@deksden-com/dd-flow-cli 0.9.0-beta.87 → 0.9.0-beta.89

package/dist/services/lifecycle-invocations.js

@@ -6,7 +6,7 @@ import { setTimeout as delay } from "node:timers/promises";
 import { AppError, errorRecord } from "../shared/errors.js";
 import { shortEntityReference } from "../shared/entity-references.js";
 import { resolveWorkReference } from "../storage/work-references.js";
-import { commandOption, parseLifecycleCommand, shellSuffixOffset } from "./lifecycle-command.js";
+import { commandOption, continuationCommand, lifecycleCommandFromPayload, parseLifecycleCommand, shellSuffixOffset } from "./lifecycle-command.js";
 import { requireProjectByRoot } from "./projects.js";
 import { assertRunMutationAllowed, assertStageSettlementAllowed, assertWorkSettlementAllowed, recoveryGuard } from "./run-recovery.js";
 import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
@@ -15,8 +15,49 @@ import { appendEvent } from "./run-controller-state.js";
 import { recoverCommittedWorkStart } from "./work-registry.js";
 import { observeCommandHook } from "./hooks.js";
 import { runtimeHarness } from "./execution-policy.js";
-import { assertPathWithin } from "../storage/paths.js";
+import { normalizedPathAlias, resolveContextualPaths } from "./command-context.js";
+import { isRegisteredRepair } from "./repair-intents.js";
+import { stageAttempt } from "./stage-work-graph.js";
 import { contextualPathOptionsForLifecycle } from "../cli/command-inputs.js";
+import { canonicalPath } from "../storage/paths.js";
+/** Auxiliary commands have no invocation capability, but may not escape their
+ * native daemon's project/RUN. Context aliases never grant mutation authority. */
+export function assertAuxiliaryCommandScope(context, command, projectRoot) {
+    const auxiliary = continuationCommand(command);
+    const daemonId = context.env.DD_FLOW_DAEMON_ID;
+    if (!auxiliary || !daemonId)
+        return;
+    const event = observedLifecycleNativeEvent(context, command, daemonId);
+    if (!event)
+        throw new AppError("invocation_receipt_missing", "Auxiliary command has no exact native receipt", 1, { phase: "prepare", effect: "no_effect" });
+    const project = context.db.get("SELECT root FROM projects WHERE id = ?", [event.project_id]);
+    if (!project || !projectRoot || canonicalPath(projectRoot, false) !== project.root)
+        throw new AppError("invocation_scope_mismatch", "Auxiliary command differs from its native project scope", 1, { phase: "prepare", effect: "no_effect" });
+    for (const record of managedProcessStatus(context)) {
+        if (record.project_id !== event.project_id || !record.run_id || !record.kind.endsWith("-daemon"))
+            continue;
+        const metadata = JSON.parse(record.metadata_json);
+        if (typeof metadata.state_dir !== "string")
+            continue;
+        let state;
+        try {
+            state = readNativeDaemonState(metadata.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (state.daemon_id !== daemonId)
+            continue;
+        requireManagedDaemonBinding(context, { stateDir: metadata.state_dir, projectId: event.project_id, runId: record.run_id });
+        const reference = auxiliary.args.options.get("run")?.[0] ?? auxiliary.args.positional[2];
+        const run = context.db.get("SELECT id FROM runs WHERE project_id = ? AND (id = ? OR short_id = ?)", [event.project_id, reference, reference]);
+        if (run?.id !== record.run_id)
+            throw new AppError("invocation_scope_mismatch", "Auxiliary command differs from its native RUN scope", 1, { phase: "prepare", effect: "no_effect" });
+        assertRunMutationAllowed(context, event.project_id, record.run_id, metadata.run_generation);
+        return;
+    }
+    throw new AppError("invocation_scope_unavailable", "Auxiliary command has no live managed daemon binding", 1, { phase: "prepare", effect: "no_effect" });
+}
 // Conclusive result/check rejections, never transport, ownership, registry or
 // unknown-effect failures. These validators reject before accepting the result.
 export function isRetryableLifecycleRejection(code, details = {}) {
@@ -68,7 +109,7 @@ function fingerprint(parsed) {
 const runtimeOwnedOptions = {
     stage_start: new Set(["project-root", "context-file", "context-sha256", "response-file", "require-session-binding"]),
     stage_finish: new Set(["project-root", "result-file", "decision-file", "verification-file"]),
-    stage_pause: new Set(["project-root"]), stage_resume: new Set(["project-root"]),
+    stage_pause: new Set(["project-root"]), stage_resume: new Set(["project-root", "answer-file"]),
     work_start: new Set(["project-root", "recovery-id"]),
     work_finish: new Set(["project-root"]), work_fail: new Set(["project-root"]),
     merge_apply: new Set(["project-root"]), merge_repair: new Set(["project-root"]),
@@ -122,9 +163,6 @@ function normalizedInvocationValue(key, value) {
 }
 /** Shell/JSON builders sometimes preserve the shell escape before an alias.
  * Accept it only for the small declared alias vocabulary. */
-function normalizedPathAlias(value) {
-    return value.replace(/^\\+(?=@(?:project|workspace|run)(?:\/|$))/, "");
-}
 function quoteModelFacingArgs(argv) {
     return argv.map(value => /^@(project|workspace|run)(?:\/.*)?$/.test(value)
         ? `'${value.replaceAll("'", `'\\''`)}'`
@@ -181,23 +219,11 @@ export function expandLifecycleInvocationArgs(context, args, scope, operation) {
     const pathOptions = contextualPathOptionsForLifecycle(operation);
     const run = scope.runId ? context.db.get("SELECT id, short_id, workspace_root, run_root FROM runs WHERE id = ?", [scope.runId]) : undefined;
     const roots = { project: scope.projectRoot, workspace: run?.workspace_root, run: run?.run_root };
-    return args.map((value, index) => {
+    return resolveContextualPaths(args.map((value, index) => {
         if (run && !args[index - 1]?.startsWith("--") && [run.short_id, normalizedInvocationValue("positional", run.id)].includes(value) && !operation.startsWith("work_"))
             return run.id;
-        const option = args[index - 1]?.replace(/^--/, "");
-        if (!option || !pathOptions.has(option))
-            return value;
-        value = normalizedPathAlias(value);
-        if (!value.startsWith("@"))
-            return value;
-        const match = /^@(project|workspace|run)(?:\/(.*))?$/.exec(value);
-        if (!match)
-            throw new AppError("usage", `Unknown path alias: ${value}`, 2, { phase: "prepare", effect: "no_effect", recoverable: true, parameter: option });
-        const root = roots[match[1]];
-        if (!root)
-            throw new AppError("usage", `Path alias @${match[1]} is unavailable without a bound RUN`, 2, { phase: "prepare", effect: "no_effect", recoverable: true, parameter: option });
-        return assertPathWithin(root, path.join(root, match[2] ?? ""), `${match[1]}_alias`);
-    });
+        return value;
+    }), pathOptions, roots);
 }
 /** Validate alias spelling before native-receipt lookup, so a correctable
  * command typo is never reported as missing infrastructure evidence. */
@@ -259,7 +285,7 @@ export function assertLifecycleOutcomes(context, scope) {
             const outcome = JSON.parse(row.outcome_json);
             if (outcome.disposition === "retrying" && outcome.deadline <= Date.now())
                 throw new AppError("lifecycle_outcome_unknown", "Storage retry has no terminal receipt; reconcile its committed evidence", 1, { lifecycle_outcome: outcome, effect: "unknown" });
-            if (outcome.disposition === "fatal")
+            if (outcome.disposition === "fatal" && !isRegisteredRepair(context, outcome.error?.details?.continuation, { projectId: project.id, runId: scope.runId }))
                 throw new AppError(outcome.error?.code ?? "lifecycle_outcome_unknown", outcome.error?.message || "Mandatory lifecycle failed (historical receipt has no message)", 1, { ...outcome.error?.details, lifecycle_outcome: outcome });
         }
     }
@@ -272,15 +298,16 @@ export function assertLifecycleOutcomes(context, scope) {
     ORDER BY a.rowid`, [scope.projectRoot, scope.runId, scope.generation]);
     for (const row of rows) {
         const error = (row.outcome_json ? JSON.parse(row.outcome_json) : null)?.error;
-        if (typeof error?.code === "string" && !isCorrectableLifecycleRejection(error.code, error.details))
+        if (typeof error?.code === "string" && !isCorrectableLifecycleRejection(error.code, error.details) && !isRegisteredRepair(context, error.details?.continuation, { projectId: project.id, runId: scope.runId }))
             throw new AppError(error.code, typeof error.message === "string" ? error.message : "Mandatory lifecycle failed", 1, { ...(error.details ?? {}), invocation_id: row.id });
     }
 }
 /** Hooks already own native identity. Retain command outcomes there, with an
  * atomic controller notification; missing notifications reconcile from the row. */
-export function observeLifecycleCommand(context, command) {
+export function observeLifecycleCommand(context, command, nativeEvent) {
     const parsed = parseLifecycleCommand(command);
-    if (parsed.kind !== "standalone")
+    const auxiliary = continuationCommand(command);
+    if (parsed.kind !== "standalone" && !auxiliary)
         return () => { };
     let anchor;
     context.observeLifecycleHook = (projectId, eventId) => {
@@ -291,6 +318,7 @@ export function observeLifecycleCommand(context, command) {
             return;
         let runId = context.db.get("SELECT run_id FROM sessions WHERE project_id = ? AND harness = ? AND (session_id = ? OR session_id = ? OR provider_session_id = ?) AND run_id IS NOT NULL ORDER BY session_id = ? DESC LIMIT 1", [projectId, event.harness, event.session_id, event.parent_session_id, event.parent_session_id, event.session_id])?.run_id;
         let generation;
+        let correlation = {};
         // A first Stage command precedes logical Session binding. Its native root
         // is already owned by the controller's retained create receipt.
         if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'")) {
@@ -305,6 +333,8 @@ export function observeLifecycleCommand(context, command) {
                     return;
                 runId = owners[0].run_id;
                 generation = owners[0].generation;
+                const current = JSON.parse(owners[0].state_json);
+                correlation = { stage: current.stage, ...(current.stage ? { attempt: stageAttempt(context, projectId, runId, current.stage) } : {}), controller_turn: current.turns };
             }
         }
         if (event.daemon_id) {
@@ -333,11 +363,14 @@ export function observeLifecycleCommand(context, command) {
         }
         if (!runId)
             return;
-        anchor = { project_id: projectId, run_id: runId, generation: generation ?? recoveryGuard(context, projectId, runId)?.generation ?? 0, hook_event_id: eventId, session_id: event.session_id, harness: event.harness, operation: parsed.invocation.operation };
+        anchor = { project_id: projectId, run_id: runId, generation: generation ?? recoveryGuard(context, projectId, runId)?.generation ?? 0, hook_event_id: eventId, session_id: event.session_id, harness: event.harness, operation: parsed.kind === "standalone" ? parsed.invocation.operation : auxiliary.operation, ...correlation, ...(auxiliary ? { auxiliary: true } : {}) };
     };
-    observeCommandHook(context, command);
-    const invocationId = commandOption(parsed.invocation, "invocation-id");
-    if (!anchor && invocationId) {
+    if (nativeEvent)
+        context.observeLifecycleHook(nativeEvent.project_id, nativeEvent.id);
+    else
+        observeCommandHook(context, command);
+    const invocationId = parsed.kind === "standalone" ? commandOption(parsed.invocation, "invocation-id") : undefined;
+    if (!anchor && invocationId && !nativeEvent) {
         const attempt = load(context, invocationId);
         checkCommand(attempt, command);
         if (attempt.event_key && ["observed", "executing"].includes(attempt.status)) {
@@ -356,7 +389,7 @@ export function observeLifecycleCommand(context, command) {
             return;
         const error = outcome.error ? errorRecord(outcome.error) : undefined;
         const correctable = error && isCorrectableLifecycleRejection(error.code, error.details);
-        const record = { ...anchor, ...(error ? { error } : outcome), effect: error ? error.details.effect ?? (correctable ? "no_effect" : "unknown") : "committed", disposition: error ? correctable ? "correctable" : "fatal" : "completed" };
+        const record = { ...anchor, ...(error ? { error } : outcome), effect: error ? error.details.effect ?? (correctable ? "no_effect" : "unknown") : "committed", disposition: error ? auxiliary ? "pending_continuation" : correctable ? "correctable" : "fatal" : "completed" };
         try {
             context.db.writeTransaction(() => {
                 const retained = context.db.get("SELECT outcome_json FROM hook_events WHERE id = ?", [anchor.hook_event_id]);
@@ -441,9 +474,10 @@ export function managedInvocationContext(context, input) {
     env.DD_FLOW_INVOCATION_SCOPE = JSON.stringify(scope);
     return { ...context, env };
 }
-/** Generated commands retain their attempt across repeated rendering. Only a
- * currently executing command can emit its own successor with the same argv. */
-export function managedLifecycleCommand(context, command) {
+/** Generated commands retain their attempt across repeated rendering. Execution
+ * can issue a retry; accepted HITL intent can replace an unobserved placeholder
+ * or issue the next pause's assignment after successful settlement. */
+export function managedLifecycleCommand(context, command, options = {}) {
     const configured = context.env.DD_FLOW_INVOCATION_SCOPE;
     if (!configured)
         return command;
@@ -474,7 +508,18 @@ export function managedLifecycleCommand(context, command) {
     return context.db.writeTransaction(() => {
         const prior = context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [JSON.stringify(scope), fingerprint(parsed)]);
         if (prior && prior.id !== context.env.DD_FLOW_CURRENT_INVOCATION) {
-            return publicInvocationCommand(context, prior, command);
+            const replacesAnswer = options.replaceUnobservedAnswer && parsed.operation === "stage_resume"
+                && (prior.status === "settled" || commandOption(invocation(prior.command), "answer-file") !== commandOption(parsed, "answer-file"));
+            if (!replacesAnswer)
+                return publicInvocationCommand(context, prior, command);
+            // The pause packet can prepare a placeholder before the controller has
+            // accepted an answer. Replace only an unobserved assignment; never change
+            // the authority of a native call already in flight.
+            const completed = prior.status === "settled" && prior.outcome_json && !JSON.parse(prior.outcome_json).error;
+            if (prior.status !== "issued" && !completed)
+                throw new AppError("invocation_answer_conflict", "Cannot replace an answer while its lifecycle assignment is in flight or failed", 1, { invocation_id: prior.id });
+            if (prior.status === "issued")
+                context.db.run("UPDATE lifecycle_invocations SET status = 'expired' WHERE id = ?", [prior.id]);
         }
         if (context.env.DD_FLOW_INVOCATION_READONLY === "1")
             throw new AppError("invocation_command_unprepared", "No prepared lifecycle command is available; read-only inspection cannot issue one", 1);
@@ -535,7 +580,9 @@ export function settleLifecycleRejection(context, id, error) {
             details.recoverable = true;
             if (storageRetry)
                 details.storage_retry = 1;
-            details.retry_instruction = "Correct only the evidenced defect, then use retry_command with the required result input. Reissuing the old command only reads its retained outcome.";
+            details.retry_instruction = isRegisteredRepair(context, details.continuation)
+                ? "The repair is already registered. End this coordinator turn so the controller can launch its fresh child. Use retry_command only after that repair completes, with fresh semantic verification."
+                : "Correct only the evidenced defect, then use retry_command with the required result input. Reissuing the old command only reads its retained outcome.";
         }
         else if (isCorrectableLifecycleRejection(error.code, error.details)) {
             details.effect = "no_effect";
@@ -807,8 +854,40 @@ export function observeLifecycleInvocation(context, input) {
         throw error;
     }
 }
-/** Return a precise native-observer rejection for the same argv. This keeps
- * shell diagnostics distinct from a genuinely absent hook receipt. */
+/** Correlate exact native argv for diagnostics, independently of assignment
+ * matching. A hook-added event key must name the same persisted native call. */
+export function observedLifecycleNativeEvent(context, command, daemonId) {
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'hook_events'"))
+        return null;
+    const signature = (value) => {
+        const parsed = parseLifecycleCommand(value);
+        const candidate = parsed.kind === "standalone" && !parsed.invocation.wrapped ? parsed.invocation : continuationCommand(value);
+        if (!candidate)
+            return null;
+        return JSON.stringify([candidate.operation, candidate.args.positional,
+            [...candidate.args.options].filter(([key]) => !["json", "progress-jsonl", "hook-event-id"].includes(key)).sort(([a], [b]) => a.localeCompare(b))]);
+    };
+    const expected = signature(command);
+    if (!expected)
+        return null;
+    const parsed = parseLifecycleCommand(command);
+    const eventKey = parsed.kind === "standalone" ? commandOption(parsed.invocation, "hook-event-id") : undefined;
+    const matches = context.db.all("SELECT project_id, id, event_key, sanitized_summary FROM hook_events WHERE daemon_id = ? AND status = 'observed' AND outcome_json IS NULL", [daemonId]).filter(row => {
+        if (eventKey && row.event_key !== eventKey)
+            return false;
+        try {
+            const observed = lifecycleCommandFromPayload(JSON.parse(row.sanitized_summary));
+            return typeof observed === "string" && signature(observed) === expected;
+        }
+        catch {
+            return false;
+        }
+    });
+    // Diagnostic correlation only: never use this as execution authority, and
+    // never choose the latest of several identical native calls.
+    return matches.length === 1 ? { project_id: matches[0].project_id, id: matches[0].id } : null;
+}
+/** Keep shell diagnostics distinct from genuinely absent native delivery. */
 export function observedLifecycleDiagnostic(context, command, daemonId) {
     const analysis = parseLifecycleCommand(command);
     if (analysis.kind !== "standalone")
@@ -833,7 +912,7 @@ export function observedLifecycleDiagnostic(context, command, daemonId) {
 /** Resolve only a command that a native hook has already bound to an issued
  * attempt. This is the CLI-side half of admission for model-facing commands
  * that intentionally omit the internal UUID. */
-export function observedLifecycleInvocation(context, command) {
+export function observedLifecycleInvocation(context, command, daemonId) {
     if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'"))
         return null;
     const analysis = parseLifecycleCommand(command);
@@ -843,6 +922,8 @@ export function observedLifecycleInvocation(context, command) {
         .filter(row => {
         try {
             const scope = JSON.parse(row.scope_json);
+            if (daemonId && scope.daemonId !== daemonId)
+                return false;
             return fingerprint(invocation(canonicalManagedCommand(context, command, scope))) === row.fingerprint;
         }
         catch {

package/dist/services/recovery-snapshot-database.js

@@ -49,7 +49,7 @@ export function captureRecoveryDatabase(source, output, projectId, runId, protoc
             merge_servers: "0", merge_sessions: "0", merge_queue: "0", lanes: "0", lane_locks: "0", lane_waiters: "0",
             sqlite_sequence: "0"
         };
-        for (const table of ["works", "check_receipts", "merge_requests", "flow_run_flag_mutations", "usage", "flow_session_segments", "flow_jobs", "run_recovery_guards", "run_controllers", "run_controls"])
+        for (const table of ["works", "stage_work_memberships", "repair_intents", "check_receipts", "merge_requests", "flow_run_flag_mutations", "usage", "flow_session_segments", "flow_jobs", "run_recovery_guards", "run_controllers", "run_controls"])
             rules[table] = ownRun;
         for (const table of ["plan_bindings", "plan_progress", "worktree_records", "audit_events"])
             rules[table] = `${ownProject} AND protocol_id IN (${protocols})`;

package/dist/services/repair-intents.js

@@ -0,0 +1,40 @@
+import crypto from "node:crypto";
+import { stageAttempt, stageCycle, bindStageWork } from "./stage-work-graph.js";
+import { assertRunMutationAllowed } from "./run-recovery.js";
+import { AppError } from "../shared/errors.js";
+/** Checks finish before entering this synchronous registration transaction. */
+export function ensureAggregateRepair(context, input, create) {
+    if (!input.failures.length || input.failures.some(receipt => receipt.status !== "failed" && receipt.status !== "aborted"))
+        throw new AppError("repair_intent_invalid", "Repair requires settled failed receipts", 1);
+    const causes = input.failures.map(receipt => ({ id: receipt.id, epoch: receipt.verification_epoch, fingerprint: receipt.workspace_fingerprint })).sort((a, b) => a.id.localeCompare(b.id));
+    return ensureRepairIntent(context, { ...input, causes: { receipts: causes, origins: [...(input.origins ?? [])].sort() } }, create);
+}
+export function ensureRepairIntent(context, input, create) {
+    return context.db.writeTransaction(() => {
+        assertRunMutationAllowed(context, input.projectId, input.runId, input.generation);
+        const attempt = stageAttempt(context, input.projectId, input.runId, input.stage);
+        const payload = JSON.stringify({ project_id: input.projectId, run_id: input.runId, stage: input.stage, attempt, cycle: stageCycle(context, input.projectId, input.runId, input.stage), causes: input.causes });
+        const identity = crypto.createHash("sha256").update(payload).digest("hex");
+        const prior = context.db.get("SELECT work_id, payload_json FROM repair_intents WHERE identity = ?", [identity]);
+        if (prior && prior.payload_json !== payload)
+            throw new AppError("repair_intent_conflict", "Repair identity has different causes", 1);
+        const workId = prior?.work_id ?? create();
+        if (!prior) {
+            bindStageWork(context, { projectId: input.projectId, runId: input.runId, workId, stage: input.stage, attempt });
+            context.db.run("INSERT INTO repair_intents (identity, project_id, run_id, stage, attempt, payload_hash, payload_json, work_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", [identity, input.projectId, input.runId, input.stage, attempt, identity, payload, workId, context.now()]);
+        }
+        return { schema_id: "dd-flow/continuation@1", kind: "repair_required", project_id: input.projectId, run_id: input.runId, stage: input.stage, attempt, identity, work_id: workId };
+    });
+}
+export function isRegisteredRepair(context, value, scope) {
+    if (!value || typeof value !== "object")
+        return false;
+    const receipt = value;
+    if (receipt.schema_id !== "dd-flow/continuation@1" || receipt.kind !== "repair_required")
+        return false;
+    if (scope && (receipt.project_id !== scope.projectId || receipt.run_id !== scope.runId))
+        return false;
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'repair_intents'"))
+        return false;
+    return Boolean(context.db.get("SELECT 1 FROM repair_intents i JOIN works w ON w.work_id = i.work_id AND w.project_id = i.project_id AND w.run_id = i.run_id WHERE i.identity = ? AND i.project_id = ? AND i.run_id = ? AND i.stage = ? AND i.attempt = ? AND i.work_id = ?", [receipt.identity, receipt.project_id, receipt.run_id, receipt.stage, receipt.attempt, receipt.work_id]));
+}

package/dist/services/run-controller.js

@@ -26,6 +26,7 @@ import { controllerNativeChildren, controllerStageEntryPrompt, nextControllerFan
 import { claimQueuedMergeRequest } from "./merge-server.js";
 import { prepareVnextCodeWorkspace } from "./vnext-code.js";
 import { requireRun, requireController, controllerReceipt, appendEvent, saveState, retainControllerContinuation, digest, digestBytes, errorRecord } from "./run-controller-state.js";
+import { assertNoCorrelatedRejection } from "./continuation-outcome.js";
 import { spawnController, recordControllerLauncher, claimControllerProcess, markControllerDispatchReady } from "./run-controller-process.js";
 import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
 import { resumeControllerSession, failControllerRecovery } from "./run-controller-recovery.js";
@@ -598,19 +599,25 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 const pause = view.index.stage_runs.find(stage => stage.stage === next.stage)?.pause;
                 if (!pause || state.current_session === null)
                     throw new AppError("controller_hitl_missing", "Paused RUN has no managed Session or HITL receipt", 1);
-                const answer = context.db.get("SELECT operation_id, input_json FROM run_controller_operations WHERE controller_id = ? AND status = 'accepted' AND json_extract(input_json, '$.action') = 'user_answer' AND json_extract(input_json, '$.pause_id') = ? ORDER BY created_at LIMIT 1", [row.controller_id, pause.id]);
+                const answer = context.db.get("SELECT operation_id, input_json, status FROM run_controller_operations WHERE controller_id = ? AND status IN ('accepted','completed') AND json_extract(input_json, '$.action') = 'user_answer' AND json_extract(input_json, '$.pause_id') = ? ORDER BY created_at LIMIT 1", [row.controller_id, pause.id]);
                 if (!answer) {
                     await delay(1000);
                     continue;
                 }
+                if (answer.status === "completed")
+                    throw new AppError("controller_answer_not_applied", "Completed answer operation still has its original HITL pause", 1, { pause_id: pause.id, operation_id: answer.operation_id, stage: next.stage });
                 const input = JSON.parse(answer.input_json);
                 if (digestBytes(fs.readFileSync(input.file)) !== input.sha256)
                     throw new AppError("context_checksum_mismatch", "Accepted HITL answer bytes changed", 1);
                 assertOwner();
                 // The accepted answer is logical intent; only its generation-bound
                 // adapter operation represents a physical dispatch that stop must drain.
-                const command = managedLifecycleCommand(executionContext, `${flowCommand(executionContext)} stage resume ${run.id} --stage ${next.stage} --work ${input.work_id} --project-root ${quote([run.project_root])} --answer-file ${quote([input.file])} --json`);
+                const command = managedLifecycleCommand(executionContext, `${flowCommand(executionContext)} stage resume ${run.id} --stage ${next.stage} --work ${input.work_id} --project-root ${quote([run.project_root])} --answer-file ${quote([input.file])} --json`, { replaceUnobservedAnswer: true });
                 const receipt = await prompt(state.sessions[state.current_session], `The user supplied the raw answer for pause ${pause.id}. Your first tool call must be this exact standalone command:\n\n${command}\n\nDo not alter the answer. Follow the returned packet, then stop at this Stage boundary.`, `${answer.operation_id}:prompt:${row.generation}`);
+                const afterAnswer = getFlowRunStatus(executionContext, { projectRoot: run.project_root, runId: run.id });
+                if (afterAnswer.index.stage_runs.some(stage => stage.status === "paused" && stage.pause?.id === pause.id)) {
+                    throw new AppError("controller_answer_not_applied", "The answer Turn completed without resuming the assigned HITL pause", 1, { pause_id: pause.id, operation_id: answer.operation_id, stage: next.stage, effect: "no_progress" });
+                }
                 context.db.run("UPDATE run_controller_operations SET status = 'completed', receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify({ delivered: true, session_id: adapterSessionId(receipt) }), context.now(), answer.operation_id]);
                 state.last_continuation = null;
                 saveState(context, row, state);
@@ -744,7 +751,9 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 saveState(context, row, state);
                 continue;
             }
-            retainControllerContinuation(state, fanout.fingerprint, { code: "fanout_stage_nonprogressing", message: "The coordinator repeated an unchanged Work-graph continuation", details: { stage: next.stage } });
+            if (state.last_continuation === fanout.fingerprint)
+                assertNoCorrelatedRejection(context, { projectId: row.project_id, runId: row.run_id, generation: row.generation, stage: next.stage, turn: state.turns });
+            retainControllerContinuation(state, fanout.fingerprint, { code: "fanout_stage_nonprogressing", message: "The coordinator repeated an unchanged Work-graph continuation", details: { stage: next.stage, before: state.last_continuation, after: fanout.fingerprint, controller_turn: state.turns } });
             saveState(context, row, state);
             await prompt(session, fanout.prompt);
         }

package/dist/services/runtime-command.js

@@ -0,0 +1,43 @@
+import path from "node:path";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import { AppError } from "../shared/errors.js";
+/** Only the trusted launcher is a shell fragment; all caller data is argv. */
+export function runtimeCommand(context, args) {
+    return `${flowCommand(context)} ${args.map(shellArgument).join(" ")}`;
+}
+export function shellArgument(value) {
+    return /^[A-Za-z0-9_./:@=-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
+}
+export function flowCommand(context) {
+    const defaultHome = path.resolve(path.join(os.homedir(), ".dd-flow"));
+    const quoted = (value) => `"${value.replace(/[\\"$`]/g, character => `\\${character}`)}"`;
+    const home = `DD_FLOW_HOME=${quoted(context.ddFlowHome)}`;
+    // The runner binds this variable to its isolated published executable.
+    if (context.env.DD_FLOW_BIN && path.isAbsolute(context.env.DD_FLOW_BIN))
+        return `${home} "$DD_FLOW_BIN"`;
+    const isolated = path.join(context.ddFlowHome, "bin", "dd-flow");
+    if (context.ddFlowHome !== defaultHome && fs.existsSync(isolated))
+        return `${home} ${quoted(isolated)}`;
+    return context.ddFlowHome === defaultHome ? "dd-flow" : `${home} dd-flow`;
+}
+export function recoveryEvidenceInput(runRoot, receiptId) {
+    const basename = crypto.createHash("sha256").update(receiptId).digest("hex").slice(0, 20);
+    return {
+        schema_id: "dd-flow/continuation@1",
+        kind: "needs_input",
+        actor: "coordinator",
+        input_file: path.join(runRoot, `check-recovery-${basename}.json`),
+        input_contract: { reason: "Nonempty evidence explaining what environment was restored; do not invent recovery." },
+        instruction: "Only after restoring the environment, write this JSON file. Then use command_after_input. This is not permission to change product code or bypass the failed check."
+    };
+}
+export function checkRetryArgs(context, projectRoot, runId, receiptId) {
+    if (!receiptId)
+        return [];
+    const run = context.db.get("SELECT run_root FROM runs WHERE project_root = ? AND id = ?", [projectRoot, runId]);
+    if (!run?.run_root)
+        throw new AppError("runtime_missing", "Check recovery requires a bound RUN root", 1);
+    return ["--retry-check", receiptId, "--reason-file", recoveryEvidenceInput(run.run_root, receiptId).input_file];
+}

package/dist/services/stage-pause.js

@@ -1,6 +1,5 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
 import { quote } from "shell-quote";
 import { lifecycleRetryCommands, managedLifecycleCommand } from "./lifecycle-invocations.js";
@@ -13,6 +12,8 @@ import { requireProjectByRoot } from "./projects.js";
 import { appendFlowRunTimelineEvent, pauseFlowRunStage, resumeFlowRunStage } from "./runs.js";
 import { bindSessionForResume, refreshRunWorkProjection } from "./work-registry.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
+import { runtimeCommand } from "./runtime-command.js";
+export { flowCommand } from "./runtime-command.js";
 export function prepareStagePause(context, input) {
     if (typeof input.question !== "string" || !input.question.trim())
         throw new AppError("validation", "stage pause requires a non-empty user question", 2);
@@ -159,8 +160,10 @@ export function resumeStageAfterUser(context, input) {
     return { ok: true, outcome: "resumed", run_id: run.id, work_id: work.work_id, stage: stage.stage, pause_id: pause.id, question_path: pause.question_path, answer_path: answerPath, prompt_path: workSession.prompt_path, worker_prompt_markdown: continuation, next_action: `continue_${stage.stage}` };
 }
 export function stagePauseCommand(context, input) {
-    const questionInputPath = `@run/works/${input.workId}/question-input.md`;
-    return managedLifecycleCommand(context, `${flowCommand(context)} stage pause ${shortEntityReference(input.runId)} --stage ${input.stage} --work ${shortEntityReference(input.workId)} --question-file '${questionInputPath}' --project-root ${quote([input.projectRoot])} --json`);
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const run = requireRun(context, project.id, input.runId);
+    const questionInputPath = path.join(requireRunHome(run), "works", input.workId, "question-input.md");
+    return managedLifecycleCommand(context, runtimeCommand(context, ["stage", "pause", shortEntityReference(input.runId), "--stage", input.stage, "--work", shortEntityReference(input.workId), "--question-file", questionInputPath, "--project-root", input.projectRoot, "--json"]));
 }
 /** Render separate file-write and lifecycle-call instructions for HITL. */
 export function stagePauseCommandTemplate(command) {
@@ -185,24 +188,7 @@ Then run this standalone command:
 ${command}`;
 }
 function stageResumeCommand(context, input) {
-    return managedLifecycleCommand(context, `${flowCommand(context)} stage resume ${shortEntityReference(input.runId)} --stage ${input.stage} --work ${shortEntityReference(input.workId)} --answer-file ${quote([input.answerInputPath])} --project-root ${quote([input.projectRoot])} --json`);
-}
-export function flowCommand(context) {
-    const defaultHome = path.resolve(path.join(os.homedir(), ".dd-flow"));
-    // Desktop/ACP tool processes are not required to inherit the environment of
-    // the adapter that created their Session.  In an isolated runtime, a bare
-    // `dd-flow` can therefore select the host-global router despite a correct
-    // DD_FLOW_HOME.  The runner supplies an absolute executable for that case;
-    // make every generated lifecycle command self-contained.
-    const executable = context.env.DD_FLOW_BIN;
-    if (executable && path.isAbsolute(executable)) {
-        return `DD_FLOW_HOME=${JSON.stringify(context.ddFlowHome)} "$DD_FLOW_BIN"`;
-    }
-    const isolatedExecutable = path.join(context.ddFlowHome, "bin", "dd-flow");
-    if (context.ddFlowHome !== defaultHome && fs.existsSync(isolatedExecutable)) {
-        return `DD_FLOW_HOME=${JSON.stringify(context.ddFlowHome)} ${JSON.stringify(isolatedExecutable)}`;
-    }
-    return context.ddFlowHome === defaultHome ? "dd-flow" : `DD_FLOW_HOME=${JSON.stringify(context.ddFlowHome)} dd-flow`;
+    return managedLifecycleCommand(context, runtimeCommand(context, ["stage", "resume", shortEntityReference(input.runId), "--stage", input.stage, "--work", shortEntityReference(input.workId), "--answer-file", input.answerInputPath, "--project-root", input.projectRoot, "--json"]));
 }
 function requireRun(context, projectId, id) {
     const rows = context.db.all("SELECT id, short_id, project_id, project_root, run_root, index_json FROM runs WHERE project_id = ? AND (id = ? OR short_id = ?)", [projectId, id, id]);

package/dist/services/stage-work-graph.js

@@ -0,0 +1,35 @@
+import { AppError } from "../shared/errors.js";
+export function stageAttempt(context, projectId, runId, stage) {
+    const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+    if (!run)
+        throw new AppError("not_found", "Stage graph RUN is unavailable", 1);
+    const stages = JSON.parse(run.index_json).stage_runs ?? [];
+    return [...stages].reverse().find(item => item.stage === stage)?.attempt ?? "try-001";
+}
+export function bindStageWork(context, input) {
+    context.db.run("INSERT OR IGNORE INTO stage_work_memberships (project_id, run_id, work_id, stage, attempt, cycle) VALUES (?, ?, ?, ?, ?, ?)", [input.projectId, input.runId, input.workId, input.stage, input.attempt ?? stageAttempt(context, input.projectId, input.runId, input.stage), input.cycle ?? stageCycle(context, input.projectId, input.runId, input.stage)]);
+}
+export function stageCycle(context, projectId, runId, stage) {
+    if (stage !== "code" && stage !== "code-review")
+        return "";
+    const row = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+    const cycle = row ? JSON.parse(row.index_json).variables?.["merge.source_repair"]?.cycle : undefined;
+    return typeof cycle === "string" ? cycle : stage === "code-review" ? "initial" : "";
+}
+export function stageWorkIds(context, projectId, runId, stage) {
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'stage_work_memberships'"))
+        throw new AppError("stage_graph_compatibility_required", "Stage Work membership is unavailable; use the RUN's pinned engine", 1);
+    return new Set(context.db.all("SELECT work_id FROM stage_work_memberships WHERE project_id = ? AND run_id = ? AND stage = ? AND attempt = ? AND cycle = ?", [projectId, runId, stage, stageAttempt(context, projectId, runId, stage), stageCycle(context, projectId, runId, stage)]).map(row => row.work_id));
+}
+/** Generic Work APIs also serve non-stage runs; null preserves that contract. */
+export function currentStageWorkIds(context, projectId, runId) {
+    const row = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+    if (!row)
+        return null;
+    const index = JSON.parse(row.index_json);
+    const stage = [...(index.stage_runs ?? [])].reverse().find(item => item.status === "running")?.stage;
+    return stage ? stageWorkIds(context, projectId, runId, stage) : null;
+}
+export function stageGraphScope(context, projectId, runId, stage) {
+    return { project_id: projectId, run_id: runId, attempt: stageAttempt(context, projectId, runId, stage), cycle: stageCycle(context, projectId, runId, stage) };
+}