@deksden-com/dd-flow-cli 0.9.0-beta.64 → 0.9.0-beta.74

package/dist/services/work-registry.js

@@ -7,7 +7,7 @@ import { findRecentMatchingHookEvent, claimStageLifecycleHookEvent, claimStageSt
 import { validateSchema } from "./schema-validation.js";
 import { resolveProjectRoot, resolveRunReferences } from "../storage/paths.js";
 import { refreshRunSessionProjection } from "./run-projection.js";
-import { readCodeCheckProfile, runCodeChecks, validateFailedCheckRetry, workspaceFingerprint } from "./code-checks.js";
+import { ignoredWorkspacePaths, normalizeWorkspacePath, readCodeCheckProfile, runCodeChecks, validateFailedCheckRetry, workspaceFingerprint } from "./code-checks.js";
 import { nextWorkId, nextWorkIds } from "./ids.js";
 import { appendFlowRunTimelineEvent } from "./runs.js";
 import { resolveStageTransition } from "./execution-policy.js";
@@ -188,23 +188,6 @@ export function listWorks(context, input) {
         }) };
 }
 export function showWork(context, id) { const work = requireWork(context, id); const sessions = context.db.all("SELECT ws.id, ws.work_id, ws.session_id, ws.hook_event_id, ws.status, ws.prompt_path, ws.result_path, ws.created_at, ws.completed_at, s.harness AS harness_id, COALESCE(s.provider_session_id, s.session_id) AS native_session_id FROM work_sessions ws LEFT JOIN sessions s ON s.project_id = ? AND s.session_id = ws.session_id WHERE ws.work_id = ? ORDER BY ws.created_at", [work.project_id, work.work_id]); return { work: { ...work, short_id: shortWorkId(work.work_id), payload: parsePayload(work), payload_json: undefined, depends_on: parseDependencies(work), sessions: sessions.map(({ session_id, harness_id, native_session_id, ...session }) => ({ ...session, ...(harness_id && native_session_id ? { session: publicSessionIdentity({ harness: harness_id, provider_session_id: native_session_id, session_id }) } : {}) })) } }; }
-/** Inspect materializations without changing either the accepted receipt or conflicting bytes. */
-export function runWorkResultArtifactIssues(context, projectId, runId, materializedPath = (file) => file) {
-    const works = context.db.all(`SELECT w.work_id, w.result, (SELECT ws.result_path FROM work_sessions ws WHERE ws.work_id = w.work_id ORDER BY ws.created_at DESC LIMIT 1) AS result_path FROM works w WHERE w.project_id = ? AND w.run_id = ? AND w.result_schema IS NOT NULL AND w.result IS NOT NULL AND w.status = 'completed'`, [projectId, runId]);
-    const issues = [];
-    for (const work of works) {
-        const file = work.result_path ? materializedPath(work.result_path) : null;
-        const actual = file && fs.existsSync(file) ? fs.readFileSync(file, "utf8") : null;
-        if (actual !== work.result)
-            issues.push({ code: actual === null ? "work_result_artifact_missing" : "work_result_artifact_drift", work_id: work.work_id, result_path: work.result_path, expected_sha256: crypto.createHash("sha256").update(work.result).digest("hex"), actual_sha256: actual === null ? null : crypto.createHash("sha256").update(actual).digest("hex") });
-    }
-    return issues;
-}
-export function assertRunWorkResultArtifacts(context, projectId, runId) {
-    const issue = runWorkResultArtifactIssues(context, projectId, runId)[0];
-    if (issue)
-        throw new AppError(issue.code, issue.code === "work_result_artifact_missing" ? "Completed structured Work has no retained result artifact" : "Completed Work result artifact no longer matches its authoritative receipt", 1, issue);
-}
 function receiptIntentPath(resultPath, sessionId) {
     return `${resultPath}.pending-${crypto.createHash("sha256").update(sessionId).digest("hex")}`;
 }
@@ -495,9 +478,9 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
     // Give each new-generation start its own immutable publication destination.
     const packetDirectory = generation > 0 ? path.join(directory, "starts", linkId) : directory;
     const promptPath = path.join(packetDirectory, "prompt.md"), resultPath = path.join(directory, "result.json");
-    // The expensive filesystem observation is not performed under the writer lock.
+    // The first reviewer freezes shared inputs in the same transaction as its claim.
     const readOnly = parsePayload(work)?.read_only === true;
-    const fingerprint = readOnly ? workspaceFingerprint(run.workspace_root) : undefined;
+    let fingerprint;
     let binding;
     try {
         binding = context.db.writeTransaction(() => {
@@ -518,6 +501,8 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
             let prompt = renderWorkerPrompt(context, current, run, dependencyResults);
             if (recovery)
                 prompt = `${recoveryPrompt(recovery)}\n\n${prompt}`;
+            if (readOnly)
+                fingerprint = sharedReviewInput(work, run, true) ?? workspaceFingerprint(run.workspace_root);
             const workContext = { schema_id: "dd-flow/work-context@1", run_id: current.run_id, work_id: current.work_id, parent_work_id: current.parent_work_id, project_root: run.project_root, workspace_root: run.workspace_root, run_root: requireRunHome(run), depends_on: parseDependencies(current), launch_policy: current.launch_policy, result_schema: current.result_schema, read_only: readOnly, ...(recovery ? { recovery } : {}), ...(readOnly ? { workspace_fingerprint: fingerprint } : {}) };
             const contextBytes = `${JSON.stringify(workContext, null, 2)}\n`;
             const response = { ok: true, work_id: current.work_id, work_session_id: linkId, worker_prompt_markdown: prompt, prompt_path: promptPath, ...(recovery ? { recovery } : {}), session_binding: { source: "PreToolUse", session: { harness_id: identity.harness, session_id: identity.nativeSessionId } } };
@@ -671,6 +656,27 @@ export function retryWork(context, id, reason) {
     refreshRunWorkProjection(context, work.project_id, work.run_id);
     return { ok: true, work_id: work.work_id, archived_attempt: path.relative(requireRunHome(run), archive).split(path.sep).join("/"), reason };
 }
+function sharedReviewInput(work, run, initialize = false) {
+    const kind = parsePayload(work)?.kind;
+    const relative = kind === "code-review" ? "06-code-review/review-context.json" : kind === "plan-review" ? "04-plan-review/work-context.json" : null;
+    if (!relative || !work.parent_work_id)
+        return null;
+    const file = path.join(requireRunHome(run), relative);
+    if (!fs.existsSync(file))
+        return null;
+    const value = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (value.read_only_input?.parent_work_id !== work.parent_work_id)
+        return null;
+    if (!value.read_only_input.fingerprint && initialize) {
+        // Called under the Work-start writer reservation, after stage setup has
+        // finished. The first reviewer accepts the input shared by this group.
+        value.read_only_input.fingerprint = workspaceFingerprint(run.workspace_root);
+        const temporary = `${file}.tmp-${crypto.randomUUID()}`;
+        fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`);
+        fs.renameSync(temporary, file);
+    }
+    return typeof value.read_only_input.fingerprint === "string" ? value.read_only_input.fingerprint : null;
+}
 async function settle(context, id, status, result, progress, retry) {
     const work = requireWork(context, id);
     assertWorkSettlementAllowed(context, work.project_id, work.run_id, work.work_id);
@@ -685,14 +691,21 @@ async function settle(context, id, status, result, progress, retry) {
         throw new AppError("runtime_missing", "Running Work has no open Work/Session link", 1, { work_id: id });
     let receipts = [];
     let coordinationDrift = [];
-    if (status === "completed") {
-        if (parsePayload(work)?.read_only === true) {
+    const assertReadOnlyInput = () => {
+        if (status === "completed" && parsePayload(work)?.read_only === true) {
+            const shared = sharedReviewInput(work, run);
+            // The final reviewer commits the shared input boundary under the writer
+            // reservation. Concurrent finishes cannot both skip this verification.
+            if (shared && context.db.get("SELECT 1 FROM works WHERE project_id = ? AND run_id = ? AND parent_work_id = ? AND work_id <> ? AND status IN ('created','running','paused') AND json_extract(payload_json, '$.read_only') = 1 AND json_extract(payload_json, '$.kind') = ? LIMIT 1", [work.project_id, work.run_id, work.parent_work_id, work.work_id, parsePayload(work)?.kind]))
+                return;
             const contextFile = link ? path.join(path.dirname(link.prompt_path), "context.json") : "";
-            const baseline = contextFile && fs.existsSync(contextFile) ? JSON.parse(fs.readFileSync(contextFile, "utf8")).workspace_fingerprint : null;
+            const baseline = shared ?? (contextFile && fs.existsSync(contextFile) ? JSON.parse(fs.readFileSync(contextFile, "utf8")).workspace_fingerprint : null);
             const current = workspaceFingerprint(run.workspace_root);
             if (typeof baseline !== "string" || baseline !== current)
-                throw new AppError("read_only_work_mutated_workspace", "Read-only Work changed the accepted workspace", 2, { work_id: work.work_id, baseline, current });
+                throw new AppError("read_only_input_changed", "The workspace changed during read-only Work; its review input is stale (the writer is unknown)", 2, { work_id: work.work_id, baseline, current });
         }
+    };
+    if (status === "completed") {
         validateWorkResult(work, result, run.project_root, run.workspace_root, requireRunHome(run), run.id, link?.result_path ?? null);
         const packet = codePacket(work);
         if (packet) {
@@ -716,6 +729,7 @@ async function settle(context, id, status, result, progress, retry) {
     const now = context.now();
     context.db.beginWriteTransaction();
     try {
+        assertReadOnlyInput();
         assertWorkSettlementAllowed(context, work.project_id, work.run_id, work.work_id);
         if (link && !context.db.get("SELECT 1 FROM work_sessions WHERE id = ? AND status = 'running'", [link.id]))
             throw new AppError("work_generation_stale", "Work Session was interrupted or superseded while checks ran", 1, { work_id: id });
@@ -749,7 +763,10 @@ function plannedAreaDrift(packet, result) {
     const changed = JSON.parse(result).changed_paths;
     if (!Array.isArray(changed) || packet.planned_write_areas.length === 0)
         return [];
-    return changed.filter((item) => typeof item === "string" && !packet.planned_write_areas.some((area) => item === area || item.startsWith(`${area}/`)));
+    return changed.filter((item) => typeof item === "string" && !packet.planned_write_areas.some((area) => {
+        const normalized = area.replace(/[\\/]+$/, "");
+        return item === normalized || item.startsWith(`${normalized}/`);
+    }));
 }
 function bindSession(context, work, run, identity, now) {
     const priorWorkSession = context.db.get("SELECT session_id FROM work_sessions WHERE work_id = ? ORDER BY created_at DESC LIMIT 1", [work.work_id])?.session_id ?? null;
@@ -811,6 +828,10 @@ function validateWorkResult(work, result, projectRoot, workspaceRoot, runHome, r
 }
 function validateCodeWorkResult(work, value, projectRoot, runHome, runId) {
     const result = value;
+    const changedPaths = (result.changed_paths ?? []).map((item) => normalizeWorkspacePath(projectRoot, item));
+    const ignored = ignoredWorkspacePaths(projectRoot, changedPaths);
+    if (ignored.length)
+        throw new AppError("environment_repair_not_product_change", "CODE Work must record ignored environment repair separately, not as a product changed_path", 2, { work_id: work.work_id, paths: ignored });
     if ((result.deviations?.length ?? 0) > 0 || (result.blockers?.length ?? 0) > 0)
         throw new AppError("work_contract_incomplete", "CODE Work cannot complete with unresolved deviations or blockers; fail the Work and report the contract mismatch", 2, { work_id: work.work_id, deviations: result.deviations ?? [], blockers: result.blockers ?? [] });
     const packet = codePacket(work);
@@ -829,7 +850,7 @@ function validateCodeWorkResult(work, value, projectRoot, runHome, runId) {
             assertPortableArtifactRef(ref, { workspaceRoot: projectRoot, runHome, runId });
     }
     const documentUpdates = (packet.document_updates ?? []);
-    const changed = new Set(result.changed_paths ?? []);
+    const changed = new Set(changedPaths);
     const missingDocuments = documentUpdates.map((entry) => entry.path).filter((entry) => !changed.has(entry));
     if (missingDocuments.length)
         throw new AppError("document_update_missing", "CODE Work did not materialize every document update assigned by PLAN", 2, { work_id: work.work_id, missing_paths: missingDocuments });
@@ -840,7 +861,7 @@ function validateCodeWorkResult(work, value, projectRoot, runHome, runId) {
     const assigned = packet.repair?.review_findings?.map((finding) => finding.finding_ref) ?? [];
     validateReviewResolutions(work.work_id, assigned, result.resolutions ?? []);
     if (assigned.length) {
-        if ((result.changed_paths?.length ?? 0) === 0)
+        if (changedPaths.length === 0)
             throw new AppError("review_repair_no_change", "Review repair must materialize a project change; a no-op cannot resolve a finding", 2, { work_id: work.work_id, findings: assigned });
         for (const resolution of result.resolutions ?? [])
             for (const ref of resolution.evidence_refs ?? [])

package/dist/shared/errors.js

@@ -9,6 +9,18 @@ export class AppError extends Error {
         this.details = details;
     }
 }
+/** Error fields must cross JSON boundaries as data: Error.message is not enumerable. */
+export function errorRecord(error, depth = 0) {
+    const value = error;
+    const details = value?.details && typeof value.details === "object" && !Array.isArray(value.details) ? value.details : {};
+    return {
+        code: typeof value?.code === "string" ? value.code : "unexpected",
+        message: typeof value?.message === "string" ? value.message : String(error),
+        exitCode: typeof value?.exitCode === "number" ? value.exitCode : 1,
+        details,
+        ...(value?.cause && depth < 3 ? { cause: errorRecord(value.cause, depth + 1) } : {})
+    };
+}
 export function isAppError(error) {
     return error instanceof AppError;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.64",
+  "version": "0.9.0-beta.74",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {