@zq-silk/yui 0.15.9 → 0.15.11

package/dist/executor/agentExecutor.js

@@ -342,6 +342,42 @@ export function updateTaskRoleProviderRuntime(set, binding, updatedAt) {
         updatedAt: requireDate(updatedAt, "Provider Runtime Binding timestamp")
     });
 }
+/**
+ * Bind a Global Role's Provider Runtime evidence, mirroring the Task Role
+ * writer (decision-3 §6/§9). Create-only: an existing distinct binding is a
+ * conflict, an identical one is idempotent. The Global set stays schemaVersion
+ * 5; only the optional providerBinding is added.
+ */
+export function bindGlobalRoleProviderRuntime(set, binding, updatedAt) {
+    validateRoleSessionSet(set);
+    const normalized = validateProviderRuntimeBinding(binding);
+    if (set.providerBinding != null) {
+        if (JSON.stringify(set.providerBinding) === JSON.stringify(normalized))
+            return set;
+        throw new Error("Global Role already has a Provider Runtime Binding.");
+    }
+    return validateRoleSessionSet({
+        ...set,
+        providerBinding: normalized,
+        updatedAt: requireDate(updatedAt, "Provider Runtime Binding timestamp")
+    });
+}
+/** In-place update of a Global Role's Provider Runtime binding; namespace and
+ * account scope are immutable, exactly as for a Task Role. */
+export function updateGlobalRoleProviderRuntime(set, binding, updatedAt) {
+    validateRoleSessionSet(set);
+    const normalized = validateProviderRuntimeBinding(binding);
+    if (set.providerBinding == null
+        || normalized.providerNamespace !== set.providerBinding.providerNamespace
+        || normalized.accountScope !== set.providerBinding.accountScope) {
+        throw new Error("Provider Runtime Binding identity cannot change in place.");
+    }
+    return validateRoleSessionSet({
+        ...set,
+        providerBinding: normalized,
+        updatedAt: requireDate(updatedAt, "Provider Runtime Binding timestamp")
+    });
+}
 /**
  * Detaches a confirmed-dead local Host without ending its resumable native
  * Session. Host connections are disposable execution
@@ -409,7 +445,7 @@ export function recordTaskRoleNativeTurnBoundary(set, input, completedAt) {
 export function validateRoleSessionSet(set) {
     const ownerScope = set.owner?.scope;
     rejectUnknownFields(set, ownerScope === "global"
-        ? ["schemaVersion", "owner", "activeAgentId", "sessions", "updatedAt", "history"]
+        ? ["schemaVersion", "owner", "activeAgentId", "sessions", "updatedAt", "history", "providerBinding", "interrupts"]
         : [
             "schemaVersion",
             "owner",
@@ -428,10 +464,19 @@ export function validateRoleSessionSet(set) {
         if (set.schemaVersion !== 5) {
             throw new Error("Global Role session set schema version is invalid.");
         }
-        if (Object.hasOwn(set, "providerBinding")) {
-            throw new Error("Global Role session set must not contain Task Role lifecycle fields.");
+        const globalSet = set;
+        for (const [requestId, control] of Object.entries(globalSet.interrupts ?? {})) {
+            requireSafeIdentity(requestId, "Global interrupt request");
+            requireText(control.fingerprint, "Global interrupt fingerprint");
+            requireText(control.attemptId, "Global interrupt attempt");
+            requireText(control.nativeSessionId, "Global interrupt Session");
+            requireText(control.receiptId, "Global interrupt receipt");
+            if (control.receipt !== undefined
+                && !["interrupt-requested", "interrupt-not-active", "interrupt-unknown", "interrupt-unavailable"]
+                    .includes(control.receipt.state))
+                throw new Error("Global interrupt receipt is invalid.");
         }
-        const history = set.history;
+        const history = globalSet.history;
         if (history !== undefined) {
             for (const [ref, session] of Object.entries(history)) {
                 requireSafeIdentity(ref, "Operator session ref");
@@ -441,6 +486,21 @@ export function validateRoleSessionSet(set) {
                 }
             }
         }
+        // A Global Role now carries the same optional Provider Runtime Binding shape
+        // as a Task Role (decision-3 §6/§9). It stays absent on every legacy set;
+        // when present, it is the exact native control evidence a Global steer or
+        // interrupt targets, validated identically to the Task branch. A fabricated
+        // Task binding is never accepted here, and its presence never upgrades the
+        // schemaVersion these raw-JSON sets are read at.
+        if (Object.hasOwn(globalSet, "providerBinding") && globalSet.providerBinding != null) {
+            const providerBinding = validateProviderRuntimeBinding(globalSet.providerBinding);
+            const conversationId = currentProviderConversation(providerBinding).conversationId;
+            const session = [...Object.values(globalSet.sessions), ...Object.values(globalSet.history ?? {})]
+                .find(entry => entry.agentId === providerBinding.accountScope && entry.nativeSessionId === conversationId);
+            if (session !== undefined && providerBinding.providerNamespace !== builtinDriverIdForAdapter(session.adapterId)) {
+                throw new Error("Provider Runtime Binding namespace does not match the Agent adapter.");
+            }
+        }
     }
     else {
         if (set.schemaVersion !== 12) {

package/dist/executor/executorRegistry.js

@@ -177,6 +177,9 @@ export class ExecutorRegistry {
         return deliveryReport(outcome);
     }
     async notifyOperatorInputOnce(input) {
+        if (this.runtimePorts?.notifyOperatorInputOnce !== undefined) {
+            return this.runtimePorts.notifyOperatorInputOnce(input);
+        }
         const probe = this.readiness(input.adapterId, "operator");
         return this.tmux.sendRoleInputOnceIfReadyAsync === undefined
             ? this.tmux.sendRoleInputOnceIfReady("operator", input.roleName, input.receiptId, input.text, probe)

package/dist/executor/fileRoleLaunchPlanner.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { mkdirSync, realpathSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 import { assertExecutionEnvironmentCurrent } from "../runtime/executionEnvironment.js";
@@ -10,7 +10,7 @@ import { taskOwnsManagedWorkspace } from "../task/task.js";
 import { configuredAgentToDefinition, resolveAgentEnvironment } from "../agent/agent.js";
 import { NATIVE_AGENT_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, operationalAgentEnvironment, selectEnvironment } from "../agent/launchEnvironment.js";
 import { activeRoleAgentBinding } from "../role/role.js";
-import { writeTextFileAtomically } from "../storage/durableFile.js";
+import { planningRuntimeCwd } from "../storage/homeLayout.js";
 import { compileRoleSessionContext, roleSessionKind } from "../context/roleSessionContext.js";
 import { materializeSessionBootstrap } from "../context/sessionBootstrapManifest.js";
 import { resolveAgentAdapter } from "./agentAdapter.js";
@@ -117,7 +117,7 @@ export class FileRoleLaunchPlanner {
         const planningDraft = purpose === "planning" && task.status === "draft";
         // A planning cwd is a disposable per-Task runtime resource, not a delivery
         // workspace. Materialize only the exact directory selected at creation.
-        if (planningDraft && resolve(role.workspace) === resolve(`${this.home}.task-runtimes`, "planning", task.id)) {
+        if (planningDraft && resolve(role.workspace) === resolve(planningRuntimeCwd(this.home, task.id))) {
             mkdirSync(role.workspace, { recursive: true, mode: 0o700 });
         }
         const workspaceFree = planningDraft || !taskOwnsManagedWorkspace(task);
@@ -236,6 +236,9 @@ export class FileRoleLaunchPlanner {
         if (role === null)
             throw new Error(`Global Role not found: ${input.roleName}.`);
         const sessionSet = this.store.getGlobalRoleSessionSet(role.name);
+        if (activeLiveRoleAgentSession(sessionSet) !== null && sessionSet?.providerBinding == null) {
+            throw new Error("Global Role has an unmanaged live Session. Stop that exact Session before opening controlled input; it will not be silently replaced.");
+        }
         const resolvedEffective = activeLiveRoleAgentSession(sessionSet)?.effective
             ?? resolveEffectiveLaunch({ role, purpose: "execution" });
         if (input.effective !== undefined
@@ -249,6 +252,9 @@ export class FileRoleLaunchPlanner {
         if (input.mode === "resume" && !compatibleExisting) {
             throw new Error(`Global Role resume effective snapshot drifted: ${role.name}.`);
         }
+        if (input.mode === "new" && sessionSet?.providerBinding != null) {
+            assertProviderConversationReplaceable(sessionSet.providerBinding);
+        }
         return this.#compile(role, input, { scope: "global" }, undefined, input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, undefined, effective, { purpose: "execution" });
     }
     #compile(role, input, owner, sessionTitle, knownNativeSessionId, workspaceOverride, effective, sessionPolicy) {
@@ -400,7 +406,6 @@ export class FileRoleLaunchPlanner {
         const launchMode = resumeNativeSessionId === undefined
             ? "new"
             : "resume";
-        const managedControl = owner.scope === "task";
         // Only an Agent that accepts a caller-chosen Session id can have one
         // preallocated. Keying this on the adapter name instead of the declared
         // capability meant every non-Claude adapter was assumed to accept one.
@@ -408,17 +413,8 @@ export class FileRoleLaunchPlanner {
             && resumeNativeSessionId === undefined
             ? requireText(this.#createNativeSessionId(), "Native session id")
             : resumeNativeSessionId;
-        const managedCompiled = managedControl
-            ? adapter.compileManagedControl(compileInput, launchMode, preallocatedNativeSessionId)
-            : undefined;
-        const compiled = managedCompiled !== undefined
-            ? managedCompiled
-            : launchMode === "resume"
-                ? adapter.compileResume({
-                    ...compileInput,
-                    nativeSessionId: resumeNativeSessionId
-                })
-                : adapter.compileNew(compileInput);
+        const managedCompiled = adapter.compileManagedControl(compileInput, launchMode, preallocatedNativeSessionId);
+        const compiled = managedCompiled;
         for (const path of [
             bootstrap.manifestPath,
             bootstrap.sessionCliPath,
@@ -437,9 +433,6 @@ export class FileRoleLaunchPlanner {
         // Its native Hooks carry no such request fence and must not compete with
         // the Host for acceptance, completion, or attachment lifecycle facts.
         // Provider tool permissions remain in compiled config, not this observer.
-        if (binding.adapterId === "claude" && owner.scope === "global") {
-            args.push("--plugin-dir", ensureClaudeLifecyclePlugin(this.home, this.#cliPath));
-        }
         if (binding.adapterId === "codex") {
             // Interactive Task sessions may use notify for presentation.
             // Managed AgentRuns receive lifecycle facts through their ordinary App Server
@@ -459,9 +452,7 @@ export class FileRoleLaunchPlanner {
         else if (launchMode === "new") {
             if (adapter.capabilities.nativeSessionDiscovery === "preallocated") {
                 const nativeSessionId = requireText(preallocatedNativeSessionId, "Native session id");
-                if (!managedControl)
-                    args.push("--session-id", nativeSessionId);
-                else if (!args.includes("--session-id"))
+                if (!args.includes("--session-id"))
                     args.push("--session-id", nativeSessionId);
                 session = readySession(input.agentId, binding.adapterId, nativeSessionId, effective);
             }
@@ -484,76 +475,81 @@ export class FileRoleLaunchPlanner {
         // Session lifecycle and AgentRun submission are separate atomic operations.
         // Planning only starts or restores the exact native Session; delivery
         // submits the AgentRun input after that Session fact is durable.
-        if (managedControl && input.runId !== undefined && (managedRun === null || managedRun.status !== "active")) {
+        if (owner.scope === "task" && input.runId !== undefined && (managedRun === null || managedRun.status !== "active")) {
             throw new Error(`Managed AgentRun is no longer active: ${input.runId}.`);
         }
-        const providerAuthority = managedControl
-            ? this.#providerAuthorityForLaunch(owner.taskId, role.name, input.mode)
-            : undefined;
-        const providerOwnedRun = managedControl && input.mode === "resume" && input.runId !== undefined
+        const providerAuthority = this.#providerAuthorityForLaunch(owner.scope === "task" ? owner.taskId : undefined, role.name, input.mode);
+        let providerOwnedRun = owner.scope === "task" && input.mode === "resume" && input.runId !== undefined
             ? this.#providerOwnedRunForLaunch(owner.taskId, role.name, input.runId)
             : undefined;
+        if (owner.scope === "global" && input.mode === "resume") {
+            const turn = this.store.getGlobalRoleSessionSet(role.name)?.providerBinding?.run;
+            if (turn?.status === "accepted") {
+                if (binding.adapterId !== "codex" || turn.nativeTurnId === undefined) {
+                    throw new Error("This Global active Turn cannot be restored with exact native identity.");
+                }
+                providerOwnedRun = { attemptId: turn.attemptId, turnId: turn.nativeTurnId };
+            }
+            else if (turn != null && ["submitting", "delivery-unknown"].includes(turn.status)) {
+                throw new Error("Global input delivery is unconfirmed; resolve its exact current attempt before restoring.");
+            }
+        }
         const providerNativeSessionId = binding.adapterId === "claude"
             ? preallocatedNativeSessionId
             : resumeNativeSessionId;
-        const providerControl = !managedControl
-            ? undefined
-            : input.mode === "resume"
-                ? {
-                    schemaVersion: 1,
-                    adapterId: binding.adapterId,
-                    // The product identity is pinned by the snapshot this launch was
-                    // resolved from, and the check above proves the Agent record still
-                    // names it. Carrying only the adapter would leave the runtime with
-                    // two products sharing one plan and no way to tell them apart.
-                    component: binding.component,
-                    transport: managedCompiled.transport,
-                    endpointImplementation,
-                    kind: "restore",
-                    sessionOnly: input.runId === undefined,
-                    mode: "resume",
-                    nativeSessionId: requireText(providerNativeSessionId, "Managed Provider restore native session id"),
-                    ...(sessionTitle === undefined ? {} : { sessionTitle }),
-                    ...(managedCompiled.codexThread === undefined
-                        ? {}
-                        : { codexThread: managedCompiled.codexThread }),
-                    ...(providerOwnedRun === undefined ? {} : { ownedTurn: providerOwnedRun }),
-                    ...(managedCompiled.acpSession === undefined
-                        ? {}
-                        : { acpSession: managedCompiled.acpSession }),
-                    authority: providerAuthority
-                }
-                : {
-                    schemaVersion: 1,
-                    adapterId: binding.adapterId,
-                    component: binding.component,
-                    transport: managedCompiled.transport,
-                    endpointImplementation,
-                    kind: "start",
-                    sessionOnly: input.runId === undefined,
-                    mode: "new",
-                    ...(providerNativeSessionId === undefined
-                        ? {}
-                        : { nativeSessionId: providerNativeSessionId }),
-                    ...(sessionTitle === undefined ? {} : { sessionTitle }),
-                    ...(managedCompiled.codexThread === undefined
-                        ? {}
-                        : { codexThread: managedCompiled.codexThread }),
-                    ...(managedCompiled.acpSession === undefined
-                        ? {}
-                        : { acpSession: managedCompiled.acpSession }),
-                    authority: providerAuthority
-                };
+        const providerControl = input.mode === "resume"
+            ? {
+                schemaVersion: 1,
+                adapterId: binding.adapterId,
+                // The product identity is pinned by the snapshot this launch was
+                // resolved from, and the check above proves the Agent record still
+                // names it. Carrying only the adapter would leave the runtime with
+                // two products sharing one plan and no way to tell them apart.
+                component: binding.component,
+                transport: managedCompiled.transport,
+                endpointImplementation,
+                kind: "restore",
+                sessionOnly: input.runId === undefined,
+                mode: "resume",
+                nativeSessionId: requireText(providerNativeSessionId, "Managed Provider restore native session id"),
+                ...(sessionTitle === undefined ? {} : { sessionTitle }),
+                ...(managedCompiled.codexThread === undefined
+                    ? {}
+                    : { codexThread: managedCompiled.codexThread }),
+                ...(providerOwnedRun === undefined ? {} : { ownedTurn: providerOwnedRun }),
+                ...(managedCompiled.acpSession === undefined
+                    ? {}
+                    : { acpSession: managedCompiled.acpSession }),
+                authority: providerAuthority
+            }
+            : {
+                schemaVersion: 1,
+                adapterId: binding.adapterId,
+                component: binding.component,
+                transport: managedCompiled.transport,
+                endpointImplementation,
+                kind: "start",
+                sessionOnly: input.runId === undefined,
+                mode: "new",
+                ...(providerNativeSessionId === undefined
+                    ? {}
+                    : { nativeSessionId: providerNativeSessionId }),
+                ...(sessionTitle === undefined ? {} : { sessionTitle }),
+                ...(managedCompiled.codexThread === undefined
+                    ? {}
+                    : { codexThread: managedCompiled.codexThread }),
+                ...(managedCompiled.acpSession === undefined
+                    ? {}
+                    : { acpSession: managedCompiled.acpSession }),
+                authority: providerAuthority
+            };
         const launch = {
             command,
             args,
             ...(effective.executionEnvironment === undefined ? {} : {
                 executionEnvironment: structuredClone(effective.executionEnvironment)
             }),
-            ...(providerControl === undefined ? {} : { providerControl }),
-            ...(owner.scope === "global" && binding.adapterId === "codex"
-                ? { interactiveCodexThread: compiled.codexThread }
-                : {}),
+            providerControl,
             env: {
                 ...launchEnvironment,
                 YUI_HOME: resolve(this.home),
@@ -593,13 +589,7 @@ export class FileRoleLaunchPlanner {
         const scopedLaunch = owner.scope === "task"
             ? this.#applyWorkspaceScope(owner.taskId, role, launch, workspaceOverride)
             : launch;
-        const sharedDaemonLaunch = owner.scope === "global" && configured.adapterId === "codex"
-            ? {
-                ...scopedLaunch,
-                args: addCodexSharedDaemonRemote(scopedLaunch.args, launchMode, scopedLaunch.env)
-            }
-            : scopedLaunch;
-        const ordinaryConversationLaunch = withCodexThreadEnvironment(sharedDaemonLaunch);
+        const ordinaryConversationLaunch = withCodexThreadEnvironment(scopedLaunch);
         return {
             role: {
                 name: role.name,
@@ -612,7 +602,9 @@ export class FileRoleLaunchPlanner {
         };
     }
     #providerAuthorityForLaunch(taskId, roleName, mode) {
-        const binding = this.store.getTaskRoleSessionSet(taskId, roleName)?.providerBinding;
+        const binding = (taskId === undefined
+            ? this.store.getGlobalRoleSessionSet(roleName)
+            : this.store.getTaskRoleSessionSet(taskId, roleName))?.providerBinding;
         if (binding === null || binding === undefined) {
             return { epoch: 1, owner: "controller", holderId: "controller" };
         }
@@ -743,38 +735,6 @@ function workspaceScopeEnvironment(environment, workspace) {
         ])))
     };
 }
-function ensureClaudeLifecyclePlugin(home, cliPath) {
-    const root = join(resolve(home), "runtime", "claude-lifecycle-plugin");
-    writeTextFileAtomically(join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify({
-        name: "yui-runtime-lifecycle",
-        description: "Yui-owned native lifecycle transport",
-        version: "1.0.0"
-    }, null, 2)}\n`);
-    const command = {
-        type: "command",
-        command: canonicalPath(process.execPath),
-        args: [canonicalPath(cliPath), "internal", "runtime-hook"]
-    };
-    writeTextFileAtomically(join(root, "hooks", "hooks.json"), `${JSON.stringify({
-        hooks: {
-            // All native names terminate at the Driver edge; core sees only
-            // canonical RuntimeObservation values.
-            SessionStart: [{ hooks: [command] }],
-            UserPromptSubmit: [{ hooks: [command] }],
-            PreToolUse: [{ hooks: [command] }],
-            PermissionRequest: [{ hooks: [command] }],
-            MessageDisplay: [{ hooks: [command] }],
-            PostToolUse: [{ hooks: [command] }],
-            PostToolUseFailure: [{ hooks: [command] }],
-            SubagentStart: [{ hooks: [command] }],
-            SubagentStop: [{ hooks: [command] }],
-            Stop: [{ hooks: [command] }],
-            StopFailure: [{ hooks: [command] }],
-            SessionEnd: [{ hooks: [command] }]
-        }
-    }, null, 2)}\n`);
-    return root;
-}
 function managedClaudeControlPlaneConfig(config, taskId, workItemId, runId) {
     if (config.permission.strategy !== "configured")
         return config;

package/dist/integration/deliveryObligation.js

@@ -93,7 +93,8 @@ export function latestGoverningQueueEntries(changeSets, queueEntries) {
 export function integrationAttemptRequiresSettlement(attempt) {
     return attempt.status === "running"
         || attempt.status === "validating"
-        || attempt.status === "blocked";
+        || attempt.status === "blocked"
+        || attempt.status === "conflicted";
 }
 function candidateProjectHead(candidate, projectId) {
     return candidate.gitSnapshot?.projects.find((project) => project.projectId === projectId)?.commit