@deksden-com/dd-flow-cli 0.9.0-beta.39 → 0.9.0-beta.40

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.40
+
+### Patch Changes
+
+- 2b4b714: Admit ordinary managed HITL answers through their exact generation-bound native
+  prompt, preserving pause, Session, raw-answer and prompt integrity. Keep accepted
+  answer intent separate from physical delivery so stop drains native operations
+  and recovery can deliver an unanswered pause without replaying completed work.
+- c5eeb6f: Capture owned Codex home configuration and evidence without copying shared host
+  history or ephemeral helper links. Reuse the provisioned shared-entry contract
+  and retain strict rejection of unrelated external recovery artifact links.
+
 ## 0.9.0-beta.39
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.39",
-  "cli_commit": "adabaee64d3de604908351aa1ee048208c1dd249",
-  "built_at": "2026-09-09T16:08:31.531Z",
+  "cli_version": "0.9.0-beta.40",
+  "cli_commit": "652524c6f370aa17c75474de5ebb7b3b9bf0b3a2",
+  "built_at": "2026-09-09T17:31:05.981Z",
   "built_with_canon": {
     "version": "4.1.0",
     "commit": "ef349bf47cba1c987468e51d73a0dbadbd48dc1f",

package/dist/cli/run-cli.js

@@ -59,6 +59,7 @@ import { fenceRuntimeBudget, runtimeBudgetStatus, admitRuntimeCheck, parseRuntim
 import { stopRuntimeScope } from "../services/runtime-scope-stop.js";
 import { launchRuntimeScopeControl, launchRuntimeScopeResume, serveRuntimeScopeControl } from "../services/runtime-scope-worker.js";
 import { launchRunController, resumeRunController, serveRunController, runControllerStatus, answerRunController, supplyRunControllerContext } from "../services/run-controller.js";
+import { controllerHitlAdmission } from "../services/run-controller-adapter.js";
 import { controlLifecycleReply, runControlStatus } from "../services/run-control.js";
 import { requestRunControl, serveRunControl } from "../services/run-control-worker.js";
 import { startRuntimeService } from "../services/runtime-service.js";
@@ -1810,7 +1811,8 @@ async function dispatchRuntime(context, command, parsed, progress) {
             }
             const run = context.db.get("SELECT status FROM runs WHERE project_id = ? AND id = ?", [record.project_id, record.run_id]);
             const retainedHitlPrompt = recovering && ["paused", "waiting_for_user"].includes(run?.status ?? "") && ["session.prompt", "session.resume"].includes(optionalOption(parsed, "operation") ?? "") && context.db.get("SELECT 1 FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND g.run_id = ? AND g.generation = ? AND b.daemon_id = ? AND b.provider_session_id = ?", [record.project_id, record.run_id, metadata.run_generation, optionalOption(parsed, "daemon-id"), optionalOption(parsed, "native-session-id")]);
-            if (!run || run.status !== "running" && !retainedHitlPrompt && !["judge", "probe"].includes(metadata.role ?? ""))
+            const acceptedHitlPrompt = ["paused", "waiting_for_user"].includes(run?.status ?? "") && controllerHitlAdmission(context, record, { stateDir: requiredOption(parsed, "state-dir"), operationId: optionalOption(parsed, "operation-id"), operation: optionalOption(parsed, "operation"), nativeSessionId: optionalOption(parsed, "native-session-id"), promptSha256: optionalOption(parsed, "prompt-sha256") });
+            if (!run || run.status !== "running" && !retainedHitlPrompt && !acceptedHitlPrompt && !["judge", "probe"].includes(metadata.role ?? ""))
                 throw new AppError("invalid_run_state", "Subject dispatch requires a running RUN or its retained recovery/HITL prompt", 1);
         }
         const budget = reserveProviderTurn(context, record, { operationId: optionalOption(parsed, "operation-id") ?? "", operation: optionalOption(parsed, "operation") ?? "", sessionId: optionalOption(parsed, "native-session-id"), daemonId: optionalOption(parsed, "daemon-id") });

package/dist/services/eval-snapshots.js

@@ -14,6 +14,7 @@ import { readVnextFlowDefinition } from "./vnext-specify.js";
 import { assertRunWorkResultArtifacts, runWorkResultArtifactIssues } from "./work-registry.js";
 import { captureRecoveryDatabase, readRecoveryResourceEvidence } from "./recovery-snapshot-database.js";
 import { resourceHome } from "./managed-processes.js";
+import { codexHomeSharedEntries } from "./hooks.js";
 /** Capture the only flow boundary which exists before `stage start --bootstrap` creates a RUN. */
 export function createEvalBootstrapSnapshot(context, input) {
     const projectRoot = resolveProjectRoot(input.projectRoot);
@@ -134,16 +135,17 @@ function captureEvalRunSnapshot(context, input) {
     fs.mkdirSync(output, { recursive: true, mode: 0o700 });
     const resourceDatabase = path.join(context.ddFlowHome, "runtime.sqlite");
     const databaseFiles = [context.db.path, resourceDatabase].flatMap(file => [file, `${file}-wal`, `${file}-shm`]);
+    const codexExclusions = codexHomeSnapshotExclusions(context, project.id, input.runId);
     if (recovery) {
         if (typeof status.run.run_root !== "string" || !isInside(physicalPath(context.ddFlowHome), physicalPath(status.run.run_root)) || samePath(physicalPath(context.ddFlowHome), physicalPath(status.run.run_root)))
             throw new AppError("snapshot_run_scope_invalid", "Recovery requires a RUN artifact root within its runtime", 1);
         for (const source of new Set([status.run.run_root, runtimeRunDir(context.ddFlowHome, project.id, input.runId)])) {
             if (fs.existsSync(source))
-                copyRuntimeTree(source, path.join(output, "runtime", path.relative(context.ddFlowHome, source)));
+                copyRuntimeTree(source, path.join(output, "runtime", path.relative(context.ddFlowHome, source)), true, codexExclusions);
         }
     }
     else
-        copyRuntimeTree(context.ddFlowHome, path.join(output, "runtime"), false, databaseFiles);
+        copyRuntimeTree(context.ddFlowHome, path.join(output, "runtime"), false, [...databaseFiles, ...codexExclusions]);
     // VACUUM INTO is a consistent SQLite read snapshot, including committed WAL
     // pages. Copying the live database and its WAL separately is not atomic.
     const databaseCopy = path.join(output, "runtime", path.relative(context.ddFlowHome, context.db.path));
@@ -734,6 +736,35 @@ function snapshotSourceVersion(context, input) {
         ...roots.map(root => [treeHash(root, true), treeModesHash(root, true), git(root, ["symbolic-ref", "--quiet", "HEAD"]), gitBytes(root, ["show-ref", "--head"]).toString("base64"), indexEntries(root).toString("base64")])
     ])).digest("hex");
 }
+/** Managed Codex homes share host configuration, not owned snapshot payload. */
+function codexHomeSnapshotExclusions(context, projectId, runId) {
+    const homes = new Set(context.db.all("SELECT target_home FROM codex_home_profiles WHERE project_id = ?", [projectId]).map(row => row.target_home));
+    if (context.db.get("SELECT 1 FROM sqlite_schema WHERE name = 'run_controllers'")) {
+        for (const { home } of context.db.all("SELECT json_extract(value, '$.codex_home') AS home FROM run_controllers, json_each(state_json, '$.sessions') WHERE project_id = ? AND run_id = ?", [projectId, runId]))
+            if (home)
+                homes.add(home);
+    }
+    const excluded = [];
+    for (const home of homes) {
+        if (!path.isAbsolute(home) || !fs.existsSync(home) || fs.lstatSync(home).isSymbolicLink())
+            continue;
+        const marker = path.join(home, ".dd-flow-home.json");
+        if (!fs.existsSync(marker) || fs.lstatSync(marker).isSymbolicLink())
+            continue;
+        const identity = JSON.parse(fs.readFileSync(marker, "utf8"));
+        if (identity.managed_by !== "dd-flow-cli" || identity.project_id !== projectId || identity.target_home !== home || !identity.source_home || !path.isAbsolute(identity.source_home))
+            continue;
+        for (const entry of codexHomeSharedEntries) {
+            const file = path.join(home, entry);
+            // Skip only the exact links installed by initCodexHome, never arbitrary
+            // external links or owned local files with the same convenient name.
+            if (fs.lstatSync(file, { throwIfNoEntry: false })?.isSymbolicLink() && fs.readlinkSync(file) === path.join(identity.source_home, entry))
+                excluded.push(file);
+        }
+        excluded.push(path.join(home, "tmp"), path.join(home, ".tmp"));
+    }
+    return excluded;
+}
 /** Copy a dedicated home or scoped recovery tree, preserving SQLite WAL commits. */
 function copyRuntimeTree(source, destination, scoped = true, excluded = []) {
     if (fs.lstatSync(source).isSymbolicLink())
@@ -794,6 +825,7 @@ function copyRuntimeTree(source, destination, scoped = true, excluded = []) {
 }
 function captureRecoveryAuxiliary(context, captured, input) {
     const runtime = path.join(input.output, "runtime");
+    const codexExclusions = codexHomeSnapshotExclusions(context, input.projectId, input.runId);
     const run = captured.db.get("SELECT run_root, project_root, workspace_root FROM runs WHERE project_id = ? AND id = ?", [input.projectId, input.runId]);
     const roots = [run.run_root, runtimeRunDir(context.ddFlowHome, input.projectId, input.runId)];
     for (const protocol of captured.db.all("SELECT id, state_path, plan_path FROM protocols")) {
@@ -801,7 +833,7 @@ function captureRecoveryAuxiliary(context, captured, input) {
         if (!isInside(physicalPath(context.ddFlowHome), physicalPath(directory)))
             throw new AppError("snapshot_protocol_scope_invalid", "Protocol runtime leaves DD_FLOW_HOME", 1);
         if (fs.existsSync(directory)) {
-            copyRuntimeTree(directory, path.join(runtime, path.relative(context.ddFlowHome, directory)));
+            copyRuntimeTree(directory, path.join(runtime, path.relative(context.ddFlowHome, directory)), true, codexExclusions);
             roots.push(directory);
         }
         for (const file of [protocol.state_path, protocol.plan_path]) {
@@ -848,7 +880,7 @@ function captureRecoveryAuxiliary(context, captured, input) {
             if (!owner || owner.project_id !== input.projectId || owner.run_id !== input.runId || owner.owner_id !== process.owner_id || owner.dd_flow_home !== context.ddFlowHome || owner.resource_home !== home || owner.state_dir !== directory)
                 throw new AppError("snapshot_native_scope_invalid", "External native artifact root has no matching RUN owner", 1, { state_dir: directory });
             const relative = path.join("native-evidence", crypto.createHash("sha256").update(directory).digest("hex"));
-            copyRuntimeTree(directory, path.join(runtime, relative));
+            copyRuntimeTree(directory, path.join(runtime, relative), true, codexExclusions);
             nativeCaptures.set(directory, relative);
         }
         const relative = path.join("resource-evidence", `${crypto.createHash("sha256").update(home).digest("hex")}.json`);

package/dist/services/hooks.js

@@ -14,7 +14,7 @@ import { registerProject, requireProjectByRoot } from "./projects.js";
 import { activeFlowSessionsForProject, bindObservedFlowSession, flowSessionPayloadFromRegisterCommand, recordFlowSessionObservation } from "./sessions.js";
 const defaultProfileName = "default";
 const maxSanitizedSummaryLength = 1600;
-const sharedEntries = [
+export const codexHomeSharedEntries = [
     "auth.json",
     "auth.bk",
     "sessions",
@@ -51,7 +51,7 @@ export function planCodexHome(context, input) {
         config_path: paths.configPath,
         hooks_path: paths.hooksPath,
         owned_files: ["config.toml", "hooks.json", ".dd-flow-home.json", "log/", ".tmp/", "tmp/"],
-        shared_entries: sharedEntries,
+        shared_entries: codexHomeSharedEntries,
         exists: fs.existsSync(paths.targetHome),
         codex_env: { CODEX_HOME: paths.targetHome }
     };
@@ -1118,7 +1118,7 @@ function objectTable(value) {
 function createSharedLinks(sourceHome, targetHome) {
     const linked = [];
     const skipped = [];
-    for (const entry of sharedEntries) {
+    for (const entry of codexHomeSharedEntries) {
         const source = path.join(sourceHome, entry);
         const target = path.join(targetHome, entry);
         if (!fs.existsSync(source)) {
@@ -1141,7 +1141,7 @@ function createSharedLinks(sourceHome, targetHome) {
     return { linked, skipped };
 }
 function removeSharedSymlinks(targetHome) {
-    for (const entry of sharedEntries) {
+    for (const entry of codexHomeSharedEntries) {
         const target = path.join(targetHome, entry);
         if (fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()) {
             fs.rmSync(target);
@@ -1154,7 +1154,7 @@ function removeDirIfEmpty(dir) {
     }
 }
 function sharedEntryStatus(sourceHome, targetHome) {
-    return sharedEntries.map((entry) => {
+    return codexHomeSharedEntries.map((entry) => {
         const source = path.join(sourceHome, entry);
         const target = path.join(targetHome, entry);
         return {

