    const profiles = Object.create(null);
+    for (const override of [policy, ...Object.values(policy.stage_overrides ?? {})]) {
+        for (const id of [override.agent_profile_id, override.delegation?.agent_profile_id]) {
+            if (id !== undefined && !Object.hasOwn(profiles, id))
+                profiles[id] = loadAgentProfile(ddFlowHome, id);
+        }
+    }
+    // Validate every declared route now, including stages not reached by this run.
+    for (const stage of [undefined, ...Object.keys(policy.stage_overrides ?? {})]) {
+        resolveExecutionPolicy({ ddFlowHome, policy, profiles, ...(stage ? { stage } : {}) });
+    }
+    return profiles;
 }
 /** Resolves a frozen policy with explicit topology.  Same profiles do not turn external work into native work. */
 export function resolveExecutionPolicy(input) {
+    if (input.work !== undefined)
+        validateExecutionOverride(input.work);
+    const profile = (id) => {
+        if (!input.profiles)
+            return loadAgentProfile(input.ddFlowHome, id);
+        if (!Object.hasOwn(input.profiles, id))
+            throw new AppError("execution_profile_not_frozen", "Profile is not in this RUN's frozen execution snapshot", 1, { id });
+        return input.profiles[id];
+    };
     const stage = input.stage ? input.policy.stage_overrides?.[input.stage] : undefined;
-    const coordinatorId = input.work?.agent_profile_id ?? stage?.agent_profile_id ?? input.policy.agent_profile_id;
+    const coordinatorId = stage?.agent_profile_id ?? input.policy.agent_profile_id;
     if (!coordinatorId)
         throw new AppError("execution_profile_missing", "Execution policy needs agent_profile_id before external dispatch", 1, { stage: input.stage ?? null });
-    const coordinator = loadAgentProfile(input.ddFlowHome, coordinatorId);
+    const coordinator = profile(coordinatorId);
     const delegation = input.work?.delegation ?? stage?.delegation ?? input.policy.delegation ?? { mode: "native" };
     validateDelegation(delegation);
-    const worker = loadAgentProfile(input.ddFlowHome, delegation.agent_profile_id ?? coordinator.id);
+    if (input.work?.agent_profile_id && input.work.delegation?.agent_profile_id && input.work.agent_profile_id !== input.work.delegation.agent_profile_id)
+        throw new AppError("execution_profile_invalid", "Work selects conflicting worker profiles", 2);
+    const worker = profile(input.work?.agent_profile_id ?? delegation.agent_profile_id ?? coordinator.id);
     if (delegation.mode === "native" && harnessKey(worker.harness) !== harnessKey(coordinator.harness)) {
         throw new AppError("native_harness_mismatch", "Native delegation cannot change harness", 2, { coordinator_harness: coordinator.harness, worker_harness: worker.harness });
     }
+    if (delegation.mode === "native" && !sameSessionProfile(coordinator, worker))
+        throw new AppError("native_profile_override_unqualified", "Native worker profile overrides require qualified adapter support; select external delegation", 2, { coordinator_profile_id: coordinator.id, worker_profile_id: worker.id });
     const resolved = {
         coordinator,
         worker,
@@ -47,15 +126,52 @@ export function resolveExecutionPolicy(input) {
     return { ...resolved, profile_hash: digest(resolved) };
 }
 export function runtimeHarness(profile) { return harnessKey(profile.harness); }
+/** Profile labels are not execution identity; every session-affecting value is. */
+export function sameSessionProfile(left, right) {
+    const settings = (profile) => ({ harness: runtimeHarness(profile), provider: profile.provider, model: profile.model, reasoning: profile.reasoning, mode: profile.mode, permission: profile.permission });
+    return digest(settings(left)) === digest(settings(right));
+}
+export function assertSameSessionMerge(input) {
+    const merge = resolveExecutionPolicy({ ...input, stage: "merge" }).coordinator;
+    for (const stage of input.previousStages) {
+        const previous = resolveExecutionPolicy({ ...input, stage }).coordinator;
+        if (!sameSessionProfile(previous, merge))
+            throw new AppError("merge_profile_session_conflict", "Same-session MERGE cannot switch execution profiles; select a compatible profile or server MERGE", 2, { previous_stage: stage, previous_profile_id: previous.id, merge_profile_id: merge.id });
+    }
+}
+export function resolveStageTransition(input) {
+    const target = resolveExecutionPolicy(input);
+    const previous = input.fromStage ? resolveExecutionPolicy({ ...input, stage: input.fromStage }).coordinator : null;
+    const compatible = !previous || sameSessionProfile(previous, target.coordinator);
+    if (input.stage === "merge" && input.mergeMode === "same_session") {
+        if (!compatible)
+            throw new AppError("merge_profile_session_conflict", "Same-session MERGE cannot replace its current coordinator", 2);
+        return { ...target, session_mode: "same_session" };
+    }
+    return { ...target, session_mode: !compatible || (input.stage === "merge" && input.mergeMode === "server") ? "new_session" : input.stageSessionMode };
+}
 function validateDelegation(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some(key => !["mode", "agent_profile_id", "max_parallel"].includes(key)))
+        throw new AppError("execution_profile_invalid", "Delegation has unsupported fields", 2);
     if (value.mode !== "native" && value.mode !== "external")
         throw new AppError("execution_profile_invalid", "Delegation mode must be native or external", 2);
-    if (value.agent_profile_id !== undefined && !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value.agent_profile_id))
+    if (value.agent_profile_id !== undefined && (typeof value.agent_profile_id !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value.agent_profile_id)))
         throw new AppError("execution_profile_invalid", "Delegation profile id is invalid", 2);
     if (value.max_parallel !== undefined && (!Number.isInteger(value.max_parallel) || value.max_parallel < 1))
         throw new AppError("execution_profile_invalid", "External max_parallel must be a positive integer", 2);
     if (value.mode === "native" && value.max_parallel !== undefined)
         throw new AppError("execution_profile_invalid", "Native delegation does not accept max_parallel", 2);
 }
+export function validateExecutionOverride(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some(key => !["agent_profile_id", "delegation"].includes(key)))
+        throw new AppError("execution_profile_invalid", "Work execution override has unsupported fields", 2);
+    const override = value;
+    if (override.agent_profile_id === undefined && override.delegation === undefined)
+        throw new AppError("execution_profile_invalid", "Work execution override is empty", 2);
+    if (override.agent_profile_id !== undefined && (typeof override.agent_profile_id !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(override.agent_profile_id)))
+        throw new AppError("execution_profile_invalid", "Work profile id is invalid", 2);
+    if (override.delegation !== undefined)
+        validateDelegation(override.delegation);
+}
 function nonempty(value) { return typeof value === "string" && Boolean(value.trim()); }
 function digest(value) { return crypto.createHash("sha256").update(JSON.stringify(value)).digest("hex"); }

package/dist/services/external-work-launch.js

@@ -3,11 +3,12 @@ import fs from "node:fs";
 import path from "node:path";
 import { ensureWorkLaunchStorage } from "../storage/database.js";
 import { AppError } from "../shared/errors.js";
-import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
+import { runtimeBudgetForRun } from "./runtime-budget.js";
+import { adapterSessionId, prepareHarnessFlowExecutable, runHarnessAdapter } from "./harness-adapter.js";
 import { harnessRuntimeArguments, resolveHarnessCommand } from "./harness-config.js";
-import { resolveExecutionPolicy, runtimeHarness } from "./execution-policy.js";
+import { resolveExecutionPolicy, runtimeHarness, validateExecutionOverride } from "./execution-policy.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
-import { workStartCommand } from "./work-registry.js";
+import { assertWorkLaunchReady, workStartCommand } from "./work-registry.js";
 /**
  * Creates an external provider root for one already-created Work.  The launch
  * is not a Work claim: only the worker's trusted `work start` hook binds it.
@@ -17,18 +18,27 @@ export async function launchExternalWork(context, input) {
     const work = context.db.get("SELECT work_id, project_id, run_id, status, payload_json FROM works WHERE work_id = ?", [input.workId]);
     if (!work)
         throw new AppError("not_found", "Work was not found", 1, { work_id: input.workId });
-    if (work.status !== "created")
-        throw new AppError("invalid_work_state", "Only created Work can be launched externally", 2, { work_id: work.work_id, status: work.status });
-    const run = context.db.get("SELECT run_root, workspace_root, index_json FROM runs WHERE project_id = ? AND id = ?", [work.project_id, work.run_id]);
+    const run = context.db.get("SELECT run_root, project_root, workspace_root, index_json, status FROM runs WHERE project_id = ? AND id = ?", [work.project_id, work.run_id]);
     if (!run?.run_root)
         throw new AppError("runtime_missing", "Work has no materialized RUN root", 1, { work_id: work.work_id });
     const existing = context.db.get("SELECT operation_id, status, provider_session_id, profile_hash, journal_path FROM work_launches WHERE work_id = ?", [work.work_id]);
     if (existing)
         return { ok: true, work_id: work.work_id, operation_id: existing.operation_id, status: existing.status, provider_session_id: existing.provider_session_id, profile_hash: existing.profile_hash, journal_path: existing.journal_path, idempotent: true };
+    assertWorkLaunchReady(context, work.work_id);
+    if (run.status !== "running")
+        throw new AppError("invalid_run_state", "External Work dispatch requires a running RUN", 2, { run_id: work.run_id, status: run.status });
     const generation = assertRunMutationAllowed(context, work.project_id, work.run_id);
     const snapshot = JSON.parse(run.index_json);
+    if (!snapshot.execution_profile?.agent_profiles)
+        throw new AppError("execution_profile_not_frozen", "External dispatch requires a RUN with frozen agent profiles; recreate the RUN with the current engine", 1, { work_id: work.work_id });
     const override = workOverride(work.payload_json);
-    const resolved = resolveExecutionPolicy({ ddFlowHome: context.ddFlowHome, policy: snapshot.execution_profile?.settings?.execution ?? {}, ...(input.stage ? { stage: input.stage } : {}), ...(override ? { work: override } : {}) });
+    const policy = snapshot.execution_profile?.settings?.execution ?? {};
+    const stage = snapshot.current_stage;
+    if (input.stage !== undefined && input.stage !== stage)
+        throw new AppError("execution_stage_mismatch", "Requested stage does not match the RUN's current stage", 2, { requested_stage: input.stage, current_stage: stage ?? null });
+    if (!stage && Object.keys(policy.stage_overrides ?? {}).length)
+        throw new AppError("execution_stage_missing", "Stage overrides require an authoritative RUN stage", 1, { run_id: work.run_id });
+    const resolved = resolveExecutionPolicy({ ddFlowHome: context.ddFlowHome, policy, profiles: snapshot.execution_profile.agent_profiles, ...(stage ? { stage } : {}), ...(override ? { work: override } : {}) });
     if (resolved.delegation.mode !== "external")
         throw new AppError("external_launch_not_selected", "This Work's frozen policy selects native delegation", 2, { work_id: work.work_id });
     const operationId = `OPR-${crypto.randomUUID()}`;
@@ -36,19 +46,27 @@ export async function launchExternalWork(context, input) {
     const journal = path.join(root, "adapter.events.jsonl");
     fs.mkdirSync(root, { recursive: true });
     const now = context.now();
-    context.db.run("INSERT INTO work_launches (operation_id, work_id, profile_json, profile_hash, status, state_dir, journal_path, provider_session_id, adapter_receipt_json, created_at, updated_at) VALUES (?, ?, ?, ?, 'launching', ?, ?, NULL, NULL, ?, ?)", [operationId, work.work_id, JSON.stringify(resolved), resolved.profile_hash, root, journal, now, now]);
+    const flowExecutable = prepareHarnessFlowExecutable(context, root);
+    const runtimeContext = { ...context, env: { ...context.env, DD_FLOW_BIN: flowExecutable } };
+    const runtimeOwner = { schema_id: "dd-flow/runtime-owner@1", owner_id: `run:${work.run_id}:work:${work.work_id}`, role: "worker", project_id: work.project_id, run_id: work.run_id, work_id: work.work_id, operation_id: operationId, state_dir: root, dd_flow_home: context.ddFlowHome, dd_flow_bin: flowExecutable, resource_home: context.env.DD_FLOW_RESOURCE_HOME ?? context.ddFlowHome, budget: runtimeBudgetForRun(context, work.project_id, work.run_id) };
     const executable = resolveHarnessCommand(context.ddFlowHome, runtimeHarness(resolved.worker), "adapter");
-    const common = ["--state-dir", root, "--journal", journal, "--cwd", run.workspace_root, "--provider", resolved.worker.provider, "--model", resolved.worker.model, "--reasoning", resolved.worker.reasoning, "--mode", resolved.worker.mode, "--permission", resolved.worker.permission, "--project-root", run.workspace_root, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, runtimeHarness(resolved.worker)), "--json"];
+    context.db.run("INSERT INTO work_launches (operation_id, work_id, profile_json, profile_hash, status, state_dir, journal_path, provider_session_id, adapter_receipt_json, created_at, updated_at) VALUES (?, ?, ?, ?, 'launching', ?, ?, NULL, NULL, ?, ?)", [operationId, work.work_id, JSON.stringify({ ...resolved, runtime_adapter: { executable, owner: runtimeOwner } }), resolved.profile_hash, root, journal, now, now]);
+    const common = ["--dd-flow-bin", flowExecutable, "--state-dir", root, "--journal", journal, "--cwd", run.workspace_root, "--provider", resolved.worker.provider, "--model", resolved.worker.model, "--reasoning", resolved.worker.reasoning, "--mode", resolved.worker.mode, "--permission", resolved.worker.permission, "--project-root", run.project_root, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, runtimeHarness(resolved.worker)), "--json"];
     const evidence = (value) => fs.appendFileSync(journal, `${JSON.stringify({ type: "adapter_call", at: context.now(), ...value })}\n`);
     try {
-        const call = (args, timeoutMs) => runHarnessAdapter({ executable, args, env: context.env, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), onEvidence: evidence });
+        const call = (args, timeoutMs) => runHarnessAdapter({ executable, args, env: runtimeContext.env, operationId: `${operationId}:${args[0]}.${args[1]}`, runtimeOwner, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), onEvidence: evidence });
         await call(["daemon", "start", ...common]);
+        assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
         const created = await call(["session", "create", ...common]);
         const sessionId = adapterSessionId(created);
         if (!sessionId)
             throw new AppError("harness_adapter_invalid", "Harness adapter did not return a typed Session id", 1, { work_id: work.work_id, harness: runtimeHarness(resolved.worker) });
+        // Retain the physical root before any subsequent guard or prompt can fail.
+        context.db.run("UPDATE work_launches SET provider_session_id = ?, adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ?", [sessionId, JSON.stringify({ create: created }), context.now(), operationId]);
+        assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
+        assertWorkLaunchReady(context, work.work_id);
         const promptFile = path.join(root, "launch.md");
-        fs.writeFileSync(promptFile, `Start the assigned Work now. Your first tool call must be this exact standalone command:\n\n${workStartCommand(context, work)}\n\nUse the packet returned by that command. Do not claim another Work or run this command more than once.\n`);
+        fs.writeFileSync(promptFile, `Start the assigned Work now. Your first tool call must be this exact standalone command:\n\n${workStartCommand(runtimeContext, work)}\n\nUse the packet returned by that command. Do not claim another Work or run this command more than once.\n`);
         const prompted = await call(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60_000);
         assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
         context.db.run("UPDATE work_launches SET status = 'start_requested', provider_session_id = ?, adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ?", [sessionId, JSON.stringify({ create: created, prompt: prompted }), context.now(), operationId]);
@@ -72,5 +90,8 @@ function workOverride(payload) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return undefined;
     const execution = value.execution_override;
-    return execution && typeof execution === "object" && !Array.isArray(execution) ? execution : undefined;
+    if (execution === undefined)
+        return undefined;
+    validateExecutionOverride(execution);
+    return execution;
 }

package/dist/services/harness-adapter.js

@@ -1,12 +1,59 @@
 import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { AppError } from "../shared/errors.js";
 const maxAdapterOutputBytes = 1_000_000;
+/** Native hooks need a real executable, not a PATH-dependent shell expression. */
+export function prepareHarnessFlowExecutable(context, stateDir) {
+    const configured = context.env.DD_FLOW_BIN;
+    if (configured !== undefined) {
+        if (!path.isAbsolute(configured) || !fs.existsSync(configured))
+            throw new AppError("harness_runtime_missing", "DD_FLOW_BIN must identify an existing absolute executable", 2);
+        if (path.basename(configured) === "dd-flow")
+            return configured;
+    }
+    const isolated = path.join(context.ddFlowHome, "bin", "dd-flow");
+    if (!configured && fs.existsSync(isolated))
+        return isolated;
+    const entry = fileURLToPath(new URL("../cli.js", import.meta.url));
+    if (!configured && !fs.existsSync(entry))
+        throw new AppError("harness_runtime_unbuilt", "Build the CLI or supply its pinned DD_FLOW_BIN before launching a harness", 1);
+    // The trusted lifecycle parser recognizes this basename, including for a
+    // custom pinned executable. Do not broaden that parser to arbitrary scripts.
+    const executable = path.join(stateDir, "dd-flow");
+    const dispatch = configured
+        ? `const { spawnSync } = await import("node:child_process");\nconst child = spawnSync(${JSON.stringify(configured)}, process.argv.slice(2), { stdio: "inherit", env: process.env });\nif (child.error) throw child.error;\nif (child.signal) process.kill(process.pid, child.signal);\nprocess.exit(child.status ?? 1);\n`
+        : `await import(${JSON.stringify(pathToFileURL(entry).href)});\n`;
+    const contents = `#!${process.execPath}\nprocess.env.DD_FLOW_HOME = ${JSON.stringify(context.ddFlowHome)};\n${dispatch}`;
+    try {
+        fs.writeFileSync(executable, contents, { flag: "wx", mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST" || fs.readFileSync(executable, "utf8") !== contents)
+            throw new AppError("harness_runtime_binding_conflict", "Launch runtime executable already has different content", 1, { path: executable });
+    }
+    return executable;
+}
 /** Runs one harness command with the lifecycle guarantees shared by agent services. */
 export function runHarnessAdapter(input) {
     const timeoutMs = input.timeoutMs ?? 120_000;
+    if (!input.operationId.trim())
+        throw new AppError("operation_id_required", "Harness calls require a scoped operation id", 2);
+    // The current adapter transport uses this name; its identity is runtime-owned,
+    // never the operation or trusted daemon identity of the calling coordinator.
+    const env = { ...input.env, DD_EVAL_OPERATION_ID: input.operationId };
+    delete env.DD_FLOW_DAEMON_ID;
+    delete env.DD_FLOW_SCOPE_CONTROL_TOKEN;
+    delete env.DD_FLOW_RUNTIME_OWNER;
+    if (input.runtimeOwner) {
+        if (!path.isAbsolute(input.executable) || input.runtimeOwner.adapter_executable !== undefined && input.runtimeOwner.adapter_executable !== input.executable)
+            throw new AppError("harness_runtime_binding_conflict", "Owned harness call must use its frozen absolute adapter executable", 1);
+        env.DD_FLOW_RUNTIME_OWNER = JSON.stringify({ ...input.runtimeOwner, adapter_executable: input.executable });
+    }
     return new Promise((resolve, reject) => {
         const detached = process.platform !== "win32";
-        const child = spawn(input.executable, input.args, { env: input.env, detached, stdio: ["ignore", "pipe", "pipe"] });
+        const child = spawn(input.executable, input.args, { env, ...(input.cwd ? { cwd: input.cwd } : {}), detached, stdio: ["ignore", "pipe", "pipe"] });
         let stdout = "";
         let stderr = "";
         let outputTooLarge = false;
@@ -21,7 +68,7 @@ export function runHarnessAdapter(input) {
         catch { /* The process already settled. */ } };
         const heartbeat = input.progress && input.progressMessage ? setInterval(() => input.progress?.(`${input.progressMessage}; waiting for adapter completion`), 15_000) : undefined;
         const timer = setTimeout(() => { timedOut = true; terminate("SIGTERM"); killTimer = setTimeout(() => terminate("SIGKILL"), 5_000); }, timeoutMs);
-        const evidence = (value) => input.onEvidence?.({ executable: input.executable, args: input.args, ...value, at: new Date().toISOString() });
+        const evidence = (value) => input.onEvidence?.({ operation_id: input.operationId, executable: input.executable, args: input.args, ...value, at: new Date().toISOString() });
         const append = (current, chunk) => {
             if (Buffer.byteLength(current) + Buffer.byteLength(chunk) > maxAdapterOutputBytes) {
                 outputTooLarge = true;

package/dist/services/hooks.js

@@ -14,7 +14,7 @@ import { registerProject, requireProjectByRoot } from "./projects.js";
 import { activeFlowSessionsForProject, bindObservedFlowSession, flowSessionPayloadFromRegisterCommand, recordFlowSessionObservation } from "./sessions.js";
 const defaultProfileName = "default";
 const maxSanitizedSummaryLength = 1600;
-const sharedEntries = [
+export const codexHomeSharedEntries = [
     "auth.json",
     "auth.bk",
     "sessions",
@@ -51,7 +51,7 @@ export function planCodexHome(context, input) {
         config_path: paths.configPath,
         hooks_path: paths.hooksPath,
         owned_files: ["config.toml", "hooks.json", ".dd-flow-home.json", "log/", ".tmp/", "tmp/"],
-        shared_entries: sharedEntries,
+        shared_entries: codexHomeSharedEntries,
         exists: fs.existsSync(paths.targetHome),
         codex_env: { CODEX_HOME: paths.targetHome }
     };
@@ -1118,7 +1118,7 @@ function objectTable(value) {
 function createSharedLinks(sourceHome, targetHome) {
     const linked = [];
     const skipped = [];
-    for (const entry of sharedEntries) {
+    for (const entry of codexHomeSharedEntries) {
         const source = path.join(sourceHome, entry);
         const target = path.join(targetHome, entry);
         if (!fs.existsSync(source)) {
@@ -1141,7 +1141,7 @@ function createSharedLinks(sourceHome, targetHome) {
     return { linked, skipped };
 }
 function removeSharedSymlinks(targetHome) {
-    for (const entry of sharedEntries) {
+    for (const entry of codexHomeSharedEntries) {
         const target = path.join(targetHome, entry);
         if (fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()) {
             fs.rmSync(target);
@@ -1154,7 +1154,7 @@ function removeDirIfEmpty(dir) {
     }
 }
 function sharedEntryStatus(sourceHome, targetHome) {
-    return sharedEntries.map((entry) => {
+    return codexHomeSharedEntries.map((entry) => {
         const source = path.join(sourceHome, entry);
         const target = path.join(targetHome, entry);
         return {

package/dist/services/managed-daemon-binding.js

@@ -0,0 +1,38 @@
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { managedProcessRuntimeHome, managedProcessStatus } from "./managed-processes.js";
+export function readNativeDaemonState(stateDir) {
+    if (!path.isAbsolute(stateDir))
+        throw new AppError("daemon_owner_mismatch", "Native state directory must be absolute", 1);
+    return JSON.parse(fs.readFileSync(path.join(stateDir, "daemon.json"), "utf8"));
+}
+/** A shared directory or logical owner is not a physical provider binding. */
+export function managedProviderBelongsToDaemon(provider, daemon, state) {
+    const child = JSON.parse(provider.metadata_json), parent = JSON.parse(daemon.metadata_json);
+    return provider.kind === daemon.kind.replace(/-daemon$/, "-provider")
+        && state.provider_process?.id === provider.id && state.provider_process.lease_token === provider.lease_token
+        && Boolean(provider.pid && provider.pid_started_at && daemon.pid && daemon.pid_started_at)
+        && state.provider_pid === provider.pid && child.owner_pid === daemon.pid && child.owner_pid_started_at === daemon.pid_started_at
+        && provider.owner_id === daemon.owner_id && provider.project_id === daemon.project_id && provider.run_id === daemon.run_id && provider.work_id === daemon.work_id
+        && child.state_dir === parent.state_dir && child.role === parent.role && child.dd_flow_home === parent.dd_flow_home && child.adapter_executable === parent.adapter_executable
+        && child.dispatch_barrier === "run-generation@1" && child.budget?.scope_id === parent.budget?.scope_id;
+}
+/** Identity proof only. Liveness and clean shutdown are separate caller decisions. */
+export function requireManagedDaemonBinding(context, input) {
+    const state = readNativeDaemonState(input.stateDir);
+    const owner = state.config?.runtime_owner;
+    const record = managedProcessStatus(context).find(record => record.id === state.resource_process?.id);
+    const metadata = record && JSON.parse(record.metadata_json);
+    if (!record || !owner || !record.kind.endsWith("-daemon")
+        || record.lease_token !== state.resource_process?.lease_token
+        || !record.pid || record.pid !== state.pid || !record.pid_started_at
+        || record.owner_id !== owner.owner_id || input.ownerId !== undefined && record.owner_id !== input.ownerId
+        || record.project_id !== input.projectId || owner.project_id !== input.projectId
+        || record.run_id !== input.runId || owner.run_id !== input.runId
+        || metadata?.state_dir !== input.stateDir || owner.state_dir !== input.stateDir
+        || owner.dd_flow_home !== context.ddFlowHome || managedProcessRuntimeHome(record, context) !== context.ddFlowHome) {
+        throw new AppError("daemon_owner_mismatch", "Native daemon has no proven physical ownership in this RUN and runtime home", 1);
+    }
+    return { state, process: record };
+}

package/dist/services/managed-processes.js

@@ -1,12 +1,47 @@
 import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
 import { spawnSync } from "node:child_process";
 import net from "node:net";
 import { getResourceDatabase } from "../storage/database.js";
+import { AppError } from "../shared/errors.js";
+export function managedProcessBinding(record, home) {
+    return { resource_home: home, process_id: record.id, registration_sha256: crypto.createHash("sha256").update(JSON.stringify([home, record.id, record.kind, record.owner_id, record.lease_token, record.pid, record.pid_started_at, record.project_id, record.run_id, record.work_id, record.check_id, record.operation_id, record.metadata_json])).digest("hex") };
+}
 const defaultLeaseMs = 15 * 60_000;
 export function resourceHome(context) {
     return context.env?.DD_FLOW_RESOURCE_HOME ?? context.ddFlowHome ?? "/tmp/dd-flow-runtime";
 }
+/** Runtime IDs are home-local; a shared host registry needs this extra scope. */
+export function managedProcessRuntimeHome(record, authority) {
+    const metadata = parseMetadata(record.metadata_json);
+    if (metadata.dd_flow_home !== undefined)
+        return typeof metadata.dd_flow_home === "string" && path.isAbsolute(metadata.dd_flow_home) ? metadata.dd_flow_home : null;
+    // Older native registrations can still prove their home from the retained
+    // exact daemon owner; PID or project/RUN labels alone never establish it.
+    if (typeof metadata.state_dir === "string" && path.isAbsolute(metadata.state_dir)) {
+        try {
+            const state = JSON.parse(fs.readFileSync(path.join(metadata.state_dir, "daemon.json"), "utf8"));
+            const owner = state.config?.runtime_owner;
+            if (owner?.owner_id === record.owner_id && owner.project_id === record.project_id && owner.run_id === record.run_id && owner.state_dir === metadata.state_dir && typeof owner.dd_flow_home === "string" && path.isAbsolute(owner.dd_flow_home))
+                return owner.dd_flow_home;
+        }
+        catch { /* No retained native scope proof. */ }
+    }
+    if (record.kind === "run-controller" && authority.db.get("SELECT 1 FROM sqlite_schema WHERE name = 'run_controllers'") && authority.db.get("SELECT 1 FROM run_controllers WHERE controller_id = ? AND process_id = ? AND process_lease_token = ? AND project_id = ? AND run_id = ?", [record.owner_id, record.id, record.lease_token, record.project_id, record.run_id]))
+        return authority.ddFlowHome;
+    if (record.kind === "run-control" && authority.db.get("SELECT 1 FROM sqlite_schema WHERE name = 'run_control_workers'") && authority.db.get("SELECT 1 FROM run_control_workers w JOIN run_controls c ON c.control_id = w.control_id WHERE w.control_id = ? AND w.process_id = ? AND w.process_lease_token = ? AND c.project_id = ? AND c.run_id = ?", [record.owner_id, record.id, record.lease_token, record.project_id, record.run_id]))
+        return authority.ddFlowHome;
+    return null;
+}
 export function registerManagedProcess(context, input) {
+    const observer = input.kind === "eval-observer";
+    const observerBirth = observer && input.pid ? processStartedAt(input.pid) : null;
+    if (observer) {
+        if (!Number.isSafeInteger(input.pid) || !input.pid || input.pid < 1 || !observerBirth || input.ownerPid !== undefined && input.ownerPid !== input.pid || input.processGroupId !== undefined && input.processGroupId !== input.pid)
+            throw new AppError("process_ownership_unknown", "EVAL observer registration requires its live self-owned process identity", 1);
+        input = { ...input, ownerPid: input.pid, uniqueActiveOperation: true };
+    }
     if (!input.uniqueActiveOperation)
         return insertManagedProcess(context, input);
     if (!input.operationId)
@@ -16,8 +51,13 @@ export function registerManagedProcess(context, input) {
     try {
         const existing = db.get("SELECT * FROM managed_processes WHERE operation_id = ? AND state IN ('starting','running','stopping','orphaned')", [input.operationId]);
         if (existing)
-            throw Object.assign(new Error("The operation already owns a managed process; observe it instead of spawning a duplicate"), { code: "managed_operation_in_progress", details: { process_id: existing.id, operation_id: input.operationId } });
-        const result = insertManagedProcess(context, input);
+            throw new AppError("managed_operation_in_progress", "The operation already owns a managed process; observe it instead of spawning a duplicate", 1, { process_id: existing.id, operation_id: input.operationId });
+        let result = insertManagedProcess(context, input);
+        if (observer) {
+            result = confirmManagedProcess(context, { id: result.id, leaseToken: result.lease_token, pid: input.pid, ...(input.processGroupId ? { processGroupId: input.processGroupId } : {}) });
+            if (result.pid_started_at !== observerBirth || !processIsAlive(result))
+                throw new AppError("process_ownership_unknown", "EVAL observer changed before registration committed", 1);
+        }
         db.exec("COMMIT");
         return result;
     }
@@ -33,7 +73,7 @@ function insertManagedProcess(context, input) {
     const token = crypto.randomUUID();
     db.run(`INSERT INTO managed_processes
       (id, kind, pid, pid_started_at, owner_id, lease_token, lease_expires_at, project_id, run_id, work_id, check_id, operation_id, stdout_path, stderr_path, state, started_at, updated_at, finished_at, termination_reason, metadata_json)
-     VALUES (?, ?, NULL, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'starting', ?, ?, NULL, NULL, ?)`, [id, input.kind, input.ownerId, token, leaseExpiry(now, input.leaseMs), input.projectId ?? null, input.runId ?? null, input.workId ?? null, input.checkId ?? null, input.operationId ?? null, input.stdoutPath ?? null, input.stderrPath ?? null, now, now, JSON.stringify({ ...input.metadata, ...(input.ownerPid ? { owner_pid: input.ownerPid, owner_pid_started_at: processStartedAt(input.ownerPid) } : {}) })]);
+     VALUES (?, ?, NULL, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'starting', ?, ?, NULL, NULL, ?)`, [id, input.kind, input.ownerId, token, leaseExpiry(now, input.leaseMs), input.projectId ?? null, input.runId ?? null, input.workId ?? null, input.checkId ?? null, input.operationId ?? null, input.stdoutPath ?? null, input.stderrPath ?? null, now, now, JSON.stringify({ ...input.metadata, dd_flow_home: context.ddFlowHome, ...(input.ownerPid ? { owner_pid: input.ownerPid, owner_pid_started_at: processStartedAt(input.ownerPid) } : {}) })]);
     return requireProcess(db, id);
 }
 export function confirmManagedProcess(context, input) {
@@ -67,7 +107,11 @@ export function finishManagedProcess(context, input) {
     const updated = db.run("UPDATE managed_processes SET state = ?, termination_reason = ?, finished_at = ?, updated_at = ?, lease_expires_at = ? WHERE id = ? AND lease_token = ? AND state IN ('starting','running','stopping','orphaned')", [input.state, input.reason ?? null, now, now, now, input.id, input.leaseToken]).changes === 1;
     if (updated)
         db.run("DELETE FROM managed_resources WHERE process_id = ?", [input.id]);
-    return updated;
+    if (updated)
+        return true;
+    // Another client may have completed the same lease after our initial read.
+    const current = requireProcess(db, input.id);
+    return current.lease_token === input.leaseToken && current.state === input.state;
 }
 export function processIsAlive(record) {
     if (!record.pid)
@@ -140,18 +184,21 @@ export async function stopManagedProcess(context, input) {
         throw new Error("Managed process lease does not match");
     if (["stopped", "failed"].includes(record.state) && !processTreeIsAlive(record))
         return record;
+    if (!record.pid || !record.pid_started_at)
+        throw Object.assign(new Error("Managed process has no confirmed physical identity; retain its pending launch"), { code: "process_identity_unknown" });
     db.run("UPDATE managed_processes SET state = 'stopping', updated_at = ? WHERE id = ? AND lease_token = ? AND state IN ('starting','running','orphaned')", [context.now(), record.id, record.lease_token]);
     if (processTreeIsAlive(record)) {
         terminateOwnedProcess(record, "SIGTERM");
         await delay(input.graceMs ?? 1_000);
-        if (processTreeIsAlive(record)) {
+        if (input.force !== false && processTreeIsAlive(record)) {
             terminateOwnedProcess(record, "SIGKILL");
             await delay(250);
         }
         if (processTreeIsAlive(record))
             throw Object.assign(new Error("Owned process tree could not be safely stopped; resources retained"), { code: "process_tree_not_settled", details: { process_id: record.id } });
     }
-    finishManagedProcess(context, { id: record.id, leaseToken: record.lease_token, state: "stopped", reason: input.reason ?? "requested_stop" });
+    if (!finishManagedProcess(context, { id: record.id, leaseToken: record.lease_token, state: "stopped", reason: input.reason ?? "requested_stop" }))
+        throw Object.assign(new Error("Managed process ownership changed before settlement"), { code: "process_lease_lost" });
     return requireProcess(db, record.id);
 }
 /** Reconcile only records the system owns and has atomically claimed. */
@@ -206,7 +253,7 @@ function registry(context) { return getResourceDatabase(resourceHome(context));
 function requireProcess(db, id) { const row = db.get("SELECT * FROM managed_processes WHERE id = ?", [id]); if (!row)
     throw new Error(`Managed process is missing: ${id}`); return row; }
 function leaseExpiry(now, leaseMs = defaultLeaseMs) { return new Date(Date.parse(now) + leaseMs).toISOString(); }
-function processStartedAt(pid) { const result = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8" }); const value = result.status === 0 ? result.stdout.trim() : ""; return value || null; }
+export function processStartedAt(pid) { const result = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8" }); const value = result.status === 0 ? result.stdout.trim() : ""; return value || null; }
 function releasePortClaims(db, claims) { for (const claim of claims)
     db.run("DELETE FROM managed_resources WHERE resource_kind = 'port' AND resource_key = ? AND lease_token = ?", [claim.key, claim.token]); }
 function terminateOwnedProcess(record, signal) {