@zq-silk/yui 0.2.0 → 0.4.2

package/dist/lifecycle/providerLifecycleMapping.js

@@ -0,0 +1,190 @@
+import { createCanonicalLifecycleEvent, CanonicalLifecycleError } from "./canonicalLifecycleEvent.js";
+/**
+ * Claude, mapped from its observed SessionStart / UserPromptSubmit / StopFailure
+ * contract (claude 2.1.x). SessionStart with source=startup fires at process
+ * startup, *before* the first prompt, so only that exact variant proves pre-input
+ * readiness. A resume/clear/compact SessionStart occurs within an existing
+ * session and is downgraded to provider-session-started (never pre-input-ready).
+ * A single prompt push precedes the only acceptance fence, an identity-matched
+ * UserPromptSubmit.
+ */
+const CLAUDE_PRE_INPUT_SESSION_SOURCE = "startup";
+const CLAUDE_LIFECYCLE_MAPPING = {
+    adapterId: "claude",
+    preInputReadiness: {
+        status: "supported",
+        nativeEvent: "SessionStart(source=startup)",
+        note: "Claude fires SessionStart at process startup before the first prompt, so "
+            + "readiness is proven pre-input by a native durable event. Only the "
+            + "startup variant qualifies; resume/clear/compact are session-started only."
+    },
+    supportedSignals: [
+        "native-session-start",
+        "native-prompt-submit",
+        "native-turn-progress",
+        "native-turn-complete",
+        "native-stop-failure"
+    ],
+    map(signal) {
+        switch (signal.kind) {
+            case "native-session-start": {
+                // The SessionStart source discriminator is required for Claude: readiness
+                // safety depends on distinguishing startup from later in-session variants.
+                if (signal.sessionSource === undefined) {
+                    throw new CanonicalLifecycleError("Claude native-session-start requires the SessionStart source variant.");
+                }
+                if (signal.sessionSource !== CLAUDE_PRE_INPUT_SESSION_SOURCE) {
+                    // A non-startup SessionStart (resume/clear/compact) fires inside an
+                    // existing session and cannot prove pre-input readiness; downgrade it.
+                    return createCanonicalLifecycleEvent({
+                        phase: "provider-session-started",
+                        source: "provider-native",
+                        evidence: "provider-native-durable",
+                        fence: signal.fence
+                    });
+                }
+                // SessionStart(startup) proves readiness before any input for Claude.
+                return createCanonicalLifecycleEvent({
+                    phase: "provider-ready",
+                    source: "provider-native",
+                    evidence: "provider-native-durable",
+                    preInputReady: true,
+                    readinessVariant: `SessionStart(source=${signal.sessionSource})`,
+                    fence: signal.fence
+                });
+            }
+            case "native-prompt-submit":
+                return createCanonicalLifecycleEvent({
+                    phase: "provider-accepted",
+                    source: "provider-native",
+                    evidence: "provider-native-durable",
+                    fence: signal.fence
+                });
+            case "native-turn-progress":
+                return createCanonicalLifecycleEvent({
+                    phase: "turn-progress",
+                    source: "provider-native",
+                    evidence: "provider-native-durable",
+                    ...(signal.sequence === undefined ? {} : { sequence: signal.sequence }),
+                    fence: signal.fence
+                });
+            case "native-turn-complete":
+                return createCanonicalLifecycleEvent({
+                    phase: "turn-terminal",
+                    source: "provider-native",
+                    evidence: "provider-native-durable",
+                    summary: signal.summary,
+                    fence: signal.fence
+                });
+            case "native-stop-failure":
+                return createCanonicalLifecycleEvent({
+                    phase: "turn-terminal",
+                    source: "provider-native",
+                    evidence: "provider-native-durable",
+                    summary: signal.summary,
+                    fence: signal.fence
+                });
+            default:
+                throw unsupportedSignal("claude", signal);
+        }
+    }
+};
+/**
+ * Codex 0.145, mapped from its observed run_turn(input) -> SessionStart ->
+ * UserPromptSubmit ordering. SessionStart fires *inside* run_turn — after the
+ * first input — so it can only prove that the session/thread now exists, never
+ * pre-input readiness. UserPromptSubmit is the acceptance fence; the notify
+ * agent-turn-complete is the terminal fact. Codex emits no StopFailure hook.
+ */
+const CODEX_LIFECYCLE_MAPPING = {
+    adapterId: "codex",
+    preInputReadiness: {
+        status: "unsupported",
+        reason: "not-available",
+        note: "Codex 0.145 SessionStart fires within run_turn(input), i.e. after the "
+            + "first input; no native event precedes the first prompt, so pre-input "
+            + "readiness is not available and fails closed."
+    },
+    supportedSignals: [
+        "native-session-start",
+        "native-prompt-submit",
+        "native-turn-progress",
+        "native-turn-complete"
+    ],
+    map(signal) {
+        switch (signal.kind) {
+            case "native-session-start":
+                // SessionStart proves the thread exists but arrives after the first
+                // input, so it maps to session-started only — never ready, never pre-input.
+                return createCanonicalLifecycleEvent({
+                    phase: "provider-session-started",
+                    source: "provider-native",
+                    evidence: "provider-native-durable",
+                    fence: signal.fence
+                });
+            case "native-prompt-submit":
+                return createCanonicalLifecycleEvent({
+                    phase: "provider-accepted",
+                    source: "provider-native",
+                    evidence: "provider-native-durable",
+                    fence: signal.fence
+                });
+            case "native-turn-progress":
+                return createCanonicalLifecycleEvent({
+                    phase: "turn-progress",
+                    source: "provider-native",
+                    evidence: "provider-native-durable",
+                    ...(signal.sequence === undefined ? {} : { sequence: signal.sequence }),
+                    fence: signal.fence
+                });
+            case "native-turn-complete":
+                return createCanonicalLifecycleEvent({
+                    phase: "turn-terminal",
+                    source: "provider-native",
+                    evidence: "provider-native-durable",
+                    summary: signal.summary,
+                    fence: signal.fence
+                });
+            case "native-stop-failure":
+                // Codex 0.145 has no StopFailure hook; refuse rather than invent one.
+                throw unsupportedSignal("codex", signal);
+            default:
+                throw unsupportedSignal("codex", signal);
+        }
+    }
+};
+const PROVIDER_LIFECYCLE_MAPPINGS = Object.freeze({
+    claude: CLAUDE_LIFECYCLE_MAPPING,
+    codex: CODEX_LIFECYCLE_MAPPING
+});
+/**
+ * Registry lookup: returns the mapping for an adapter without the caller
+ * branching on the provider name. Unknown adapters fail closed.
+ */
+export function providerLifecycleMapping(adapterId) {
+    const mapping = findProviderLifecycleMapping(adapterId);
+    if (mapping === null) {
+        throw new CanonicalLifecycleError(`No lifecycle mapping for adapter: ${adapterId}.`);
+    }
+    return mapping;
+}
+export function findProviderLifecycleMapping(adapterId) {
+    return adapterId === "codex" || adapterId === "claude"
+        ? PROVIDER_LIFECYCLE_MAPPINGS[adapterId]
+        : null;
+}
+/** Neutral capability lookup for consumers that need only the readiness fact. */
+export function preInputReadinessCapability(adapterId) {
+    return providerLifecycleMapping(adapterId).preInputReadiness;
+}
+/**
+ * Maps a native signal through the adapter selected by its fence. The fence's
+ * adapterId chooses the mapping, so a Codex signal can never be mapped by
+ * Claude's rules or vice versa.
+ */
+export function mapNativeLifecycleSignal(signal) {
+    return providerLifecycleMapping(signal.fence.adapterId).map(signal);
+}
+function unsupportedSignal(adapterId, signal) {
+    return new CanonicalLifecycleError(`Adapter ${adapterId} does not emit native signal: ${signal.kind}.`);
+}

package/dist/lifecycle/taskRoleSessionReset.js

@@ -0,0 +1,124 @@
+import { enqueueWork } from "../coordination/workMailboxQueue.js";
+import { resetTaskRoleSession } from "../executor/agentExecutor.js";
+import { createTaskEvent } from "../event/taskEvent.js";
+import { createTaskMessage } from "../message/message.js";
+import { updateRoleStatus } from "../role/role.js";
+import { createLeaderRecoveryNotification } from "../scheduler/operatorNotification.js";
+import { recordLeaderFailure } from "../scheduler/leaderFailure.js";
+import { RUNTIME_CLEANUP_REQUIRED_REASON, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
+import { formatAgentRunReceiptId } from "../task/taskRecordReference.js";
+import { updateWorkItemStatus } from "../workItem/workItem.js";
+import { terminalizeExactTaskRun } from "./exactRunTerminalization.js";
+/**
+ * Resets the current native generation using Yui's own persisted identities.
+ * The caller supplies intent only; the Controller verifies process cleanup.
+ */
+export function resetTaskRoleSessionGeneration(store, taskId, roleName, reason, now) {
+    const task = store.getTask(requiredIdentity(taskId, "Task id"));
+    if (task === null)
+        throw new Error(`Task not found: ${taskId}.`);
+    if (task.status !== "active")
+        throw new Error(`Task is not active: ${task.id}/${task.status}.`);
+    const normalizedRole = requiredIdentity(roleName, "Role name");
+    const role = store.getRole(task.id, normalizedRole);
+    if (role === null)
+        throw new Error(`Role not found: ${task.id}/${normalizedRole}.`);
+    const summary = `Reset native Session: ${requiredText(reason, "Reset reason")}`;
+    let sessions = store.getTaskRoleSessionSet(task.id, role.name);
+    const current = sessions?.sessions[sessions.activeAgentId];
+    const activeRun = store.getActiveAgentRun(task.id, role.name);
+    if (activeRun !== null) {
+        const receiptId = sessions?.inFlight?.runId === activeRun.id
+            ? sessions.inFlight.receiptId
+            : formatAgentRunReceiptId(task.id, activeRun.id);
+        const terminal = terminalizeExactTaskRun(store, {
+            taskId: task.id,
+            roleName: role.name,
+            agentId: activeRun.effective.agentId,
+            runId: activeRun.id,
+            receiptId,
+            ...(current === undefined ? {} : {
+                nativeSessionId: current.nativeSessionId,
+                ...(current.launchId === undefined ? {} : { launchId: current.launchId })
+            }),
+            outcome: { status: "failed", summary }
+        }, now);
+        if (terminal.disposition !== "applied" || terminal.run === null) {
+            throw new Error(`Task Role reset lost its exact Run fence: ${terminal.reason ?? "obsolete"}.`);
+        }
+        if (activeRun.purpose === "execution" && activeRun.workItemId !== undefined) {
+            const item = store.getWorkItem(task.id, activeRun.workItemId);
+            if (item !== null && !["completed", "failed", "retired"].includes(item.status)) {
+                store.saveWorkItem(task.id, updateWorkItemStatus(item, "failed", now, summary));
+            }
+        }
+    }
+    enqueueWork(store, runtimeLifecycleTarget({
+        scope: "task",
+        taskId: task.id,
+        roleName: role.name
+    }), RUNTIME_CLEANUP_REQUIRED_REASON, now, [{ type: "task", id: task.id }]);
+    sessions = store.getTaskRoleSessionSet(task.id, role.name);
+    if (sessions !== null)
+        store.saveTaskRoleSessionSet(resetTaskRoleSession(sessions, now));
+    const updatedRole = store.getRole(task.id, role.name);
+    store.saveRole(task.id, updateRoleStatus(updatedRole, role.name === "leader" ? "failed" : "idle", now));
+    const message = createTaskMessage(store.nextMessageId(task.id), task.id, summary, "system", { type: "system" }, now, activeRun === null ? {} : {
+        runId: activeRun.id,
+        ...(activeRun.workItemId === undefined ? {} : { workItemId: activeRun.workItemId })
+    });
+    store.saveMessage(task.id, message);
+    store.saveEvent(task.id, createTaskEvent(store.nextEventId(task.id), task.id, "runtime.role-session-reset", {
+        roleName: role.name,
+        reason: summary,
+        ...(activeRun === null ? {} : { runId: activeRun.id }),
+        ...(current?.nativeSessionId === undefined
+            ? {}
+            : { nativeSessionId: current.nativeSessionId })
+    }, now));
+    if (role.name === "leader") {
+        const nativeSessionId = current?.nativeSessionId ?? `reset-${task.id}`;
+        store.saveLeaderFailure(recordLeaderFailure(task.id, nativeSessionId, summary, now, store.getLeaderFailure(task.id)));
+        store.saveOperatorNotification(createLeaderRecoveryNotification(task.id, summary, now, store.getOperatorNotification(task.id)));
+        enqueueWork(store, { kind: "operator" }, "leader-run-failed", now, [
+            { type: "task", id: task.id },
+            { type: "message", taskId: task.id, id: message.id },
+            ...(activeRun === null ? [] : [{
+                    type: "run",
+                    taskId: task.id,
+                    id: activeRun.id
+                }])
+        ]);
+    }
+    else {
+        enqueueWork(store, { kind: "role", taskId: task.id, roleName: "leader" }, "role-run-failed", now, [
+            { type: "message", taskId: task.id, id: message.id },
+            ...(activeRun === null ? [] : [{
+                    type: "run",
+                    taskId: task.id,
+                    id: activeRun.id
+                }])
+        ]);
+    }
+    return {
+        taskId: task.id,
+        roleName: role.name,
+        run: activeRun === null ? null : store.getAgentRun(task.id, activeRun.id),
+        ...(current === undefined ? {} : { nativeSessionId: current.nativeSessionId })
+    };
+}
+function requiredIdentity(value, label) {
+    const normalized = requiredText(value, label);
+    if (["__proto__", "prototype", "constructor", ".", ".."].includes(normalized)
+        || /[\/\\\0]/u.test(normalized))
+        throw new Error(`${label} is invalid.`);
+    return normalized;
+}
+function requiredText(value, label) {
+    if (typeof value !== "string" || value.includes("\0"))
+        throw new Error(`${label} is invalid.`);
+    const normalized = value.trim();
+    if (normalized.length === 0)
+        throw new Error(`${label} is required.`);
+    return normalized;
+}

package/dist/message/message.js

@@ -1,12 +1,14 @@
+import { validateTaskRecordReference } from "../task/taskRecordReference.js";
 export const TASK_MESSAGE_KINDS = ["user", "operator", "role-result", "system"];
-export function createTaskMessage(id, body, kind, author, now, context = {}) {
+export function createTaskMessage(id, taskId, body, kind, author, now, context = {}) {
     validateKindAndAuthor(kind, author);
     const message = {
-        schemaVersion: 1,
+        schemaVersion: 2,
         id: requireSafeIdentity(id, "Message id"),
+        taskId: requireSafeIdentity(taskId, "Message Task id"),
         kind,
         author: normalizeAuthor(author),
-        body: requireText(body, "Message body"),
+        body: requireBody(body),
         ...(context.runId === undefined
             ? {}
             : { runId: requireSafeIdentity(context.runId, "Message Run id") }),
@@ -22,16 +24,22 @@ export function taskMessageAuthorLabel(author) {
     return author.type === "role" ? author.roleName : author.type;
 }
 export function validateTaskMessage(message) {
-    if (message.schemaVersion !== 1)
-        throw new Error("Task Message must use schemaVersion 1.");
-    requireSafeIdentity(message.id, "Message id");
+    if (message.schemaVersion !== 2)
+        throw new Error("Task Message must use schemaVersion 2.");
+    validateTaskRecordReference({ taskId: message.taskId, localId: message.id }, "message");
     requireText(message.body, "Message body");
     validateKindAndAuthor(message.kind, message.author);
     normalizeAuthor(message.author);
     if (message.runId !== undefined)
         requireSafeIdentity(message.runId, "Message Run id");
     if (message.workItemId !== undefined) {
-        requireSafeIdentity(message.workItemId, "Message Work item id");
+        validateTaskRecordReference({
+            taskId: message.taskId,
+            localId: message.workItemId
+        }, "workItem");
+    }
+    if (message.runId !== undefined) {
+        validateTaskRecordReference({ taskId: message.taskId, localId: message.runId }, "agentRun");
     }
     if (typeof message.createdAt !== "string" || Number.isNaN(Date.parse(message.createdAt))) {
         throw new Error("Message createdAt is invalid.");
@@ -67,3 +75,11 @@ function requireText(value, label) {
         throw new Error(`${label} is required.`);
     return normalized;
 }
+function requireBody(value) {
+    if (typeof value !== "string" || value.includes("\0")) {
+        throw new Error("Message body is invalid.");
+    }
+    if (value.trim().length === 0)
+        throw new Error("Message body is required.");
+    return value;
+}

package/dist/milestone/milestone.js

@@ -1,7 +1,8 @@
+import { validateTaskRecordReference } from "../task/taskRecordReference.js";
 export function createMilestone(id, taskId, title, summary, now) {
     return {
         schemaVersion: 1,
-        id: requireSafeIdentity(id, "Milestone id"),
+        id: validateTaskRecordReference({ taskId, localId: id }, "milestone").localId,
         taskId: requireSafeIdentity(taskId, "Task id"),
         title: requireText(title, "Milestone title"),
         summary: requireText(summary, "Milestone summary"),

package/dist/operator/operatorSessionHistory.js

@@ -0,0 +1,124 @@
+import { normalizeRoleAgentSessionText, roleAgentSessionRef, validateRoleSessionSet } from "../executor/agentExecutor.js";
+export function operatorSessionRef(session) {
+    return roleAgentSessionRef(session);
+}
+export function listOperatorSessions(sessions) {
+    if (sessions === null)
+        return [];
+    validateRoleSessionSet(sessions);
+    const current = Object.values(sessions.sessions).map((session) => (listItem(session, session.status === "stopped" || session.status === "broken"
+        ? "current"
+        : "running")));
+    const history = Object.values(sessions.history ?? {}).map((session) => (listItem(session, "history")));
+    return [...current, ...history].sort((left, right) => (right.updatedAt.localeCompare(left.updatedAt)
+        || right.createdAt.localeCompare(left.createdAt)
+        || left.ref.localeCompare(right.ref)));
+}
+export function prepareOperatorNewSession(sessions, targetAgentId, now) {
+    validateRoleSessionSet(sessions);
+    const agentId = requireText(targetAgentId, "Target Agent id");
+    const current = sessions.sessions[agentId];
+    const nextSessions = { ...sessions.sessions };
+    let history = { ...(sessions.history ?? {}) };
+    if (current !== undefined) {
+        history = archiveCurrent(history, current);
+        delete nextSessions[agentId];
+    }
+    return validateRoleSessionSet({
+        ...sessions,
+        activeAgentId: agentId,
+        sessions: nextSessions,
+        history,
+        updatedAt: requireDate(now)
+    });
+}
+export function prepareOperatorResumeSession(sessions, ref, now) {
+    validateRoleSessionSet(sessions);
+    const normalizedRef = requireText(ref, "Operator session ref");
+    const current = Object.values(sessions.sessions).find((candidate) => operatorSessionRef(candidate) === normalizedRef);
+    if (current !== undefined) {
+        return validateRoleSessionSet({
+            ...sessions,
+            activeAgentId: current.agentId,
+            updatedAt: requireDate(now)
+        });
+    }
+    const selected = sessions.history?.[normalizedRef];
+    if (selected === undefined) {
+        throw new Error(`Operator session not found: ${normalizedRef}.`);
+    }
+    const nextSessions = { ...sessions.sessions };
+    const history = { ...(sessions.history ?? {}) };
+    const replaced = nextSessions[selected.agentId];
+    if (replaced !== undefined) {
+        Object.assign(history, archiveCurrent(history, replaced));
+    }
+    delete history[normalizedRef];
+    nextSessions[selected.agentId] = {
+        ...selected,
+        status: "stopped",
+        updatedAt: requireDate(now)
+    };
+    return validateRoleSessionSet({
+        ...sessions,
+        activeAgentId: selected.agentId,
+        sessions: nextSessions,
+        history,
+        updatedAt: requireDate(now)
+    });
+}
+function archiveCurrent(history, session) {
+    if (session.status !== "stopped" && session.status !== "broken") {
+        throw new Error(`Cannot replace Operator session while its native process is ${session.status}.`);
+    }
+    const archived = {
+        ...session,
+        status: "stopped"
+    };
+    return {
+        ...history,
+        [operatorSessionRef(archived)]: archived
+    };
+}
+function listItem(session, state) {
+    const ref = operatorSessionRef(session);
+    const title = optionalDisplayText(session.title);
+    const preview = optionalDisplayText(session.preview);
+    const fallback = `${adapterLabel(session.adapterId)} session · ${ref.slice(-8)}`;
+    return {
+        ref,
+        agentId: session.agentId,
+        adapterId: session.adapterId,
+        displayTitle: title ?? preview ?? fallback,
+        ...(title === undefined ? {} : { title }),
+        ...(preview === undefined ? {} : { preview }),
+        state,
+        createdAt: session.createdAt,
+        updatedAt: session.updatedAt
+    };
+}
+function optionalDisplayText(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = normalizeRoleAgentSessionText(value);
+    return normalized.length === 0 ? undefined : normalized;
+}
+function adapterLabel(adapterId) {
+    return adapterId === "codex"
+        ? "Codex"
+        : adapterId === "claude"
+            ? "Claude"
+            : adapterId;
+}
+function requireText(value, label) {
+    if (typeof value !== "string" || value.includes("\0") || value.trim().length === 0) {
+        throw new Error(`${label} is required.`);
+    }
+    return value.trim();
+}
+function requireDate(value) {
+    if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {
+        throw new Error("Operator session timestamp is invalid.");
+    }
+    return value.toISOString();
+}

package/dist/output/agentConfigurationPresentation.js

@@ -0,0 +1,43 @@
+import { renderAgentConfigurationResolutionNotice } from "../cli/agentConfigurationPicker.js";
+import { defaultTableWidth, renderTable } from "./table.js";
+export function renderAgentConfigurationCatalog(resolved) {
+    const { catalog } = resolved;
+    const version = catalog.cliVersion === undefined ? "" : ` ${catalog.cliVersion}`;
+    const modelRows = catalog.models.map((model) => [
+        model.label,
+        model.isDefault ? "default" : "",
+        model.efforts.map((effort) => effort.value).join(", ") || "not configurable",
+        model.defaultEffort ?? "",
+        model.serviceTiers?.map((tier) => tier.value).join(", ") || "none reported"
+    ]);
+    const fieldRows = catalog.fields
+        .filter((field) => field.key !== "model" && field.key !== "effort")
+        .map((field) => [
+        field.key,
+        field.choices.map((choice) => choice.value).join(", ") || "none reported",
+        field.available === false
+            ? `unavailable${field.reason === undefined ? "" : `: ${field.reason}`}`
+            : "available",
+        field.allowCustom ? "yes" : "no"
+    ]);
+    const sections = [
+        modelRows.length === 0
+            ? "No runtime models were reported."
+            : renderTable(`Agent capabilities: ${catalog.agentId} (${catalog.adapterId}${version})`, [
+                { header: "Model", minWidth: 12, maxWidth: 34 },
+                { header: "Default", minWidth: 7, maxWidth: 8 },
+                { header: "Efforts", minWidth: 12, maxWidth: 44 },
+                { header: "Default effort", minWidth: 14, maxWidth: 18 },
+                { header: "Service tiers", minWidth: 13, maxWidth: 24 }
+            ], modelRows, defaultTableWidth()),
+        ...(fieldRows.length === 0
+            ? []
+            : [renderTable("Other runtime configuration", [
+                    { header: "Field", minWidth: 12, maxWidth: 30 },
+                    { header: "Values", minWidth: 18, maxWidth: 58 },
+                    { header: "Status", minWidth: 10, maxWidth: 38 },
+                    { header: "Custom", minWidth: 6, maxWidth: 8 }
+                ], fieldRows, defaultTableWidth())])
+    ];
+    return `${sections.join("\n\n")}\n${renderAgentConfigurationResolutionNotice(resolved)}`;
+}

package/dist/output/rolePresentation.js

@@ -1,3 +1,4 @@
+import { activeRoleAgentSession } from "../executor/agentExecutor.js";
 import { defaultTableWidth, renderTable } from "./table.js";
 export function activeRoleSummary(role) {
     const binding = role.agentBindings[role.activeAgentId];
@@ -10,6 +11,7 @@ export function activeRoleSummary(role) {
 export function renderRoleDetails(title, role, input) {
     const bindings = Object.values(role.agentBindings)
         .sort((left, right) => left.agentId.localeCompare(right.agentId));
+    const effective = activeRoleAgentSession(input.sessions ?? null)?.effective;
     const profile = [
         `  Description      ${present(role.description)}`,
         `  Responsibilities ${presentList(role.responsibilities)}`,
@@ -22,7 +24,16 @@ export function renderRoleDetails(title, role, input) {
         `  Kind             ${input.kind}`,
         `  Active Agent     ${role.activeAgentId}`,
         ...("status" in role ? [`  Status           ${role.status}`] : []),
-        `  Workspace        ${role.workspace}`
+        `  Workspace        ${role.workspace}`,
+        `  Desired launch   r${role.launchRevision}; Profile intent=${role.defaultAccess}`,
+        `  Effective launch ${effective === undefined
+            ? "not started"
+            : `${effective.agentId}/${effective.adapterId}; r${effective.sourceDesiredRevision}; Profile intent=${effective.profileAccess}; permission=${effective.permission.strategy}`}`,
+        `  Desired drift    ${effective === undefined
+            ? "-"
+            : effective.sourceDesiredRevision === role.launchRevision
+                ? "none"
+                : "pending next launch"}`
     ];
     return [
         title,
@@ -61,18 +72,31 @@ function bindingRow(binding, role, sessions) {
 }
 function permission(binding) {
     if (binding.config.adapterId === "codex") {
-        const sandbox = binding.config.permission?.sandbox;
-        const approval = binding.config.permission?.approval;
-        if (sandbox === undefined && approval === undefined)
+        const permission = binding.config.permission;
+        if (permission.strategy === "default")
             return "CLI default";
+        if (permission.strategy === "bypass")
+            return "bypass";
         return [
-            sandbox === undefined ? undefined : `sandbox=${sandbox}`,
-            approval === undefined ? undefined : `approval=${approval}`
-        ].filter((value) => value !== undefined).join(", ");
+            permission.sandbox === undefined ? undefined : `sandbox=${permission.sandbox}`,
+            permission.approval === undefined ? undefined : `approval=${permission.approval}`
+        ].filter((value) => value !== undefined).join("; ");
     }
-    return binding.config.permission?.mode === undefined
-        ? "CLI default"
-        : `mode=${binding.config.permission.mode}`;
+    const permission = binding.config.permission;
+    if (permission.strategy === "default")
+        return "CLI default";
+    if (permission.strategy === "bypass")
+        return "bypass";
+    const rules = [
+        permission.mode === undefined ? undefined : `mode=${permission.mode}`,
+        permission.allowedTools === undefined
+            ? undefined
+            : `allow=${permission.allowedTools.join(", ")}`,
+        permission.disallowedTools === undefined
+            ? undefined
+            : `deny=${permission.disallowedTools.join(", ")}`
+    ].filter((value) => value !== undefined);
+    return rules.join("; ");
 }
 function present(value) {
     return value === undefined || value.length === 0 ? "-" : value;

package/dist/output/terminal.js

@@ -61,6 +61,14 @@ export function terminalSupportsColor(stream, env = process.env) {
         return true;
     return stream.isTTY === true && env.TERM !== "dumb";
 }
+export function usableInteractiveTerminal(value) {
+    const normalized = value?.trim();
+    return normalized === undefined
+        || normalized.length === 0
+        || normalized.toLowerCase() === "dumb"
+        ? "xterm-256color"
+        : normalized;
+}
 export function defaultTerminalWidth(stream = process.stdout) {
     const columns = stream.columns;
     return columns === undefined || !Number.isFinite(columns) || columns <= 0