@zq-silk/yui 0.13.5 → 0.13.7

package/ARCHITECTURE.md

@@ -254,21 +254,20 @@ Yui's current attachment, not exclusive ownership of the Provider thread. One
 Turn identifies one provider-native execution. Yui's authority epoch fences
 only Yui's own submissions and retries.
 
-Codex Task threads can be opened and used directly in Desktop as ordinary
-sessions; no Yui takeover is required. If a direct user Turn is active, Yui
-keeps its pending Run/message and retries after that Turn settles. The explicit
-tmux takeover gateway remains for providers whose managed conversation is
-attached to an independent process. Global interactive entry remains a native
+Codex Task threads remain ordinary native sessions and can be opened and used
+directly in Desktop. If a direct user Turn is active, Yui keeps its pending
+Run/message until that Turn settles. Global interactive entry remains a native
 session-lifecycle operation outside the Task delivery contract.
 
-Codex uses `app-server proxy` to create or resume a normal thread on the shared
-App Server daemon. Role model, effort, permission, workspace, and shell settings are passed at
+Codex establishes an App Server WebSocket through the byte-forwarding
+`app-server proxy` to create or resume a normal thread on the shared daemon.
+Role model, effort, permission, workspace, and shell settings are passed at
 `thread/start`/`thread/resume`, while the ordinary Task message points to the
 Session Manifest and matching Role Skill. Yui does not write either to global
-Codex config and may only ensure that the daemon is running; it never restarts
-or stops it for a thread error. A Codex native config profile is rejected for
-Managed Codex because the protocol cannot isolate it to one thread; a Yui Agent
-Profile supplies the per-Role behavior, Skills, model, and effort instead.
+Codex config. A native Codex profile is rejected because it cannot be isolated
+to one shared-daemon thread. The Agent Host owns only its proxy and WebSocket:
+Task execution stop discards the Yui attachment without waiting for or changing
+the daemon or native thread, and start creates a new attachment.
 Claude uses a persistent stream-json
 transport with exact user-message replay acknowledgement. In both cases, Yui
 records Turn intent before writing, accepts only exact Provider evidence, and

package/README.md

@@ -875,13 +875,14 @@ Provider conversations remain ordinary user conversations. Yui adds the Role
 Skill and Session Manifest pointer, then sends Task work through provider-native
 structured requests. Managed prompts are never delivered as terminal bytes.
 
-Codex uses `app-server proxy` to create or resume a normal thread on the shared
-App Server daemon. The thread is visible and directly usable in Desktop; Yui
-does not require takeover or install global Hook/config state. It may
-idempotently start an absent daemon, but never restarts or stops it for a thread
-error. When a user Turn is active, Yui keeps pending Task work and retries
-later. If Yui's proxy disconnects, the Host reattaches without ending the
-logical Activation and reconciles the exact owned Turn from native history.
+Codex establishes the App Server WebSocket protocol through `app-server proxy`
+to create or resume an ordinary thread on the shared native daemon. The thread
+remains visible and directly usable in Desktop. Task execution stop terminates
+Yui's Agent Host and proxy while leaving the daemon and thread untouched; start
+creates a fresh proxy attachment.
+If the proxy disconnects, the Host may attach a bounded replacement client and
+reconcile the exact owned Turn from native history. A failed fresh attachment
+is released instead of becoming a cleanup prerequisite for later Runs.
 Claude Code keeps its independent stream-json process with exact
 user-message replay acknowledgement. A timeout or uncertain write becomes
 `delivery-unknown` and is never automatically retried.
@@ -894,10 +895,10 @@ yui task role takeover <task-id> <role>
 yui task role release <task-id> <role>
 ```
 
-For Codex, open the Role's ordinary thread in Desktop for direct interaction;
-these commands are not required. `view`/`takeover`/`release` remain the explicit
-PTY gateway for providers whose managed conversation uses an independent
-process.
+For an independently hosted Provider such as Claude, these commands are the
+supported human-control boundary. A Codex Role uses an ordinary shared thread
+and may be operated directly in Desktop; an active Desktop Turn creates bounded
+backpressure for Yui rather than a failed Run.
 
 Global Operator and global Role sessions remain native interactive CLIs:
 
@@ -962,7 +963,7 @@ movement cannot conceal a workflow that is not advancing.
