@zq-silk/yui 0.12.3 → 0.13.0

package/dist/cli/commandCatalog.js

@@ -784,8 +784,8 @@ const taskChildren = [
             {
                 name: "retire",
                 summary: "Retire an incorrect historical Agent Run without deleting its audit record.",
-                usage: "yui task run retire <task>/<run> --reason <text>",
-                options: ["--reason"]
+                usage: "yui task run retire <task>/<run> --reason <text> [--expected-progress-at <timestamp>] [--agent-id <id>] [--adapter-id <id>] [--native-session-id <id>] [--launch-id <id>]",
+                options: ["--reason", "--expected-progress-at", "--progress-at", "--agent-id", "--adapter-id", "--native-session-id", "--launch-id"]
             }
         ]
     },

package/dist/cli/updatePorts.js

@@ -765,9 +765,25 @@ function runControllerCommandOutput(home, environment, spawn, method, cliBinary)
     const args = cliBinary === undefined
         ? [UPDATE_CLI_PATH, "--json", "controller", method]
         : ["--json", "controller", method];
-    const result = spawn(command, args, { cwd: process.cwd(), env: { ...environment, YUI_HOME: home }, shell: false });
+    const result = spawn(command, args, {
+        cwd: process.cwd(),
+        env: {
+            ...environment,
+            YUI_HOME: home,
+            // The restart child participates in the handover owned by this parent
+            // update process. Without the owner PID it waits on its parent's live
+            // lock as though a foreign update owned the Home, then times out.
+            YUI_UPDATE_HANDOVER_OWNER_PID: String(process.pid)
+        },
+        shell: false
+    });
     if (result.error !== undefined || result.status !== 0) {
-        throw new Error(`Controller ${method} failed (exit ${result.status ?? "null"}).`);
+        const detail = structuredErrorMessage(result) ?? result.stderr.toString("utf8").trim();
+        const error = new Error(`Controller ${method} failed (exit ${result.status ?? "null"})${detail.length === 0 ? "." : `: ${detail}`}`);
+        const code = controllerErrorCodeFromResult(result);
+        if (code !== undefined)
+            Object.assign(error, { code });
+        throw error;
     }
     const parsed = JSON.parse(result.stdout.toString("utf8"));
     if (!isRecord(parsed) || parsed.ok !== true) {

package/dist/cli.js

@@ -807,7 +807,7 @@ export async function main() {
         if (resolved[1] === "integration") {
             const result = await runTaskIntegrationCommand(resolved.slice(2), store, home, {
                 environment: process.env,
-                jobPort: createControllerIntegrationJobPort(home, { environment: process.env, store })
+                jobPort: createControllerIntegrationJobPort(home, { environment: process.env })
             });
             emit(result.output, false, result.data);
             return;
@@ -896,10 +896,7 @@ export async function main() {
             }
             const reference = cliWorkItemReference(workItemId, process.env);
             const qualified = `${reference.taskId}/${reference.localId}`;
-            const actor = taskActor(process.env, reference.taskId);
-            if (actor === "operator") {
-                throw usageError("Only the Task Leader may clean a WorkItem from a managed Session.");
-            }
+            taskActor(process.env, reference.taskId);
             if (disposition === "--runtime-only") {
                 let runtimeCleanup;
                 try {
@@ -1117,7 +1114,7 @@ export async function main() {
                 // Keep completion offline by default. An explicit refresh is the only
                 // path that may fetch and reconcile a moved remote baseline.
                 if (refreshRemote) {
-                    await reconcileTaskRemoteBaselines(resolved[2], store, home, { environment: process.env, jobPort: createControllerIntegrationJobPort(home, { environment: process.env, store }) });
+                    await reconcileTaskRemoteBaselines(resolved[2], store, home, { environment: process.env, jobPort: createControllerIntegrationJobPort(home, { environment: process.env }) });
                 }
             }
         }

package/dist/commands/durableJobCommands.js

@@ -1,7 +1,7 @@
 import { usageError } from "../errors/cliError.js";
 import { ensureFileTaskController } from "../controller/clientRuntime.js";
 import { acknowledgeDurableJob, cancelDurableJob, getDurableJob, startDurableJob } from "../controller/jobClient.js";
-import { resolveJobCaller, taskActor } from "./taskActor.js";
+import { resolveJobCaller, taskLocalActor } from "./taskActor.js";
 /**
  * The textual `--owner` forms accepted by `job start`. The public help text in
  * the command catalog must document exactly these forms.
@@ -34,10 +34,7 @@ export async function runDurableJobCommand(args, options) {
 async function startJob(args, options) {
     const parsed = parseStartArgs(args);
     await ensureFileTaskController(options.home, { environment: options.environment });
-    // rr8/rr12: Bind the declared owner to the caller's managed identity. The
-    // Controller rejects a Reviewer, constrains a Worker to its own Work Item,
-    // and requires a verified Leader assertion for user scope.
-    const caller = resolveJobCaller(options.environment, parsed.taskId, options.store);
+    const caller = resolveJobCaller(options.environment, parsed.taskId);
     const params = {
         taskId: parsed.taskId,
         owner: parsed.owner,
@@ -89,7 +86,7 @@ async function cancelJob(args, options) {
     const ref = parseRefArgs(args, "cancel");
     await ensureFileTaskController(options.home, { environment: options.environment });
     // rr8/rr12: Bind the cancel request to the caller's managed identity.
-    const caller = resolveJobCaller(options.environment, ref.taskId, options.store);
+    const caller = resolveJobCaller(options.environment, ref.taskId);
     const result = await cancelDurableJob(options.home, ref.taskId, ref.jobId, caller);
     if (options.json === true)
         return `${JSON.stringify(result, null, 2)}\n`;
@@ -99,20 +96,11 @@ async function cancelJob(args, options) {
 }
 async function acknowledgeJob(args, options) {
     const ref = parseRefArgs(args, "acknowledge");
-    // rr5/f5(a): only the Task Leader may acknowledge an
-    // unknown-needs-attention job. A non-Leader (Worker, Operator, or plain
-    // user) is rejected at the CLI boundary.
-    const actor = taskActor(options.environment, ref.taskId);
-    if (actor !== "leader") {
-        throw usageError("Only the Task Leader may acknowledge a DurableJob: "
-            + `${ref.taskId}.`);
-    }
     if (options.store === undefined) {
-        throw usageError("job acknowledge requires a Task store to resolve the Leader assertion.");
+        throw usageError("job acknowledge requires a Task store to resolve the caller.");
     }
-    // Carry the full managed task caller, including its ephemeral launch key.
-    // A durable leaderAssertion by itself is intentionally not sufficient.
-    const caller = resolveJobCaller(options.environment, ref.taskId, options.store);
+    taskLocalActor(options.store, options.environment, ref.taskId, options.home);
+    const caller = resolveJobCaller(options.environment, ref.taskId);
     await ensureFileTaskController(options.home, { environment: options.environment });
     const result = await acknowledgeDurableJob(options.home, ref.taskId, ref.jobId, caller);
     if (options.json === true)

package/dist/commands/executionAuditCommands.js

@@ -156,7 +156,7 @@ export function renderExecutionAudit(report, width = defaultTableWidth()) {
                 `Delta-rechecks: ${reviews.deltaRechecks.total} total · `
                     + `${reviews.deltaRechecks.equivalentAndAccepted} accepted · `
                     + `${reviews.deltaRechecks.finding} finding · `
-                    + `${reviews.deltaRechecks.requiresFullReview} requiring Leader decision`
+                    + `${reviews.deltaRechecks.requiresFullReview} requiring Task Agent decision`
             ]));
     }
     else {

package/dist/commands/taskActor.js

@@ -30,6 +30,24 @@ export function taskActor(environment, taskId) {
     }
     return "user";
 }
+/**
+ * Resolve authority for a recoverable Task-local mutation. A managed Leader
+ * does not gain that authority from long-lived process environment alone: the
+ * command must carry the exact current Turn assertion and it must still match
+ * the durable active Run, receipt, Role binding, native Session, and Home.
+ * Plain-user and global-Operator behavior remains unchanged.
+ */
+export function taskLocalActor(store, environment, taskId, yuiHome) {
+    const actor = taskActor(environment, taskId);
+    if (actor !== "leader")
+        return actor;
+    const assertion = leaderActionAssertion(environment ?? {});
+    if (assertion === undefined || assertion === "invalid"
+        || taskLeaderActionRunId(store, taskId, environment, yuiHome) === undefined) {
+        throw usageError(`Task-local Leader authority requires the exact current-Turn assertion: ${taskId}.`);
+    }
+    return actor;
+}
 export function projectActor(environment) {
     const env = environment ?? {};
     if (env.YUI_SESSION_SCOPE === "task")
@@ -49,29 +67,26 @@ export function projectActor(environment) {
 }
 /**
  * rr8: Resolve the caller identity for a `job.start`/`job.cancel` request from
- * the managed Session environment. The Controller binds the declared job owner
- * to this identity — a Reviewer is rejected outright, a Worker can only touch
- * its own Work Item's jobs, and a Leader or plain user retains full access.
+ * the managed Session environment. The Controller verifies the Agent Session
+ * and its scope; Role does not narrow Task control authority.
  *
  * rr12: The identity is now Controller-verified rather than self-reported:
  * - A managed Task Session (`YUI_SESSION_SCOPE=task`) returns `scope: "task"`
- *   with its Role and Run. A Leader additionally carries the current in-flight
- *   Turn receipt (preferring the explicit `YUI_LEADER_ACTION_*` assertion over
- *   a possibly-stale `YUI_RUN_ID`), which the Controller verifies through the
- *   same active-Run + in-flight + Session check as `job.acknowledge`.
+ *   with its Role and Run. For a Leader, the explicit current-Turn Run id is
+ *   preferred over a possibly stale `YUI_RUN_ID`.
  *
  * rr13: A managed Task Session also carries `callerKey` — the
  * `YUI_JOB_CALLER_KEY` injected at its native Session launch. The Controller
  * hashes it and compares against the durable `jobCallerKeyHashes` map, so a
  * client that reads durable state cannot replay the caller. A `user`-scope
- * caller is rejected outright for job.start/job.cancel (fail-closed); the
- * human operator acts through the Leader Session.
+ * caller is rejected outright for job.start/job.cancel (fail-closed); a
+ * managed global Agent carries its own durable Session identity.
  *
  * A managed Task Session may only start jobs for its own Task. An incomplete
  * managed identity (role/agent/run/session vars without a scope) is rejected
  * rather than silently downgraded to user authority.
  */
-export function resolveJobCaller(environment, taskId, store) {
+export function resolveJobCaller(environment, taskId) {
     const env = environment ?? {};
     if (env.YUI_SESSION_SCOPE === "task") {
         if (env.YUI_TASK_ID !== taskId) {
@@ -83,9 +98,7 @@ export function resolveJobCaller(environment, taskId, store) {
         // Controller boundary.
         const callerKey = env[JOB_CALLER_KEY_ENV];
         if (role === LEADER_ROLE) {
-            // Prefer the explicit current-turn Leader assertion over a possibly
-            // stale YUI_RUN_ID/launch. The Controller verifies it against the
-            // active in-flight Leader Run.
+            // Prefer the explicit current-Turn Run over a possibly stale YUI_RUN_ID.
             const assertion = leaderActionAssertion(env);
             if (assertion !== undefined && assertion !== "invalid") {
                 return {
@@ -93,7 +106,6 @@ export function resolveJobCaller(environment, taskId, store) {
                     taskId,
                     role,
                     runId: assertion.runId,
-                    receiptId: assertion.receiptId,
                     ...(callerKey === undefined ? {} : { callerKey })
                 };
             }
@@ -107,7 +119,14 @@ export function resolveJobCaller(environment, taskId, store) {
         };
     }
     if (env.YUI_SESSION_SCOPE === "global") {
-        return userCaller(store, taskId);
+        return {
+            scope: "global",
+            role: env.YUI_ROLE,
+            agentId: env.YUI_AGENT_ID,
+            adapterId: env.YUI_ADAPTER_ID,
+            launchId: env.YUI_LAUNCH_ID,
+            nativeSessionId: env.YUI_NATIVE_SESSION_ID
+        };
     }
     if (env.YUI_ROLE !== undefined
         || env.YUI_AGENT_ID !== undefined
@@ -115,52 +134,7 @@ export function resolveJobCaller(environment, taskId, store) {
         || env.YUI_NATIVE_SESSION_ID !== undefined) {
         throw usageError("Managed Agent identity is incomplete; refusing to infer user authority.");
     }
-    return userCaller(store, taskId);
-}
-/**
- * rr12: Build a `scope: "user"` caller. When a store is available, attach the
- * active in-flight Leader assertion so the Controller can verify the request
- * acts under real Leader authority. Without a store, return the bare
- * `{scope: "user"}` which the Controller rejects (fail-closed).
- */
-function userCaller(store, taskId) {
-    if (store === undefined)
-        return { scope: "user" };
-    const runId = activeLeaderRunId(store, taskId);
-    if (runId === undefined) {
-        throw usageError("job.start/job.cancel user scope requires an active in-flight Task Leader: "
-            + `${taskId}.`);
-    }
-    return {
-        scope: "user",
-        leaderAssertion: {
-            runId,
-            receiptId: formatAgentRunReceiptId(taskId, runId)
-        }
-    };
-}
-/**
- * rr12: Resolve the current in-flight Task Leader Run for a non-managed
- * (operator/bare-shell) caller. Unlike `taskLeaderActionRunId`, this does not
- * require managed Leader environment variables — it verifies the durable
- * state directly: an active Leader Run whose Role Session is currently
- * in-flight with the matching receipt. Returns undefined when no Leader is
- * active or in flight.
- */
-function activeLeaderRunId(store, taskId) {
-    const run = store.getActiveAgentRun(taskId, LEADER_ROLE);
-    if (run === null || run.status !== "active" || run.roleName !== LEADER_ROLE) {
-        return undefined;
-    }
-    const sessions = store.getTaskRoleSessionSet(taskId, LEADER_ROLE);
-    const expectedReceipt = agentRunDeliveryReceiptId(run);
-    if (sessions === null
-        || sessions.inFlight === null
-        || sessions.inFlight.runId !== run.id
-        || sessions.inFlight.receiptId !== expectedReceipt) {
-        return undefined;
-    }
-    return run.id;
+    return { scope: "user" };
 }
 /**
  * Resolve an exact current Task Leader Run for event attribution.