@zq-silk/yui 0.15.9 → 0.15.12

package/dist/setup/setupCommand.js

@@ -1,10 +1,11 @@
 import { existsSync, mkdirSync, realpathSync } from "node:fs";
-import { delimiter, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { delimiter, isAbsolute, join, relative, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { configuredAgentToDefinition, createConfiguredAgent } from "../agent/agent.js";
 import { assertRoleRuntimeMutationAllowed } from "../commands/roleRuntimeGuard.js";
 import { resolveTmuxBin } from "../config/yuiConfig.js";
 import { usageError } from "../errors/cliError.js";
+import { managedGlobalRoleWorkspace } from "../storage/homeLayout.js";
 import { createGlobalRole, createRoleAgentBinding, updateGlobalRole } from "../role/role.js";
 import { SYSTEM_LEADER_ROLE, SYSTEM_OPERATOR_ROLE } from "../role/systemRoles.js";
 import { initializeCurrentTaskStore } from "../storage/currentTaskStore.js";
@@ -48,14 +49,27 @@ export async function runSetupCommand(args, env, executor, io = {}) {
         const currentOperator = store.getGlobalRole(SYSTEM_OPERATOR_ROLE);
         const selected = await selectOperatorAgent(choices, currentOperator, store.getConfig().defaultAgent, question, io);
         const agent = selected.existing ?? createConfiguredAgent(selected.id, selected.adapterId, selected.command, [], [], new Date());
-        const workspace = resolveWorkspace(store.getConfig().defaultWorkspace ?? join(dirname(resolve(home)), "workspace"), home);
-        const roleStatus = saveMinimumConfiguration(store, agent, workspace, new Set(choices.map(({ id }) => id)));
+        // The built-in Global Operator/Leader run under a Home-internal working
+        // directory. Yui never auto-invents an external scratch root here: a user
+        // who wants an external project-input root configures `default-workspace`
+        // explicitly (kept outside Home by its own guard). An already-configured one
+        // is carried forward and normalized; none is fabricated.
+        const configuredWorkspace = store.getConfig().defaultWorkspace;
+        const externalWorkspace = configuredWorkspace === undefined
+            ? undefined
+            : resolveWorkspace(configuredWorkspace, home);
+        const roleWorkspace = managedGlobalRoleWorkspace(home);
+        mkdirSync(roleWorkspace, { recursive: true, mode: 0o700 });
+        const roleStatus = saveMinimumConfiguration(store, agent, roleWorkspace, externalWorkspace, new Set(choices.map(({ id }) => id)));
         return `${[
             "Yui setup complete.",
             `Yui home: ${home}.`,
             `Operator: ${agent.id} (${roleStatus.operator}).`,
             `Leader: ${roleStatus.leaderAgentId} (${roleStatus.leader}).`,
-            `Default workspace: ${workspace}.`,
+            `Global Role workspace: ${roleWorkspace}.`,
+            ...(externalWorkspace === undefined
+                ? []
+                : [`Default workspace: ${externalWorkspace}.`]),
             "Run `yui config show` to inspect configuration, or `yui operator enter` to start an Operator session for configuration changes or development tasks."
         ].join("\n")}\n`;
     }
@@ -116,14 +130,18 @@ async function selectOperatorAgent(choices, currentOperator, defaultAgent, quest
     }
     return selected;
 }
-function saveMinimumConfiguration(store, agent, workspace, usableAgentIds) {
+function saveMinimumConfiguration(store, agent, roleWorkspace, externalWorkspace, usableAgentIds) {
     return store.transaction((tx) => {
         tx.saveConfiguredAgent(agent);
         const config = tx.getConfig();
         tx.saveConfig({
             ...config,
             defaultAgent: config.defaultAgent ?? agent.id,
-            defaultWorkspace: config.defaultWorkspace ?? workspace
+            // Only persist a default workspace the user actually configured; setup no
+            // longer fabricates an external Home-sibling root.
+            ...(externalWorkspace === undefined
+                ? {}
+                : { defaultWorkspace: config.defaultWorkspace ?? externalWorkspace })
         });
         const now = new Date();
         const leader = tx.getGlobalRole(SYSTEM_LEADER_ROLE);
@@ -135,7 +153,7 @@ function saveMinimumConfiguration(store, agent, workspace, usableAgentIds) {
                 roleName: SYSTEM_LEADER_ROLE
             }, "creation");
             const definition = configuredAgentToDefinition(agent);
-            tx.saveGlobalRole(createGlobalRole(SYSTEM_LEADER_ROLE, [createRoleAgentBinding(definition)], agent.id, workspace, now));
+            tx.saveGlobalRole(createGlobalRole(SYSTEM_LEADER_ROLE, [createRoleAgentBinding(definition)], agent.id, roleWorkspace, now));
             leaderStatus = "created";
             leaderAgentId = agent.id;
         }
@@ -161,7 +179,7 @@ function saveMinimumConfiguration(store, agent, workspace, usableAgentIds) {
                 scope: "global",
                 roleName: SYSTEM_OPERATOR_ROLE
             }, "creation");
-            tx.saveGlobalRole(createGlobalRole(SYSTEM_OPERATOR_ROLE, [binding], agent.id, workspace, now));
+            tx.saveGlobalRole(createGlobalRole(SYSTEM_OPERATOR_ROLE, [binding], agent.id, roleWorkspace, now));
             return {
                 operator: "created",
                 leader: leaderStatus,

package/dist/storage/homeLayout.js

@@ -0,0 +1,130 @@
+import { isAbsolute, join, relative, resolve } from "node:path";
+/**
+ * The single authority for every Yui self-managed path derived from a Home.
+ *
+ * Historically the managed Git worktrees and provider runtimes escaped Home
+ * through two different mechanisms: worktree/task roots were derived from the
+ * user-facing `defaultWorkspace` (an out-of-Home directory), and provider
+ * runtimes/backups were written to string-built siblings of Home
+ * (`${home}.task-runtimes`, `${home}-backups`). Both are unified here so that a
+ * single canonical YUI_HOME contains all self-managed data, with only the
+ * approved short-path IPC sockets (Controller, tmux, Agent Host, integration
+ * runtime) remaining outside it for the `sockaddr_un` length budget. Within the
+ * managed workspace root, storage v20 further collapses the former
+ * physical-worktree/symlink-view split into a single layer of real worktrees
+ * under `tasks/` (see {@link managedTaskRoot}).
+ *
+ * `defaultWorkspace` is intentionally NOT an input to this module: it remains a
+ * user-facing cwd for ad-hoc/global Roles and the origin for external Project
+ * input, never a second authority for internal managed layout.
+ */
+/** Canonicalize a Home string the same way callers already resolve it. */
+function homeRoot(home) {
+    const resolved = resolve(home);
+    if (!isAbsolute(resolved)) {
+        throw new Error("YUI_HOME must be an absolute path.");
+    }
+    return resolved;
+}
+/**
+ * Root that contains every managed Git workspace. Since storage v20 this holds a
+ * single layer of real worktrees under `tasks/` (plus the legacy `worktree/`
+ * root, preserved by the 19->20 migration as its rollback anchor). A single
+ * parent keeps the managed families adjacent and lets the storage migrations
+ * relocate them as one subtree.
+ */
+export function managedWorkspacesRoot(home) {
+    return join(homeRoot(home), "workspaces");
+}
+/**
+ * LEGACY physical worktree root: `<home>/workspaces/worktree`. Before storage
+ * v20 every managed clone/linked worktree lived here under a per-Project subtree,
+ * surfaced to each Task through a symlink view under `tasks/`. The 19->20
+ * migration collapses those into real worktrees under `tasks/` and PRESERVES this
+ * tree as the rollback anchor, so this path survives only for that migration's
+ * inline layout and for post-upgrade cleanup — no current runtime code derives a
+ * live worktree path from it.
+ */
+export function managedWorktreeRoot(home) {
+    return join(managedWorkspacesRoot(home), "worktree");
+}
+/**
+ * Managed Git worktrees, one real worktree per Task owner and Project at
+ * `<home>/workspaces/tasks/<taskId>/<owner>/<projectDirectory>` (owner being
+ * `main`, `work-items/<id>`, `reviews/<name>`, `integrations/<id>`, or
+ * `execution-lanes/<g>/<l>`). Before storage v20 these were symlink views over
+ * the physical `worktree/` root; the 19->20 migration makes them the worktrees
+ * themselves, so the logical entry path and the physical Git worktree coincide.
+ */
+export function managedTaskRoot(home) {
+    return join(managedWorkspacesRoot(home), "tasks");
+}
+/**
+ * Dedicated partition for provider runtime roots (data/cache/tmp) and the
+ * planning cwd. This is the ONE Home subtree the Task runtime isolation
+ * boundary permits its roots to overlap; every other part of Home (the
+ * database, `workspaces/`, `projects/`) stays protected.
+ */
+export function managedRuntimeRoot(home) {
+    return join(homeRoot(home), "runtime", "task-runtimes");
+}
+/**
+ * Dedicated Home partition for the integration check runtime's provider
+ * data/cache/tmp. Distinct from `managedRuntimeRoot` so an integration attempt's
+ * disposable roots never collide with a Task runtime's, yet still sit inside the
+ * one managed runtime subtree the isolation boundary permits to overlap Home.
+ * The integration tmux socket endpoint is NOT here — it stays a short `/tmp`
+ * path for the `sockaddr_un` budget (see `gitIntegrationService`).
+ */
+export function managedIntegrationRuntimeRoot(home) {
+    return join(homeRoot(home), "runtime", "integration-runtimes");
+}
+/**
+ * Disposable staging prefix for `yui update`'s side-by-side package install
+ * (an upgrade artifact): `<home>/runtime/update-staging`. Kept under Home so a
+ * staged upgrade never lands in a shared system temp root.
+ */
+export function updateStagingRoot(home) {
+    return join(homeRoot(home), "runtime", "update-staging");
+}
+/**
+ * Disposable scratch parent for the release workflow's Yui-authored artifacts —
+ * the fresh-install smoke directory and the verified publish-snapshot tarball
+ * (release artifacts): `<home>/runtime/release-workflow`. Kept under Home so a
+ * release artifact never lands in a shared system temp root.
+ */
+export function releaseWorkflowScratchRoot(home) {
+    return join(homeRoot(home), "runtime", "release-workflow");
+}
+/** Disposable planning cwd parent: `<home>/runtime/task-runtimes/planning`. */
+export function planningRuntimeRoot(home) {
+    return join(managedRuntimeRoot(home), "planning");
+}
+/** Planning cwd for a single Task, materialized on demand at launch. */
+export function planningRuntimeCwd(home, taskId) {
+    return join(planningRuntimeRoot(home), taskId);
+}
+/** Storage-upgrade database backups: `<home>/backups` (was a Home sibling). */
+export function storageBackupRoot(home) {
+    return join(homeRoot(home), "backups");
+}
+/**
+ * Default working directory for Yui-owned Roles that carry no user-chosen,
+ * external cwd: the built-in Global Operator/Leader created by `yui setup` and
+ * ad-hoc Global Roles added without an explicit `--workspace`. Historically
+ * these fell back to a Home-sibling `workspace/` directory (or `process.cwd()`),
+ * which leaked Yui-managed scratch outside the canonical Home. A user who names
+ * an external directory keeps external-resource semantics; only the auto-created
+ * default lands here, under Home: `<home>/workspaces/global`.
+ *
+ * This is a plain cwd, NOT a managed Git workspace, so it is deliberately a
+ * sibling of `worktree/`+`tasks/` under `workspaces/`, never inside them.
+ */
+export function managedGlobalRoleWorkspace(home) {
+    return join(managedWorkspacesRoot(home), "global");
+}
+/** True when `child` is strictly inside `parent` (shared with isolation checks). */
+export function isWithinManagedRoot(parent, child) {
+    const nested = relative(resolve(parent), resolve(child));
+    return nested.length > 0 && !nested.startsWith("..") && !isAbsolute(nested);
+}