@deksden-com/dd-flow-cli 0.9.0-beta.46 → 0.9.0-beta.47

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.47
+
+### Patch Changes
+
+- Initialize the managed Codex hook home for external worker sessions so their
+  first `work start` receives a trusted session binding.
+
 ## 0.9.0-beta.44
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.46",
-  "cli_commit": "412219119d588c6d1a3178dd4bd80a54535bebc7",
-  "built_at": "2026-09-10T19:17:56.481Z",
+  "cli_version": "0.9.0-beta.47",
+  "cli_commit": "c6ad5bc48196d4f9a616667b737363c04d837e4e",
+  "built_at": "2026-09-10T20:41:49.668Z",
   "built_with_canon": {
     "version": "4.1.0",
     "commit": "ef349bf47cba1c987468e51d73a0dbadbd48dc1f",

package/dist/services/external-work-launch.js

@@ -9,6 +9,7 @@ import { harnessRuntimeArguments, resolveHarnessCommand } from "./harness-config
 import { resolveExecutionPolicy, runtimeHarness, validateExecutionOverride } from "./execution-policy.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
 import { assertWorkLaunchReady, workStartCommand } from "./work-registry.js";
+import { initCodexHome } from "./hooks.js";
 /**
  * Creates an external provider root for one already-created Work.  The launch
  * is not a Work claim: only the worker's trusted `work start` hook binds it.
@@ -47,7 +48,16 @@ export async function launchExternalWork(context, input) {
     fs.mkdirSync(root, { recursive: true });
     const now = context.now();
     const flowExecutable = prepareHarnessFlowExecutable(context, root);
-    const runtimeContext = { ...context, env: { ...context.env, DD_FLOW_BIN: flowExecutable } };
+    const env = { ...context.env, DD_FLOW_BIN: flowExecutable };
+    // An external Codex root is a fresh thread, so it does not inherit the
+    // coordinator's managed PreToolUse hook.  Its first `work start` must emit
+    // that hook event to bind the Work to the physical session.
+    if (runtimeHarness(resolved.worker) === "codex-desktop") {
+        const codexHome = path.join(root, "codex-home");
+        initCodexHome(context, { projectRoot: run.project_root, profile: `external-${operationId}`, targetHome: codexHome, ...(context.env.CODEX_HOME ? { sourceHome: context.env.CODEX_HOME } : {}) });
+        env.CODEX_HOME = codexHome;
+    }
+    const runtimeContext = { ...context, env };
     const runtimeOwner = { schema_id: "dd-flow/runtime-owner@1", owner_id: `run:${work.run_id}:work:${work.work_id}`, role: "worker", project_id: work.project_id, run_id: work.run_id, work_id: work.work_id, operation_id: operationId, state_dir: root, dd_flow_home: context.ddFlowHome, dd_flow_bin: flowExecutable, resource_home: context.env.DD_FLOW_RESOURCE_HOME ?? context.ddFlowHome, budget: runtimeBudgetForRun(context, work.project_id, work.run_id) };
     const executable = resolveHarnessCommand(context.ddFlowHome, runtimeHarness(resolved.worker), "adapter");
     context.db.run("INSERT INTO work_launches (operation_id, work_id, profile_json, profile_hash, status, state_dir, journal_path, provider_session_id, adapter_receipt_json, created_at, updated_at) VALUES (?, ?, ?, ?, 'launching', ?, ?, NULL, NULL, ?, ?)", [operationId, work.work_id, JSON.stringify({ ...resolved, runtime_adapter: { executable, owner: runtimeOwner } }), resolved.profile_hash, root, journal, now, now]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.46",
+  "version": "0.9.0-beta.47",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {