@deksden-com/dd-flow-cli 0.9.0-beta.64 → 0.9.0-beta.74

package/dist/harness-runtime/lib/dd-zcode-daemon.mjs

@@ -23,10 +23,21 @@ import {
 const REQUEST_SCHEMA = "dd-zcode/daemon-request@1";
 const RESPONSE_SCHEMA = "dd-zcode/daemon-response@1";
 const STATE_SCHEMA = "dd-zcode/daemon-state@1";
-// An agent can spend several minutes in a single tool operation or provider
-// turn without emitting an ACP update.  This is an idle deadline, not a
-// wall-clock cap: every observed update resets it.
+// ACP silence starts diagnostics; it is not a provider-failure deadline.
 export const DEFAULT_LIVENESS_TIMEOUT_MS = 600_000;
+export const DEFAULT_REQUEST_TIMEOUT_MS = null;
+
+function positiveDuration(value, name, fallback) {
+  const duration = value ?? fallback;
+  if (!Number.isFinite(duration) || duration <= 0) throw new DaemonError("invalid_duration", `${name} must be a positive finite duration`, false, { name, value: duration });
+  return duration;
+}
+
+function optionalDuration(value, name, fallback) {
+  if (value === null) return null;
+  if (value === undefined && fallback === null) return null;
+  return positiveDuration(value, name, fallback);
+}
 
 class DaemonError extends Error {
   constructor(code, message, retryable = false, details) {
@@ -114,7 +125,7 @@ export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 3
 }
 
 function sameConfig(state, config) {
-  return ["cwd", "journal", "bin", "zcodePath", "ddFlowBin", "ddFlowHome", "projectRoot", "resourceHome", "livenessTimeoutMs"].every((key) => (state.config?.[key] ?? null) === (config[key] ?? null));
+  return ["cwd", "journal", "bin", "zcodePath", "ddFlowBin", "ddFlowHome", "projectRoot", "resourceHome", "livenessTimeoutMs", "requestTimeoutMs"].every((key) => (state.config?.[key] ?? null) === (config[key] ?? null));
 }
 
 export async function startDaemon(options) {
@@ -135,7 +146,8 @@ export async function startDaemon(options) {
     projectRoot: options.projectRoot ? absolute(options.projectRoot, "--project-root") : null,
     resourceHome: process.env.DD_FLOW_RESOURCE_HOME ? absolute(process.env.DD_FLOW_RESOURCE_HOME, "DD_FLOW_RESOURCE_HOME") : null,
     env: options.ddFlowHome ? { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home") } : {},
-    livenessTimeoutMs: options.livenessTimeoutMs ?? DEFAULT_LIVENESS_TIMEOUT_MS,
+    livenessTimeoutMs: positiveDuration(options.livenessTimeoutMs, "livenessTimeoutMs", DEFAULT_LIVENESS_TIMEOUT_MS),
+    requestTimeoutMs: optionalDuration(options.requestTimeoutMs, "requestTimeoutMs", DEFAULT_REQUEST_TIMEOUT_MS),
   };
   await prepareRuntimeOwner(config, paths.dir);
   await mkdir(paths.dir, { recursive: true, mode: 0o700 });
@@ -230,7 +242,96 @@ export class DaemonRuntime {
     const known = this.sessions.get(params.sessionId);
     const adapter = params.adapterSessionId ?? known?.adapter_session_id ?? params.sessionId;
     const generation = this.activeGeneration ?? this.controlGeneration ?? 0;
-    return { ...this.state.config, ...params, knownChildSessionIds: known?.known_child_session_ids ?? [], adapterSessionId: adapter, daemonId: this.state.daemon_id, allowBackground: true, liveSession: this.liveAdapters.has(adapter), assertDispatch: () => { if (generation !== (this.controlGeneration ?? 0)) throw new DaemonError("operation_cancelled", "ZCode prompt was cancelled before native dispatch"); } };
+    return {
+      ...this.state.config, ...params, knownChildSessionIds: known?.known_child_session_ids ?? [], adapterSessionId: adapter,
+      daemonId: this.state.daemon_id, allowBackground: true, liveSession: this.liveAdapters.has(adapter),
+      assertDispatch: () => { if (generation !== (this.controlGeneration ?? 0)) throw new DaemonError("operation_cancelled", "ZCode prompt was cancelled before native dispatch"); },
+      // The bridge owns the quiet timer; the daemon owns the durable status.
+      // Do not infer provider state or cancel here.
+      onInactivity: async ({ requestId, sessionId, lastActivityAt, idleTimeoutMs }) => {
+        const request = this.state.active_request;
+        // `sessionId` is ACP identity; the durable request's `session_id` is
+        // native/provider identity. These strings can coincide but are not
+        // interchangeable.
+        if (!request || request.adapter_session_id !== sessionId) return;
+        const adapterSessionId = request.adapter_session_id;
+        let diagnostics;
+        try {
+          // Both are non-mutating native observations. In particular, do not
+          // inspect/resume a running child: some ZCode children are known to
+          // be non-resident and unsubscribable while their request is alive.
+          const [resident, topology] = await Promise.all([
+            this.bridge.request("zcode/session/resident", { sessionId: adapterSessionId }, 5_000),
+            this.bridge.request("zcode/session/retainedSubagents", { sessionId: adapterSessionId }, 5_000),
+          ]);
+          diagnostics = {
+            observed_at: new Date().toISOString(), adapter_session_id: adapterSessionId,
+            resident: resident?.resident === true,
+            child_session_ids: zcodeChildSessionIds(topology?.topology ?? topology),
+          };
+        } catch (error) {
+          diagnostics = { observed_at: new Date().toISOString(), adapter_session_id: adapterSessionId, observation_error: errorPayload(error) };
+        }
+        // The probe is asynchronous. Do not recreate a completed or
+        // reconnected request with a stale callback snapshot.
+        const current = this.state.active_request;
+        if (!current || current.request_id !== request.request_id || current.adapter_session_id !== adapterSessionId || this.activeGeneration !== request.generation) return;
+        await this.persist({ active_request: {
+          ...current,
+          observation: { state: "quiet", request_id: requestId, detected_at: new Date().toISOString(), last_activity_at: new Date(lastActivityAt).toISOString(), quiet_threshold_ms: idleTimeoutMs, diagnostics },
+        } });
+      },
+      // Native create publishes its identities before post-create work. Keep
+      // that allocation in the same durable request record so recovery can
+      // distinguish "no Session allocated" from "allocated, later step lost".
+      onSessionAliasAllocated: async (identity) => {
+        const current = this.state.active_request;
+        await this.persist({
+          active_request: {
+            ...(current ?? {
+              request_id: randomUUID(),
+              session_id: params.sessionId ?? null,
+              adapter_session_id: identity.adapter_session_id,
+              generation: this.controlGeneration ?? 0,
+              dispatched_at: new Date().toISOString(),
+            }),
+            allocation: {
+              adapter_session_id: identity.adapter_session_id,
+              provider_session_id: null,
+              cwd: identity.cwd,
+              allocated_at: new Date().toISOString(),
+            },
+          },
+        });
+      },
+      onSessionAllocated: async (identity) => {
+        const current = this.state.active_request;
+        // A late identity is evidence, not permission to resurrect a completed
+        // request or overwrite another operation's ownership.
+        this.track(identity);
+        if (!current || current.allocation?.adapter_session_id !== identity.adapter_session_id) {
+          await this.persist({});
+          return;
+        }
+        await this.persist({
+          active_request: {
+            ...(current ?? {
+              request_id: randomUUID(),
+              session_id: params.sessionId ?? null,
+              adapter_session_id: params.adapterSessionId ?? params.sessionId ?? null,
+              generation: this.controlGeneration ?? 0,
+              dispatched_at: new Date().toISOString(),
+            }),
+            allocation: {
+              adapter_session_id: identity.adapter_session_id,
+              provider_session_id: identity.provider_session_id,
+              cwd: identity.cwd,
+              allocated_at: new Date().toISOString(),
+            },
+          },
+        });
+      },
+    };
   }
 
   track(result, topology = result?.evidence?.subagents) {
@@ -265,19 +366,36 @@ export class DaemonRuntime {
     return evidence?.read?.projection?.status !== "idle" || !Array.isArray(children) || children.length > 0 || Boolean(evidence?.subagents?.observation_error);
   }
 
-  async productive(name, task) {
+  async productive(name, task, request = null) {
     if (this.activeProductive) throw new DaemonError("operation_busy", `${this.activeProductive} is already running`, true);
     this.activeProductive = name;
     this.activeGeneration = this.controlGeneration ?? 0;
     try {
-      await this.persist({ active_tree: true, active_operation: name });
+      await this.persist({ active_tree: true, active_operation: name, ...(request ? { active_request: request } : {}) });
       const result = await task();
       this.track(result);
       const running = this.treeRunning(result);
-      await this.persist({ active_tree: running, active_operation: null });
-      return result;
+      await this.persist({ active_tree: running, active_operation: null, active_request: null });
+      return { ...result, settled: !running };
     } catch (error) {
-      await this.persist({ active_operation: null });
+      // Keep an allocated identity visible until the controller seals the
+      // outcome. Clearing it here was the source of `provider_identity_unknown`
+      // after a late/partial create: the native Session existed, but the
+      // daemon state no longer carried the only correlation to it.
+      const active = this.state?.active_request;
+      try {
+        await this.persist({
+          active_operation: null,
+          active_request: active?.allocation
+            ? { ...active, outcome: "unknown", error: errorPayload(error) }
+            : null,
+        });
+      } catch (cleanupError) {
+        // Preserve the operation's primary failure if durable cleanup itself
+        // is unavailable. The caller will retain the outcome as unknown and
+        // the next recovery pass can retry the state write.
+        if (error && typeof error === "object") error.cleanup_error = errorPayload(cleanupError);
+      }
       throw error;
     } finally { this.activeProductive = null; this.activeGeneration = null; }
   }
@@ -303,7 +421,7 @@ export class DaemonRuntime {
       cwd: this.state.cwd, journal: this.state.journal, versions: this.state.versions,
       started_at: this.state.started_at, updated_at: this.state.updated_at,
       shutdown_state: this.state.shutdown_state, recovery_status: this.state.recovery_status,
-      active_tree: this.state.active_tree, active_operation: this.activeProductive,
+      active_tree: this.state.active_tree, active_operation: this.activeProductive, active_request: this.state.active_request ?? null,
       sessions: [...this.sessions.values()], config: this.state.config,
     };
     if (operation === "hook.resolve") {
@@ -312,10 +430,29 @@ export class DaemonRuntime {
       if (!session?.root_provider_session_id) throw new DaemonError("hook_identity_unknown", "ZCode hook Session is not a tracked controlled Session", false, { session_id: sessionId });
       return { daemonId: this.state.daemon_id, rootProviderSessionId: session.root_provider_session_id, parentProviderSessionId: session.parent_provider_session_id ?? null, observedProfile: this.bridge.modelProfiles?.get(sessionId) ?? {} };
     }
-    if (operation === "session.create") return await this.productive(operation, async () => await createSessionWithBridge(this.bridge, this.options(params), this.initialized));
+    if (operation === "session.create") {
+      const request = {
+        request_id: randomUUID(),
+        session_id: params.sessionId ?? null,
+        adapter_session_id: params.adapterSessionId ?? params.sessionId ?? null,
+        generation: this.controlGeneration ?? 0,
+        dispatched_at: new Date().toISOString(),
+        request_timeout_ms: this.state.config.requestTimeoutMs,
+      };
+      return await this.productive(operation, async () => await createSessionWithBridge(this.bridge, this.options(params), this.initialized), request);
+    }
     if (operation === "session.prompt") {
       if (this.sessions.get(params.sessionId)?.close_receipt) throw new DaemonError("session_closed", "Closed Session requires explicit recovery before another prompt");
-      const result = await this.productive(operation, async () => { await this.requireSettled(params); return await promptSessionWithBridge(this.bridge, this.options(params)); });
+      const known = this.sessions.get(params.sessionId);
+      const request = {
+        request_id: randomUUID(),
+        session_id: params.sessionId,
+        adapter_session_id: params.adapterSessionId ?? known?.adapter_session_id ?? params.sessionId,
+        generation: this.controlGeneration ?? 0,
+        dispatched_at: new Date().toISOString(),
+        request_timeout_ms: this.state.config.requestTimeoutMs,
+      };
+      const result = await this.productive(operation, async () => { await this.requireSettled(params); return await promptSessionWithBridge(this.bridge, { ...this.options(params), timeoutMs: request.request_timeout_ms }); }, request);
       const session = this.sessions.get(result.provider_session_id); if (session) session.completed_turns = (session.completed_turns ?? 0) + 1;
       await this.persist(); return result;
     }
@@ -327,6 +464,13 @@ export class DaemonRuntime {
         const topology = closed.topology;
         if (topology?.root_session_id !== params.sessionId || !Array.isArray(topology.child_session_ids) || topology.child_session_ids.some(id => typeof id !== "string" || !id)) return { ...closed, settled: false, observation_error: { code: "topology_incomplete", message: "closed Session has no native topology identity" } };
         const previous = this.state.settlement_observations?.[params.sessionId];
+        // A confirmed closed tree cannot resume through this daemon. Retain
+        // that terminal evidence even after its bridge has been retired.
+        for (const receipt of [previous, closed]) {
+          if (receipt?.close?.closed === true && receipt.settled === true
+            && receipt.topology?.complete === true && receipt.topology.root_session_id === params.sessionId
+            && Array.isArray(receipt.topology.child_session_ids)) return receipt;
+        }
         const known = [...new Set([...topology.child_session_ids, ...(previous?.topology?.child_session_ids ?? [])])];
         const observation = { ...closed, ...await observeClosedZcodeTree(this.bridge, params.sessionId, known), observed_at: new Date().toISOString() };
         // Observations are not ownership inventory: their timestamps must not
@@ -412,14 +556,36 @@ export class DaemonRuntime {
       }
     }
     if (unsettled.length) throw new DaemonError("tree_not_settled", "daemon still owns running Sessions", false, { sessions: unsettled });
+    // A cooperative close can make the native Session non-resident while its
+    // original ACP prompt is still pending.  For an explicitly whole-RUN
+    // cancellation this daemon owns the bridge process group, so retire that
+    // group now rather than reporting a clean-looking but still live tree.
+    // A per-child cancellation never takes this path.
+    let bridgeClosed = false;
+    if (this.activeProductive && cancel) {
+      try {
+        if (typeof this.bridge.close === "function") await this.bridge.close();
+        bridgeClosed = true;
+      } catch (error) {
+        throw new DaemonError(error.code ?? "provider_process_stop_incomplete", error.message ?? String(error), false);
+      }
+    }
     const deadline = Date.now() + 5000;
     while (this.activeProductive && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 50));
     if (this.activeProductive) throw new DaemonError("tree_not_settled", "productive operation did not settle after cancellation");
-    await this.persist({ active_tree: false, shutdown_state: "stopping", active_operation: null });
-    return { daemon_id: this.state.daemon_id, stopped: true, clean: true, _shutdown: true };
+    // The owned bridge process group is the physical stop barrier. A native
+    // closed/resident receipt only proves API state and cannot seal recovery.
+    // A bridge without a close method occurs only in in-memory diagnostics: it
+    // owns no OS process boundary. Production AcpBridge always has one.
+    try { if (!bridgeClosed && typeof this.bridge.close === "function") await this.bridge.close(); }
+    catch (error) { throw new DaemonError(error.code ?? "provider_process_stop_incomplete", error.message ?? String(error), false); }
+    await this.persist({ active_tree: false, shutdown_state: "stopping", active_operation: null, active_request: null, physical_settlement: { confirmed_at: new Date().toISOString(), bridge_pid: this.bridge.child?.pid ?? null } });
+    return { daemon_id: this.state.daemon_id, stopped: true, clean: true, physical_settlement: this.state.physical_settlement, _shutdown: true };
   }
 
   async shutdown() {
+    // prepareStop has already closed the owned bridge. Signal shutdown may get
+    // here directly, so close remains idempotent.
     await this.bridge.close();
     await this.persist({ active_tree: false, shutdown_state: "clean", stopped_at: new Date().toISOString() });
     const resourceProcess = this.state.resource_process;