@deksden-com/dd-flow-cli 0.9.0-beta.81 → 0.9.0-beta.83

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.83
+
+### Patch Changes
+
+- bf69c56: Accept shell-escaped lifecycle path aliases deterministically and render model-facing aliases with stable quoting.
+
+## 0.9.0-beta.82
+
+### Patch Changes
+
+- Keep release registry readback running through delayed npm propagation while still failing authorization errors immediately.
+
 ## 0.9.0-beta.81
 
 ### Patch Changes
@@ -1224,6 +1236,7 @@ record` command with the bounded 15-probe contract.
 - 16f68a3: Add router-native engine snapshot commands and routed project-command dispatch.
 
   Also include the runtime/dashboard compatibility wave needed by the current Memory Bank canon:
+
   - target-based dashboard `open`/`refresh` commands and related-command help;
   - persisted FIFO lane waiters and merge wait-acquire specialization;
   - `migration plan/report/verify` evidence helpers for controlled `mb-upgrade` runtime migrations;

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.81",
-  "cli_commit": "0e1bd85b82868a501bc9e368e103fe288445370a",
-  "built_at": "2026-09-20T10:24:22.045Z",
+  "cli_version": "0.9.0-beta.83",
+  "cli_commit": "7ede03ea5da48b77ab59b46bed8028b2a885da61",
+  "built_at": "2026-09-20T14:09:35.175Z",
   "built_with_canon": {
     "version": "4.1.1",
     "commit": "97f811d33c212ae3497020178b1ed825c7c3ebac",

package/dist/cli/run-cli.js

@@ -4,7 +4,7 @@ import { randomUUID } from "node:crypto";
 import { quote } from "shell-quote";
 import { observeLifecycleCommand } from "../services/lifecycle-invocations.js";
 import { verifyCodexHookDelivery } from "../services/codex-hook-delivery.js";
-import { assertLifecycleInvocationCurrent, awaitLifecycleInvocation, expandLifecycleInvocationArgs, issueLifecycleInvocation, prepareLifecycleIssuance, lifecycleInvocationScope, observedLifecycleInvocation, settleLifecycleInvocation, settleLifecycleRejection } from "../services/lifecycle-invocations.js";
+import { assertLifecycleInvocationCurrent, awaitLifecycleInvocation, expandLifecycleInvocationArgs, issueLifecycleInvocation, prepareLifecycleIssuance, lifecycleInvocationScope, observedLifecycleInvocation, settleLifecycleInvocation, settleLifecycleRejection, validateLifecyclePathAliases } from "../services/lifecycle-invocations.js";
 import { createContext, createRouterContext } from "../runtime/context.js";
 import { migrateStoreWriter } from "../storage/writer-migration.js";
 import { helpForArgs } from "./help.js";
@@ -130,6 +130,8 @@ export async function runCli(args, io = defaultIo, env = process.env) {
         const routerContext = createRouterContext(env);
         const publicCommand = quote(["dd-flow", ...output.args]);
         const lifecycleCommand = parseLifecycleCommand(publicCommand);
+        if (lifecycleCommand.kind === "standalone")
+            validateLifecyclePathAliases(output.args, lifecycleCommand.invocation.operation);
         const observedInvocation = observedLifecycleInvocation(routerContext, publicCommand);
         if (!observedInvocation && !suppliedInvocationId && env.DD_FLOW_DAEMON_ID && lifecycleCommand.kind === "standalone") {
             throw new AppError("invocation_receipt_missing", "Managed lifecycle command has no committed native receipt", 1, { effect: "no_effect", recoverable: false });

