@zq-silk/yui 0.13.6 → 0.13.7

package/ARCHITECTURE.md

@@ -254,21 +254,20 @@ Yui's current attachment, not exclusive ownership of the Provider thread. One
 Turn identifies one provider-native execution. Yui's authority epoch fences
 only Yui's own submissions and retries.
 
-Codex Task threads remain ordinary native sessions and can be inspected in
-Desktop. While their managed Role runtime is live, writes go through Yui's
-view/takeover boundary; stop Task execution before resuming the thread from a
-different client. If Yui observes a pre-existing active Turn during resume, it
-keeps its pending Run/message until that Turn settles. Global interactive entry
-remains a native session-lifecycle operation outside the Task delivery contract.
-
-Codex uses a Yui-owned direct `app-server` child to create or resume a normal
-thread. The process loads the selected native config profile; Role model,
-effort, permission, workspace, and shell settings are passed at
+Codex Task threads remain ordinary native sessions and can be opened and used
+directly in Desktop. If a direct user Turn is active, Yui keeps its pending
+Run/message until that Turn settles. Global interactive entry remains a native
+session-lifecycle operation outside the Task delivery contract.
+
+Codex establishes an App Server WebSocket through the byte-forwarding
+`app-server proxy` to create or resume a normal thread on the shared daemon.
+Role model, effort, permission, workspace, and shell settings are passed at
 `thread/start`/`thread/resume`, while the ordinary Task message points to the
 Session Manifest and matching Role Skill. Yui does not write either to global
-Codex config. The Agent Host owns the Provider process group, so Task execution
-stop can end the complete runtime and start can rebuild it without depending on
-the shared Codex daemon.
+Codex config. A native Codex profile is rejected because it cannot be isolated
+to one shared-daemon thread. The Agent Host owns only its proxy and WebSocket:
+Task execution stop discards the Yui attachment without waiting for or changing
+the daemon or native thread, and start creates a new attachment.
 Claude uses a persistent stream-json
 transport with exact user-message replay acknowledgement. In both cases, Yui
 records Turn intent before writing, accepts only exact Provider evidence, and

package/README.md

@@ -875,13 +875,14 @@ Provider conversations remain ordinary user conversations. Yui adds the Role
 Skill and Session Manifest pointer, then sends Task work through provider-native
 structured requests. Managed prompts are never delivered as terminal bytes.
 
-Codex uses a direct, Yui-owned `app-server` child to create or resume a normal
-thread. The thread remains visible in Codex, while Yui's view/takeover boundary
-is the supported way to interact with a live managed Role. Task execution stop
-terminates the Agent Host and its Provider process group; start creates a fresh
-owned runtime without depending on the shared Codex daemon. If the child
-disconnects, the Host may start a bounded replacement process and reconcile the
-exact owned Turn from native history.
+Codex establishes the App Server WebSocket protocol through `app-server proxy`
+to create or resume an ordinary thread on the shared native daemon. The thread
+remains visible and directly usable in Desktop. Task execution stop terminates
+Yui's Agent Host and proxy while leaving the daemon and thread untouched; start
+creates a fresh proxy attachment.
+If the proxy disconnects, the Host may attach a bounded replacement client and
+reconcile the exact owned Turn from native history. A failed fresh attachment
+is released instead of becoming a cleanup prerequisite for later Runs.
 Claude Code keeps its independent stream-json process with exact
 user-message replay acknowledgement. A timeout or uncertain write becomes
 `delivery-unknown` and is never automatically retried.
@@ -894,9 +895,10 @@ yui task role takeover <task-id> <role>
 yui task role release <task-id> <role>
 ```
 
-For a live managed Role, including Codex, these commands are the supported
-human-control boundary. Its ordinary native thread remains inspectable in
-Codex; stop Task execution before resuming it from a different client.
+For an independently hosted Provider such as Claude, these commands are the
+supported human-control boundary. A Codex Role uses an ordinary shared thread
+and may be operated directly in Desktop; an active Desktop Turn creates bounded
+backpressure for Yui rather than a failed Run.
 
 Global Operator and global Role sessions remain native interactive CLIs:
 
@@ -961,7 +963,7 @@ movement cannot conceal a workflow that is not advancing.
