@deksden-com/dd-flow-cli 0.9.0-beta.7 → 0.9.0-beta.74

package/dist/services/run-controller-adapter.js

@@ -0,0 +1,211 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
+import { runtimeHarness } from "./execution-policy.js";
+import { appendEvent, digest, digestBytes, errorRecord } from "./run-controller-state.js";
+/** A paused RUN admits only its controller's exact accepted answer Turn. */
+export function controllerHitlAdmission(context, record, input) {
+    if (input.operation !== "session.prompt" || !input.operationId || !input.promptSha256)
+        return false;
+    if (!context.db.get("SELECT 1 FROM sqlite_schema WHERE name = 'run_controller_operations'"))
+        return false;
+    const row = context.db.get("SELECT * FROM run_controllers WHERE controller_id = ? AND project_id = ? AND run_id = ? AND status = 'waiting_for_user'", [record.owner_id, record.project_id, record.run_id]);
+    if (!row || row.generation !== JSON.parse(record.metadata_json).run_generation)
+        return false;
+    const suffix = `:prompt:${row.generation}`;
+    if (!input.operationId.endsWith(suffix))
+        return false;
+    const state = JSON.parse(row.state_json);
+    const session = state.current_session === null ? undefined : state.sessions[state.current_session];
+    if (!session || session.stopped || session.id !== input.nativeSessionId || session.state_dir !== input.stateDir || session.owner.owner_id !== record.owner_id)
+        return false;
+    const operation = (id) => context.db.get("SELECT input_json, input_hash FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'dispatching'", [id, row.controller_id, row.generation]);
+    const answer = context.db.get("SELECT input_json, input_hash FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation <= ? AND status = 'accepted'", [input.operationId.slice(0, -suffix.length), row.controller_id, row.generation]);
+    const prompt = operation(input.operationId);
+    if (!answer || !prompt)
+        return false;
+    const accepted = JSON.parse(answer.input_json);
+    const dispatch = JSON.parse(prompt.input_json);
+    const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [record.project_id, record.run_id]);
+    const stage = run && JSON.parse(run.index_json).stage_runs.find(item => item.stage === accepted.stage);
+    if (accepted.action !== "user_answer" || state.stage !== accepted.stage || stage?.status !== "paused" || !stage.pause || stage.pause.answer_path || stage.pause.id !== accepted.pause_id || stage.pause.work_id !== accepted.work_id)
+        return false;
+    if (answer.input_hash !== digest({ pause_id: accepted.pause_id, answer_sha256: accepted.sha256 }) || prompt.input_hash !== digest(dispatch))
+        return false;
+    const value = (option) => dispatch.args.includes(option) ? dispatch.args[dispatch.args.indexOf(option) + 1] : undefined;
+    if (dispatch.owner !== record.owner_id || dispatch.state_dir !== input.stateDir || dispatch.args[0] !== "session" || dispatch.args[1] !== "prompt" || value("--session-id") !== input.nativeSessionId || dispatch.prompt_sha256 !== input.promptSha256 || !value("--prompt-file"))
+        return false;
+    return digestBytes(fs.readFileSync(accepted.file)) === accepted.sha256 && digestBytes(fs.readFileSync(value("--prompt-file"))) === input.promptSha256;
+}
+export function sessionArguments(context, manifest, session) {
+    const profile = session.profile;
+    return ["--dd-flow-bin", manifest.flow_executable, "--dd-flow-home", context.ddFlowHome, "--project-root", manifest.request.project_root, "--state-dir", session.state_dir, "--journal", session.journal, "--cwd", session.cwd, "--provider", profile.provider, "--model", profile.model, "--reasoning", profile.reasoning, "--mode", profile.mode, "--permission", profile.permission, ...manifest.adapters[runtimeHarness(profile)].runtime_args, "--json"];
+}
+export function controllerEnvironment(context, manifest, session) {
+    const env = { ...context.env, DD_FLOW_HOME: context.ddFlowHome, DD_FLOW_BIN: manifest.flow_executable, DD_FLOW_RESOURCE_HOME: manifest.resource_home, DD_FLOW_RUNTIME_BUDGET: manifest.budget ? JSON.stringify(manifest.budget) : undefined };
+    for (const key of ["DD_FLOW_CONTROLLER_TOKEN", "DD_FLOW_CONTROL_TOKEN", "DD_FLOW_DAEMON_ID", "DD_FLOW_RUNTIME_OWNER", "DD_FLOW_WORK_ID", "DD_FLOW_SESSION_ID", "CODEX_THREAD_ID"])
+        delete env[key];
+    if (session?.codex_home)
+        env.CODEX_HOME = session.codex_home;
+    return env;
+}
+function settlement(value) {
+    const state = value.settlement;
+    return state && typeof state === "object" && !Array.isArray(state) ? state : null;
+}
+function settlementInspectArgs(args) {
+    const values = ["session", "inspect"];
+    for (let index = 2; index < args.length; index += 1) {
+        const value = args[index];
+        if (["--prompt", "--prompt-file", "--answers-file", "--target-json"].includes(value)) {
+            index += 1;
+            continue;
+        }
+        values.push(value);
+    }
+    return values;
+}
+function settlementRetryArgs(args, operationId) {
+    const stateDir = args[args.indexOf("--state-dir") + 1];
+    if (!stateDir)
+        throw new AppError("settlement_recovery_required", "Harness settlement has no state directory", 1, { operation_id: operationId });
+    return ["daemon", "operation", "settle", "--state-dir", stateDir, "--operation-id", operationId, "--json"];
+}
+function operationInspectArgs(args, operationId) {
+    const stateDir = args[args.indexOf("--state-dir") + 1];
+    if (!stateDir)
+        throw new AppError("controller_operation_binding_unknown", "Harness operation has no state directory", 1, { operation_id: operationId });
+    return ["daemon", "operation", "--state-dir", stateDir, "--operation-id", operationId, "--json"];
+}
+function expectedMethod(args) {
+    return `${args[0]}.${args[1] === "status" ? "inspect" : args[1]}`;
+}
+function validateReceipt(receipt, session, args) {
+    // `daemon start --session-id` names the retained state being reopened; the
+    // start receipt itself is a daemon lifecycle result and need not echo a
+    // provider Session identity.  Only session operations promise that binding.
+    const target = args[0] === "session" && args.includes("--session-id") ? args[args.indexOf("--session-id") + 1] : null;
+    if (target && adapterSessionId(receipt) !== target)
+        throw new AppError("session_identity_mismatch", "Managed adapter reply belongs to another or unidentified Session", 1);
+    if (receipt.harness !== undefined && receipt.harness !== runtimeHarness(session.profile))
+        throw new AppError("profile_integrity_violation", "Managed adapter returned another harness identity", 1);
+    const fork = receipt.fork_receipt;
+    const forkUnproven = (args[0] === "session" && args[1] === "fork" && receipt.fork_continuity_error !== undefined)
+        || (fork && typeof fork === "object" && !Array.isArray(fork) && fork.history_prefix_proven === false);
+    if (forkUnproven) {
+        throw new AppError("fork_continuity_unproven", "Native fork exists but its source-history continuity is not proven", 1);
+    }
+}
+async function recoverCompletedOperation(context, manifest, session, executable, args, operationId, signal) {
+    // Creation has no stable client Session id yet. Its durable daemon journal
+    // is reconciled by run-control after the owner is fenced; probing it from the
+    // failing transport path would be a second adapter invocation and can itself
+    // be mistaken for replay.
+    if (args[0] === "session" && args[1] === "create")
+        return null;
+    // A detached adapter without a native daemon has no durable operation
+    // journal to inspect. Avoid a second adapter invocation in that case; the
+    // original failure remains outcome-unknown and the controller will fence it.
+    if (!fs.existsSync(path.join(session.state_dir, "daemon.json")))
+        return null;
+    let observed;
+    try {
+        observed = await runHarnessAdapter({ executable, args: operationInspectArgs(args, operationId), env: controllerEnvironment(context, manifest, session), operationId: `${operationId}:observe`, runtimeOwner: session.owner, timeoutMs: 30_000, ...(signal ? { signal } : {}) });
+    }
+    catch {
+        return null;
+    }
+    const target = args.includes("--session-id") ? args[args.indexOf("--session-id") + 1] : null;
+    const result = observed.result;
+    if (observed.operation_id !== operationId || observed.operation !== expectedMethod(args) || observed.state !== "completed"
+        || !result || typeof result !== "object" || Array.isArray(result)
+        || target && (observed.session_id !== target || adapterSessionId(result) !== target))
+        return null;
+    return { ...result, ...(settlement(observed) ? { settlement: settlement(observed) } : {}) };
+}
+async function awaitSettlement(context, row, manifest, session, executable, args, operationId, initial, assertOwner, signal) {
+    let current = initial, delay = 250;
+    const deadline = Date.now() + 120_000;
+    while (["pending", "blocked"].includes(String(settlement(current)?.state))) {
+        if (signal?.aborted)
+            throw new AppError("harness_settlement_interrupted", "Harness settlement was interrupted", 1, { operation_id: operationId });
+        if (Date.now() >= deadline)
+            throw new AppError("settlement_recovery_required", "Completed provider operation requires settlement recovery", 1, { operation_id: operationId, settlement: settlement(current) });
+        await new Promise(resolve => setTimeout(resolve, Math.min(delay, Math.max(0, deadline - Date.now()))));
+        delay = Math.min(delay * 2, 8_000);
+        assertOwner?.();
+        if (Date.now() >= deadline)
+            continue;
+        try {
+            // This only retries durable bookkeeping against the same operation
+            // receipt.  It cannot replay the provider request.
+            current = await runHarnessAdapter({ executable, args: settlementRetryArgs(args, operationId), env: controllerEnvironment(context, manifest, session), operationId: `${operationId}:settlement`, runtimeOwner: session.owner, timeoutMs: Math.min(30_000, Math.max(1, deadline - Date.now())), ...(signal ? { signal } : {}) });
+        }
+        catch (error) {
+            current = { settlement: { state: "pending", reason: "inspection_error", error: errorRecord(error) } };
+        }
+        if (!(["pending", "blocked"].includes(String(settlement(current)?.state))))
+            continue;
+        // A receipt without final tree proof needs a fresh native inspection.  Do
+        // it only after the receipt-only retry, and only when this is a session.
+        if (!args.includes("--session-id") || !["tree_unsettled", "settlement_evidence_required"].includes(String(settlement(current)?.reason)) || Date.now() >= deadline)
+            continue;
+        try {
+            current = await runHarnessAdapter({ executable, args: settlementInspectArgs(args), env: controllerEnvironment(context, manifest, session), operationId: `${operationId}:settlement-inspect`, runtimeOwner: session.owner, timeoutMs: Math.min(30_000, Math.max(1, deadline - Date.now())), ...(signal ? { signal } : {}) });
+        }
+        catch (error) {
+            current = { settlement: { state: "pending", reason: "inspection_error", error: errorRecord(error) } };
+        }
+    }
+    return current;
+}
+export async function controllerAdapter(context, row, manifest, session, args, assertOwner, retainedOperationId, signal) {
+    assertOwner?.();
+    const operationId = retainedOperationId ?? `${row.controller_id}:${crypto.randomUUID()}`;
+    const executable = manifest.adapters[runtimeHarness(session.profile)].executable;
+    const promptFile = args.indexOf("--prompt-file"), inlinePrompt = args.indexOf("--prompt");
+    const promptSha256 = promptFile >= 0 ? digestBytes(fs.readFileSync(args[promptFile + 1])) : inlinePrompt >= 0 ? digestBytes(args[inlinePrompt + 1] ?? "") : undefined;
+    const input = { executable, args, owner: session.owner.owner_id, state_dir: session.state_dir, ...(args[0] === "session" && args[1] === "prompt" && promptSha256 ? { prompt_sha256: promptSha256 } : {}) };
+    const now = context.now();
+    context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'dispatching', ?, ?)", [operationId, row.controller_id, row.generation, digest(input), JSON.stringify(input), now, now]);
+    appendEvent(context, row.controller_id, "operation_requested", { operation_id: operationId, operation: args.slice(0, 2), session_id: session.id || null });
+    try {
+        assertOwner?.();
+        let receipt = await runHarnessAdapter({ executable, args, env: controllerEnvironment(context, manifest, session), operationId, runtimeOwner: session.owner, timeoutMs: args[0] === "session" && args[1] === "prompt" ? null : 120_000, ...(signal ? { signal } : {}) });
+        if (["pending", "blocked"].includes(String(settlement(receipt)?.state))) {
+            const recovered = await awaitSettlement(context, row, manifest, session, executable, args, operationId, receipt, assertOwner, signal);
+            receipt = { ...receipt, settlement: settlement(recovered) };
+        }
+        context.db.run("UPDATE run_controller_operations SET receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(receipt), context.now(), operationId]);
+        validateReceipt(receipt, session, args);
+        context.db.run("UPDATE run_controller_operations SET status = 'completed', updated_at = ? WHERE operation_id = ?", [context.now(), operationId]);
+        assertOwner?.();
+        appendEvent(context, row.controller_id, "operation_completed", { operation_id: operationId, operation: args.slice(0, 2), session_id: adapterSessionId(receipt) });
+        return receipt;
+    }
+    catch (error) {
+        const retained = await recoverCompletedOperation(context, manifest, session, executable, args, operationId, signal);
+        if (retained) {
+            let receipt = retained;
+            if (["pending", "blocked"].includes(String(settlement(receipt)?.state))) {
+                const recovered = await awaitSettlement(context, row, manifest, session, executable, args, operationId, receipt, assertOwner, signal);
+                receipt = { ...receipt, settlement: settlement(recovered) };
+            }
+            context.db.run("UPDATE run_controller_operations SET receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(receipt), context.now(), operationId]);
+            validateReceipt(receipt, session, args);
+            context.db.run("UPDATE run_controller_operations SET status = 'completed', error_json = NULL, updated_at = ? WHERE operation_id = ?", [context.now(), operationId]);
+            assertOwner?.();
+            appendEvent(context, row.controller_id, "operation_recovered", { operation_id: operationId, operation: args.slice(0, 2), session_id: adapterSessionId(receipt) });
+            return receipt;
+        }
+        try {
+            context.db.run("UPDATE run_controller_operations SET status = CASE WHEN status = 'dispatching' THEN 'outcome_unknown' ELSE status END, error_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(errorRecord(error)), context.now(), operationId]);
+        }
+        catch (persistence) {
+            process.stderr.write(`${JSON.stringify({ operation_id: operationId, primary: errorRecord(error), persistence_error: errorRecord(persistence) })}\n`);
+        }
+        throw error;
+    }
+}

package/dist/services/run-controller-capture.js

@@ -0,0 +1,134 @@
+import fs from "node:fs";
+import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { AppError } from "../shared/errors.js";
+import { createEvalRunSnapshot, verifyControllerBoundarySnapshot } from "./eval-snapshots.js";
+import { observeControllerBoundary } from "./run-control.js";
+import { assertRunMutationAllowed, recoveryGuard } from "./run-recovery.js";
+import { appendEvent, digest, errorRecord, requireController, requireRun } from "./run-controller-state.js";
+import { getFlowRunStatus } from "./runs.js";
+import { recoveryObservationBudget, withRecoveryObservation } from "./recovery-observation-budget.js";
+/** Capture is performed by the productive owner, before it releases the next
+ * Stage. An observer never races the controller to copy a completed boundary. */
+export async function captureControllerBoundary(context, row, manifest, stage, nextStage, assertPhysicalOwner) {
+    const root = manifest.request.capture_root;
+    if (!root)
+        return;
+    const identity = (value) => ({ run_id: row.run_id, stage: value.stage, attempt: value.attempt ?? null, started_at: value.started_at ?? null, completed_at: value.completed_at ?? null });
+    const boundaryKey = digest(identity(stage));
+    const operationId = `${row.controller_id}:boundary:${boundaryKey}`;
+    const output = path.join(root, `${stage.stage}-${boundaryKey}`);
+    const scope = { projectRoot: manifest.request.project_root, runId: row.run_id };
+    const expected = { controllerId: row.controller_id, operationId, boundaryKey, runId: row.run_id, stageEntry: nextStage };
+    const prior = context.db.get("SELECT status,receipt_json FROM run_controller_operations WHERE operation_id = ?", [operationId]);
+    if (prior?.status === "completed") {
+        try {
+            const receipt = JSON.parse(prior.receipt_json ?? "{}");
+            if (typeof receipt.manifest_sha256 !== "string")
+                throw new AppError("controller_boundary_snapshot_invalid", "Completed capture has no immutable manifest receipt", 1);
+            verifyControllerBoundarySnapshot(output, { ...expected, manifestSha256: receipt.manifest_sha256 });
+            return;
+        }
+        catch (error) {
+            assertPhysicalOwner();
+            context.db.run("UPDATE run_controllers SET status = 'capture_failed', last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ?", [JSON.stringify(errorRecord(error)), context.now(), row.controller_id, row.owner_token]);
+            throw error;
+        }
+    }
+    context.db.beginWriteTransaction();
+    try {
+        assertPhysicalOwner();
+        assertRunMutationAllowed(context, row.project_id, row.run_id, row.generation);
+        const now = context.now();
+        context.db.run("UPDATE run_controllers SET status = 'capturing', updated_at = ? WHERE controller_id = ? AND owner_token = ?", [now, row.controller_id, row.owner_token]);
+        context.db.run("INSERT INTO run_controller_operations (operation_id,controller_id,generation,input_hash,input_json,status,created_at,updated_at) VALUES (?,?,?,?,?,'capturing',?,?) ON CONFLICT(operation_id) DO UPDATE SET generation = excluded.generation, status = 'capturing', error_json = NULL, updated_at = excluded.updated_at", [operationId, row.controller_id, row.generation, boundaryKey, JSON.stringify({ action: "boundary_capture", ...identity(stage), stage_entry: nextStage, output }), now, now]);
+        appendEvent(context, row.controller_id, "boundary_capture_requested", { operation_id: operationId, boundary_key: boundaryKey, stage: stage.stage, stage_entry: nextStage });
+        context.db.exec("COMMIT");
+    }
+    catch (error) {
+        context.db.exec("ROLLBACK");
+        throw error;
+    }
+    const assertCurrent = () => {
+        assertPhysicalOwner();
+        const guard = recoveryGuard(context, row.project_id, row.run_id);
+        if ((guard?.generation ?? 0) !== row.generation || ["draining", "sealed", "resuming"].includes(guard?.status ?? ""))
+            throw new AppError("run_recovery_guarded", "Recovery or operator control superseded boundary capture", 1);
+        if (requireController(context, row.controller_id).status !== "capturing" || context.db.get("SELECT status FROM run_controller_operations WHERE operation_id = ?", [operationId])?.status !== "capturing")
+            throw new AppError("controller_capture_owner_lost", "Controller no longer owns boundary capture", 1);
+        const index = JSON.parse(requireRun(context, row.project_id, row.run_id).index_json);
+        const current = index.stage_runs.find(item => item.stage === stage.stage);
+        if (!current || !["done", "skipped"].includes(current.status) || digest(identity(current)) !== boundaryKey)
+            throw new AppError("controller_boundary_changed", "Stage identity changed after its capture fence", 1);
+        const continuation = getFlowRunStatus(context, scope).continuation;
+        if (nextStage ? continuation.kind !== "start_stage" || continuation.stage !== nextStage : continuation.kind !== "terminal")
+            throw new AppError("controller_boundary_changed", "Stage successor changed after its capture fence", 1);
+    };
+    let priorObservation = null;
+    try {
+        priorObservation = prior?.receipt_json ? JSON.parse(prior.receipt_json) : null;
+    }
+    catch {
+        priorObservation = { recovery_observation: { remaining_ms: 0 } };
+    }
+    const observationBudget = recoveryObservationBudget(priorObservation);
+    try {
+        let receipt;
+        if (fs.existsSync(output)) {
+            assertCurrent();
+            receipt = verifyControllerBoundarySnapshot(output, expected);
+        }
+        else {
+            let lastPending = "";
+            for (;;) {
+                if (observationBudget.exhausted()) {
+                    context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(COALESCE(receipt_json, '{}'), '$.recovery_observation', json(?)), updated_at = ? WHERE operation_id = ?", [JSON.stringify(observationBudget.state()), context.now(), operationId]);
+                    throw new AppError("recovery_observation_budget_exhausted", "Boundary capture has no stable settlement within the active observation budget", 1, { recovery_observation: observationBudget.state() });
+                }
+                assertCurrent();
+                let verify = () => { throw new AppError("controller_boundary_unsettled", "Boundary has no stable writer observation", 1); };
+                const observation = await withRecoveryObservation(observationBudget, () => observeControllerBoundary(context, { ...scope, controllerId: row.controller_id, operationId, assertCurrent, retainVerification: value => { verify = value; } }));
+                if (observation.settled === true) {
+                    try {
+                        createEvalRunSnapshot(context, { ...scope, output, ...(nextStage ? { stageEntry: nextStage } : { candidate: true }), boundary: { controllerId: row.controller_id, operationId, boundaryKey, observation, verify } });
+                        receipt = verifyControllerBoundarySnapshot(output, expected);
+                        break;
+                    }
+                    catch (error) {
+                        if (!(error instanceof AppError) || !["snapshot_source_changed", "owned_inventory_changed"].includes(error.code))
+                            throw error;
+                        observation.settled = false;
+                        observation.pending_reasons = [error.code];
+                    }
+                }
+                observationBudget.exhausted();
+                const published = { ...observation, recovery_observation: observationBudget.state() };
+                const pending = digest(observation.pending_reasons);
+                context.db.run("UPDATE run_controller_operations SET receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(published), context.now(), operationId]);
+                if (pending !== lastPending) {
+                    appendEvent(context, row.controller_id, "boundary_capture_pending", { operation_id: operationId, pending_reasons: observation.pending_reasons });
+                    lastPending = pending;
+                }
+                await delay(observationBudget.nextDelay());
+            }
+        }
+        context.db.beginWriteTransaction();
+        try {
+            assertCurrent();
+            context.db.run("UPDATE run_controller_operations SET status = 'completed', receipt_json = ?, error_json = NULL, updated_at = ? WHERE operation_id = ?", [JSON.stringify(receipt), context.now(), operationId]);
+            appendEvent(context, row.controller_id, "boundary_captured", { ...identity(stage), boundary_key: boundaryKey, operation_id: operationId, ...receipt });
+            context.db.run("UPDATE run_controllers SET status = 'running', updated_at = ? WHERE controller_id = ? AND owner_token = ?", [context.now(), row.controller_id, row.owner_token]);
+            context.db.exec("COMMIT");
+        }
+        catch (error) {
+            context.db.exec("ROLLBACK");
+            throw error;
+        }
+    }
+    catch (error) {
+        observationBudget.exhausted();
+        context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(COALESCE(receipt_json, '{}'), '$.recovery_observation', json(?)) WHERE operation_id = ?", [JSON.stringify(observationBudget.state()), operationId]);
+        context.db.run("UPDATE run_controller_operations SET status = 'failed', error_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(errorRecord(error)), context.now(), operationId]);
+        throw error;
+    }
+}

package/dist/services/run-controller-process.js

@@ -0,0 +1,189 @@
+import fs from "node:fs";
+import crypto from "node:crypto";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { AppError } from "../shared/errors.js";
+import { getResourceDatabase } from "../storage/database.js";
+import { finishManagedProcess, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processStartedAt, processTreeIsAlive, registerManagedProcess } from "./managed-processes.js";
+import { setFlowRunRecoveryPaused } from "./runs.js";
+import { assertRunMutationAllowed, recoveryGuard } from "./run-recovery.js";
+import { requireRun, requireController, controllerReceipt, appendEvent, digest, errorRecord } from "./run-controller-state.js";
+const launchId = (row) => `${row.controller_id}:owner-launch:${digest(row.owner_token)}`;
+const processOperation = (context, row) => `controller:${digest({ database: context.db.path, project: row.project_id, run: row.run_id })}`;
+const birth = () => ({ pid: process.pid, pid_started_at: processStartedAt(process.pid) });
+const dead = (value) => Boolean(value && Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.pid_started_at === "string" && value.pid_started_at && !processIsAlive(value));
+/** Called inside the RUN intent transaction, before the client can disappear. */
+export function recordControllerLauncher(context, row, retired) {
+    const request = { action: "controller_owner_launch", owner_id: launchId(row) };
+    const receipt = { ...birth(), registration: "controller_self@1", ...(retired ? { retired_process: { id: retired.id, lease_token: retired.lease_token, pid: retired.pid, pid_started_at: retired.pid_started_at } } : {}) };
+    const now = context.now();
+    context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, receipt_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'completed', ?, ?, ?)", [launchId(row), row.controller_id, row.generation, digest(request), JSON.stringify(request), JSON.stringify(receipt), now, now]);
+}
+function launchRecord(context, row) {
+    const record = context.db.get("SELECT receipt_json FROM run_controller_operations WHERE operation_id = ?", [launchId(row)]);
+    if (!record)
+        return null;
+    const value = JSON.parse(record.receipt_json);
+    return value?.registration === "controller_self@1" ? { ...record, value } : null;
+}
+function assertLaunchAllowed(context, row) {
+    const run = requireRun(context, row.project_id, row.run_id);
+    if (!["running", "paused", "waiting_for_user"].includes(run.status))
+        throw new AppError("invalid_run_state", "A terminal RUN cannot start a physical controller", 1);
+    const state = JSON.parse(row.state_json);
+    if (!state.recovery) {
+        assertRunMutationAllowed(context, row.project_id, row.run_id, row.generation);
+        return;
+    }
+    const guard = recoveryGuard(context, row.project_id, row.run_id);
+    if (guard?.generation !== row.generation || guard.recovery_id !== state.recovery.recovery_id || !["sealed", "resuming"].includes(guard.status)
+        || !context.db.get("SELECT 1 FROM run_controls WHERE control_id = ? AND recovery_id = ? AND status = 'resuming'", [state.recovery.control_id, state.recovery.recovery_id]))
+        throw new AppError("run_control_superseded", "Controller launch no longer owns the accepted recovery", 1);
+}
+function retire(context, row, identity) {
+    const record = managedProcessStatus(context).find(item => item.id === identity.id);
+    if (!record || record.kind !== "run-controller" || record.owner_id !== row.controller_id || record.project_id !== row.project_id || record.run_id !== row.run_id
+        || managedProcessRuntimeHome(record, context) !== context.ddFlowHome || record.lease_token !== identity.lease_token || record.pid !== identity.pid || record.pid_started_at !== identity.pid_started_at || !dead(identity) || processTreeIsAlive(record)
+        || !finishManagedProcess(context, { id: record.id, leaseToken: record.lease_token, state: "stopped", reason: "controller_launch_owner_retired" }))
+        throw new AppError("controller_owner_unsettled", "Prior controller identity is not proven dead and retired", 1);
+}
+/** Retry only before productive admission, with exact prior birth and journal CAS. */
+function prepareSpawn(context, row) {
+    const launch = launchRecord(context, row);
+    if (!launch || launch.value.dispatch_ready || !["starting", "running", "recovery_required"].includes(row.status))
+        return null;
+    const resourceContext = { ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: JSON.parse(row.manifest_json).resource_home } };
+    const ours = launch.value.pid === process.pid && launch.value.pid_started_at === processStartedAt(process.pid);
+    let token = row.owner_token;
+    if (!ours) {
+        if (row.owner_pid) {
+            if (launch.value.owner?.pid !== row.owner_pid || !dead(launch.value.owner))
+                return null;
+            const records = managedProcessStatus(resourceContext).filter(item => item.operation_id === processOperation(context, row));
+            const owned = records.filter(item => { const metadata = JSON.parse(item.metadata_json); return metadata.owner_pid === row.owner_pid && metadata.owner_pid_started_at === launch.value.owner.pid_started_at; });
+            if (owned.length > 1 || row.process_id && owned[0]?.id !== row.process_id)
+                return null;
+            const record = owned[0];
+            if (records.some(item => item.id !== record?.id && (item.state !== "stopped" || !item.pid_started_at || processTreeIsAlive(item))))
+                return null;
+            if (record) {
+                if (record.kind !== "run-controller" || record.owner_id !== row.controller_id || record.project_id !== row.project_id || record.run_id !== row.run_id || managedProcessRuntimeHome(record, context) !== context.ddFlowHome || row.process_lease_token && record.lease_token !== row.process_lease_token || record.pid !== null && record.pid !== row.owner_pid || processTreeIsAlive(record))
+                    return null;
+                if (record.pid === null) {
+                    const db = getResourceDatabase(JSON.parse(row.manifest_json).resource_home);
+                    if (db.run("UPDATE managed_processes SET pid = ?, pid_started_at = ? WHERE id = ? AND lease_token = ? AND pid IS NULL", [row.owner_pid, launch.value.owner.pid_started_at, record.id, record.lease_token]).changes !== 1)
+                        return null;
+                }
+                retire(resourceContext, row, { id: record.id, lease_token: record.lease_token, ...launch.value.owner });
+            }
+        }
+        else {
+            if (row.process_id || row.process_lease_token || !dead(launch.value))
+                return null;
+            if (launch.value.child && !dead(launch.value.child))
+                return null;
+            if (managedProcessStatus(resourceContext).some(item => item.operation_id === processOperation(context, row) && item.id !== launch.value.retired_process?.id && (item.state !== "stopped" || !item.pid_started_at || processTreeIsAlive(item))))
+                return null;
+        }
+        token = crypto.randomUUID();
+    }
+    else if (row.owner_pid || launch.value.spawn_started)
+        return null;
+    if (launch.value.retired_process)
+        retire(resourceContext, row, launch.value.retired_process);
+    context.db.beginWriteTransaction();
+    try {
+        assertLaunchAllowed(context, row);
+        const changed = context.db.run(`UPDATE run_controllers SET owner_token = ?, owner_pid = NULL, process_id = NULL, process_lease_token = NULL, status = 'starting', last_error_json = NULL, updated_at = ?
+      WHERE controller_id = ? AND owner_token = ? AND owner_pid IS ? AND process_id IS ? AND status = ? AND state_json = ?
+        AND (SELECT receipt_json FROM run_controller_operations WHERE operation_id = ?) = ?`, [token, context.now(), row.controller_id, row.owner_token, row.owner_pid, row.process_id, row.status, row.state_json, launchId(row), launch.receipt_json]);
+        if (changed.changes !== 1) {
+            context.db.exec("ROLLBACK");
+            return null;
+        }
+        const current = requireController(context, row.controller_id);
+        if (!ours) {
+            recordControllerLauncher(context, current);
+            appendEvent(context, row.controller_id, "launch_owner_reconciled", { prior_launch: launchId(row), generation: row.generation, prior_process_id: row.process_id });
+        }
+        context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.spawn_started', json('true')), updated_at = ? WHERE operation_id = ?", [context.now(), launchId(current)]);
+        context.db.exec("COMMIT");
+        return current;
+    }
+    catch (error) {
+        context.db.exec("ROLLBACK");
+        throw error;
+    }
+}
+/** The physical child records its own birth before resource registration. */
+export function claimControllerProcess(context, row) {
+    const launch = launchRecord(context, row);
+    if (!launch && (!row.process_id || !row.process_lease_token))
+        throw new AppError("controller_owner_mismatch", "Managed registration is not authorized", 1);
+    context.db.beginWriteTransaction();
+    try {
+        const claimed = context.db.run("UPDATE run_controllers SET owner_pid = ?, status = 'running', updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [process.pid, context.now(), row.controller_id, row.owner_token]);
+        if (claimed.changes !== 1)
+            throw new AppError("controller_already_owned", "Managed owner has already claimed this launch", 1);
+        if (launch)
+            context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.owner', json(?)), updated_at = ? WHERE operation_id = ?", [JSON.stringify(birth()), context.now(), launchId(row)]);
+        context.db.exec("COMMIT");
+    }
+    catch (error) {
+        context.db.exec("ROLLBACK");
+        throw error;
+    }
+    if (!row.process_id) {
+        const manifest = JSON.parse(row.manifest_json);
+        const resourceContext = { ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: manifest.resource_home } };
+        const log = path.join(row.state_dir, "controller.log");
+        const record = registerManagedProcess(resourceContext, { kind: "run-controller", ownerId: row.controller_id, projectId: row.project_id, runId: row.run_id, operationId: processOperation(context, row), uniqueActiveOperation: true, ownerPid: process.pid, stdoutPath: log, stderrPath: log, metadata: { controller_id: row.controller_id, state_dir: row.state_dir, role: "controller", budget: manifest.budget } });
+        row.process_id = record.id;
+        row.process_lease_token = record.lease_token;
+        if (context.db.run("UPDATE run_controllers SET process_id = ?, process_lease_token = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND owner_pid = ? AND status = 'running'", [record.id, record.lease_token, context.now(), row.controller_id, row.owner_token, process.pid]).changes !== 1)
+            throw new AppError("controller_owner_mismatch", "Managed owner changed during registration", 1);
+    }
+}
+export function markControllerDispatchReady(context, row) {
+    context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.dispatch_ready', json('true')), updated_at = ? WHERE operation_id = ?", [context.now(), launchId(row)]);
+}
+export async function spawnController(context, row) {
+    const admitted = prepareSpawn(context, row);
+    if (!admitted)
+        return controllerReceipt(requireController(context, row.controller_id));
+    row = admitted;
+    const manifest = JSON.parse(row.manifest_json);
+    const run = requireRun(context, row.project_id, row.run_id);
+    const controllerId = row.controller_id, root = row.state_dir, token = row.owner_token;
+    const entry = fileURLToPath(new URL("../cli.js", import.meta.url));
+    try {
+        if (!fs.existsSync(entry))
+            throw new AppError("harness_runtime_unbuilt", "Build the CLI before launching its detached controller", 1);
+        const output = fs.openSync(path.join(root, "controller.log"), "a", 0o600);
+        try {
+            const child = spawn(process.execPath, [entry, "run", "drive", "serve", "--run", run.id, "--project-root", run.project_root, "--controller-id", controllerId, "--json"], { cwd: run.workspace_root, detached: true, stdio: ["ignore", output, output], env: { ...context.env, DD_FLOW_HOME: context.ddFlowHome, DD_FLOW_RESOURCE_HOME: manifest.resource_home, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_CONTROLLER_TOKEN: token } });
+            await new Promise((resolve, reject) => { child.once("spawn", resolve); child.once("error", reject); });
+            context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.child', json(?)), updated_at = ? WHERE operation_id = ?", [JSON.stringify({ pid: child.pid, pid_started_at: child.pid ? processStartedAt(child.pid) : null }), context.now(), launchId(row)]);
+            child.unref();
+        }
+        finally {
+            fs.closeSync(output);
+        }
+        return controllerReceipt(requireController(context, controllerId));
+    }
+    catch (error) {
+        context.db.exec("SAVEPOINT controller_spawn_status");
+        try {
+            const changed = context.db.run("UPDATE run_controllers SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [JSON.stringify(errorRecord(error)), context.now(), controllerId, token]);
+            if (changed.changes && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation)
+                setFlowRunRecoveryPaused(context, row.project_id, row.run_id, true);
+            context.db.exec("RELEASE controller_spawn_status");
+        }
+        catch (failure) {
+            context.db.exec("ROLLBACK TO controller_spawn_status; RELEASE controller_spawn_status");
+            throw failure;
+        }
+        throw error;
+    }
+}