 
 Stable Role context never creates a separate bootstrap Turn. Task execution Runs use the generic Leader or Worker Skill, while review Runs use the generic Reviewer Skill based on durable Run purpose rather than a configured Role name. The provider either carries the Skill through a safe additive native context channel or points to it from the ordinary Task delivery. These Yui-owned Role Skills define portable orchestration only. Project Skills remain ordinary versioned files in the Project and are discovered, selected, and loaded by the Agent through its native project mechanism; Yui does not scan, parse, copy, or inject them.
 
-Managed Codex keeps the user's native developer instructions unchanged. The ordinary Task message includes a compact absolute Session Manifest pointer, and the manifest identifies the matching Yui-owned Role Skill for Codex to read on demand. Model, effort, permission, workspace, and shell settings selected for the Role are supplied as thread-scoped `thread/start` or `thread/resume` configuration through the shared App Server daemon. A Codex native config profile cannot be isolated to one shared-daemon thread, so Managed Codex rejects that setting and directs callers to a Yui Agent Profile; ordinary non-Yui and interactive Codex sessions remain unaffected. Unrelated Codex threads keep their existing user, profile, project, and system configuration and the underlying config file is never mutated. App Server notifications are the managed thread's lifecycle authority; Yui installs no managed Codex Hook and does not claim `notify`. Interactive Codex Sessions may still use Yui's structured `notify` callback, and Doctor reports any effective configuration conflict. `skills.config` is not misused because it only enables or disables already-discovered Skills. Claude receives the same Yui-owned Role Skill content from a private `0600` managed context file rather than a large or sensitive argv value; retries and resumes reuse the purpose-specific Role path. Non-Operator global Roles stay neutral and receive no Task orchestration Skill. Operator therefore opens at an empty native composer, so the user's text remains its first user message. Leader wakeups and Worker or Reviewer Run assignments remain real mailbox-delivered work messages.
+Managed Codex keeps the user's native developer instructions unchanged. The ordinary Task message includes a compact absolute Session Manifest pointer, and the manifest identifies the matching Yui-owned Role Skill for Codex to read on demand. Model, effort, permission, workspace, and shell settings are supplied to `thread/start` or `thread/resume` through the shared App Server daemon; a Codex native config profile is rejected because it cannot be isolated to one shared-daemon thread. The underlying Codex config file is never mutated. App Server notifications are the managed thread's lifecycle authority; Yui installs no managed Codex Hook and does not claim `notify`. Interactive Codex Sessions may still use Yui's structured `notify` callback, and Doctor reports any effective configuration conflict. `skills.config` is not misused because it only enables or disables already-discovered Skills. Claude receives the same Yui-owned Role Skill content from a private `0600` managed context file rather than a large or sensitive argv value; retries and resumes reuse the purpose-specific Role path. Non-Operator global Roles stay neutral and receive no Task orchestration Skill. Operator therefore opens at an empty native composer, so the user's text remains its first user message. Leader wakeups and Worker or Reviewer Run assignments remain real mailbox-delivered work messages.
 
 ## Controller and failure handling
 

package/dist/executor/agentAdapter.js

@@ -172,8 +172,7 @@ class CodexAdapter extends BaseAdapter {
             ...launch,
             argv: [...argv, "app-server", "proxy"],
             transport: "codex-app-server-proxy",
-            codexThread: codexThreadOptions(input, config),
-            codexDaemonStartArgs: [...input.agent.baseArgs, "app-server", "daemon", "start"]
+            codexThread: codexThreadOptions(input, config)
         };
     }
 }

package/dist/executor/fileRoleLaunchPlanner.js

@@ -420,8 +420,9 @@ export class FileRoleLaunchPlanner {
             if (owner.scope !== "task" || input.runId === undefined) {
                 args = addCodexSessionNotify(args, launchMode, this.#cliPath);
             }
-            // Managed Codex Runs are ordinary shared-daemon threads. Their Session
-            // Manifest points at the Yui Skills; no Yui Hook config is installed.
+            // Managed Codex Runs use disposable proxy clients against the shared
+            // native App Server. Their Session Manifest points at the Yui Skills;
+            // no Yui Hook config is installed.
             if (owner.scope === "task" && input.runId !== undefined) {
                 if (managedRun === null || managedRun.status !== "active") {
                     throw new Error(`Managed Codex Run is no longer active: ${input.runId}.`);
@@ -516,9 +517,6 @@ export class FileRoleLaunchPlanner {
                     ...(managedCompiled.codexThread === undefined
                         ? {}
                         : { codexThread: managedCompiled.codexThread }),
-                    ...(managedCompiled.codexDaemonStartArgs === undefined
-                        ? {}
-                        : { codexDaemonStartArgs: managedCompiled.codexDaemonStartArgs }),
                     ...(providerOwnedTurn === undefined ? {} : { ownedTurn: providerOwnedTurn }),
                     authority: providerAuthority
                 }
@@ -536,9 +534,6 @@ export class FileRoleLaunchPlanner {
                         ...(managedCompiled.codexThread === undefined
                             ? {}
                             : { codexThread: managedCompiled.codexThread }),
-                        ...(managedCompiled.codexDaemonStartArgs === undefined
-                            ? {}
-                            : { codexDaemonStartArgs: managedCompiled.codexDaemonStartArgs }),
                         authority: providerAuthority,
                         initialTurn
                     }
@@ -553,9 +548,6 @@ export class FileRoleLaunchPlanner {
                         ...(managedCompiled.codexThread === undefined
                             ? {}
                             : { codexThread: managedCompiled.codexThread }),
-                        ...(managedCompiled.codexDaemonStartArgs === undefined
-                            ? {}
-                            : { codexDaemonStartArgs: managedCompiled.codexDaemonStartArgs }),
                         authority: providerAuthority,
                         initialTurn
                     };

package/dist/runtime/agentHost.js

@@ -153,7 +153,6 @@ export async function runAgentHost(input) {
                     ? {}
                     : { sessionTitle: previousControl.sessionTitle }),
                 codexThread: previousControl.codexThread,
-                codexDaemonStartArgs: previousControl.codexDaemonStartArgs,
                 ...(ownedTurn === undefined ? {} : { ownedTurn }),
                 authority
             }
@@ -258,7 +257,7 @@ export async function runAgentHost(input) {
                     ...(activeTurnAttemptId === undefined ? {} : { attemptId: activeTurnAttemptId }),
                     ...(activeNativeTurnId === undefined ? {} : { nativeTurnId: activeNativeTurnId }),
                     ...exitAuthority,
-                    detail: "Codex client disconnected; reattaching to the shared daemon."
+                    detail: "Codex App Server proxy disconnected; attaching a replacement client."
                 }));
                 await reconnectCodexClient(providerSession, currentPayload);
                 return;

package/dist/runtime/builtinAgentDrivers.js

@@ -121,7 +121,8 @@ export const BUILTIN_AGENT_DRIVERS = Object.freeze([
             }),
             observation: Object.freeze({
                 ...STRUCTURED_CLI_CAPABILITIES.observation,
-                // Managed Codex uses the ordinary shared App Server event stream.
+                // Managed Codex uses its Yui-owned proxy subscription to the shared
+                // App Server event stream.
                 // Turn lifecycle is exact; Yui does not install per-thread Hooks merely
                 // to manufacture tool/wait/usage observations.
                 operations: Object.freeze([]),

package/dist/runtime/launchBroker.js

@@ -93,18 +93,8 @@ function validateProviderControl(control) {
     if ((control.adapterId === "codex") !== (control.codexThread !== undefined)) {
         throw new Error("Agent Host Provider thread settings do not match its adapter.");
     }
-    if ((control.adapterId === "codex") !== (control.codexDaemonStartArgs !== undefined)) {
-        throw new Error("Agent Host Provider daemon bootstrap does not match its adapter.");
-    }
     if (control.codexThread !== undefined)
         validateCodexThreadOptions(control.codexThread);
-    if (control.codexDaemonStartArgs !== undefined) {
-        if (!Array.isArray(control.codexDaemonStartArgs)
-            || control.codexDaemonStartArgs.length === 0) {
-            throw new Error("Agent Host Codex daemon bootstrap args are invalid.");
-        }
-        control.codexDaemonStartArgs.forEach((value) => text(value, "Codex daemon argument"));
-    }
     if (control.mode !== "new" && control.mode !== "resume") {
         throw new Error("Agent Host Provider control mode is invalid.");
     }

package/dist/runtime/structuredProviderHost.js

@@ -1,11 +1,12 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import { Duplex } from "node:stream";
+import WebSocket from "ws";
 import { CodexAppServerRequestError, CodexAppServerRuntime, codexAppServerErrorIsMissing } from "./codexAppServerRuntime.js";
 import { PROVIDER_ACCEPT_TIMEOUT_MS } from "./runtimeDeadlines.js";
 import { YUI_VERSION } from "../version.js";
 const PROVIDER_MESSAGE_MAX_BYTES = 16 * 1024 * 1024;
-const CODEX_DAEMON_START_TIMEOUT_MS = 10_000;
-const CODEX_DAEMON_OUTPUT_MAX_BYTES = 64 * 1024;
+const CODEX_PROXY_HANDSHAKE_TIMEOUT_MS = 10_000;
 export class ProviderDeliveryUnknownError extends Error {
     attemptId;
     name = "ProviderDeliveryUnknownError";
@@ -46,9 +47,6 @@ export async function startStructuredProviderSession(payload, input = {}) {
     if (control === undefined) {
         throw new Error("Managed Agent Host launch requires Provider control metadata.");
     }
-    if (control.adapterId === "codex") {
-        await ensureCodexAppServerDaemon(payload, control);
-    }
     const child = spawn(payload.command, [...payload.args], {
         cwd: payload.cwd,
         env: { ...payload.environment },
@@ -78,79 +76,57 @@ export async function startStructuredProviderSession(payload, input = {}) {
         throw error;
     }
 }
-async function ensureCodexAppServerDaemon(payload, control) {
-    if (payload.args.at(-2) !== "app-server" || payload.args.at(-1) !== "proxy")
-        return;
-    if (control.adapterId !== "codex")
-        return;
-    const environment = Object.fromEntries(Object.entries(payload.environment).filter(([key]) => (!key.startsWith("YUI_")
-        && key !== "CODEX_INTERNAL_ORIGINATOR_OVERRIDE"
-        && !["TMPDIR", "XDG_CACHE_HOME", "XDG_DATA_HOME", "XDG_STATE_HOME", "XDG_RUNTIME_DIR"]
-            .includes(key))));
-    const child = spawn(payload.command, [...control.codexDaemonStartArgs], {
-        cwd: payload.cwd,
-        env: environment,
-        stdio: ["ignore", "pipe", "pipe"]
-    });
-    await new Promise((resolvePromise, reject) => {
-        let output = "";
-        let settled = false;
-        let timer;
-        const settle = (error) => {
-            if (settled)
-                return;
-            settled = true;
-            if (timer !== undefined)
-                clearTimeout(timer);
-            if (error === undefined)
-                resolvePromise();
-            else
-                reject(error);
-        };
-        const capture = (chunk) => {
-            output += String(chunk);
-            if (Buffer.byteLength(output, "utf8") <= CODEX_DAEMON_OUTPUT_MAX_BYTES)
-                return;
-            child.kill("SIGTERM");
-            settle(new Error("Codex App Server daemon start output exceeded its bound."));
-        };
-        child.stdout.on("data", capture);
-        child.stderr.on("data", capture);
-        child.once("error", (error) => settle(error));
-        child.once("close", (code, signal) => {
-            if (code === 0)
-                settle();
-            else
-                settle(new Error(`Codex App Server daemon start failed (${code ?? signal ?? "unknown"})${output.trim().length === 0 ? "" : `: ${output.trim()}`}`));
-        });
-        timer = setTimeout(() => {
-            child.kill("SIGTERM");
-            settle(new Error("Codex App Server daemon start timed out."));
-        }, CODEX_DAEMON_START_TIMEOUT_MS);
-        timer.unref();
-    });
-}
-class JsonLineChannel {
+class CodexProxyWebSocketChannel {
     child;
     mirror;
     #pending = new Map();
     #listeners = new Set();
-    #buffer = "";
     #nextId = 1;
     #closedError;
+    #ready = false;
+    #readyPromise;
+    #resolveReady;
+    #rejectReady;
+    #webSocket;
     constructor(child, mirror) {
         this.child = child;
         this.mirror = mirror;
-        child.stdout.setEncoding("utf8");
-        child.stdout.on("data", (chunk) => this.#receive(chunk));
+        let resolveReady;
+        let rejectReady;
+        this.#readyPromise = new Promise((resolvePromise, reject) => {
+            resolveReady = resolvePromise;
+            rejectReady = reject;
+        });
+        this.#resolveReady = resolveReady;
+        this.#rejectReady = rejectReady;
+        const transport = new ChildProcessDuplex(child);
+        this.#webSocket = new WebSocket("ws://localhost/rpc", {
+            createConnection: () => transport,
+            handshakeTimeout: CODEX_PROXY_HANDSHAKE_TIMEOUT_MS,
+            maxPayload: PROVIDER_MESSAGE_MAX_BYTES,
+            perMessageDeflate: false
+        });
+        this.#webSocket.once("open", () => {
+            this.#ready = true;
+            this.#resolveReady();
+        });
+        this.#webSocket.on("message", (data, isBinary) => this.#receive(data, isBinary));
+        this.#webSocket.on("error", (error) => this.#close(error));
+        this.#webSocket.once("close", (code, reason) => this.#close(new Error(`Codex App Server proxy WebSocket closed (code=${code}, reason=${reason.toString() || "none"}).`)));
         child.once("error", (error) => this.#close(error));
         child.once("close", (code, signal) => this.#close(new Error(`Provider process exited before replying (code=${code ?? "none"}, signal=${signal ?? "none"}).`)));
     }
+    static async connect(child, mirror) {
+        const channel = new CodexProxyWebSocketChannel(child, mirror);
+        await channel.#readyPromise;
+        return channel;
+    }
     onMessage(listener) {
         this.#listeners.add(listener);
         return () => this.#listeners.delete(listener);
     }
     async request(method, params) {
+        await this.#readyPromise;
         if (this.#closedError !== undefined)
             throw this.#closedError;
         const id = String(this.#nextId++);
@@ -177,6 +153,136 @@ class JsonLineChannel {
     async notify(method, params) {
         await this.send({ method, ...(params === undefined ? {} : { params }) });
     }
+    async send(message) {
+        await this.#readyPromise;
+        if (this.#closedError !== undefined)
+            throw this.#closedError;
+        const encoded = JSON.stringify(message);
+        if (Buffer.byteLength(encoded, "utf8") > PROVIDER_MESSAGE_MAX_BYTES) {
+            throw new Error("Provider request exceeds its message bound.");
+        }
+        await new Promise((resolvePromise, reject) => {
+            this.#webSocket.send(encoded, (error) => {
+                if (error === undefined || error === null)
+                    resolvePromise();
+                else
+                    reject(error);
+            });
+        });
+    }
+    #receive(data, isBinary) {
+        const encoded = Buffer.isBuffer(data)
+            ? data
+            : data instanceof ArrayBuffer
+                ? Buffer.from(data)
+                : Buffer.concat(data);
+        if (isBinary || encoded.byteLength > PROVIDER_MESSAGE_MAX_BYTES) {
+            this.#close(new Error(isBinary
+                ? "Provider returned an unsupported binary WebSocket message."
+                : "Provider response message exceeds its bound."));
+            terminateProcessGroup(this.child, "SIGTERM");
+            return;
+        }
+        const text = encoded.toString("utf8");
+        this.mirror("stdout", `${text}\n`);
+        let message;
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+                return;
+            message = parsed;
+        }
+        catch {
+            return;
+        }
+        const id = requestId(message.id);
+        const pending = id === undefined ? undefined : this.#pending.get(id);
+        if (pending !== undefined) {
+            clearTimeout(pending.timer);
+            this.#pending.delete(id);
+            const error = object(message.error);
+            if (error !== null) {
+                pending.reject(new CodexAppServerRequestError(typeof error.code === "number" || typeof error.code === "string"
+                    ? error.code
+                    : "UNKNOWN", typeof error.message === "string" ? error.message : "Provider request failed.", error.data));
+            }
+            else {
+                pending.resolve(object(message.result) ?? {});
+            }
+            return;
+        }
+        for (const listener of this.#listeners)
+            listener(message);
+    }
+    #close(error) {
+        if (this.#closedError !== undefined)
+            return;
+        this.#closedError = error;
+        if (!this.#ready)
+            this.#rejectReady(error);
+        for (const pending of this.#pending.values()) {
+            clearTimeout(pending.timer);
+            pending.reject(error);
+        }
+        this.#pending.clear();
+        if (this.child.exitCode === null && this.child.signalCode === null) {
+            terminateProcessGroup(this.child, "SIGTERM");
+        }
+    }
+}
+class ChildProcessDuplex extends Duplex {
+    child;
+    connecting = false;
+    constructor(child) {
+        super();
+        this.child = child;
+        child.stdout.on("data", (chunk) => {
+            if (!this.push(chunk))
+                child.stdout.pause();
+        });
+        child.stdout.once("end", () => this.push(null));
+        child.once("error", (error) => this.destroy(error));
+        child.once("close", () => this.destroy());
+    }
+    _read() {
+        this.child.stdout.resume();
+    }
+    _write(chunk, encoding, callback) {
+        this.child.stdin.write(chunk, encoding, callback);
+    }
+    _final(callback) {
+        this.child.stdin.end(callback);
+    }
+    setNoDelay() {
+        return this;
+    }
+    setKeepAlive() {
+        return this;
+    }
+    setTimeout(_timeout, callback) {
+        if (callback !== undefined)
+            this.once("timeout", callback);
+        return this;
+    }
+}
+class JsonLineChannel {
+    child;
+    mirror;
+    #listeners = new Set();
+    #buffer = "";
+    #closedError;
+    constructor(child, mirror) {
+        this.child = child;
+        this.mirror = mirror;
+        child.stdout.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => this.#receive(chunk));
+        child.once("error", (error) => this.#close(error));
+        child.once("close", (code, signal) => this.#close(new Error(`Provider process exited (code=${code ?? "none"}, signal=${signal ?? "none"}).`)));
+    }
+    onMessage(listener) {
+        this.#listeners.add(listener);
+        return () => this.#listeners.delete(listener);
+    }
     async send(message) {
         if (this.#closedError !== undefined)
             throw this.#closedError;
@@ -209,45 +315,21 @@ class JsonLineChannel {
             this.#buffer = this.#buffer.slice(newline + 1);
             if (line.length === 0)
                 continue;
-            let message;
             try {
                 const parsed = JSON.parse(line);
                 if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
                     continue;
-                message = parsed;
+                for (const listener of this.#listeners)
+                    listener(parsed);
             }
             catch {
                 continue;
             }
-            const id = requestId(message.id);
-            const pending = id === undefined ? undefined : this.#pending.get(id);
-            if (pending !== undefined) {
-                clearTimeout(pending.timer);
-                this.#pending.delete(id);
-                const error = object(message.error);
-                if (error !== null) {
-                    pending.reject(new CodexAppServerRequestError(typeof error.code === "number" || typeof error.code === "string"
-                        ? error.code
-                        : "UNKNOWN", typeof error.message === "string" ? error.message : "Provider request failed.", error.data));
-                }
-                else {
-                    pending.resolve(object(message.result) ?? {});
-                }
-                continue;
-            }
-            for (const listener of this.#listeners)
-                listener(message);
         }
     }
     #close(error) {
-        if (this.#closedError !== undefined)
-            return;
-        this.#closedError = error;
-        for (const pending of this.#pending.values()) {
-            clearTimeout(pending.timer);
-            pending.reject(error);
-        }
-        this.#pending.clear();
+        if (this.#closedError === undefined)
+            this.#closedError = error;
     }
 }
 class CodexStructuredProviderSession {
@@ -271,7 +353,7 @@ class CodexStructuredProviderSession {
         this.onTerminal = onTerminal;
     }
     static async open(child, exit, processInstanceId, payload, control, onTerminal, mirror) {
-        const channel = new JsonLineChannel(child, mirror);
+        const channel = await CodexProxyWebSocketChannel.connect(child, mirror);
         const openingMessages = [];
         const stopOpeningBuffer = channel.onMessage((message) => openingMessages.push(message));
         await channel.request("initialize", {

package/dist/runtime/tmuxAdapters.js

@@ -347,7 +347,7 @@ export class TmuxSessionHost {
                     : { [YUI_TASK_RUNTIME_DESCRIPTOR]: frozenTaskRuntime })
             }
         };
-        let hostCreated;
+        let hostCreated = false;
         let providerAcknowledged = false;
         let providerDeliveryUnknown = false;
         let providerBusy = false;
@@ -420,6 +420,14 @@ export class TmuxSessionHost {
         }
         catch (error) {
             broker.revoke(request.launchId);
+            if (hostCreated && !providerDispatchObserved) {
+                try {
+                    await stopExactRole(this.tmux, hostId, request.owner.roleName);
+                }
+                catch (stopError) {
+                    throw new Error(`Managed Provider launch failed and its disposable Agent Host could not be stopped: ${stopError instanceof Error ? stopError.message : String(stopError)}`, { cause: stopError });
+                }
+            }
             throw error;
         }
         if (providerDispatchObserved

package/i18n/README.zh-CN.md

@@ -510,9 +510,9 @@ Task 生命周期的交互选择只展示有效来源状态：activate 只展示
 
 ## Session 与 tmux
 
-受管理的 Provider 会话仍然是普通用户会话。Yui 只添加对应的 Role Skill 与 Session Manifest 指针，并通过 Provider 原生结构化协议提交 Task 工作；Yui 不接管完整对话历史。受管理输入绝不会作为终端按键、粘贴文本或启动 argv 发送。Codex 通过 `app-server proxy` 在共享 App Server daemon 上创建或恢复普通 thread；proxy 断开时 Host 会保留逻辑 Activation，重新连接并用原生 thread 历史核对 Yui 已持有的 Turn。Claude 继续使用独立的持久 stream-json 进程，并以精确回放的 user message 作为接收确认。
+受管理的 Provider 会话仍然是普通用户会话。Yui 只添加对应的 Role Skill 与 Session Manifest 指针，并通过 Provider 原生结构化协议提交 Task 工作；Yui 不接管完整对话历史。受管理输入绝不会作为终端按键、粘贴文本或启动 argv 发送。Codex 在只转发字节的 `app-server proxy` 上完成 App Server WebSocket 握手，接入与 Desktop 相同的共享 daemon；原生 thread 可在 Desktop 中直接查看和操作。Task execution stop 只终止 Yui 的 Agent Host、WebSocket 与 proxy，保留共享 daemon、原生 thread、Task、WorkItem、代码与持久消息；start 创建新的 attachment。Claude 继续使用独立的持久 stream-json 进程，并以精确回放的 user message 作为接收确认。
 
-Run、Conversation、Activation 与 Turn 是四个独立身份。Conversation 可以跨多个 Run 和客户端连接；Activation 只代表 Yui 当前的连接，而不是对 Provider thread 的独占所有权；Turn 在写入前先持久化。写入超时或结果不明确会进入 `delivery-unknown`，不会自动重发。用户在 Desktop 直接发起的 active Turn 只会让 Yui 暂时等待，不会导致 Yui Run 失败。
+Run、Conversation、Activation 与 Turn 是四个独立身份。Conversation 可以跨多个 Run 和客户端连接；Activation 只代表 Yui 当前的连接，而不是对 Provider thread 的独占所有权；Turn 在写入前先持久化。写入超时或结果不明确会进入 `delivery-unknown`，不会自动重发。Codex 已存在的原生 active Turn 只会让 Yui 暂时等待，不会导致 Yui Run 失败；Claude 等独立进程 Provider 继续通过 Yui 的 view/takeover 边界进行人工控制。
 
 Task Role 使用以下显式入口：
 
@@ -524,7 +524,7 @@ yui task role takeover <task-id> <role>
 yui task role release <task-id> <role>
 ```
 
-Codex Role thread 可以直接在 Desktop 中打开和交互，不需要执行 `takeover`；Yui 不写入全局 Hook/config。Yui 可以幂等启动尚未运行的共享 daemon，但不会因 thread 错误停止或重启它。`view`、`takeover`、`release` 继续作为独立进程型 Provider 的显式 PTY 输入网关。Global Operator 与 global Role 继续使用原生交互式 CLI，不属于受管理 Task Provider 协议。
+Codex Role thread 可在 Desktop 中直接查看和操作；Desktop 已有 active Turn 时，Yui 只保留待投递工作并等待，不会失败或重复投递。`view`、`takeover`、`release` 继续作为 Claude 等独立进程 Provider 的人工控制入口。Yui 不写入全局 Hook/config，也不启动、重启或停止共享 daemon；Codex CLI/daemon 故障由 Task 生命周期之外修复。Global Operator 与 global Role 继续使用原生交互式 CLI，不属于受管理 Task Provider 协议。
 
 当新版本需要离线迁移 Home 时，应等待当前 Turn/Run 完成，然后从普通 shell
 执行 `yui session stop --all`，再重新执行 `yui update`。停止命令会先整体预检：
@@ -560,7 +560,7 @@ state、receipt 与 pane fence。Yui 不会解析 prompt glyph、进度文本、
 或其他 Agent 终端输出来推断 ready 或 success。`captureRole()` 只用于显式的人类
 transcript 查看，不具备生命周期权威。
 
-稳定的 Role 上下文不会创建额外的 bootstrap Turn。Task execution Run 按角色使用通用 Leader 或 Worker Skill，review Run 则按持久 Run purpose 使用通用 Reviewer Skill；Provider 可以通过安全的追加式原生上下文通道携带 Skill，也可以在普通 Task 投递中指向它。这些都只是 Yui 自己拥有的可移植编排规则。Project Skills 始终是 Project 中正常版本化的文件，由 Agent 通过自身项目机制发现、选择并按需加载；Yui 不扫描、不解析、不复制，也不注入 Project Skills。Managed Codex 保留用户原有的 developer instructions；普通 Task 消息会携带精简的 Session Manifest 绝对路径，Manifest 再指向对应的 Yui Role Skill，供 Codex 按需读取。Role 选择的 model、effort、permission、workspace 与 shell 设置通过共享 App Server daemon，作为线程级 `thread/start` 或 `thread/resume` 配置传入。Codex 原生 config profile 不能隔离到共享 daemon 的单个 thread，因此 Managed Codex 会拒绝这个设置并提示使用 Yui Agent Profile；其他非 Yui 或交互式 Codex 会话不受影响。其他 Codex 线程继续使用原有的用户、profile、Project 和 system 配置，Yui 不修改底层配置文件。App Server 原生通知是 Managed Codex 线程的生命周期权威；Yui 不为它安装 Hook，也不占用 `notify`。交互式 Codex Session 仍可使用 Yui 的结构化 `notify` callback，Doctor 会报告最终生效的配置冲突。`skills.config` 只负责启停已发现 Skill，Yui 不会误用它。Claude 从 Yui 管理的私有 `0600` context 文件读取同一份 Yui Role Skill 内容，不再把大段或敏感文本放进 argv；重试和 resume 会复用按 purpose 区分的稳定路径。非 Operator 的 global Role 保持中性，不会注入 Task 编排 Skill。因此 Operator 会停在空白的原生 composer，用户输入仍是第一条 user message；Leader wake、Worker 和 Reviewer Run assignment 仍是邮箱投递的真实工作消息。
+稳定的 Role 上下文不会创建额外的 bootstrap Turn。Task execution Run 按角色使用通用 Leader 或 Worker Skill，review Run 则按持久 Run purpose 使用通用 Reviewer Skill；Provider 可以通过安全的追加式原生上下文通道携带 Skill，也可以在普通 Task 投递中指向它。这些都只是 Yui 自己拥有的可移植编排规则。Project Skills 始终是 Project 中正常版本化的文件，由 Agent 通过自身项目机制发现、选择并按需加载；Yui 不扫描、不解析、不复制，也不注入 Project Skills。Managed Codex 保留用户原有的 developer instructions；普通 Task 消息会携带精简的 Session Manifest 绝对路径，Manifest 再指向对应的 Yui Role Skill，供 Codex 按需读取。model、effort、permission、workspace 与 shell 设置作为共享 daemon 上的线程级 `thread/start` 或 `thread/resume` 配置传入；Codex 原生 config profile 因无法隔离到单条共享 thread 而被拒绝，Yui 不修改底层 Codex 配置文件。App Server 原生通知是 Managed Codex 线程的生命周期权威；Yui 不为它安装 Hook，也不占用 `notify`。交互式 Codex Session 仍可使用 Yui 的结构化 `notify` callback，Doctor 会报告最终生效的配置冲突。`skills.config` 只负责启停已发现 Skill，Yui 不会误用它。Claude 从 Yui 管理的私有 `0600` context 文件读取同一份 Yui Role Skill 内容，不再把大段或敏感文本放进 argv；重试和 resume 会复用按 purpose 区分的稳定路径。非 Operator 的 global Role 保持中性，不会注入 Task 编排 Skill。因此 Operator 会停在空白的原生 composer，用户输入仍是第一条 user message；Leader wake、Worker 和 Reviewer Run assignment 仍是邮箱投递的真实工作消息。
 
 ## Controller 与失败处理
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.13.5",
+  "version": "0.13.7",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,