 
 Stable Role context never creates a separate bootstrap Turn. Task execution Runs use the generic Leader or Worker Skill, while review Runs use the generic Reviewer Skill based on durable Run purpose rather than a configured Role name. The provider either carries the Skill through a safe additive native context channel or points to it from the ordinary Task delivery. These Yui-owned Role Skills define portable orchestration only. Project Skills remain ordinary versioned files in the Project and are discovered, selected, and loaded by the Agent through its native project mechanism; Yui does not scan, parse, copy, or inject them.
 
-Managed Codex keeps the user's native developer instructions unchanged. The ordinary Task message includes a compact absolute Session Manifest pointer, and the manifest identifies the matching Yui-owned Role Skill for Codex to read on demand. Its Yui-owned App Server process loads any selected Codex native config profile; model, effort, permission, workspace, and shell settings are supplied to `thread/start` or `thread/resume`, and the underlying Codex config file is never mutated. App Server notifications are the managed thread's lifecycle authority; Yui installs no managed Codex Hook and does not claim `notify`. Interactive Codex Sessions may still use Yui's structured `notify` callback, and Doctor reports any effective configuration conflict. `skills.config` is not misused because it only enables or disables already-discovered Skills. Claude receives the same Yui-owned Role Skill content from a private `0600` managed context file rather than a large or sensitive argv value; retries and resumes reuse the purpose-specific Role path. Non-Operator global Roles stay neutral and receive no Task orchestration Skill. Operator therefore opens at an empty native composer, so the user's text remains its first user message. Leader wakeups and Worker or Reviewer Run assignments remain real mailbox-delivered work messages.
+Managed Codex keeps the user's native developer instructions unchanged. The ordinary Task message includes a compact absolute Session Manifest pointer, and the manifest identifies the matching Yui-owned Role Skill for Codex to read on demand. Model, effort, permission, workspace, and shell settings are supplied to `thread/start` or `thread/resume` through the shared App Server daemon; a Codex native config profile is rejected because it cannot be isolated to one shared-daemon thread. The underlying Codex config file is never mutated. App Server notifications are the managed thread's lifecycle authority; Yui installs no managed Codex Hook and does not claim `notify`. Interactive Codex Sessions may still use Yui's structured `notify` callback, and Doctor reports any effective configuration conflict. `skills.config` is not misused because it only enables or disables already-discovered Skills. Claude receives the same Yui-owned Role Skill content from a private `0600` managed context file rather than a large or sensitive argv value; retries and resumes reuse the purpose-specific Role path. Non-Operator global Roles stay neutral and receive no Task orchestration Skill. Operator therefore opens at an empty native composer, so the user's text remains its first user message. Leader wakeups and Worker or Reviewer Run assignments remain real mailbox-delivered work messages.
 
 ## Controller and failure handling
 

package/dist/executor/agentAdapter.js

@@ -150,6 +150,10 @@ class CodexAdapter extends BaseAdapter {
     }
     compileManagedControl(input, _mode, _nativeSessionId) {
         const config = this.canonicalizeConfig(input.config);
+        if (config.profile !== undefined) {
+            throw new Error("Managed Codex does not accept a Codex config profile because it cannot be scoped to one "
+                + "shared-daemon thread. Use a Yui Agent Profile for skills, model, and effort.");
+        }
         const launch = this.compileNew(input);
         // A managed Codex thread is an ordinary user thread. Its Yui guidance is
         // part of the durable Task message, not a developer_instructions override
@@ -166,8 +170,8 @@ class CodexAdapter extends BaseAdapter {
         }
         return {
             ...launch,
-            argv: [...argv, "app-server"],
-            transport: "codex-app-server",
+            argv: [...argv, "app-server", "proxy"],
+            transport: "codex-app-server-proxy",
             codexThread: codexThreadOptions(input, config)
         };
     }

package/dist/executor/fileRoleLaunchPlanner.js

@@ -420,8 +420,9 @@ export class FileRoleLaunchPlanner {
             if (owner.scope !== "task" || input.runId === undefined) {
                 args = addCodexSessionNotify(args, launchMode, this.#cliPath);
             }
-            // Managed Codex Runs use Yui-owned App Server processes. Their Session
-            // Manifest points at the Yui Skills; no Yui Hook config is installed.
+            // Managed Codex Runs use disposable proxy clients against the shared
+            // native App Server. Their Session Manifest points at the Yui Skills;
+            // no Yui Hook config is installed.
             if (owner.scope === "task" && input.runId !== undefined) {
                 if (managedRun === null || managedRun.status !== "active") {
                     throw new Error(`Managed Codex Run is no longer active: ${input.runId}.`);

package/dist/runtime/agentHost.js

@@ -145,7 +145,7 @@ export async function runAgentHost(input) {
             providerControl: {
                 schemaVersion: 1,
                 adapterId: "codex",
-                transport: "codex-app-server",
+                transport: "codex-app-server-proxy",
                 kind: "ensure",
                 mode: "resume",
                 nativeSessionId: disconnectedSession.nativeSessionId,
@@ -257,7 +257,7 @@ export async function runAgentHost(input) {
                     ...(activeTurnAttemptId === undefined ? {} : { attemptId: activeTurnAttemptId }),
                     ...(activeNativeTurnId === undefined ? {} : { nativeTurnId: activeNativeTurnId }),
                     ...exitAuthority,
-                    detail: "Codex App Server disconnected; starting a replacement process."
+                    detail: "Codex App Server proxy disconnected; attaching a replacement client."
                 }));
                 await reconnectCodexClient(providerSession, currentPayload);
                 return;

package/dist/runtime/builtinAgentDrivers.js

@@ -121,7 +121,8 @@ export const BUILTIN_AGENT_DRIVERS = Object.freeze([
             }),
             observation: Object.freeze({
                 ...STRUCTURED_CLI_CAPABILITIES.observation,
-                // Managed Codex uses its Yui-owned App Server event stream.
+                // Managed Codex uses its Yui-owned proxy subscription to the shared
+                // App Server event stream.
                 // Turn lifecycle is exact; Yui does not install per-thread Hooks merely
                 // to manufacture tool/wait/usage observations.
                 operations: Object.freeze([]),

package/dist/runtime/launchBroker.js

@@ -86,7 +86,7 @@ function validateProviderControl(control) {
     if (control.adapterId !== "codex" && control.adapterId !== "claude") {
         throw new Error("Agent Host Provider control adapter is invalid.");
     }
-    if ((control.adapterId === "codex" && control.transport !== "codex-app-server")
+    if ((control.adapterId === "codex" && control.transport !== "codex-app-server-proxy")
         || (control.adapterId === "claude" && control.transport !== "claude-stream-json")) {
         throw new Error("Agent Host Provider control transport does not match its adapter.");
     }

package/dist/runtime/structuredProviderHost.js

@@ -1,9 +1,12 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import { Duplex } from "node:stream";
+import WebSocket from "ws";
 import { CodexAppServerRequestError, CodexAppServerRuntime, codexAppServerErrorIsMissing } from "./codexAppServerRuntime.js";
 import { PROVIDER_ACCEPT_TIMEOUT_MS } from "./runtimeDeadlines.js";
 import { YUI_VERSION } from "../version.js";
 const PROVIDER_MESSAGE_MAX_BYTES = 16 * 1024 * 1024;
+const CODEX_PROXY_HANDSHAKE_TIMEOUT_MS = 10_000;
 export class ProviderDeliveryUnknownError extends Error {
     attemptId;
     name = "ProviderDeliveryUnknownError";
@@ -73,27 +76,57 @@ export async function startStructuredProviderSession(payload, input = {}) {
         throw error;
     }
 }
-class JsonLineChannel {
+class CodexProxyWebSocketChannel {
     child;
     mirror;
     #pending = new Map();
     #listeners = new Set();
-    #buffer = "";
     #nextId = 1;
     #closedError;
+    #ready = false;
+    #readyPromise;
+    #resolveReady;
+    #rejectReady;
+    #webSocket;
     constructor(child, mirror) {
         this.child = child;
         this.mirror = mirror;
-        child.stdout.setEncoding("utf8");
-        child.stdout.on("data", (chunk) => this.#receive(chunk));
+        let resolveReady;
+        let rejectReady;
+        this.#readyPromise = new Promise((resolvePromise, reject) => {
+            resolveReady = resolvePromise;
+            rejectReady = reject;
+        });
+        this.#resolveReady = resolveReady;
+        this.#rejectReady = rejectReady;
+        const transport = new ChildProcessDuplex(child);
+        this.#webSocket = new WebSocket("ws://localhost/rpc", {
+            createConnection: () => transport,
+            handshakeTimeout: CODEX_PROXY_HANDSHAKE_TIMEOUT_MS,
+            maxPayload: PROVIDER_MESSAGE_MAX_BYTES,
+            perMessageDeflate: false
+        });
+        this.#webSocket.once("open", () => {
+            this.#ready = true;
+            this.#resolveReady();
+        });
+        this.#webSocket.on("message", (data, isBinary) => this.#receive(data, isBinary));
+        this.#webSocket.on("error", (error) => this.#close(error));
+        this.#webSocket.once("close", (code, reason) => this.#close(new Error(`Codex App Server proxy WebSocket closed (code=${code}, reason=${reason.toString() || "none"}).`)));
         child.once("error", (error) => this.#close(error));
         child.once("close", (code, signal) => this.#close(new Error(`Provider process exited before replying (code=${code ?? "none"}, signal=${signal ?? "none"}).`)));
     }
+    static async connect(child, mirror) {
+        const channel = new CodexProxyWebSocketChannel(child, mirror);
+        await channel.#readyPromise;
+        return channel;
+    }
     onMessage(listener) {
         this.#listeners.add(listener);
         return () => this.#listeners.delete(listener);
     }
     async request(method, params) {
+        await this.#readyPromise;
         if (this.#closedError !== undefined)
             throw this.#closedError;
         const id = String(this.#nextId++);
@@ -120,6 +153,136 @@ class JsonLineChannel {
     async notify(method, params) {
         await this.send({ method, ...(params === undefined ? {} : { params }) });
     }
+    async send(message) {
+        await this.#readyPromise;
+        if (this.#closedError !== undefined)
+            throw this.#closedError;
+        const encoded = JSON.stringify(message);
+        if (Buffer.byteLength(encoded, "utf8") > PROVIDER_MESSAGE_MAX_BYTES) {
+            throw new Error("Provider request exceeds its message bound.");
+        }
+        await new Promise((resolvePromise, reject) => {
+            this.#webSocket.send(encoded, (error) => {
+                if (error === undefined || error === null)
+                    resolvePromise();
+                else
+                    reject(error);
+            });
+        });
+    }
+    #receive(data, isBinary) {
+        const encoded = Buffer.isBuffer(data)
+            ? data
+            : data instanceof ArrayBuffer
+                ? Buffer.from(data)
+                : Buffer.concat(data);
+        if (isBinary || encoded.byteLength > PROVIDER_MESSAGE_MAX_BYTES) {
+            this.#close(new Error(isBinary
+                ? "Provider returned an unsupported binary WebSocket message."
+                : "Provider response message exceeds its bound."));
+            terminateProcessGroup(this.child, "SIGTERM");
+            return;
+        }
+        const text = encoded.toString("utf8");
+        this.mirror("stdout", `${text}\n`);
+        let message;
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+                return;
+            message = parsed;
+        }
+        catch {
+            return;
+        }
+        const id = requestId(message.id);
+        const pending = id === undefined ? undefined : this.#pending.get(id);
+        if (pending !== undefined) {
+            clearTimeout(pending.timer);
+            this.#pending.delete(id);
+            const error = object(message.error);
+            if (error !== null) {
+                pending.reject(new CodexAppServerRequestError(typeof error.code === "number" || typeof error.code === "string"
+                    ? error.code
+                    : "UNKNOWN", typeof error.message === "string" ? error.message : "Provider request failed.", error.data));
+            }
+            else {
+                pending.resolve(object(message.result) ?? {});
+            }
+            return;
+        }
+        for (const listener of this.#listeners)
+            listener(message);
+    }
+    #close(error) {
+        if (this.#closedError !== undefined)
+            return;
+        this.#closedError = error;
+        if (!this.#ready)
+            this.#rejectReady(error);
+        for (const pending of this.#pending.values()) {
+            clearTimeout(pending.timer);
+            pending.reject(error);
+        }
+        this.#pending.clear();
+        if (this.child.exitCode === null && this.child.signalCode === null) {
+            terminateProcessGroup(this.child, "SIGTERM");
+        }
+    }
+}
+class ChildProcessDuplex extends Duplex {
+    child;
+    connecting = false;
+    constructor(child) {
+        super();
+        this.child = child;
+        child.stdout.on("data", (chunk) => {
+            if (!this.push(chunk))
+                child.stdout.pause();
+        });
+        child.stdout.once("end", () => this.push(null));
+        child.once("error", (error) => this.destroy(error));
+        child.once("close", () => this.destroy());
+    }
+    _read() {
+        this.child.stdout.resume();
+    }
+    _write(chunk, encoding, callback) {
+        this.child.stdin.write(chunk, encoding, callback);
+    }
+    _final(callback) {
+        this.child.stdin.end(callback);
+    }
+    setNoDelay() {
+        return this;
+    }
+    setKeepAlive() {
+        return this;
+    }
+    setTimeout(_timeout, callback) {
+        if (callback !== undefined)
+            this.once("timeout", callback);
+        return this;
+    }
+}
+class JsonLineChannel {
+    child;
+    mirror;
+    #listeners = new Set();
+    #buffer = "";
+    #closedError;
+    constructor(child, mirror) {
+        this.child = child;
+        this.mirror = mirror;
+        child.stdout.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => this.#receive(chunk));
+        child.once("error", (error) => this.#close(error));
+        child.once("close", (code, signal) => this.#close(new Error(`Provider process exited (code=${code ?? "none"}, signal=${signal ?? "none"}).`)));
+    }
+    onMessage(listener) {
+        this.#listeners.add(listener);
+        return () => this.#listeners.delete(listener);
+    }
     async send(message) {
         if (this.#closedError !== undefined)
             throw this.#closedError;
@@ -152,45 +315,21 @@ class JsonLineChannel {
             this.#buffer = this.#buffer.slice(newline + 1);
             if (line.length === 0)
                 continue;
-            let message;
             try {
                 const parsed = JSON.parse(line);
                 if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
                     continue;
-                message = parsed;
+                for (const listener of this.#listeners)
+                    listener(parsed);
             }
             catch {
                 continue;
             }
-            const id = requestId(message.id);
-            const pending = id === undefined ? undefined : this.#pending.get(id);
-            if (pending !== undefined) {
-                clearTimeout(pending.timer);
-                this.#pending.delete(id);
-                const error = object(message.error);
-                if (error !== null) {
-                    pending.reject(new CodexAppServerRequestError(typeof error.code === "number" || typeof error.code === "string"
-                        ? error.code
-                        : "UNKNOWN", typeof error.message === "string" ? error.message : "Provider request failed.", error.data));
-                }
-                else {
-                    pending.resolve(object(message.result) ?? {});
-                }
-                continue;
-            }
-            for (const listener of this.#listeners)
-                listener(message);
         }
     }
     #close(error) {
-        if (this.#closedError !== undefined)
-            return;
-        this.#closedError = error;
-        for (const pending of this.#pending.values()) {
-            clearTimeout(pending.timer);
-            pending.reject(error);
-        }
-        this.#pending.clear();
+        if (this.#closedError === undefined)
+            this.#closedError = error;
     }
 }
 class CodexStructuredProviderSession {
@@ -214,7 +353,7 @@ class CodexStructuredProviderSession {
         this.onTerminal = onTerminal;
     }
     static async open(child, exit, processInstanceId, payload, control, onTerminal, mirror) {
-        const channel = new JsonLineChannel(child, mirror);
+        const channel = await CodexProxyWebSocketChannel.connect(child, mirror);
         const openingMessages = [];
         const stopOpeningBuffer = channel.onMessage((message) => openingMessages.push(message));
         await channel.request("initialize", {

package/dist/runtime/tmuxAdapters.js

@@ -347,7 +347,7 @@ export class TmuxSessionHost {
                     : { [YUI_TASK_RUNTIME_DESCRIPTOR]: frozenTaskRuntime })
             }
         };
-        let hostCreated;
+        let hostCreated = false;
         let providerAcknowledged = false;
         let providerDeliveryUnknown = false;
         let providerBusy = false;
@@ -420,6 +420,14 @@ export class TmuxSessionHost {
         }
         catch (error) {
             broker.revoke(request.launchId);
+            if (hostCreated && !providerDispatchObserved) {
+                try {
+                    await stopExactRole(this.tmux, hostId, request.owner.roleName);
+                }
+                catch (stopError) {
+                    throw new Error(`Managed Provider launch failed and its disposable Agent Host could not be stopped: ${stopError instanceof Error ? stopError.message : String(stopError)}`, { cause: stopError });
+                }
+            }
             throw error;
         }
         if (providerDispatchObserved

package/i18n/README.zh-CN.md

@@ -510,9 +510,9 @@ Task 生命周期的交互选择只展示有效来源状态：activate 只展示
 
 ## Session 与 tmux
 
-受管理的 Provider 会话仍然是普通用户会话。Yui 只添加对应的 Role Skill 与 Session Manifest 指针，并通过 Provider 原生结构化协议提交 Task 工作；Yui 不接管完整对话历史。受管理输入绝不会作为终端按键、粘贴文本或启动 argv 发送。Codex 由每个存活的 Role Runtime 启动并持有独立的 `app-server` 子进程；Task execution stop 会终止 Agent Host 及其 Provider 进程组，start 会创建新的受控运行时，不再依赖共享 Codex daemon。原生 thread 历史仍由 Codex 保留，Task、WorkItem、代码与持久消息仍由 Yui 保留。Claude 继续使用独立的持久 stream-json 进程，并以精确回放的 user message 作为接收确认。
+受管理的 Provider 会话仍然是普通用户会话。Yui 只添加对应的 Role Skill 与 Session Manifest 指针，并通过 Provider 原生结构化协议提交 Task 工作；Yui 不接管完整对话历史。受管理输入绝不会作为终端按键、粘贴文本或启动 argv 发送。Codex 在只转发字节的 `app-server proxy` 上完成 App Server WebSocket 握手，接入与 Desktop 相同的共享 daemon；原生 thread 可在 Desktop 中直接查看和操作。Task execution stop 只终止 Yui 的 Agent Host、WebSocket 与 proxy，保留共享 daemon、原生 thread、Task、WorkItem、代码与持久消息；start 创建新的 attachment。Claude 继续使用独立的持久 stream-json 进程，并以精确回放的 user message 作为接收确认。
 
-Run、Conversation、Activation 与 Turn 是四个独立身份。Conversation 可以跨多个 Run 和客户端连接；Activation 只代表 Yui 当前的连接，而不是对 Provider thread 的独占所有权；Turn 在写入前先持久化。写入超时或结果不明确会进入 `delivery-unknown`，不会自动重发。已经存在的原生 active Turn 只会让 Yui 暂时等待，不会导致 Yui Run 失败；存活的受管理 Role 应通过 Yui 的 view/takeover 边界进行人工控制，避免其他客户端并发写入。
+Run、Conversation、Activation 与 Turn 是四个独立身份。Conversation 可以跨多个 Run 和客户端连接；Activation 只代表 Yui 当前的连接，而不是对 Provider thread 的独占所有权；Turn 在写入前先持久化。写入超时或结果不明确会进入 `delivery-unknown`，不会自动重发。Codex 已存在的原生 active Turn 只会让 Yui 暂时等待，不会导致 Yui Run 失败；Claude 等独立进程 Provider 继续通过 Yui 的 view/takeover 边界进行人工控制。
 
 Task Role 使用以下显式入口：
 
@@ -524,7 +524,7 @@ yui task role takeover <task-id> <role>
 yui task role release <task-id> <role>
 ```
 
-Codex Role thread 仍可在 Desktop 中查看，但存活的受管理 Role 应通过 `view`、`takeover`、`release` 进行人工控制；若要从其他客户端恢复该 thread，应先停止 Task execution。Yui 不写入全局 Hook/config，也不依赖或控制共享 Codex daemon。Global Operator 与 global Role 继续使用原生交互式 CLI，不属于受管理 Task Provider 协议。
+Codex Role thread 可在 Desktop 中直接查看和操作；Desktop 已有 active Turn 时，Yui 只保留待投递工作并等待，不会失败或重复投递。`view`、`takeover`、`release` 继续作为 Claude 等独立进程 Provider 的人工控制入口。Yui 不写入全局 Hook/config，也不启动、重启或停止共享 daemon；Codex CLI/daemon 故障由 Task 生命周期之外修复。Global Operator 与 global Role 继续使用原生交互式 CLI，不属于受管理 Task Provider 协议。
 
 当新版本需要离线迁移 Home 时，应等待当前 Turn/Run 完成，然后从普通 shell
 执行 `yui session stop --all`，再重新执行 `yui update`。停止命令会先整体预检：
@@ -560,7 +560,7 @@ state、receipt 与 pane fence。Yui 不会解析 prompt glyph、进度文本、
 或其他 Agent 终端输出来推断 ready 或 success。`captureRole()` 只用于显式的人类
 transcript 查看，不具备生命周期权威。
 
-稳定的 Role 上下文不会创建额外的 bootstrap Turn。Task execution Run 按角色使用通用 Leader 或 Worker Skill，review Run 则按持久 Run purpose 使用通用 Reviewer Skill；Provider 可以通过安全的追加式原生上下文通道携带 Skill，也可以在普通 Task 投递中指向它。这些都只是 Yui 自己拥有的可移植编排规则。Project Skills 始终是 Project 中正常版本化的文件，由 Agent 通过自身项目机制发现、选择并按需加载；Yui 不扫描、不解析、不复制，也不注入 Project Skills。Managed Codex 保留用户原有的 developer instructions；普通 Task 消息会携带精简的 Session Manifest 绝对路径，Manifest 再指向对应的 Yui Role Skill，供 Codex 按需读取。每个存活 Role 的 Yui-owned App Server 进程会加载所选 Codex 原生 config profile；model、effort、permission、workspace 与 shell 设置作为线程级 `thread/start` 或 `thread/resume` 配置传入，Yui 不修改底层 Codex 配置文件。App Server 原生通知是 Managed Codex 线程的生命周期权威；Yui 不为它安装 Hook，也不占用 `notify`。交互式 Codex Session 仍可使用 Yui 的结构化 `notify` callback，Doctor 会报告最终生效的配置冲突。`skills.config` 只负责启停已发现 Skill，Yui 不会误用它。Claude 从 Yui 管理的私有 `0600` context 文件读取同一份 Yui Role Skill 内容，不再把大段或敏感文本放进 argv；重试和 resume 会复用按 purpose 区分的稳定路径。非 Operator 的 global Role 保持中性，不会注入 Task 编排 Skill。因此 Operator 会停在空白的原生 composer，用户输入仍是第一条 user message；Leader wake、Worker 和 Reviewer Run assignment 仍是邮箱投递的真实工作消息。
+稳定的 Role 上下文不会创建额外的 bootstrap Turn。Task execution Run 按角色使用通用 Leader 或 Worker Skill，review Run 则按持久 Run purpose 使用通用 Reviewer Skill；Provider 可以通过安全的追加式原生上下文通道携带 Skill，也可以在普通 Task 投递中指向它。这些都只是 Yui 自己拥有的可移植编排规则。Project Skills 始终是 Project 中正常版本化的文件，由 Agent 通过自身项目机制发现、选择并按需加载；Yui 不扫描、不解析、不复制，也不注入 Project Skills。Managed Codex 保留用户原有的 developer instructions；普通 Task 消息会携带精简的 Session Manifest 绝对路径，Manifest 再指向对应的 Yui Role Skill，供 Codex 按需读取。model、effort、permission、workspace 与 shell 设置作为共享 daemon 上的线程级 `thread/start` 或 `thread/resume` 配置传入；Codex 原生 config profile 因无法隔离到单条共享 thread 而被拒绝，Yui 不修改底层 Codex 配置文件。App Server 原生通知是 Managed Codex 线程的生命周期权威；Yui 不为它安装 Hook，也不占用 `notify`。交互式 Codex Session 仍可使用 Yui 的结构化 `notify` callback，Doctor 会报告最终生效的配置冲突。`skills.config` 只负责启停已发现 Skill，Yui 不会误用它。Claude 从 Yui 管理的私有 `0600` context 文件读取同一份 Yui Role Skill 内容，不再把大段或敏感文本放进 argv；重试和 resume 会复用按 purpose 区分的稳定路径。非 Operator 的 global Role 保持中性，不会注入 Task 编排 Skill。因此 Operator 会停在空白的原生 composer，用户输入仍是第一条 user message；Leader wake、Worker 和 Reviewer Run assignment 仍是邮箱投递的真实工作消息。
 
 ## Controller 与失败处理
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.13.6",
+  "version": "0.13.7",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,