package/dist/services/run-controller-adapter.js

@@ -1,8 +1,43 @@
 import crypto from "node:crypto";
+import fs from "node:fs";
 import { AppError } from "../shared/errors.js";
 import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
 import { runtimeHarness } from "./execution-policy.js";
-import { appendEvent, digest, errorRecord } from "./run-controller-state.js";
+import { appendEvent, digest, digestBytes, errorRecord } from "./run-controller-state.js";
+/** A paused RUN admits only its controller's exact accepted answer Turn. */
+export function controllerHitlAdmission(context, record, input) {
+    if (input.operation !== "session.prompt" || !input.operationId || !input.promptSha256)
+        return false;
+    if (!context.db.get("SELECT 1 FROM sqlite_schema WHERE name = 'run_controller_operations'"))
+        return false;
+    const row = context.db.get("SELECT * FROM run_controllers WHERE controller_id = ? AND project_id = ? AND run_id = ? AND status = 'waiting_for_user'", [record.owner_id, record.project_id, record.run_id]);
+    if (!row || row.generation !== JSON.parse(record.metadata_json).run_generation)
+        return false;
+    const suffix = `:prompt:${row.generation}`;
+    if (!input.operationId.endsWith(suffix))
+        return false;
+    const state = JSON.parse(row.state_json);
+    const session = state.current_session === null ? undefined : state.sessions[state.current_session];
+    if (!session || session.stopped || session.id !== input.nativeSessionId || session.state_dir !== input.stateDir || session.owner.owner_id !== record.owner_id)
+        return false;
+    const operation = (id) => context.db.get("SELECT input_json, input_hash FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'dispatching'", [id, row.controller_id, row.generation]);
+    const answer = context.db.get("SELECT input_json, input_hash FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation <= ? AND status = 'accepted'", [input.operationId.slice(0, -suffix.length), row.controller_id, row.generation]);
+    const prompt = operation(input.operationId);
+    if (!answer || !prompt)
+        return false;
+    const accepted = JSON.parse(answer.input_json);
+    const dispatch = JSON.parse(prompt.input_json);
+    const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [record.project_id, record.run_id]);
+    const stage = run && JSON.parse(run.index_json).stage_runs.find(item => item.stage === accepted.stage);
+    if (accepted.action !== "user_answer" || state.stage !== accepted.stage || stage?.status !== "paused" || !stage.pause || stage.pause.answer_path || stage.pause.id !== accepted.pause_id || stage.pause.work_id !== accepted.work_id)
+        return false;
+    if (answer.input_hash !== digest({ pause_id: accepted.pause_id, answer_sha256: accepted.sha256 }) || prompt.input_hash !== digest(dispatch))
+        return false;
+    const value = (option) => dispatch.args.includes(option) ? dispatch.args[dispatch.args.indexOf(option) + 1] : undefined;
+    if (dispatch.owner !== record.owner_id || dispatch.state_dir !== input.stateDir || dispatch.args[0] !== "session" || dispatch.args[1] !== "prompt" || value("--session-id") !== input.nativeSessionId || dispatch.prompt_sha256 !== input.promptSha256 || !value("--prompt-file"))
+        return false;
+    return digestBytes(fs.readFileSync(accepted.file)) === accepted.sha256 && digestBytes(fs.readFileSync(value("--prompt-file"))) === input.promptSha256;
+}
 export function sessionArguments(context, manifest, session) {
     const profile = session.profile;
     return ["--dd-flow-bin", manifest.flow_executable, "--dd-flow-home", context.ddFlowHome, "--project-root", manifest.request.project_root, "--state-dir", session.state_dir, "--journal", session.journal, "--cwd", session.cwd, "--provider", profile.provider, "--model", profile.model, "--reasoning", profile.reasoning, "--mode", profile.mode, "--permission", profile.permission, ...manifest.adapters[runtimeHarness(profile)].runtime_args, "--json"];
@@ -19,7 +54,7 @@ export async function controllerAdapter(context, row, manifest, session, args, a
     assertOwner?.();
     const operationId = retainedOperationId ?? `${row.controller_id}:${crypto.randomUUID()}`;
     const executable = manifest.adapters[runtimeHarness(session.profile)].executable;
-    const input = { executable, args, owner: session.owner.owner_id, state_dir: session.state_dir };
+    const input = { executable, args, owner: session.owner.owner_id, state_dir: session.state_dir, ...(args[0] === "session" && args[1] === "prompt" ? { prompt_sha256: digestBytes(fs.readFileSync(args[args.indexOf("--prompt-file") + 1])) } : {}) };
     const now = context.now();
     context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'dispatching', ?, ?)", [operationId, row.controller_id, row.generation, digest(input), JSON.stringify(input), now, now]);
     appendEvent(context, row.controller_id, "operation_requested", { operation_id: operationId, operation: args.slice(0, 2), session_id: session.id || null });

package/dist/services/run-controller.js

@@ -342,12 +342,12 @@ async function executeController(context, row, manifest, state, assertOwner, ass
         if (failure)
             throw failure.reason;
     };
-    const prompt = async (session, text) => {
+    const prompt = async (session, text, operationId) => {
         const file = path.join(row.state_dir, `turn-${String(state.turns + 1).padStart(5, "0")}.md`);
         fs.writeFileSync(file, `${text}\n`, { flag: "wx", mode: 0o600 });
         state.turns += 1;
         saveState(context, row, state);
-        const receipt = await call(session, ["session", "prompt", "--session-id", session.id, "--prompt-file", file, ...sessionArguments(context, manifest, session)]);
+        const receipt = await controllerAdapter(executionContext, row, manifest, session, ["session", "prompt", "--session-id", session.id, "--prompt-file", file, ...sessionArguments(context, manifest, session)], assertOwner, operationId);
         state.last_receipt = receipt;
         saveState(context, row, state);
         return receipt;
@@ -391,9 +391,10 @@ async function executeController(context, row, manifest, state, assertOwner, ass
             if (digestBytes(fs.readFileSync(input.file)) !== input.sha256)
                 throw new AppError("context_checksum_mismatch", "Accepted HITL answer bytes changed", 1);
             assertOwner();
-            context.db.run("UPDATE run_controller_operations SET status = 'dispatching', updated_at = ? WHERE operation_id = ? AND status = 'accepted'", [context.now(), answer.operation_id]);
+            // The accepted answer is logical intent; only its generation-bound
+            // adapter operation represents a physical dispatch that stop must drain.
             const command = `${flowCommand(executionContext)} stage resume ${run.id} --stage ${next.stage} --work ${input.work_id} --project-root ${JSON.stringify(run.project_root)} --answer-stdin --json < ${JSON.stringify(input.file)}`;
-            const receipt = await prompt(state.sessions[state.current_session], `The user supplied the raw answer for pause ${pause.id}. Your first tool call must be this exact standalone command:\n\n${command}\n\nDo not alter the answer. Follow the returned packet, then stop at this Stage boundary.`);
+            const receipt = await prompt(state.sessions[state.current_session], `The user supplied the raw answer for pause ${pause.id}. Your first tool call must be this exact standalone command:\n\n${command}\n\nDo not alter the answer. Follow the returned packet, then stop at this Stage boundary.`, `${answer.operation_id}:prompt:${row.generation}`);
             context.db.run("UPDATE run_controller_operations SET status = 'completed', receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify({ delivered: true, session_id: adapterSessionId(receipt) }), context.now(), answer.operation_id]);
             state.last_continuation = null;
             saveState(context, row, state);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.39",
+  "version": "0.9.0-beta.40",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {