@zq-silk/yui 0.15.12 → 0.16.0

package/dist/core/fileLockOwner.js

@@ -0,0 +1,74 @@
+import { lstatSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+/** One process generation, shared by file-lock producers and reclaim checks. */
+export function currentFileLockOwner() {
+    return `${process.pid}:${readProcessStart(process.pid)}`;
+}
+/**
+ * False requires proof of absence or a different process generation.
+ * Missing publication, invalid identity and unavailable OS evidence are not
+ * dead owners: callers retain the lock and report the bounded diagnosis.
+ */
+export function fileLockOwnerIsLive(lock) {
+    let owner;
+    try {
+        owner = readFileSync(join(lock, "owner"), "utf8").trim();
+    }
+    catch (error) {
+        if (hasCode(error, "ENOENT")) {
+            try {
+                lstatSync(lock);
+            }
+            catch (statError) {
+                if (hasCode(statError, "ENOENT"))
+                    return false;
+            }
+        }
+        throw unverified(lock);
+    }
+    const match = /^([1-9][0-9]*):(0|[1-9][0-9]{0,31})$/u.exec(owner);
+    const pid = Number(match?.[1]);
+    if (match === null || !Number.isSafeInteger(pid))
+        throw unverified(lock);
+    try {
+        return processGenerationIsLive(pid, match[2]);
+    }
+    catch {
+        throw unverified(lock);
+    }
+}
+/** A known generation is live, provably gone, or unverified (throws). */
+export function processGenerationIsLive(pid, startIdentity) {
+    if (!Number.isSafeInteger(pid) || pid < 1 || !/^(0|[1-9][0-9]{0,31})$/u.test(startIdentity)) {
+        throw new Error(`Unverified process generation for PID ${pid}.`);
+    }
+    try {
+        return readProcessStart(pid) === startIdentity;
+    }
+    catch {
+        // PID liveness can prove a process is gone, never prove its generation.
+        try {
+            process.kill(pid, 0);
+        }
+        catch (error) {
+            if (hasCode(error, "ESRCH"))
+                return false;
+        }
+        throw new Error(`Unverified process generation for PID ${pid}; OS identity could not be read.`);
+    }
+}
+function readProcessStart(pid) {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    const close = stat.lastIndexOf(")");
+    const start = close < 0 ? undefined : stat.slice(close + 2).trim().split(/\s+/u)[19];
+    if (start === undefined || !/^(0|[1-9][0-9]{0,31})$/u.test(start)) {
+        throw new Error(`Process start identity is unavailable for PID ${pid}.`);
+    }
+    return start;
+}
+function unverified(lock) {
+    return new Error(`Unverified lock owner identity: ${lock}. Preserve the lock and inspect its owner before cleanup.`);
+}
+function hasCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}

package/dist/decision/decision.js

@@ -1,4 +1,21 @@
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
+import { requireTimestamp } from "../domain/validation.js";
+export function validateDecision(decision) {
+    if (decision.schemaVersion !== 1)
+        throw new Error("Decision must use schemaVersion 1.");
+    validateTaskRecordReference({ taskId: decision.taskId, localId: decision.id }, "decision");
+    requireText(decision.title, "Decision title");
+    requireText(decision.rationale, "Decision rationale");
+    requireTimestamp(decision.createdAt, "Decision createdAt");
+    requireTimestamp(decision.updatedAt, "Decision updatedAt");
+    if (decision.status !== "active" && decision.status !== "superseded")
+        throw new Error("Decision status is invalid.");
+    if (decision.status === "superseded") {
+        requireText(decision.supersededReason, "Decision supersede reason");
+        requireTimestamp(decision.supersededAt, "Decision supersededAt");
+    }
+    return decision;
+}
 export function createDecision(id, taskId, title, rationale, now) {
     const timestamp = now.toISOString();
     return {

package/dist/doctor/doctor.js

@@ -3,20 +3,20 @@ import { isAbsolute, join } from "node:path";
 import Database from "better-sqlite3";
 import { configuredAgentToDefinition, resolveAgentEnvironment } from "../agent/agent.js";
 import { operationalAgentEnvironment } from "../agent/launchEnvironment.js";
+import { resolveTmuxBin } from "../config/yuiConfig.js";
+import { compileRoleSessionContext } from "../context/roleSessionContext.js";
+import { EPHEMERAL_DOMAIN_GRACE_MS, readEphemeralDomainIdentity, readLinuxProcessStartIdentity } from "../controller/domainIdentity.js";
+import { usageError } from "../errors/cliError.js";
 import { inspectAgentCapabilities, resolveAgentAdapter } from "../executor/agentAdapter.js";
 import { assertCodexLaunchOverridesAvailable, inspectCodexLaunchConfig } from "../executor/codexConfigConflict.js";
-import { nativeAdditionalDirectories, nativeAgentWorkspace, withNativeProjectDirectories } from "../executor/fileRoleLaunchPlanner.js";
 import { resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
-import { compileRoleSessionContext } from "../context/roleSessionContext.js";
-import { usageError } from "../errors/cliError.js";
+import { nativeAdditionalDirectories, nativeAgentWorkspace, withNativeProjectDirectories } from "../executor/fileRoleLaunchPlanner.js";
 import { defaultTableWidth, renderTable } from "../output/table.js";
-import { resolveYuiHome } from "../storage/taskStore.js";
 import { CURRENT_DATABASE_FILENAME, openCurrentTaskStore } from "../storage/currentTaskStore.js";
 import { inspectStorageSchema } from "../storage/storageSchema.js";
 import { resolveStoreWorkerEnabledForHome } from "../storage/storeRpc.js";
-import { resolveTmuxBin } from "../config/yuiConfig.js";
+import { resolveYuiHome } from "../storage/taskStore.js";
 import { CommandExecutionError } from "../tmux/commandExecutor.js";
-import { EPHEMERAL_DOMAIN_GRACE_MS, readEphemeralDomainIdentity, readLinuxProcessStartIdentity } from "../controller/domainIdentity.js";
 /**
  * The storage-relevant doctor checks, in the order they are produced. Post-update
  * verification (P1-3) keys off exactly these: a green `yui doctor` for the update
@@ -243,7 +243,7 @@ function checkSchema(state) {
     }
 }
 /** Diagnose admission to the exact current storage contract without repair. */
-function inspectCompatibility(home, homeCheck, schema) {
+function inspectCompatibility(_home, homeCheck, schema) {
     const name = "storage compatibility";
     if (homeCheck.status !== "ok") {
         return { check: { name, status: homeCheck.status, detail: homeCheck.detail } };
@@ -311,8 +311,10 @@ function inspectState(home, homeCheck, schema, compatibility) {
     if (!existsSync(databasePath)) {
         return blockedStorage("invalid", "Current storage is incomplete: yui.db is missing.");
     }
+    let ownedStore;
     try {
-        const store = openCurrentTaskStore(home);
+        const store = ownedStore = openCurrentTaskStore(home);
+        store.validateCurrentRecords();
         const config = store.getConfig();
         const agents = store.listConfiguredAgents();
         const tasks = store.listTasks();
@@ -346,6 +348,9 @@ function inspectState(home, homeCheck, schema, compatibility) {
     catch (error) {
         return blockedStorage("invalid", errorMessage(error));
     }
+    finally {
+        ownedStore?.close();
+    }
 }
 function storageBlockerDetail(check) {
     const corruptionPrefix = "unsupported (CORRUPTED): ";
@@ -755,8 +760,9 @@ function errorMessage(error) {
  * the Home store cannot be opened (the doctor must still run on broken Homes).
  */
 function readDurableConfigSafely(home) {
+    let ownedStore;
     try {
-        const store = openCurrentTaskStore(home);
+        const store = ownedStore = openCurrentTaskStore(home);
         const config = store.getConfig();
         return {
             tmuxBin: resolveTmuxBin(config.tmuxBin),
@@ -766,4 +772,7 @@ function readDurableConfigSafely(home) {
     catch {
         return { tmuxBin: "tmux", gitBin: "git" };
     }
+    finally {
+        ownedStore?.close();
+    }
 }

package/dist/event/taskEvent.js

@@ -1,4 +1,5 @@
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
+import { requireTimestamp } from "../domain/validation.js";
 export function createTaskEvent(id, taskId, type, payload, now) {
     const event = {
         schemaVersion: 2,
@@ -8,7 +9,18 @@ export function createTaskEvent(id, taskId, type, payload, now) {
         payload: normalizePayload(payload),
         createdAt: now.toISOString()
     };
+    return validateTaskEvent(event);
+}
+export function validateTaskEvent(event) {
+    if (event.schemaVersion !== 2)
+        throw new Error("Task Event must use schemaVersion 2.");
     validateTaskRecordReference({ taskId: event.taskId, localId: event.id }, "event");
+    requireText(event.type, "Task event type");
+    if (event.payload === null || typeof event.payload !== "object" || Array.isArray(event.payload)) {
+        throw new Error("Task event payload must be an object.");
+    }
+    normalizePayload(event.payload);
+    requireTimestamp(event.createdAt, "Task event createdAt");
     return event;
 }
 /**

package/dist/execution/workItemExecutionProjection.js

@@ -1,5 +1,5 @@
-import { governingWorkItemCandidate, currentWorkItemExecutionGroup } from "../workItem/workItem.js";
 import { synthesisSourceRunIds } from "../context/runContextPack.js";
+import { currentWorkItemExecutionGroup, governingWorkItemCandidate } from "../workItem/workItem.js";
 export function projectWorkItemExecution(item, runs, sessionSets = [], sourceStore) {
     const group = currentWorkItemExecutionGroup(item);
     const relevantRuns = runs.filter((run) => run.workItemId === item.id);
@@ -164,7 +164,7 @@ function projectMainRun(item, group, runs, sessionsByRole) {
         observation: run.result === undefined ? "unobserved" : "observed"
     });
 }
-function projectSynthesis(group, lanes, mainRun) {
+function projectSynthesis(group, _lanes, mainRun) {
     if (group === undefined) {
         return Object.freeze({
             status: "not-applicable",

package/dist/executor/agentCapabilityConfig.js

@@ -0,0 +1,43 @@
+import { isAbsolute } from "node:path";
+import { isAgentAdapterId } from "../agent/adapterCatalog.js";
+/** Project an existing Role/launch config without changing its native values. */
+export function projectAgentCapabilityConfig(config) {
+    return validateAgentCapabilityConfig({
+        adapterId: config.adapterId,
+        ...(config.model === undefined ? {} : { model: config.model }),
+        ...(config.effort === undefined ? {} : { effort: config.effort }),
+        ...(config.adapterId !== "codex" || config.profile === undefined ? {} : { profile: config.profile }),
+        ...(config.adapterId !== "claude" || config.settingsFile === undefined ? {} : { settingsFile: config.settingsFile }),
+        ...(config.adapterId !== "claude" || config.settingsSources === undefined ? {} : { settingsSources: [...config.settingsSources] })
+    });
+}
+export function validateAgentCapabilityConfig(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Agent capability configuration is invalid.");
+    }
+    const config = value;
+    if (!isAgentAdapterId(config.adapterId))
+        throw new Error("Agent capability adapter is invalid.");
+    const keys = ["adapterId", "model", "effort",
+        ...(config.adapterId === "codex" ? ["profile"] : []),
+        ...(config.adapterId === "claude" ? ["settingsFile", "settingsSources"] : [])];
+    if (Object.keys(config).some(key => !keys.includes(key))) {
+        throw new Error("Agent capability configuration contains execution-only or unsupported fields.");
+    }
+    for (const key of ["model", "effort", "profile", "settingsFile"]) {
+        const field = config[key];
+        if (field !== undefined && (typeof field !== "string" || field.trim().length === 0 || field.includes("\0"))) {
+            throw new Error(`Agent capability ${key} is invalid.`);
+        }
+    }
+    if (config.settingsFile !== undefined && !isAbsolute(config.settingsFile)) {
+        throw new Error("Agent capability settings file must be absolute.");
+    }
+    const sources = config.settingsSources;
+    if (sources !== undefined && (!Array.isArray(sources)
+        || sources.some(source => typeof source !== "string" || source.trim().length === 0 || source.includes("\0"))
+        || new Set(sources).size !== sources.length)) {
+        throw new Error("Agent capability settings sources are invalid.");
+    }
+    return config;
+}

package/dist/executor/agentConfigurationCatalog.js

@@ -4,6 +4,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
 import { resolveAgentAdapter } from "./agentAdapter.js";
+import { redactAgentErrorText } from "../runtime/agentError.js";
 const DEFAULT_TIMEOUT_MS = 8_000;
 export class AgentConfigurationCatalogService {
     yuiHome;
@@ -11,20 +12,39 @@ export class AgentConfigurationCatalogService {
     #timeoutMs;
     #now;
     #discover;
+    #memoryCacheLimit;
     #requests = new Map();
+    #completed = new Map();
     constructor(yuiHome, options = {}) {
         this.yuiHome = yuiHome;
         this.#environment = options.environment ?? process.env;
         this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         this.#now = options.now ?? (() => new Date());
         this.#discover = options.discover ?? ((input) => resolveAgentAdapter(input.agent.adapterId).discoverConfiguration(input));
+        this.#memoryCacheLimit = options.memoryCacheLimit ?? 64;
+        if (!Number.isSafeInteger(this.#memoryCacheLimit) || this.#memoryCacheLimit < 1) {
+            throw new Error("Agent metadata memory cache limit must be positive.");
+        }
     }
     resolve(input) {
         const fingerprint = catalogFingerprint(input, this.#environment);
-        const existing = this.#requests.get(fingerprint);
-        if (existing !== undefined)
-            return existing;
-        const request = this.#resolve(input, fingerprint);
+        const active = this.#requests.get(fingerprint);
+        if (active !== undefined)
+            return active;
+        const cached = this.#completed.get(fingerprint);
+        if (cached !== undefined && input.refresh !== true) {
+            this.#completed.delete(fingerprint);
+            this.#completed.set(fingerprint, cached);
+            return Promise.resolve(cached.source === "live" ? { ...cached, source: "cache" } : cached);
+        }
+        const request = this.#resolve(input, fingerprint).then(result => {
+            this.#completed.delete(fingerprint);
+            this.#completed.set(fingerprint, result);
+            while (this.#completed.size > this.#memoryCacheLimit) {
+                this.#completed.delete(this.#completed.keys().next().value);
+            }
+            return result;
+        }).finally(() => { this.#requests.delete(fingerprint); });
         this.#requests.set(fingerprint, request);
         return request;
     }
@@ -174,24 +194,42 @@ export function defaultModel(catalog) {
 export function modelChoice(catalog, value) {
     return value === undefined
         ? defaultModel(catalog)
-        : catalog.models.find((model) => model.value === value);
+        : catalog.models.find((model) => model.value === value)
+            ?? catalog.models.find((model) => model.resolvedModel === value && !model.isDefault)
+            ?? catalog.models.find((model) => model.resolvedModel === value);
+}
+/** Observed choices, not an invented complete list of a Provider's model IDs. */
+export function agentModelOptionsSummary(catalog) {
+    const choices = catalog.models.map(model => `${JSON.stringify(model.value)}${model.resolvedModel === undefined
+        || model.resolvedModel === model.value ? "" : ` -> ${JSON.stringify(model.resolvedModel)}`}`);
+    return [
+        choices.length === 0
+            ? "No native model options were reported."
+            : `Native model options: ${choices.join(", ")}.`,
+        ...(configurationField(catalog, "model")?.allowCustom === true
+            ? ["Custom model IDs are validated by the Provider; this list is not exhaustive."] : [])
+    ].join(" ");
 }
 /**
- * Validates the launch-time model/effort against a live or cached capability
- * catalog. A fallback catalog intentionally carries no model list, so an
- * unavailable Provider probe does not block a supported launch.
+ * Validate known model/effort constraints. An explicitly open model field
+ * delegates unlisted IDs to the Provider; aliases are not a complete whitelist.
+ * A fallback has no model list and makes no claim about native acceptance.
  */
 export function validateAgentLaunchConfiguration(catalog, config) {
     if (catalog.models.length === 0)
         return;
     const model = modelChoice(catalog, config.model);
     if (model === undefined) {
-        throw new Error(`Unsupported ${catalog.adapterId} launch configuration: field=model actual=${JSON.stringify(config.model ?? "")} supported=${JSON.stringify(catalog.models.map(({ value }) => value))}.`);
+        if (config.model !== undefined && configurationField(catalog, "model")?.allowCustom === true)
+            return;
+        throw new Error(`Unsupported ${catalog.adapterId} launch configuration: field=model actual=${JSON.stringify(config.model ?? "")}. ${agentModelOptionsSummary(catalog)} `
+            + `Inspect current options: yui config agent capabilities ${catalog.agentId}.`);
     }
     if (config.effort !== undefined
         && model.efforts.length > 0
         && !model.efforts.some((effort) => effort.value === config.effort)) {
-        throw new Error(`Unsupported ${catalog.adapterId} launch configuration: field=effort actual=${JSON.stringify(config.effort)} model=${JSON.stringify(model.value)} supported=${JSON.stringify(model.efforts.map(({ value }) => value))}.`);
+        throw new Error(`Unsupported ${catalog.adapterId} launch configuration: field=effort actual=${JSON.stringify(config.effort)} model=${JSON.stringify(model.value)} supported=${JSON.stringify(model.efforts.map(({ value }) => value))}. ${agentModelOptionsSummary(catalog)} `
+            + `Inspect current options: yui config agent capabilities ${catalog.agentId}.`);
     }
 }
 function field(key, choices, allowCustom) {
@@ -442,7 +480,7 @@ function catalogFailure(error) {
         code: code === "ETIMEDOUT" || candidate.name === "AbortError"
             ? "timeout"
             : code === "ENOENT" ? "missing-command" : "probe-failed",
-        message: candidate.message || "Agent capability discovery failed."
+        message: redactAgentErrorText(candidate.message || "Agent capability discovery failed.")
     };
 }
 function record(value) {

package/dist/executor/agentExecutor.js

@@ -33,7 +33,7 @@ export function createRoleSessionSet(owner, activeAgentId, now) {
         updatedAt: now.toISOString()
     };
     return owner.scope === "global"
-        ? { ...base, schemaVersion: 5 }
+        ? { ...base, schemaVersion: 5, providerBinding: null }
         : {
             ...base,
             schemaVersion: 12,
@@ -486,13 +486,10 @@ export function validateRoleSessionSet(set) {
                 }
             }
         }
-        // A Global Role now carries the same optional Provider Runtime Binding shape
-        // as a Task Role (decision-3 §6/§9). It stays absent on every legacy set;
-        // when present, it is the exact native control evidence a Global steer or
-        // interrupt targets, validated identically to the Task branch. A fabricated
-        // Task binding is never accepted here, and its presence never upgrades the
-        // schemaVersion these raw-JSON sets are read at.
-        if (Object.hasOwn(globalSet, "providerBinding") && globalSet.providerBinding != null) {
+        if (!Object.hasOwn(globalSet, "providerBinding")) {
+            throw new Error("Global Role session set must contain its Provider Runtime Binding.");
+        }
+        if (globalSet.providerBinding !== null) {
             const providerBinding = validateProviderRuntimeBinding(globalSet.providerBinding);
             const conversationId = currentProviderConversation(providerBinding).conversationId;
             const session = [...Object.values(globalSet.sessions), ...Object.values(globalSet.history ?? {})]

package/dist/executor/fileRoleLaunchPlanner.js

@@ -1,30 +1,30 @@
-import { randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { mkdirSync, realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
-import { assertExecutionEnvironmentCurrent } from "../runtime/executionEnvironment.js";
 import { runPurposeAdmitsTaskState } from "../agentRun/agentRun.js";
+import { assertExecutionEnvironmentCurrent } from "../runtime/executionEnvironment.js";
 import { taskOwnsManagedWorkspace } from "../task/task.js";
 import { configuredAgentToDefinition, resolveAgentEnvironment } from "../agent/agent.js";
 import { NATIVE_AGENT_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, operationalAgentEnvironment, selectEnvironment } from "../agent/launchEnvironment.js";
-import { activeRoleAgentBinding } from "../role/role.js";
-import { planningRuntimeCwd } from "../storage/homeLayout.js";
 import { compileRoleSessionContext, roleSessionKind } from "../context/roleSessionContext.js";
 import { materializeSessionBootstrap } from "../context/sessionBootstrapManifest.js";
-import { resolveAgentAdapter } from "./agentAdapter.js";
-import { resolveTaskRoleSessionTitle } from "../runtime/sessionTitle.js";
-import { classifyWorkspacePreflight, formatWorkspacePreflightError } from "./workspacePreflightClassification.js";
-import { activeLiveRoleAgentSession, taskRoleControlTarget } from "./agentExecutor.js";
-import { roleSessionMayContinue, effectiveRoleForLaunch, resolveEffectiveLaunch } from "./effectiveLaunch.js";
-import { parseTaskRuntimeIsolationDescriptor, taskRuntimeIsolationEnvironment } from "../runtime/taskRuntimeIsolation.js";
 import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
-import { builtinAgentDriverRegistry, builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
+import { activeRoleAgentBinding } from "../role/role.js";
 import { managedRuntimeAdmission } from "../runtime/agentDriver.js";
 import { builtinAgentEndpointImplementation, validateAgentEndpointImplementation } from "../runtime/agentEndpointIdentity.js";
+import { builtinAgentDriverRegistry, builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 import { assertProviderConversationReplaceable } from "../runtime/providerRuntimeIdentity.js";
+import { resolveTaskRoleSessionTitle } from "../runtime/sessionTitle.js";
+import { parseTaskRuntimeIsolationDescriptor, taskRuntimeIsolationEnvironment } from "../runtime/taskRuntimeIsolation.js";
+import { planningRuntimeCwd } from "../storage/homeLayout.js";
+import { resolveAgentAdapter } from "./agentAdapter.js";
+import { activeLiveRoleAgentSession, taskRoleControlTarget } from "./agentExecutor.js";
 import { assertCodexLaunchOverridesAvailable, inspectCodexLaunchConfig } from "./codexConfigConflict.js";
+import { effectiveRoleForLaunch, resolveEffectiveLaunch, roleSessionMayContinue } from "./effectiveLaunch.js";
+import { classifyWorkspacePreflight, formatWorkspacePreflightError } from "./workspacePreflightClassification.js";
 /** Builds managed native Agent launches from the authoritative Task records. */
 export class FileRoleLaunchPlanner {
     home;
@@ -791,9 +791,6 @@ const inspectWorkspacePhysicalState = (entry) => {
         recordedBaseIsAncestor: ancestorResult.status === 0
     };
 };
-function shellQuote(value) {
-    return `'${value.replaceAll("'", "'\"'\"'")}'`;
-}
 function patchEnvironment(current, names, values) {
     const next = { ...current };
     for (const name of names)
@@ -830,45 +827,6 @@ function codexShellEnvironmentConfig(environment) {
         .map(([name, value]) => `${JSON.stringify(name)}=${JSON.stringify(value)}`);
     return `shell_environment_policy.set={${entries.join(",")}}`;
 }
-/**
- * Codex 0.145 discovers lifecycle hooks from its effective config. Keep Yui's
- * two handlers invocation-local: this avoids mutating CODEX_HOME or the Task
- * workspace, while the exact launch environment supplies the durable AgentRun fence.
- */
-function codexLifecycleHooksConfig(cliPath) {
-    const command = [
-        shellQuote(canonicalPath(process.execPath)),
-        shellQuote(canonicalPath(cliPath)),
-        "internal",
-        "runtime-hook"
-    ].join(" ");
-    const handler = `{hooks=[{type="command",command=${JSON.stringify(command)}}]}`;
-    return `hooks={`
-        + `SessionStart=[${handler}],`
-        + `UserPromptSubmit=[${handler}],`
-        + `PreToolUse=[${handler}],`
-        + `PermissionRequest=[${handler}],`
-        + `PostToolUse=[${handler}],`
-        + `SubagentStart=[${handler}],`
-        + `SubagentStop=[${handler}],`
-        + `Stop=[${handler}]`
-        + `}`;
-}
-function addCodexLifecycleHooks(args, mode, cliPath) {
-    // Session flags are Yui-owned and exact to this launch. Hook trust bypass is
-    // still explicit because these handlers execute a local command.
-    const managed = [
-        "--enable", "hooks",
-        "--config", codexLifecycleHooksConfig(cliPath),
-        "--dangerously-bypass-hook-trust"
-    ];
-    if (mode === "new")
-        return [...args, ...managed];
-    if (args.length < 2 || args.at(-2) !== "resume") {
-        throw new Error("Codex resume launch shape is invalid.");
-    }
-    return [...args.slice(0, -2), ...managed, ...args.slice(-2)];
-}
 function withCodexThreadEnvironment(launch) {
     const control = launch.providerControl;
     if (control?.adapterId !== "codex" || control.codexThread === undefined)

package/dist/executor/taskAgentCapabilities.js

@@ -0,0 +1,64 @@
+import { usageError, taskNotFound, roleNotFound, agentNotFound } from "../errors/cliError.js";
+import { projectAgentCapabilityConfig } from "./agentCapabilityConfig.js";
+import { activeRoleAgentBinding } from "../role/role.js";
+import { configuredAgentFingerprint, readAgentFailureContext } from "../runtime/agentFailureContext.js";
+import { resolveManagedTaskReader } from "../runtime/managedCaller.js";
+import { assertContextRecordReadable } from "../context/taskContext.js";
+/** Resolve authority and scope before any native metadata process is started. */
+export function resolveTaskAgentCapabilities(query, store, environment = {}) {
+    const { taskId, roleName, errorId } = query;
+    const reader = resolveManagedTaskReader(store, environment);
+    if (reader !== undefined && (reader.taskId !== taskId
+        || reader.roleName !== "leader" && reader.roleName !== roleName)) {
+        throw usageError("Agent capability query is outside the caller's Task/Role.");
+    }
+    const task = store.getTask(taskId);
+    if (task === null)
+        throw taskNotFound(taskId);
+    let agentId, cwd, config;
+    let expectedFingerprint;
+    let expectedComponent;
+    if (errorId !== undefined) {
+        assertContextRecordReadable(store, taskId, "task-event", errorId, environment);
+        const event = store.listEventsByType(taskId, ["runtime.agent-error"]).find(event => event.id === errorId);
+        if (event === undefined || event.payload.roleName !== roleName) {
+            throw usageError("Agent failure is not owned by this Task/Role.");
+        }
+        const captured = readAgentFailureContext(event.payload.capabilityContext);
+        if (captured.status === "unavailable") {
+            throw usageError(`${captured.reason} No historical configuration was inferred. `
+                + `Inspect current desired configuration explicitly with yui task role capabilities ${taskId} ${roleName} --refresh.`);
+        }
+        ({ agentId, cwd, config } = captured);
+        expectedFingerprint = captured.agentFingerprint;
+    }
+    else {
+        const role = store.getRole(taskId, roleName);
+        if (role === null)
+            throw roleNotFound(roleName);
+        const binding = activeRoleAgentBinding(role);
+        agentId = binding.agentId;
+        expectedComponent = binding.component;
+        cwd = role.workspace;
+        config = projectAgentCapabilityConfig(binding.config);
+    }
+    const agent = store.getConfiguredAgent(agentId);
+    if (agent === null)
+        throw agentNotFound(agentId);
+    if (agent.adapterId !== config.adapterId
+        || expectedComponent !== undefined && agent.component !== expectedComponent) {
+        throw usageError("The Role capability binding no longer matches the configured Agent implementation.");
+    }
+    if (expectedFingerprint !== undefined && configuredAgentFingerprint(agent) !== expectedFingerprint) {
+        throw usageError("The configured Agent command or environment bindings changed since this failure. "
+            + "The historical capability query was not run; inspect current desired configuration explicitly.");
+    }
+    return {
+        input: { agent, cwd, config,
+            refresh: query.refresh === true },
+        context: { taskId, roleName, selection: errorId === undefined ? "desired-role" : "failed-launch",
+            ...(errorId === undefined ? {} : { errorId }), agentId: agent.id,
+            ...(config.model === undefined ? {} : { requestedModel: config.model }),
+            cwd }
+    };
+}

package/dist/integration/deliveryObligation.js

@@ -33,78 +33,10 @@ export function workItemDeliverySettled(delivery, integrations) {
         && attempt.source.startCommit === delivery.startCommit
         && attempt.source.resultCommit === delivery.resultCommit));
 }
-/**
- * Delivery obligations follow the Candidate that currently governs each
- * WorkItem. Older Candidates and their ChangeSets remain audit evidence, but
- * they do not keep a Task open after a replacement Candidate is accepted.
- */
-export function governingChangeSets(workItems, changeSets) {
-    const selected = new Map();
-    for (const item of workItems) {
-        const candidate = governingWorkItemCandidate(item);
-        if (candidate === undefined)
-            continue;
-        for (const changeSet of changeSets) {
-            if (changeSet.workItemId !== item.id)
-                continue;
-            const expectedHead = candidateProjectHead(candidate, changeSet.projectId);
-            if (expectedHead !== undefined && changeSet.headCommit !== expectedHead)
-                continue;
-            const key = `${item.id}\0${changeSet.projectId}`;
-            const current = selected.get(key);
-            if (current === undefined || compareChangeSets(current, changeSet) < 0) {
-                selected.set(key, changeSet);
-            }
-        }
-    }
-    return [...selected.values()].sort(compareChangeSets);
-}
-export function changeSetDeliverySettled(changeSet, integrations, queueEntries = []) {
-    if (integrations.some((attempt) => (attempt.status === "committed"
-        && attempt.projectId === changeSet.projectId
-        && attempt.source.kind === "work-item"
-        && attempt.source.workItemId === changeSet.workItemId
-        && attempt.source.resultCommit === changeSet.headCommit)))
-        return true;
-    const latestQueueEntry = queueEntries
-        .filter((entry) => entry.changeSetId === changeSet.id)
-        .sort(compareQueueEntries)
-        .at(-1);
-    return latestQueueEntry?.status === "superseded";
-}
-export function latestGoverningQueueEntries(changeSets, queueEntries) {
-    const governingIds = new Set(changeSets.map(({ id }) => id));
-    const latest = new Map();
-    for (const entry of queueEntries) {
-        if (!governingIds.has(entry.changeSetId))
-            continue;
-        const current = latest.get(entry.changeSetId);
-        if (current === undefined || compareQueueEntries(current, entry) < 0) {
-            latest.set(entry.changeSetId, entry);
-        }
-    }
-    return [...latest.values()].sort(compareQueueEntries);
-}
-/**
- * Historical blocked attempts are audit evidence once every ChangeSet they
- * reference has been replaced by a newer governing Candidate. Attempts that
- * may still be writing remain blockers regardless of Candidate history.
- */
+/** Unsettled Integration attempts remain blockers independently of Agent ordering. */
 export function integrationAttemptRequiresSettlement(attempt) {
     return attempt.status === "running"
         || attempt.status === "validating"
         || attempt.status === "blocked"
         || attempt.status === "conflicted";
 }
-function candidateProjectHead(candidate, projectId) {
-    return candidate.gitSnapshot?.projects.find((project) => project.projectId === projectId)?.commit
-        ?? candidate.taskMainSnapshot?.projects.find((project) => project.projectId === projectId)?.headCommit;
-}
-function compareChangeSets(left, right) {
-    return left.createdAt.localeCompare(right.createdAt)
-        || left.id.localeCompare(right.id, undefined, { numeric: true });
-}
-function compareQueueEntries(left, right) {
-    return left.updatedAt.localeCompare(right.updatedAt)
-        || left.id.localeCompare(right.id, undefined, { numeric: true });
-}