@zq-silk/yui 0.15.11 → 0.15.12

package/ARCHITECTURE.md

@@ -169,8 +169,9 @@ Leader management is limited to its Task; executable code still requires exact
 Operator-issued grants. Plugin validation is not a security certification.
 
 CLI contributions and controlled Web panels are projections of the Registry.
-Web is loopback-only and Controller-owned; browser credentials do not become
-Operator authority. See [Plugin SDK](docs/plugin-sdk.md) and
+Web is loopback-only and Controller-owned. Its authenticated local-user controls
+share CLI domain operations; query panels remain read-only and cannot borrow
+that user authority for mutations or plugin management. See [Plugin SDK](docs/plugin-sdk.md) and
 [capabilities and resources](docs/architecture/capabilities-and-resources.md).
 
 ## Persistence, completion and operation
@@ -181,8 +182,11 @@ Homes; malformed state is diagnosed, not automatically repaired.
 
 Completion freezes the delivery result and checks applicable acceptance,
 integration and review contracts. It is distinct from publication, verified
-remote merge, physical quiescence and archive. Archive requires settled work
-and clean removable managed resources, preserves Task history, and cannot reopen.
+remote merge, physical quiescence and archive. Ordinary archive requires settled
+work and clean removable managed resources. Explicitly authorized force archive
+can retain unresolved evidence and unsafe resources without claiming delivery or
+quiescence. Both preserve Task history and cannot reopen.
+See [Task delivery and archive](docs/task-delivery.md#archive).
 
 Runtime health and cost are observations, not semantic verdicts. The Agent reads
 exact faults and current intent to choose retry, repair or abandonment. Yui does

package/ARCHITECTURE.zh-CN.md

@@ -132,7 +132,8 @@ Registry 暴露 context、消息、artifact、环境、插件以及部分 Task/J
 由 Operator 签发的 grant。插件验证不是安全认证。
 
 CLI 贡献和受控的 Web 面板是 Registry 的投影。Web 仅本地回环、由 Controller 拥有；浏览器
-凭据不会变成 Operator 权限。参见[插件 SDK](docs/plugin-sdk.zh-CN.md)和
+凭据认证本地用户控制，这些控制复用 CLI 领域操作；查询面板仍只读，不能借用该用户权限
+执行修改或插件管理。参见[插件 SDK](docs/plugin-sdk.zh-CN.md)和
 [能力与资源](docs/architecture/capabilities-and-resources.zh-CN.md)。
 
 ## 持久化、完成与运维
@@ -141,7 +142,9 @@ Home 有一条只追加的存储迁移链。普通运行时只接受当前记录
 有效 Home；畸形状态被诊断，而不是自动修复。
 
 完成会冻结交付结果，并检查适用的验收、集成和审查合同。它区别于发布、已验证的远程合并、
-物理静止和归档。归档要求工作已了结、受管资源干净可移除，保留 Task 历史，且不可重开。
+物理静止和归档。普通归档要求工作已了结、受管资源干净可移除。明确授权的 force 归档
+可以保留未解决证据与不安全资源，但不宣称交付或物理静止。两者都保留 Task 历史且不可
+重开。参见[Task 交付与归档](docs/task-delivery.zh-CN.md#归档)。
 
 运行时健康度和成本是观察，而不是语义判定。Agent 读取精确的故障和当前意图，以选择重试、
 修复或放弃。Yui 不会自动创建救援 Worker 或选择另一个模型。

package/README.md

@@ -30,7 +30,7 @@ not from terminal windows you juggle or details you have to remember.
 - **Bring your own Agent** — Codex CLI, Claude Code CLI and ACP peers run behind
   one boundary and stay replaceable without losing the Task.
 - **Local-first and private** — everything runs on your machine for one trusted
-  user; the Web view is loopback and read-only.
+  user; Web is loopback-only, with read-only views and authenticated user controls.
 - **Isolated by default** — repository work happens in managed Git worktrees;
   the stable checkout stays read-only.
 
@@ -137,7 +137,11 @@ when necessary. A failed process does not erase the Task, and an uncertain
 submission is not silently repeated.
 
 For a visual overview, run `yui web` in another terminal. The local Web view
-shows the same tasks and pending questions; it is not a separate task system.
+shows the same tasks and pending questions and lets you send messages, answer
+questions and explicitly queue, steer or interrupt Task input. These authenticated
+Task controls use the same operations as the CLI; Web is not a separate task system.
+See [Web permissions](docs/architecture/capabilities-and-resources.md#cli-and-web)
+and [input timing](docs/managed-turn-and-session-runtime.md#input-timing-queue-steer-and-interrupt).
 
 ## Architecture
 
@@ -243,7 +247,7 @@ the Controller are what touch the store:
      it moves work and records facts — it never judges an answer
 
   Agents work in Projects: read-only checkout + isolated worktrees.
-  Web view (yui web): a loopback, read-only projection of the store.
+  Web (yui web): loopback views + authenticated user controls.
 ```
 
 ### Layered design
@@ -253,7 +257,7 @@ never a fixed workflow:
 
 ```text
   Experience   —  how you interact
-    CLI (Operator) · Web (loopback, read-only) · native Agent sessions
+    CLI (Operator) · Web (loopback, authenticated) · native Agent sessions
     collect input · show facts · confirm actions · invoke capabilities
         ▼
   Intelligence —  who decides
@@ -290,9 +294,13 @@ extra states:
   WorkItem  open ─▶ accepted ─▶ retired
 
   Draft holds planning only; activation adopts a delivery workspace.
-  Archive needs settled work and clean worktrees; it cannot reopen.
+  Ordinary archive needs settled work and clean worktrees; it cannot reopen.
 ```
 
+Explicitly authorized force archive can retain unresolved evidence and unsafe
+resources; it does not prove delivery or permission to delete them.
+See the [archive contract](docs/task-delivery.md#archive).
+
 ## Design principles
 
 ### Agents make decisions; Yui makes work durable

package/dist/agentRun/agentRun.js

@@ -2,6 +2,7 @@ import { validateEffectiveLaunchSnapshot } from "../executor/effectiveLaunch.js"
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
 import { validateManagedWorkspace } from "../worktree/managedWorkspace.js";
 import { createRunInput, createRunInputEnvelope, validateRunInput } from "../context/runInputContract.js";
+import { providerRetryProjection } from "../runtime/providerRetry.js";
 import { boundedRunFailureDiagnostic, MAX_RUN_FAILURE_DIAGNOSTIC_BYTES, MAX_RUN_RESULT_OUTPUT_BYTES } from "../domain/agentResultTransport.js";
 export { boundedRunFailureDiagnostic, MAX_RUN_FAILURE_DIAGNOSTIC_BYTES, MAX_RUN_RESULT_OUTPUT_BYTES, transportAgentResult } from "../domain/agentResultTransport.js";
 /** Record lifecycle and observed delivery are separate read-only facts. */
@@ -17,6 +18,8 @@ export function runExecutionObservation(run, binding, events = []) {
     return {
         recordStatus: run.status,
         delivery,
+        retry: binding?.retry?.previousRunId === run.id || binding?.retry?.successorRunId === run.id
+            ? providerRetryProjection(binding) : null,
         ...(current === undefined ? {} : {
             attemptId: current.attemptId, observedAt: current.updatedAt,
             ...(current.nativeTurnId === undefined ? {} : { nativeTurnId: current.nativeTurnId })

package/dist/cli/commandCatalog.js

@@ -215,6 +215,11 @@ const globalSessionChildren = [
         summary: "Reconcile durable Session owners with native sessions.",
         usage: "yui session reconcile [--report] [--cleanup]",
         options: ["--report", "--cleanup"]
+    },
+    {
+        name: "retry",
+        summary: "Inspect or control bounded Provider recovery for this Global Session.",
+        usage: "yui session retry <role> [show|cancel|disable|enable]"
     }
 ];
 const profileChildren = [
@@ -373,9 +378,9 @@ const taskChildren = [
     },
     {
         name: "list",
-        summary: "List unarchived Task overviews.",
-        usage: "yui task list [--all] [--verbose]",
-        options: ["--all", "--verbose"]
+        summary: "List Task overviews or a bounded discovery catalog.",
+        usage: "yui task list [--all] [--verbose] | --view compact [--all] [--status <status>] [--project <id>] [--search <text>] [--attention <category>] [--limit <1..100>] [--cursor <cursor>]",
+        options: ["--all", "--verbose", "--view", "--status", "--project", "--search", "--attention", "--limit", "--cursor"]
     },
     { name: "show", summary: "Show a Task.", usage: "yui task show <id>" },
     {
@@ -406,6 +411,12 @@ const taskChildren = [
         usage: "yui task remote-delivery <task> [--json]",
         options: ["--json"]
     },
+    {
+        name: "archive-preflight",
+        summary: "Inspect current archive and exact-owner cleanup blockers without changing state or authorizing removal.",
+        usage: "yui task archive-preflight <id> (--integrated|--abandon) [--force] [--json]",
+        options: ["--integrated", "--abandon", "--force", "--json"]
+    },
     {
         name: "archive",
         summary: "Archive a terminal Task; explicit --force commits despite delivery/cleanup warnings, retaining unsafe resources.",
@@ -606,17 +617,29 @@ const taskChildren = [
     {
         name: "publication",
         summary: "Create or update external PR/MR publication evidence for a Task.",
-        sections: [{ id: "manage", title: "Commands", entries: ["upsert", "verify", "list", "show"] }],
+        sections: [{ id: "manage", title: "Commands", entries: ["upsert", "diff", "adopt", "verify", "list", "show"] }],
         children: [
             {
                 name: "upsert",
                 summary: "Create or immutably update an external PR/MR and its publication state.",
-                usage: "yui task publication upsert <task> --project <project> --provider <github|gitlab> --repository <owner/name> --kind <pull-request|merge-request> --id <external-id> [--url <url>] [--title <text>] [--source-branch <branch>] [--target-branch <branch>] [--local-commit <sha>] [--remote-commit <sha>] [--state <open|merged|closed>] [--reported|--verified] [--evidence <text>] [--merged-at <iso-timestamp>]",
-                options: ["--project", "--provider", "--repository", "--kind", "--id", "--url", "--title", "--source-branch", "--target-branch", "--local-commit", "--remote-commit", "--state", "--reported", "--verified", "--evidence", "--merged-at"]
+                usage: "yui task publication upsert <task> --project <project> --provider <github|gitlab> --repository <owner/name> --kind <pull-request|merge-request> --id <external-id> [--url <url>] [--title <text>] [--source-branch <branch>] [--target-branch <branch>] [--local-commit <sha>] [--head-commit <sha>] [--remote-commit <sha>] [--state <open|merged|closed>] [--reported|--verified] [--evidence <text>] [--merged-at <iso-timestamp>]",
+                options: ["--project", "--provider", "--repository", "--kind", "--id", "--url", "--title", "--source-branch", "--target-branch", "--local-commit", "--head-commit", "--remote-commit", "--state", "--reported", "--verified", "--evidence", "--merged-at"]
+            },
+            {
+                name: "diff",
+                summary: "Read a completed Task's fixed acceptance-to-publication candidate diff using local Git only.",
+                usage: "yui task publication diff <task>/<publication> [--integration <id>]",
+                options: ["--integration"]
+            },
+            {
+                name: "adopt",
+                summary: "Explicitly accept the reviewed publication candidate as covering the original completion.",
+                usage: "yui task publication adopt <task>/<publication> --reviewed-diff <sha256> --acceptance <text> [--integration <id>]",
+                options: ["--reviewed-diff", "--acceptance", "--integration"]
             },
             {
                 name: "verify",
-                summary: "Verify one current GitHub PR against the exact Task delivery head through gh.",
+                summary: "Observe the current PR/MR head and merge through its provider; record verification separately from Task coverage.",
                 usage: "yui task publication verify (<task>/<publication-id> | <task> <publication-id>)"
             },
             {
@@ -668,8 +691,13 @@ const taskChildren = [
                 name: "session",
                 summary: "Inspect, stop or explicitly select a new Task Role Session.",
                 executable: true,
-                sections: [{ id: "manage", title: "Commands", entries: ["inspect", "stop", "new"] }],
+                sections: [{ id: "manage", title: "Commands", entries: ["inspect", "retry", "stop", "new"] }],
                 children: [
+                    {
+                        name: "retry",
+                        summary: "Inspect or control Provider recovery without stopping an admitted Turn.",
+                        usage: "yui task role session retry <task> <role> [show|cancel|disable|enable]"
+                    },
                     {
                         name: "inspect",
                         summary: "Read the current Session, Host process, and AgentRun facts.",
@@ -1481,7 +1509,7 @@ export const ROOT_COMMAND = buildNode({
             sections: [
                 { id: "global", title: "Global Role sessions", entries: ["context", "enter", "record", "replace"] },
                 { id: "maintenance", title: "Maintenance", entries: ["stop"] },
-                { id: "recovery", title: "Recovery", entries: ["reconcile"] }
+                { id: "recovery", title: "Recovery", entries: ["reconcile", "retry"] }
             ],
             children: globalSessionChildren
         },
@@ -1489,7 +1517,7 @@ export const ROOT_COMMAND = buildNode({
             name: "task",
             summary: "Manage Tasks, WorkItems, AgentRuns, and integration.",
             sections: [
-                { id: "lifecycle", title: "Lifecycle", entries: ["create", "project", "base", "update", "activate", "activation", "execution", "complete", "cancel", "reopen", "retire", "list", "show", "context", "next-action", "remote-delivery", "archive", "replace", "reconcile", "upstream", "artifact"] },
+                { id: "lifecycle", title: "Lifecycle", entries: ["create", "project", "base", "update", "activate", "activation", "execution", "complete", "cancel", "reopen", "retire", "list", "show", "context", "next-action", "remote-delivery", "archive-preflight", "archive", "replace", "reconcile", "upstream", "artifact"] },
                 { id: "collaboration", title: "Collaboration", entries: ["message", "input", "grant", "workflow", "publication", "work", "run", "review", "integration", "role", "overlap", "change-set"] },
                 { id: "knowledge", title: "Task Knowledge", entries: ["brief", "decision", "milestone", "event", "continuation", "wake"] }
             ],

package/dist/cli/interactionPolicy.js

@@ -229,6 +229,10 @@ export const INTERACTION_POLICIES = Object.freeze([
         ...taskTarget("remote-delivery"),
         trailingOptions: { "--json": "flag" }
     },
+    {
+        ...taskTarget("archive-preflight"),
+        trailingOptions: { "--integrated": "flag", "--abandon": "flag", "--force": "flag", "--json": "flag" }
+    },
     {
         ...taskTarget("archive", 2, ["completed", "cancelled"]),
         trailingOptions: { "--integrated": "flag", "--abandon": "flag", "--force": "flag" },

package/dist/cli/managedDiagnostics.js

@@ -3,7 +3,7 @@
 export function taskDiagnosticTarget(args) {
     if (args[0] !== "task")
         return undefined;
-    if (["show", "context", "next-action"].includes(args[1] ?? "")) {
+    if (["show", "context", "next-action", "archive-preflight"].includes(args[1] ?? "")) {
         return args[1] === "context" && ["inspect", "delta"].includes(args[2] ?? "")
             ? args[3] : args[2];
     }

package/dist/cli.js

@@ -42,10 +42,13 @@ import { runResourcesCommand } from "./commands/resourcesCommands.js";
 import { applyOperatorSessionControl, runOperatorCommand } from "./commands/operatorCommands.js";
 import { runProjectCommand } from "./commands/projectCommands.js";
 import { previewProfileAgentConfigurationMutation, runProfileCommand } from "./commands/profileCommands.js";
-import { assertWorkItemDependenciesCompletedForCommand, requireWorkItemAssignee, dispatchPreparedReviewRound, failPendingReviewRound, preserveReviewRoundWorkspace, parseTaskCompletionRequest, previewTaskRoleAgentConfigurationMutation, preflightTaskCompletion, runTaskCommand, planReplicatedWorkItemLanes, validateTaskArchiveRequest } from "./commands/taskCommands.js";
+import { assertWorkItemDependenciesCompletedForCommand, requireWorkItemAssignee, dispatchPreparedReviewRound, failPendingReviewRound, preserveReviewRoundWorkspace, parseTaskCompletionRequest, previewTaskRoleAgentConfigurationMutation, preflightTaskCompletion, runTaskCommand, planReplicatedWorkItemLanes, validateTaskArchiveRequest, parseTaskArchiveArguments } from "./commands/taskCommands.js";
 import { assertTaskRemoteDeliveryIntegrated, createTaskRemoteDeliveryProof } from "./commands/taskRemoteDeliveryCommand.js";
 import { renderArchiveDiagnostics, taskArchiveDiagnostics } from "./task/archiveDiagnostics.js";
+import { inspectTaskArchive, renderTaskArchivePreflight } from "./task/archivePreflight.js";
+import { CleanupInspectionError } from "./workspace/cleanupInspection.js";
 import { runTaskPublicationVerifyCommand } from "./commands/taskPublicationVerifyCommand.js";
+import { runTaskPublicationAdoptCommand } from "./commands/taskPublicationAdoptCommand.js";
 import { createGitHubCliPublicationVerifier } from "./external/githubPublicationVerifier.js";
 import { createGitLabCliPublicationVerifier } from "./external/gitlabPublicationVerifier.js";
 import { taskLocalActor, assertTaskDeliveryAuthority } from "./commands/taskActor.js";
@@ -115,6 +118,9 @@ const rawArgs = [...taskFinalReviewInvocation.args];
 const jsonOutput = rawArgs.includes("--json");
 const args = normalizeAliases(jsonOutput ? rawArgs.filter((argument) => argument !== "--json") : rawArgs);
 void main().catch((error) => {
+    if (error instanceof CleanupInspectionError) {
+        error = cleanupCliError(error, error.checks[0]?.resource ?? "workspace");
+    }
     if (error instanceof CliError) {
         const rendered = jsonOutput
             ? JSON.stringify({ ok: false, code: error.code, message: error.message, details: error.details })
@@ -913,6 +919,15 @@ export async function main() {
         return;
     }
     if (resolved[0] === "task") {
+        if (resolved[1] === "archive-preflight") {
+            const request = parseTaskArchiveArguments(resolved.slice(2), "archive-preflight");
+            if (process.env.YUI_SESSION_SCOPE === "task" && process.env.YUI_TASK_ID !== request.taskId) {
+                throw usageError("Archive inspection must remain within this Session's Task.");
+            }
+            const data = await inspectTaskArchive(workspaceCoordinator, request);
+            emit(renderTaskArchivePreflight(data), false, data);
+            return;
+        }
         if (resolved[1] === "artifact") {
             // File/directory artifacts live in the Task's local Git repository, so
             // their save/read/list are asynchronous and handled here rather than in
@@ -1033,6 +1048,13 @@ export async function main() {
             emit(result.output, false, result.data);
             return;
         }
+        if (resolved[1] === "publication" && (resolved[2] === "diff" || resolved[2] === "adopt")) {
+            const result = await runTaskPublicationAdoptCommand(resolved.slice(2), store, {
+                environment: process.env
+            });
+            emit(result.output, false, result.data);
+            return;
+        }
         if (resolved[1] === "publication" && resolved[2] === "verify") {
             const result = await runTaskPublicationVerifyCommand(resolved.slice(3), store, {
                 verifiers: {
@@ -1043,12 +1065,6 @@ export async function main() {
                         environmentPath: process.env.PATH
                     })
                 },
-                candidateForTask: async (taskId) => {
-                    const status = store.getTask(taskId)?.status;
-                    return status === "active" || status === "cancelled"
-                        ? snapshotActualTaskReviewCandidate(taskId, store, workspacePreparer)
-                        : null;
-                },
                 environment: process.env
             });
             emit(result.output, false, result.data);
@@ -1154,7 +1170,7 @@ export async function main() {
                     await new WorkItemChangeSetManager(store).assertIntegrated(reference.taskId, reference.localId);
                 }
                 catch (error) {
-                    throw usageError(error instanceof Error ? error.message : String(error));
+                    throw cleanupCliError(error, `work-item:${qualified}`);
                 }
             }
             let removal;
@@ -1245,15 +1261,15 @@ export async function main() {
                         await new WorkItemChangeSetManager(store).assertIntegrated(task.id, item.id);
                     }
                     catch (error) {
-                        throw usageError(error instanceof Error ? error.message : String(error));
+                        throw cleanupCliError(error, `work-item:${task.id}/${item.id}`);
                     }
                 }
                 const cleanup = await workspaceCoordinator.cleanupTaskForArchive(task.id, disposition);
                 if (cleanup.status === "retained-dirty") {
-                    throw usageError(cleanup.error ?? `Task ${task.id} has dirty managed worktrees and remains terminal.`, undefined, cleanupBlockedDetails(cleanup.reason ?? "dirty-worktree", cleanup.resource ?? `task:${task.id}`, cleanup.retryable ?? true));
+                    throw usageError(cleanup.error ?? `Task ${task.id} has dirty managed worktrees and remains terminal.`, undefined, cleanupBlockedDetails(cleanup.reason ?? "dirty-worktree", cleanup.resource ?? `task:${task.id}`, cleanup.retryable ?? true, cleanup.checks));
                 }
                 if (cleanup.status === "failed") {
-                    throw usageError(`Task ${task.id} worktree cleanup failed: ${cleanup.error ?? "unknown error"}.`, undefined, cleanupBlockedDetails(cleanup.reason ?? "cleanup-failed", cleanup.resource ?? `task:${task.id}`, cleanup.retryable ?? true));
+                    throw usageError(`Task ${task.id} worktree cleanup failed: ${cleanup.error ?? "unknown error"}.`, undefined, cleanupBlockedDetails(cleanup.reason ?? "cleanup-failed", cleanup.resource ?? `task:${task.id}`, cleanup.retryable ?? true, cleanup.checks));
                 }
             }
         }
@@ -1953,17 +1969,21 @@ function assertManagedSessionManifest(home, scope) {
     return manifest;
 }
 function cleanupCliError(error, fallbackResource) {
+    if (error instanceof CleanupInspectionError) {
+        return usageError(error.message, undefined, cleanupBlockedDetails(error.checks[0]?.reason ?? "cleanup-failed", fallbackResource, true, error.checks));
+    }
     if (error instanceof WorkspaceCleanupBlockedError) {
         return usageError(error.message, undefined, cleanupBlockedDetails(error.reason, error.resource, error.retryable));
     }
     return new CliError("RUNTIME_ERROR", error instanceof Error ? error.message : String(error), undefined, cleanupBlockedDetails("cleanup-failed", fallbackResource, true));
 }
-function cleanupBlockedDetails(reason, resource, retryable) {
+function cleanupBlockedDetails(reason, resource, retryable, checks) {
     return {
         status: "blocked",
         blockedBy: [{ resource, reason, retryable }],
         remainingResources: [resource],
-        retryable
+        retryable,
+        ...(checks === undefined ? {} : { checks })
     };
 }
 function cliWorkItemReference(value, environment) {
@@ -2042,9 +2062,20 @@ async function prepareExecutionLaneWorkspacesForCommand(args, store, preparer, e
             throw usageError(`${item.taskId}/${roleName} already has an active turn.`);
         }
     }
-    const held = preparer.acquireTaskProjectMaintenanceLocks(item.taskId);
+    const held = await preparer.acquireTaskProjectMaintenanceLocks(item.taskId);
     const map = new Map();
     try {
+        assertTaskDeliveryAuthority(store, environment, item.taskId);
+        const currentItem = store.getWorkItem(item.taskId, item.id);
+        if (currentItem?.revision !== item.revision
+            || JSON.stringify(workItemDispatchLanePlan(args, store, currentItem)) !== JSON.stringify(plan)) {
+            throw new Error(`Work item dispatch changed while waiting for Project maintenance: ${item.id}.`);
+        }
+        if (held.current.status !== "active" || held.current.executionGate.state !== "enabled"
+            || plan.roles.some(roleName => store.getRole(item.taskId, roleName) === null
+                || store.getActiveRun(item.taskId, roleName) !== null)) {
+            throw new Error(`Task/Role dispatch state changed while waiting for Project maintenance: ${item.taskId}.`);
+        }
         const projectPaths = new Map();
         for (const { projectId } of held.current.projectBindings) {
             const project = store.getProject(projectId);
@@ -2667,7 +2698,7 @@ function selectionCall(store, catalogs, method, params) {
         case "role.list": return store.listGlobalRoles();
         case "role.show": return store.getGlobalRole(String(params.name ?? ""));
         case "project.list": return callOptional(reader, "listProjects");
-        case "task.list": return callOptional(reader, "listTasks");
+        case "task.list": return store.listTaskChoices();
         case "task.integration.list": return store.listIntegrationAttempts(String(params.taskId ?? ""));
         case "task.change-set.list": return store.listChangeSets(String(params.taskId ?? ""));
         case "task.role.list": return callOptional(reader, "listRoles", [params.taskId]);

package/dist/commands/executionAuditCommands.js

@@ -7,6 +7,7 @@
  */
 import { usageError } from "../errors/cliError.js";
 import { defaultTableWidth, renderTable } from "../output/table.js";
+import { formatUsageMetric } from "../runtime/taskUsageMetrics.js";
 import { runExecutionAudit } from "../observability/executionAudit.js";
 export function parseExecutionAuditOptions(args) {
     const options = {};
@@ -246,6 +247,15 @@ export function renderExecutionAudit(report, width = defaultTableWidth()) {
     else {
         lines.push("", ...sectionError("orchestration", report));
     }
+    if (report.usage.status === "ok" && report.usage.data !== undefined) {
+        lines.push("", "Observed usage — Task lifetime, observed sources only (audit time window not applied):");
+        for (const usage of report.usage.data) {
+            lines.push(`  ${usage.taskId}: tokens=${formatUsageMetric(usage.tokens)}; tools=${formatUsageMetric(usage.toolCalls)}; elapsed=${formatUsageMetric(usage.elapsedSeconds, "s")}; native execution sum=${formatUsageMetric(usage.executionSeconds, "s")}`);
+        }
+    }
+    else {
+        lines.push("", ...sectionError("usage", report));
+    }
     if (report.storage.status === "ok" && report.storage.data !== undefined) {
         const storage = report.storage.data;
         lines.push("", `Storage: backend ${storage.backend} · state.json ${formatBytes(storage.stateJsonBytes)} · yui.db ${formatBytes(storage.databaseBytes)}`

package/dist/commands/globalRoleCommands.js

@@ -1,4 +1,6 @@
 import { roleNotFound, usageError } from "../errors/cliError.js";
+import { controlProviderRetry, providerRetryProjection, renderProviderRetry } from "../runtime/providerRetry.js";
+import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 import { createRoleSessionSet, recordRoleAgentSession } from "../executor/agentExecutor.js";
 import { resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
 import { managedGlobalRoleWorkspace } from "../storage/homeLayout.js";
@@ -14,9 +16,9 @@ import { hasRoleLaunchContextOptions, validateConfiguredRoleSkills } from "./rol
 import { assertLiveRoleSessionAcknowledged, assertRoleRuntimeMutationAllowed, LIVE_SESSION_ACKNOWLEDGEMENT_OPTION } from "./roleRuntimeGuard.js";
 export function runGlobalRoleCommand(args, store, options = {}) {
     const [command, ...rest] = args;
-    if (command === "message" || command === "interrupt") {
+    if (command === "message" || command === "interrupt" || command === "session" && rest[0] === "retry") {
         const env = options.env ?? process.env;
-        const target = command === "message" ? rest[1] : rest[0];
+        const target = command === "message" || command === "session" ? rest[1] : rest[0];
         if (env.YUI_SESSION_SCOPE !== undefined && env.YUI_SESSION_SCOPE !== "global"
             || env.YUI_SESSION_SCOPE === "global" && env.YUI_ROLE !== "operator"
                 && env.YUI_ROLE !== target) {
@@ -126,6 +128,7 @@ function roleContext(args, store, options) {
         pendingMessages: pendingQueue,
         messages: store.listGlobalRoleMessages(name),
         nativeTurn: sessions?.providerBinding?.run ?? null,
+        retry: providerRetryProjection(sessions?.providerBinding),
         interrupts: sessions?.interrupts ?? {},
         sessionManifestPath: environment.YUI_SESSION_MANIFEST,
         cliCommand: "yui"
@@ -382,6 +385,28 @@ function enterRole(args, store) {
 }
 function roleSession(args, store, options) {
     const [command, rawName, ...tail] = args;
+    if (command === "retry") {
+        const name = roleName(rawName);
+        const [action = "show", ...extra] = tail;
+        if (extra.length > 0 || !["show", "cancel", "disable", "enable"].includes(action)) {
+            throw usageError("Usage: yui session retry <role> [show|cancel|disable|enable]");
+        }
+        return store.transaction(tx => {
+            requireRole(name, tx);
+            const sessions = tx.getGlobalRoleSessionSet(name);
+            let binding = sessions?.providerBinding ?? null;
+            if (action !== "show") {
+                if (sessions === null || binding === null)
+                    throw usageError("No current Provider Session.");
+                binding = controlProviderRetry(binding, action, Date.now());
+                tx.saveGlobalRoleSessionSet({ ...sessions, providerBinding: binding });
+                settleGlobalRetryInput(tx, name, binding, new Date());
+            }
+            return options.jsonOutput ? JSON.stringify({
+                roleName: name, retry: providerRetryProjection(binding), disabled: binding?.retryDisabled ?? false
+            }) + "\n" : renderProviderRetry(binding) + "\n";
+        });
+    }
     if (command !== "record" && command !== "replace") {
         throw usageError("Session usage: yui session record|replace <role> --native-id <id> [--reason <reason>].");
     }

package/dist/commands/projectCommands.js

@@ -1,10 +1,10 @@
 import { existsSync } from "node:fs";
 import { readdir, rename, rm } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { usageError } from "../errors/cliError.js";
+import { CliError, usageError } from "../errors/cliError.js";
 import { defaultTableWidth, renderTable } from "../output/table.js";
 import { healCheckoutSwap, restoreCheckoutSwap, swapManagedCheckout } from "../repository/checkoutSwap.js";
-import { NodeGitWorkspace } from "../repository/gitWorkspace.js";
+import { GitWorkspaceRefreshError, NodeGitWorkspace } from "../repository/gitWorkspace.js";
 import { acquireProjectMaintenanceLock } from "../repository/projectMaintenanceLock.js";
 import { addProjectKnowledge, addKnowledgeProposal, assertProjectActive, decideKnowledgeProposal, createProject, findKnowledgeProposal, findKnowledgeProposalByFingerprint, knowledgeEvidenceDigest, knowledgeProposalFingerprint, managedProjectPath, planKnowledgeAcceptance, retireProject, retireProjectKnowledge, resolveProject, updateProjectKnowledge, updateProjectMetadata, validateProject, validateProjectName } from "../repository/project.js";
 import { managedWorkspacesRoot } from "../storage/homeLayout.js";
@@ -22,10 +22,14 @@ export async function runProjectCommand(args, store, options = {}) {
     }
     if (command === "refresh") {
         const refreshed = await refreshProject(rest, store, options);
+        const head = refreshed.changed
+            ? `Refreshed project ${refreshed.project.id}: ${refreshed.fromCommit} -> ${refreshed.toCommit}`
+            : `Project ${refreshed.project.id} HEAD is already current at ${refreshed.toCommit}`;
+        const tracking = refreshed.tracking;
         return {
-            output: refreshed.changed
-                ? `Refreshed project ${refreshed.project.id}: ${refreshed.fromCommit} -> ${refreshed.toCommit}\n`
-                : `Project ${refreshed.project.id} is already current at ${refreshed.toCommit}\n`,
+            output: `${head}\n` + (tracking.status === "unmanaged"
+                ? `Tracking unmanaged: ${tracking.reason}\n`
+                : `Tracking ${tracking.status}: ${tracking.ref} at ${tracking.toCommit}\n`),
             data: refreshed
         };
     }
@@ -101,14 +105,23 @@ async function refreshProject(args, store, options) {
     // RFC Phase 1: hold the per-Project maintenance fence for the whole refresh
     // so Task workspace preparation and other maintenance cannot interleave
     // with the canonical branch/working-tree move.
-    const releaseMaintenance = acquireProjectMaintenanceLock(store.rootDirectory(), project.id);
+    const releaseMaintenance = await acquireProjectMaintenanceLock(store.rootDirectory(), project.id, { signal: options.signal });
     try {
+        const current = requireUnchangedMaintenanceProject(store, project, "refresh");
         const refreshed = await (options.git ?? new NodeGitWorkspace()).refresh({
-            repositoryPath: project.path,
-            remoteUrl: project.remoteUrl,
-            stableRef: project.stableBranch
+            repositoryPath: current.path,
+            remoteUrl: current.remoteUrl,
+            stableRef: current.stableBranch
         });
-        return { project, ...refreshed };
+        return { project: current, ...refreshed };
+    }
+    catch (error) {
+        if (error instanceof GitWorkspaceRefreshError) {
+            throw new CliError("RUNTIME_ERROR", error.message, undefined, {
+                projectId: project.id, refresh: error.result
+            });
+        }
+        throw error;
     }
     finally {
         releaseMaintenance();
@@ -131,8 +144,9 @@ async function diagnoseProject(args, store, options) {
         };
     }
     const git = options.git ?? new NodeGitWorkspace();
-    const releaseMaintenance = acquireProjectMaintenanceLock(store.rootDirectory(), project.id);
+    const releaseMaintenance = await acquireProjectMaintenanceLock(store.rootDirectory(), project.id, { signal: options.signal });
     try {
+        requireUnchangedMaintenanceProject(store, project, "diagnose");
         const current = await git.inspect(project.path, "HEAD");
         const remote = await git.resolveRemoteBaseline({
             repositoryPath: project.path,
@@ -307,13 +321,14 @@ async function migrateProject(args, store, options) {
     // Migration rewrites the Project's Git repository: hold the per-Project
     // maintenance fence so no rebuild/archive/cleanup (or a second migrate)
     // interleaves, and the Controller defers worktree preparation meanwhile.
-    const releaseMaintenance = acquireProjectMaintenanceLock(store.rootDirectory(), project.id);
+    const releaseMaintenance = await acquireProjectMaintenanceLock(store.rootDirectory(), project.id, { signal: options.signal });
     try {
         // Re-read the Project under the fence. A concurrent migration may have
         // completed and switched the catalog to the Home-managed repo since the
         // record was resolved above; the stale snapshot must not drive any Git
         // effect (in particular it must not delete the now-canonical repo).
         const current = requireProject(store, project.id);
+        assertProjectActive(current, "migrate");
         if (current.ownership === "managed") {
             throw usageError(`Project is already Home-managed: ${project.id}.`);
         }
@@ -588,7 +603,7 @@ async function resetProject(args, store, options) {
         throw usageError(`Project reset requires matching stable and development branches: ${project.id}.`);
     }
     const git = options.git ?? new NodeGitWorkspace();
-    const releaseMaintenance = acquireProjectMaintenanceLock(store.rootDirectory(), project.id);
+    const releaseMaintenance = await acquireProjectMaintenanceLock(store.rootDirectory(), project.id, { signal: options.signal });
     try {
         // Re-read under the fence so a concurrent catalog change can never drive
         // a destructive Git effect from a stale snapshot.
@@ -713,7 +728,7 @@ async function replaceProject(args, store, options) {
             + "Re-run with --discard-local to acknowledge that the checkout and any uncommitted state will be discarded.");
     }
     const git = options.git ?? new NodeGitWorkspace();
-    const releaseMaintenance = acquireProjectMaintenanceLock(store.rootDirectory(), project.id);
+    const releaseMaintenance = await acquireProjectMaintenanceLock(store.rootDirectory(), project.id, { signal: options.signal });
     try {
         const current = requireProject(store, project.id);
         assertProjectActive(current, "replace");
@@ -922,8 +937,9 @@ async function deleteProjectCommand(args, store, options) {
     // every failure restores it, so the catalog never loses its recoverable
     // entry while a live checkout (or its failure) is still in play.
     const tombstone = join(store.rootDirectory(), "projects", `.delete-${project.id}`);
-    const releaseMaintenance = acquireProjectMaintenanceLock(store.rootDirectory(), project.id);
+    const releaseMaintenance = await acquireProjectMaintenanceLock(store.rootDirectory(), project.id, { signal: options.signal });
     try {
+        requireUnchangedMaintenanceProject(store, project, "delete");
         // Heal a crashed earlier attempt before the prechecks turn.
         await healCheckoutSwap({ currentPath: project.path, backupPath: tombstone });
         if (existsSync(project.path)) {
@@ -1289,6 +1305,19 @@ function projectKnowledge(args, store, options) {
         ? "Project knowledge command is required."
         : `Unknown command: project knowledge ${command}`);
 }
+/** Waiting yields to catalog writers too; never apply stale Git/lifecycle inputs. */
+function requireUnchangedMaintenanceProject(store, expected, action) {
+    const current = requireProject(store, expected.id);
+    if (current.path !== expected.path
+        || current.remoteUrl !== expected.remoteUrl
+        || current.stableBranch !== expected.stableBranch
+        || current.developmentBranch !== expected.developmentBranch
+        || current.ownership !== expected.ownership
+        || current.status !== expected.status) {
+        throw new Error(`Project changed while waiting to ${action}: ${expected.id}; read current state before retrying.`);
+    }
+    return current;
+}
 function requireProject(store, reference) {
     const project = resolveProject(store.listProjects(), reference);
     if (project === null)