@zq-silk/yui 0.15.8 → 0.15.11

package/dist/runtime/taskRuntimeIsolation.js

@@ -65,7 +65,9 @@ export class FileTaskRuntimeIsolation {
             this.#resourceRegistrar().registerTaskRuntimeIsolation(descriptor);
             return;
         }
-        ensureDirectoryChain(this.#runtimeRoot, dirname(root));
+        ensureDirectoryChain(this.#controlPlane.managedRuntimeRoot === undefined
+            ? this.#runtimeRoot
+            : this.#controlPlane.yuiHome, dirname(root));
         mkdirSync(root, { mode: 0o700 });
         try {
             const marker = {
@@ -255,10 +257,22 @@ export function assertTaskRuntimeIsolationPreflight(input) {
         }
     }
     const control = normalizeControlBoundary(input.controlPlane);
-    const protectedPaths = [control.yuiHome, ...control.globalInstallPaths];
     for (const root of Object.values(descriptor.roots)) {
-        if (protectedPaths.some((path) => pathsOverlap(root, path))) {
-            throw new Error("Task runtime roots overlap the control YUI_HOME or a global install path.");
+        if (control.globalInstallPaths.some((path) => pathsOverlap(root, path))) {
+            throw new Error("Task runtime roots overlap a global install path.");
+        }
+        // Precise partition isolation: a runtime root may occupy Home only when it
+        // is fully within the single designated managed runtime partition. Every
+        // other part of Home — the database, managed Git workspaces, projects —
+        // stays protected. Both Task and integration runtimes now supply such a
+        // partition; a caller that supplies none keeps the whole-Home overlap ban.
+        if (pathsOverlap(root, control.yuiHome)) {
+            const partition = control.managedRuntimeRoot;
+            const withinPartition = partition !== undefined
+                && (root === partition || isWithin(partition, root));
+            if (!withinPartition) {
+                throw new Error("Task runtime roots overlap the control YUI_HOME outside the managed runtime partition.");
+            }
         }
         if (pathsOverlap(root, descriptor.workspace.root)) {
             throw new Error("Task runtime roots must not dirty the managed workspace.");
@@ -441,11 +455,21 @@ function taskRuntimeServiceNamespace(taskId, owner, runtimeRoot) {
     ])).slice(0, 24)}`;
 }
 function normalizeControlBoundary(value) {
+    const yuiHome = canonicalPath(value.yuiHome, "Control YUI_HOME");
+    const managedRuntimeRoot = value.managedRuntimeRoot === undefined
+        ? undefined
+        : canonicalPath(value.managedRuntimeRoot, "Managed runtime root");
+    if (managedRuntimeRoot !== undefined
+        && managedRuntimeRoot !== yuiHome
+        && !isWithin(yuiHome, managedRuntimeRoot)) {
+        throw new Error("Managed runtime root must be within the control YUI_HOME.");
+    }
     return Object.freeze({
-        yuiHome: canonicalPath(value.yuiHome, "Control YUI_HOME"),
+        yuiHome,
         controllerSocketPath: canonicalPath(value.controllerSocketPath, "Controller socket path"),
         tmuxNamespace: requireIdentity(value.tmuxNamespace, "Controller tmux namespace"),
-        globalInstallPaths: Object.freeze((value.globalInstallPaths ?? []).map((path) => canonicalPath(path, "Global install path")))
+        globalInstallPaths: Object.freeze((value.globalInstallPaths ?? []).map((path) => canonicalPath(path, "Global install path"))),
+        ...(managedRuntimeRoot === undefined ? {} : { managedRuntimeRoot })
     });
 }
 function validateObservation(resource) {

package/dist/runtime/tmuxAdapters.js

@@ -209,7 +209,8 @@ export class TmuxSessionHost {
                 throw toRuntimeLaunchFailure(error, "validation", launchContext);
             }
         }
-        const interactiveCodex = request.owner.scope === "global" && request.adapterId === "codex";
+        const interactiveCodex = request.owner.scope === "global" && request.adapterId === "codex"
+            && planned.launch.providerControl === undefined;
         let reuseInteractivePane = false;
         if (interactiveCodex) {
             let status;
@@ -310,6 +311,7 @@ export class TmuxSessionHost {
         }
         const reservation = broker.reserve(Object.freeze({
             schemaVersion: 2,
+            ...(request.runId === undefined ? {} : { startupRunId: request.runId }),
             command: planned.launch.command,
             args: [...planned.launch.args],
             environment: { ...planned.launch.env },
@@ -577,8 +579,8 @@ export class AgentHostPromptPushAdapter {
         try {
             const result = await sendAgentHostSteerControl({
                 home: this.home,
-                scope: "task",
-                taskId: request.owner.taskId,
+                scope: request.owner.scope,
+                ...(request.owner.scope === "task" ? { taskId: request.owner.taskId } : {}),
                 roleName: request.owner.roleName,
                 control: {
                     protocol: AGENT_HOST_CONTROL_PROTOCOL,

package/dist/scheduler/operatorEvent.js

@@ -4,6 +4,8 @@ import { queueLeaderWakeup } from "./wakeupQueue.js";
 export const LEADER_ATTENTION_REQUIRED_EVENT = "leader.attention-required";
 /** The sole Task-event boundary into the global Operator mailbox. */
 export function enqueueOperatorEvent(store, event, reason, now) {
+    if (store.getTask?.(event.taskId)?.status === "archived")
+        return;
     enqueueWork(store, { kind: "operator" }, reason, now, [
         { type: "event", taskId: event.taskId, id: event.id }
     ], {
@@ -13,6 +15,8 @@ export function enqueueOperatorEvent(store, event, reason, now) {
 }
 /** Routes one Role fact to its supervisor without exposing Provider details to Operator code. */
 export function routeRoleEvent(store, event, roleName, reason, now) {
+    if (store.getTask?.(event.taskId)?.status === "archived")
+        return;
     if (roleName === "leader") {
         enqueueOperatorEvent(store, event, reason, now);
         return;

package/dist/scheduler/taskExecutionProjection.js

@@ -210,9 +210,11 @@ export function projectTaskExecution(facts) {
         && runs.filter((run) => run.workItemId === item.id).at(-1)?.status === "failed");
     const candidateReady = workItems.some((item) => (item.status === "open" && item.currentCandidateId !== undefined));
     const blockedIntegration = integrations.some((attempt) => attempt.status === "blocked");
+    const conflictedIntegration = integrations.find((attempt) => attempt.status === "conflicted");
     const unresolvedIntegration = integrations.some((attempt) => (attempt.status === "running"
         || attempt.status === "validating"
-        || attempt.status === "blocked"));
+        || attempt.status === "blocked"
+        || attempt.status === "conflicted"));
     const hasLeaderMismatch = attention.some((item) => item.kind === "identity-mismatch");
     const renderAttention = () => {
         const first = attention[0];
@@ -279,6 +281,15 @@ export function projectTaskExecution(facts) {
     if (attention.length > 0) {
         return renderAttention();
     }
+    if (conflictedIntegration !== undefined) {
+        return render({
+            task, status: "needs-leader-action", owner: "leader",
+            action: "resolve-integration-conflicts",
+            summary: `Integration ${conflictedIntegration.id} has Git conflicts; resolve its workspace and continue.`,
+            reason: "integration-conflicted", monitoring, failClosed: false,
+            activeRuns: activeRunViews, attention, blockers, pendingWakeup
+        });
+    }
     if (blockedIntegration || failedWork || hasLeaderMismatch) {
         return render({
             task,

package/dist/scheduler/wakeReason.js

@@ -37,7 +37,13 @@ const IMMEDIATE_KINDS = new Set([
     "activation-failed",
     "task-reopened",
     "leader-turn-failed",
-    "role-turn-failed"
+    "role-turn-failed",
+    // A claimed interrupt-then handoff for a no-Run Leader turn: the operator/Leader
+    // explicitly redirected, so the release wake bypasses the aggregation debounce.
+    // It is still held by the leader-mailbox busy-gate until the interrupted native
+    // Turn reaches its proven terminal (decision-3 §4), so "immediate" only removes
+    // the extra 60s aggregation delay once that terminal actually opens the gate.
+    "interrupt-then"
 ]);
 export function wakeReason(kind, ref) {
     if (ref === undefined)

package/dist/scheduler/wakeupQueue.js

@@ -1,5 +1,7 @@
 import { mergePendingWakeup } from "./pendingWakeup.js";
 export function queueLeaderWakeup(store, taskId, reason, now) {
+    if (store.getTask?.(taskId)?.status === "archived")
+        return null;
     if (store.enqueueLeaderWakeup !== undefined) {
         return store.enqueueLeaderWakeup(taskId, reason, now);
     }

package/dist/setup/setupCommand.js

@@ -1,10 +1,11 @@
 import { existsSync, mkdirSync, realpathSync } from "node:fs";
-import { delimiter, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { delimiter, isAbsolute, join, relative, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { configuredAgentToDefinition, createConfiguredAgent } from "../agent/agent.js";
 import { assertRoleRuntimeMutationAllowed } from "../commands/roleRuntimeGuard.js";
 import { resolveTmuxBin } from "../config/yuiConfig.js";
 import { usageError } from "../errors/cliError.js";
+import { managedGlobalRoleWorkspace } from "../storage/homeLayout.js";
 import { createGlobalRole, createRoleAgentBinding, updateGlobalRole } from "../role/role.js";
 import { SYSTEM_LEADER_ROLE, SYSTEM_OPERATOR_ROLE } from "../role/systemRoles.js";
 import { initializeCurrentTaskStore } from "../storage/currentTaskStore.js";
@@ -48,20 +49,28 @@ export async function runSetupCommand(args, env, executor, io = {}) {
         const currentOperator = store.getGlobalRole(SYSTEM_OPERATOR_ROLE);
         const selected = await selectOperatorAgent(choices, currentOperator, store.getConfig().defaultAgent, question, io);
         const agent = selected.existing ?? createConfiguredAgent(selected.id, selected.adapterId, selected.command, [], [], new Date());
-        const workspace = resolveWorkspace(store.getConfig().defaultWorkspace ?? join(dirname(resolve(home)), "workspace"), home);
-        const roleStatus = saveMinimumConfiguration(store, agent, workspace, new Set(choices.map(({ id }) => id)));
+        // The built-in Global Operator/Leader run under a Home-internal working
+        // directory. Yui never auto-invents an external scratch root here: a user
+        // who wants an external project-input root configures `default-workspace`
+        // explicitly (kept outside Home by its own guard). An already-configured one
+        // is carried forward and normalized; none is fabricated.
+        const configuredWorkspace = store.getConfig().defaultWorkspace;
+        const externalWorkspace = configuredWorkspace === undefined
+            ? undefined
+            : resolveWorkspace(configuredWorkspace, home);
+        const roleWorkspace = managedGlobalRoleWorkspace(home);
+        mkdirSync(roleWorkspace, { recursive: true, mode: 0o700 });
+        const roleStatus = saveMinimumConfiguration(store, agent, roleWorkspace, externalWorkspace, new Set(choices.map(({ id }) => id)));
         return `${[
             "Yui setup complete.",
             `Yui home: ${home}.`,
-            `Operator Agent: ${agent.id}.`,
-            `Leader Agent: ${roleStatus.leaderAgentId}.`,
-            `Default workspace: ${workspace}.`,
-            `Operator configuration: ${roleStatus.operator}.`,
-            `Leader configuration: ${roleStatus.leader}.`,
-            `Tmux: ${tmuxBin}.`,
-            "Setup did not configure Review, Worker, Profiles, or shell completion.",
-            "Provider login and native key/initialization confirmations remain with the Provider; setup did not call a model.",
-            "Run `yui operator enter` to continue, or `yui config show` to inspect configuration."
+            `Operator: ${agent.id} (${roleStatus.operator}).`,
+            `Leader: ${roleStatus.leaderAgentId} (${roleStatus.leader}).`,
+            `Global Role workspace: ${roleWorkspace}.`,
+            ...(externalWorkspace === undefined
+                ? []
+                : [`Default workspace: ${externalWorkspace}.`]),
+            "Run `yui config show` to inspect configuration, or `yui operator enter` to start an Operator session for configuration changes or development tasks."
         ].join("\n")}\n`;
     }
     finally {
@@ -121,14 +130,18 @@ async function selectOperatorAgent(choices, currentOperator, defaultAgent, quest
     }
     return selected;
 }
-function saveMinimumConfiguration(store, agent, workspace, usableAgentIds) {
+function saveMinimumConfiguration(store, agent, roleWorkspace, externalWorkspace, usableAgentIds) {
     return store.transaction((tx) => {
         tx.saveConfiguredAgent(agent);
         const config = tx.getConfig();
         tx.saveConfig({
             ...config,
             defaultAgent: config.defaultAgent ?? agent.id,
-            defaultWorkspace: config.defaultWorkspace ?? workspace
+            // Only persist a default workspace the user actually configured; setup no
+            // longer fabricates an external Home-sibling root.
+            ...(externalWorkspace === undefined
+                ? {}
+                : { defaultWorkspace: config.defaultWorkspace ?? externalWorkspace })
         });
         const now = new Date();
         const leader = tx.getGlobalRole(SYSTEM_LEADER_ROLE);
@@ -140,7 +153,7 @@ function saveMinimumConfiguration(store, agent, workspace, usableAgentIds) {
                 roleName: SYSTEM_LEADER_ROLE
             }, "creation");
             const definition = configuredAgentToDefinition(agent);
-            tx.saveGlobalRole(createGlobalRole(SYSTEM_LEADER_ROLE, [createRoleAgentBinding(definition)], agent.id, workspace, now));
+            tx.saveGlobalRole(createGlobalRole(SYSTEM_LEADER_ROLE, [createRoleAgentBinding(definition)], agent.id, roleWorkspace, now));
             leaderStatus = "created";
             leaderAgentId = agent.id;
         }
@@ -166,7 +179,7 @@ function saveMinimumConfiguration(store, agent, workspace, usableAgentIds) {
                 scope: "global",
                 roleName: SYSTEM_OPERATOR_ROLE
             }, "creation");
-            tx.saveGlobalRole(createGlobalRole(SYSTEM_OPERATOR_ROLE, [binding], agent.id, workspace, now));
+            tx.saveGlobalRole(createGlobalRole(SYSTEM_OPERATOR_ROLE, [binding], agent.id, roleWorkspace, now));
             return {
                 operator: "created",
                 leader: leaderStatus,

package/dist/storage/homeLayout.js

@@ -0,0 +1,130 @@
+import { isAbsolute, join, relative, resolve } from "node:path";
+/**
+ * The single authority for every Yui self-managed path derived from a Home.
+ *
+ * Historically the managed Git worktrees and provider runtimes escaped Home
+ * through two different mechanisms: worktree/task roots were derived from the
+ * user-facing `defaultWorkspace` (an out-of-Home directory), and provider
+ * runtimes/backups were written to string-built siblings of Home
+ * (`${home}.task-runtimes`, `${home}-backups`). Both are unified here so that a
+ * single canonical YUI_HOME contains all self-managed data, with only the
+ * approved short-path IPC sockets (Controller, tmux, Agent Host, integration
+ * runtime) remaining outside it for the `sockaddr_un` length budget. Within the
+ * managed workspace root, storage v20 further collapses the former
+ * physical-worktree/symlink-view split into a single layer of real worktrees
+ * under `tasks/` (see {@link managedTaskRoot}).
+ *
+ * `defaultWorkspace` is intentionally NOT an input to this module: it remains a
+ * user-facing cwd for ad-hoc/global Roles and the origin for external Project
+ * input, never a second authority for internal managed layout.
+ */
+/** Canonicalize a Home string the same way callers already resolve it. */
+function homeRoot(home) {
+    const resolved = resolve(home);
+    if (!isAbsolute(resolved)) {
+        throw new Error("YUI_HOME must be an absolute path.");
+    }
+    return resolved;
+}
+/**
+ * Root that contains every managed Git workspace. Since storage v20 this holds a
+ * single layer of real worktrees under `tasks/` (plus the legacy `worktree/`
+ * root, preserved by the 19->20 migration as its rollback anchor). A single
+ * parent keeps the managed families adjacent and lets the storage migrations
+ * relocate them as one subtree.
+ */
+export function managedWorkspacesRoot(home) {
+    return join(homeRoot(home), "workspaces");
+}
+/**
+ * LEGACY physical worktree root: `<home>/workspaces/worktree`. Before storage
+ * v20 every managed clone/linked worktree lived here under a per-Project subtree,
+ * surfaced to each Task through a symlink view under `tasks/`. The 19->20
+ * migration collapses those into real worktrees under `tasks/` and PRESERVES this
+ * tree as the rollback anchor, so this path survives only for that migration's
+ * inline layout and for post-upgrade cleanup — no current runtime code derives a
+ * live worktree path from it.
+ */
+export function managedWorktreeRoot(home) {
+    return join(managedWorkspacesRoot(home), "worktree");
+}
+/**
+ * Managed Git worktrees, one real worktree per Task owner and Project at
+ * `<home>/workspaces/tasks/<taskId>/<owner>/<projectDirectory>` (owner being
+ * `main`, `work-items/<id>`, `reviews/<name>`, `integrations/<id>`, or
+ * `execution-lanes/<g>/<l>`). Before storage v20 these were symlink views over
+ * the physical `worktree/` root; the 19->20 migration makes them the worktrees
+ * themselves, so the logical entry path and the physical Git worktree coincide.
+ */
+export function managedTaskRoot(home) {
+    return join(managedWorkspacesRoot(home), "tasks");
+}
+/**
+ * Dedicated partition for provider runtime roots (data/cache/tmp) and the
+ * planning cwd. This is the ONE Home subtree the Task runtime isolation
+ * boundary permits its roots to overlap; every other part of Home (the
+ * database, `workspaces/`, `projects/`) stays protected.
+ */
+export function managedRuntimeRoot(home) {
+    return join(homeRoot(home), "runtime", "task-runtimes");
+}
+/**
+ * Dedicated Home partition for the integration check runtime's provider
+ * data/cache/tmp. Distinct from `managedRuntimeRoot` so an integration attempt's
+ * disposable roots never collide with a Task runtime's, yet still sit inside the
+ * one managed runtime subtree the isolation boundary permits to overlap Home.
+ * The integration tmux socket endpoint is NOT here — it stays a short `/tmp`
+ * path for the `sockaddr_un` budget (see `gitIntegrationService`).
+ */
+export function managedIntegrationRuntimeRoot(home) {
+    return join(homeRoot(home), "runtime", "integration-runtimes");
+}
+/**
+ * Disposable staging prefix for `yui update`'s side-by-side package install
+ * (an upgrade artifact): `<home>/runtime/update-staging`. Kept under Home so a
+ * staged upgrade never lands in a shared system temp root.
+ */
+export function updateStagingRoot(home) {
+    return join(homeRoot(home), "runtime", "update-staging");
+}
+/**
+ * Disposable scratch parent for the release workflow's Yui-authored artifacts —
+ * the fresh-install smoke directory and the verified publish-snapshot tarball
+ * (release artifacts): `<home>/runtime/release-workflow`. Kept under Home so a
+ * release artifact never lands in a shared system temp root.
+ */
+export function releaseWorkflowScratchRoot(home) {
+    return join(homeRoot(home), "runtime", "release-workflow");
+}
+/** Disposable planning cwd parent: `<home>/runtime/task-runtimes/planning`. */
+export function planningRuntimeRoot(home) {
+    return join(managedRuntimeRoot(home), "planning");
+}
+/** Planning cwd for a single Task, materialized on demand at launch. */
+export function planningRuntimeCwd(home, taskId) {
+    return join(planningRuntimeRoot(home), taskId);
+}
+/** Storage-upgrade database backups: `<home>/backups` (was a Home sibling). */
+export function storageBackupRoot(home) {
+    return join(homeRoot(home), "backups");
+}
+/**
+ * Default working directory for Yui-owned Roles that carry no user-chosen,
+ * external cwd: the built-in Global Operator/Leader created by `yui setup` and
+ * ad-hoc Global Roles added without an explicit `--workspace`. Historically
+ * these fell back to a Home-sibling `workspace/` directory (or `process.cwd()`),
+ * which leaked Yui-managed scratch outside the canonical Home. A user who names
+ * an external directory keeps external-resource semantics; only the auto-created
+ * default lands here, under Home: `<home>/workspaces/global`.
+ *
+ * This is a plain cwd, NOT a managed Git workspace, so it is deliberately a
+ * sibling of `worktree/`+`tasks/` under `workspaces/`, never inside them.
+ */
+export function managedGlobalRoleWorkspace(home) {
+    return join(managedWorkspacesRoot(home), "global");
+}
+/** True when `child` is strictly inside `parent` (shared with isolation checks). */
+export function isWithinManagedRoot(parent, child) {
+    const nested = relative(resolve(parent), resolve(child));
+    return nested.length > 0 && !nested.startsWith("..") && !isAbsolute(nested);
+}