package/dist/services/lifecycle-invocations.js

@@ -64,6 +64,7 @@ function fingerprint(parsed) {
     return crypto.createHash("sha256").update(JSON.stringify([parsed.operation, parsed.args.positional.map(value => normalizedInvocationValue("positional", value)), options])).digest("hex");
 }
 function normalizedInvocationValue(key, value) {
+    value = normalizedPathAlias(value);
     if (key === "project-root" && (path.isAbsolute(value) || value === "@project"))
         return "@project";
     if (["result-file", "decision-file", "verification-file"].includes(key))
@@ -79,6 +80,16 @@ function normalizedInvocationValue(key, value) {
         return shortEntityReference(value);
     return key === "retry-check" ? /(?:^|\/)(RCP-\d{3,})$/.exec(value)?.[1] ?? value : value;
 }
+/** Shell/JSON builders sometimes preserve the shell escape before an alias.
+ * Accept it only for the small declared alias vocabulary. */
+function normalizedPathAlias(value) {
+    return value.replace(/^\\+(?=@(?:project|workspace|run)(?:\/|$))/, "");
+}
+function quoteModelFacingArgs(argv) {
+    return argv.map(value => /^@(project|workspace|run)(?:\/.*)?$/.test(value)
+        ? `'${value.replaceAll("'", `'\\''`)}'`
+        : quote([value])).join(" ");
+}
 function withoutInvocationId(command, aliases) {
     const parsed = invocation(command);
     const argv = [...parsed.argv];
@@ -109,7 +120,7 @@ function withoutInvocationId(command, aliases) {
     const executable = parsed.env.DD_FLOW_BIN || parsed.executable === "$DD_FLOW_BIN" ? '"$DD_FLOW_BIN"' : quote([parsed.executable]);
     const prefix = Object.entries(env).map(([key, value]) => `${key}=${quote([value])}`).join(" ");
     const suffix = command.slice(shellSuffixOffset(command)).trimStart();
-    return `${prefix ? `${prefix} ` : ""}${executable}${argv.length ? ` ${quote(argv)}` : ""}${suffix ? ` ${suffix}` : ""}`.trim();
+    return `${prefix ? `${prefix} ` : ""}${executable}${argv.length ? ` ${quoteModelFacingArgs(argv)}` : ""}${suffix ? ` ${suffix}` : ""}`.trim();
 }
 function publicInvocationCommand(context, row, command) {
     const rendered = renderInvocationCommand(row, command);
@@ -128,7 +139,10 @@ export function expandLifecycleInvocationArgs(context, args, scope, operation) {
         if (run && !args[index - 1]?.startsWith("--") && [run.short_id, normalizedInvocationValue("positional", run.id)].includes(value) && !operation.startsWith("work_"))
             return run.id;
         const option = args[index - 1]?.replace(/^--/, "");
-        if (!option || !pathOptions.has(option) || !value.startsWith("@"))
+        if (!option || !pathOptions.has(option))
+            return value;
+        value = normalizedPathAlias(value);
+        if (!value.startsWith("@"))
             return value;
         const match = /^@(project|workspace|run)(?:\/(.*))?$/.exec(value);
         if (!match)
@@ -139,6 +153,22 @@ export function expandLifecycleInvocationArgs(context, args, scope, operation) {
         return assertPathWithin(root, path.join(root, match[2] ?? ""), `${match[1]}_alias`);
     });
 }
+/** Validate alias spelling before native-receipt lookup, so a correctable
+ * command typo is never reported as missing infrastructure evidence. */
+export function validateLifecyclePathAliases(args, operation) {
+    const pathOptions = contextualPathOptionsForLifecycle(operation);
+    for (let index = 0; index < args.length; index += 1) {
+        const option = args[index - 1]?.replace(/^--/, "");
+        if (!option || !pathOptions.has(option))
+            continue;
+        const original = args[index];
+        const value = normalizedPathAlias(original);
+        if ((original.startsWith("\\") && original.replace(/^\\+/, "").startsWith("@") && value === original)
+            || (value.startsWith("@") && !/^@(project|workspace|run)(?:\/.*)?$/.test(value))) {
+            throw new AppError("usage", `Unknown path alias: ${original}`, 2, { phase: "prepare", effect: "no_effect", recoverable: true, parameter: option });
+        }
+    }
+}
 function canonicalManagedCommand(context, command, scope) {
     const parsed = invocation(command);
     const argv = expandLifecycleInvocationArgs(context, parsed.argv, scope, parsed.operation);

package/dist/services/work-registry.js

@@ -988,7 +988,7 @@ function renderWorkerPrompt(context, work, run, dependencies) {
         codeContext.push("<document_updates>", JSON.stringify(packet.document_updates, null, 2), "Materialize every listed update. dd-flow verifies the resulting file against its PLAN-time baseline.", "</document_updates>", "", "<completion_contract>", "Successful completion requires empty deviations and blockers and every assigned document update in changed_paths. A necessary path outside planned_write_areas is normal coordination drift, not a blocker; include it in changed_paths and continue.", "</completion_contract>", "");
     if (packet)
         codeContext.push("<temporary_services>", "Prefer the declared check launcher: it already owns check resources. If the planned scenario genuinely requires an interactive HTTP service, use the managed supervisor below. This is a template: replace the project service command, port names and readiness path from the plan/project instructions; do not invent a fixed port.", `${command} runtime process start --run ${run.id} --project-root ${JSON.stringify(run.project_root)} --command '<project-service-command>' --ports api --ready-port api --ready-path /health --json --progress-jsonl`, "The service receives DD_FLOW_PORT_API (and equivalent variables for all declared names). The command stays running as its supervisor. Retain its tool handle; wait for the service ready event and read its service.json receipt. Pass those exact ports and the same project environment to reset/seed, API and browser operations.", "A ready receipt proves service readiness only. Record the scenario outcome and real evidence separately. After the scenario, execute the exact stop_command from that receipt, then wait for the supervisor to exit. Never use pkill/killall or stop a sibling's process. If cleanup fails, retain the process id and report the failure; do not claim the resource is free.", "</temporary_services>", "");
-    return ["<work>", `- work_id: ${work.work_id}`, `- run_id: ${work.run_id}`, `- project_root: ${run.project_root}`, `- workspace_root: ${run.workspace_root}`, `- run_home: ${requireRunHome(run)}`, "</work>", "", "<cli_context>", `- Work commands use the short ID ${shortWorkId(work.work_id)}; dd-flow binds it to this RUN.`, `- @project = ${run.project_root}`, `- @workspace = ${run.workspace_root}`, `- @run = ${requireRunHome(run)}`, "- @ aliases are accepted only by declared dd-flow path parameters. Shell tools such as cat and rg require ordinary paths relative to cwd or absolute paths.", "- Lifecycle invocation IDs are internal runtime authority and are intentionally omitted from commands.", "</cli_context>", "", "<hard_write_boundary>", ...writeBoundary, "</hard_write_boundary>", "", ...codeContext, "<dependency_results>", JSON.stringify(dependencies.filter(Boolean), null, 2), "</dependency_results>", "", "<task>", resolveRunReferences(work.task, work.run_id, requireRunHome(run)), "</task>", "", ...(work.result_schema ? ["<result_contract>", `Return JSON matching \`${work.result_schema}\`.`, ...resultSchemaGuidance(work, run.id), "Do not create result.json yourself. Send the JSON to dd-flow on stdin; it atomically validates and stores the canonical receipt.", "</result_contract>", ""] : []), "<completion>", packet?.repair?.verification_check_refs?.length ? "Work finish runs its normal work-scoped checks plus the listed causal repair checks. Their original run_at remains an aggregate obligation; this is the additional proof required before accepting this repair." : "Work finish runs only declared run_at=work checks. Stage finish owns readiness/code/merge gates; successful Work completion does not mean those gates have passed.", "A failed receipt means only that the check failed; it is not proof of an engine, harness, dependency, or environment blocker.", ...completionRepair, "Use Fail only for a concrete external blocker after deterministic bootstrap or a contradiction with an accepted requirement/non-goal. Never fail merely because a necessary project path was absent from planned_write_areas.", "Finish may run for several minutes. Preserve the shell tool's process/session handle and poll that same invocation until it exits; progress arrives as JSONL on stderr. Never reissue Finish merely because final stdout has not arrived.", `Finish as one standalone command with a quoted heredoc (replace the example JSON with your result):\n${finishWorkCommand} <<'DD_FLOW_RESULT'\n{}\nDD_FLOW_RESULT`, `Fail only for an evidenced external or semantic-contract blocker: ${failWorkCommand}`, "</completion>", ""].join("\n");
+    return ["<work>", `- work_id: ${work.work_id}`, `- run_id: ${work.run_id}`, `- project_root: ${run.project_root}`, `- workspace_root: ${run.workspace_root}`, `- run_home: ${requireRunHome(run)}`, "</work>", "", "<cli_context>", `- Work commands use the short ID ${shortWorkId(work.work_id)}; dd-flow binds it to this RUN.`, `- @project = ${run.project_root}`, `- @workspace = ${run.workspace_root}`, `- @run = ${requireRunHome(run)}`, "- @ aliases are accepted only by declared dd-flow path parameters. Copy the quoted alias literally; do not add backslashes. Shell tools such as cat and rg require ordinary paths relative to cwd or absolute paths.", "- Lifecycle invocation IDs are internal runtime authority and are intentionally omitted from commands.", "</cli_context>", "", "<hard_write_boundary>", ...writeBoundary, "</hard_write_boundary>", "", ...codeContext, "<dependency_results>", JSON.stringify(dependencies.filter(Boolean), null, 2), "</dependency_results>", "", "<task>", resolveRunReferences(work.task, work.run_id, requireRunHome(run)), "</task>", "", ...(work.result_schema ? ["<result_contract>", `Return JSON matching \`${work.result_schema}\`.`, ...resultSchemaGuidance(work, run.id), "Do not create result.json yourself. Send the JSON to dd-flow on stdin; it atomically validates and stores the canonical receipt.", "</result_contract>", ""] : []), "<completion>", packet?.repair?.verification_check_refs?.length ? "Work finish runs its normal work-scoped checks plus the listed causal repair checks. Their original run_at remains an aggregate obligation; this is the additional proof required before accepting this repair." : "Work finish runs only declared run_at=work checks. Stage finish owns readiness/code/merge gates; successful Work completion does not mean those gates have passed.", "A failed receipt means only that the check failed; it is not proof of an engine, harness, dependency, or environment blocker.", ...completionRepair, "Use Fail only for a concrete external blocker after deterministic bootstrap or a contradiction with an accepted requirement/non-goal. Never fail merely because a necessary project path was absent from planned_write_areas.", "Finish may run for several minutes. Preserve the shell tool's process/session handle and poll that same invocation until it exits; progress arrives as JSONL on stderr. Never reissue Finish merely because final stdout has not arrived.", `Finish as one standalone command with a quoted heredoc (replace the example JSON with your result):\n${finishWorkCommand} <<'DD_FLOW_RESULT'\n{}\nDD_FLOW_RESULT`, `Fail only for an evidenced external or semantic-contract blocker: ${failWorkCommand}`, "</completion>", ""].join("\n");
 }
 export function resultSchemaGuidance(work, runId) {
     const schema = work.result_schema;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.81",
+  "version": "0.9.0-beta.83",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {