@zq-silk/yui 0.6.6 → 0.6.8

package/dist/integration/gitIntegrationService.js

@@ -59,7 +59,7 @@ export class GitIntegrationService {
     environment;
     runtimeIsolation;
     #resourceRegistrarValue;
-    constructor(home, store, git = new NodeGitWorkspace(), now = () => new Date(), environment = process.env, runtimeIsolation = defaultIntegrationRuntimeIsolation(home), jobPort) {
+    constructor(home, store, git = new NodeGitWorkspace(), now = () => new Date(), environment = process.env, runtimeIsolation = defaultIntegrationRuntimeIsolation(home, store.getHomeIdentity().homeId), jobPort) {
         this.store = store;
         this.git = git;
         this.now = now;
@@ -883,14 +883,14 @@ function isNodeCode(error, code) {
         && "code" in error
         && error.code === code;
 }
-function defaultIntegrationRuntimeIsolation(home) {
+function defaultIntegrationRuntimeIsolation(home, homeId) {
     const controlHome = resolve(home);
     return new FileTaskRuntimeIsolation({
         runtimeRoot: integrationRuntimeRoot(),
         pathLayout: "compact",
         controlPlane: {
             yuiHome: controlHome,
-            controllerSocketPath: controllerSocketPath(controlHome),
+            controllerSocketPath: controllerSocketPath(homeId),
             tmuxNamespace: yuiTmuxServerName(controlHome),
             globalInstallPaths: [process.execPath]
         }

package/dist/repository/homeIdentity.js

@@ -1,6 +1,12 @@
 import { randomBytes } from "node:crypto";
 export const HOME_IDENTITY_PATTERN = /^home-[a-f0-9]{16}$/;
 const HOME_ENTROPY_BYTES = 16;
+export function validateHomeId(homeId) {
+    if (typeof homeId !== "string" || !HOME_IDENTITY_PATTERN.test(homeId)) {
+        throw new Error("Home identity id is invalid.");
+    }
+    return homeId;
+}
 export function generateHomeIdentity(now, source = () => randomBytes(HOME_ENTROPY_BYTES)) {
     const entropy = source().toString("hex");
     const homeId = `home-${randomBytes(8).toString("hex")}`;
@@ -15,9 +21,7 @@ export function validateHomeIdentity(identity) {
     if (identity.schemaVersion !== 1) {
         throw new Error("Home identity must use schemaVersion 1.");
     }
-    if (typeof identity.homeId !== "string" || !HOME_IDENTITY_PATTERN.test(identity.homeId)) {
-        throw new Error("Home identity id is invalid.");
-    }
+    validateHomeId(identity.homeId);
     if (typeof identity.entropy !== "string" || !/^[a-f0-9]{32}$/.test(identity.entropy)) {
         throw new Error("Home identity entropy is invalid.");
     }

package/dist/resources/liveReferences.js

@@ -12,6 +12,9 @@ import { join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { parseExactTaskRuntimeDescriptor } from "../runtime/exactControlPlane.js";
 import { readRuntimeIdentity, releasesDirectory, resolveActiveRelease } from "../release/runtimeRelease.js";
+import { isControllerSocketPathForHome } from "../core/controllerEndpoint.js";
+import { parseControllerDiscovery } from "../core/protocol.js";
+import { readHomeFilesystemId } from "../core/homeFilesystemIdentity.js";
 const executeFile = promisify(execFile);
 /**
  * Collect every live reference for the given paths. The scan is fail-closed:
@@ -481,7 +484,11 @@ export function readControllerDiscovery(home) {
     }
     let record;
     try {
-        record = JSON.parse(readFileSync(path, "utf8"));
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            throw new Error("controller.json is not an object");
+        }
+        record = value;
     }
     catch (error) {
         return Object.freeze({
@@ -537,9 +544,35 @@ export function readControllerDiscovery(home) {
             }
         });
     }
+    let discovery;
+    try {
+        const homeId = record.homeId;
+        const socketPath = record.socketPath;
+        if (typeof homeId !== "string"
+            || typeof socketPath !== "string"
+            || !isControllerSocketPathForHome(homeId, socketPath)) {
+            throw new Error("Controller endpoint identity is invalid.");
+        }
+        discovery = parseControllerDiscovery(record, {
+            homeFilesystemId: readHomeFilesystemId(home),
+            socketPath
+        });
+    }
+    catch (error) {
+        return Object.freeze({
+            protects: false,
+            token: "",
+            protectedPaths: Object.freeze([]),
+            diagnostic: {
+                source: "controller",
+                severity: "error",
+                message: `controller.json identity is invalid: ${error instanceof Error ? error.message : "unknown error"}`
+            }
+        });
+    }
     return Object.freeze({
         protects: true,
-        token: `controller:${record.pid}`,
+        token: `controller:${discovery.homeId}:${discovery.controllerInstanceId}:${record.pid}`,
         protectedPaths: Object.freeze([path])
     });
 }

package/dist/storage/compatibleTaskStore.js

@@ -3,8 +3,9 @@ import { join } from "node:path";
 import { StorageCompatibilityError, loadCompatibleSnapshot } from "./migration/index.js";
 import { createProductionStorageRegistry } from "./migration/productionRegistry.js";
 import { FileTaskStore, STORAGE_STATE_FILE, stateFileFingerprint, StorageRecordError, validateCurrentStorageStateSnapshot } from "./taskStore.js";
-import { SqliteTaskStore } from "./sqliteStore.js";
+import { readSqliteHomeIdentity, SqliteTaskStore } from "./sqliteStore.js";
 import { COMMITTED_DATABASE_FILENAME } from "./upgrade/sqliteStateMigration.js";
+import { validateHomeIdentity } from "../repository/homeIdentity.js";
 import { ensureStorageSchema, inspectStorageSchema, readStorageSchemaManifest, STORAGE_SCHEMA_FILE } from "./storageSchema.js";
 import { classifyHome } from "./upgrade/homeClassification.js";
 import { inspectSnapshotVersionState } from "./upgrade/homeMigrationTarget.js";
@@ -81,6 +82,40 @@ export function openCompatibleFileTaskStore(home, options = {}) {
             throw new StorageCompatibilityError(describeUnsupported(classification.classification));
     }
 }
+/**
+ * Read the one authoritative durable Home identity without creating runtime
+ * state. SQLite is opened read-only; file-backed Homes read only the immutable
+ * identity field, so an aggregate that requires offline migration can still
+ * authenticate its already-running Controller before the migration stops it.
+ */
+export function readCompatibleHomeIdentity(home, options = {}) {
+    const schema = inspectStorageSchema(home);
+    if (!options.forceStateSource
+        && (schema.status === "current" || schema.status === "unsupported")
+        && schema.currentLayoutVersion >= 7
+        && existsSync(join(home, COMMITTED_DATABASE_FILENAME))) {
+        return readSqliteHomeIdentity(home, COMMITTED_DATABASE_FILENAME);
+    }
+    if (!existsSync(join(home, STORAGE_STATE_FILE))) {
+        throw new StorageRecordError("Durable Home identity is missing.");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(join(home, STORAGE_STATE_FILE), "utf8"));
+    }
+    catch {
+        throw new StorageRecordError("Durable Home identity state is invalid JSON.");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new StorageRecordError("Durable Home identity state is invalid.");
+    }
+    try {
+        return validateHomeIdentity(parsed.homeIdentity);
+    }
+    catch {
+        throw new StorageRecordError("Durable Home identity is invalid.");
+    }
+}
 /**
  * The one-snapshot open for a Home whose manifest is already current. A single
  * fingerprint-fenced read of `state.json` supplies:

package/dist/storage/sqliteStore.js

@@ -43,7 +43,7 @@ import { mailboxTargetKey } from "../coordination/workMailbox.js";
 import { validatePendingTurnCompletion } from "../executor/turnCompletion.js";
 import { compareRuntimeSessionCandidates, projectRuntimeSessionCandidate } from "../runtime/runtimeSessionCandidate.js";
 import { validateReviewFinding } from "../review/reviewFinding.js";
-import { generateHomeIdentity } from "../repository/homeIdentity.js";
+import { generateHomeIdentity, validateHomeIdentity } from "../repository/homeIdentity.js";
 import { validateIntegrationQueueEntry } from "../integration/integrationQueueEntry.js";
 import { validDurableJobTransition, validateDurableJob } from "../job/durableJob.js";
 import { TASK_RECORD_ID_PREFIXES } from "../task/taskRecordReference.js";
@@ -53,6 +53,30 @@ import { CURRENT_CONFIG_SCHEMA_VERSION, CURRENT_PENDING_WAKEUP_SCHEMA_VERSION, C
 import { gateArtifactKey, validateGateArtifact } from "../verification/gateArtifact.js";
 import { migrateSqliteSchema, SQLITE_AGGREGATE_VERSION, SQLITE_LAYOUT_VERSION, TELEMETRY_KEEP_PER_GENERATION, TELEMETRY_RUN_CAP } from "./sqliteSchema.js";
 import { inspectStorageSchema } from "./storageSchema.js";
+/** Read the immutable Home identity without opening a writable Store connection. */
+export function readSqliteHomeIdentity(rootDir, databaseFilename = "yui.db") {
+    const database = new Database(join(rootDir, databaseFilename), {
+        readonly: true,
+        fileMustExist: true
+    });
+    try {
+        const row = database.prepare("SELECT home_identity FROM home_meta WHERE id = 1").get();
+        if (typeof row?.home_identity !== "string") {
+            throw new StorageRecordError("SQLite Home identity is missing.");
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(row.home_identity);
+        }
+        catch {
+            throw new StorageRecordError("SQLite Home identity is invalid JSON.");
+        }
+        return validateHomeIdentity(parsed);
+    }
+    finally {
+        database.close();
+    }
+}
 const DEFAULT_CONFIG = { schemaVersion: CURRENT_CONFIG_SCHEMA_VERSION };
 function numericCompare(left, right) {
     return left.localeCompare(right, undefined, { numeric: true });

package/dist/storage/taskStore.js

@@ -1,6 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { validateConfiguredAgent } from "../agent/agent.js";
 import { validateCapabilityGrant } from "../grant/capabilityGrant.js";
@@ -1735,11 +1735,56 @@ export class StorageCancelledError extends Error {
     constructor(message) { super(message); this.name = "StorageCancelledError"; }
 }
 export function resolveYuiHome(env) {
-    return env.YUI_HOME === undefined || env.YUI_HOME.length === 0
+    const requested = env.YUI_HOME === undefined || env.YUI_HOME.length === 0
         ? join(homedir(), ".yui")
         : resolve(env.YUI_HOME);
+    return canonicalizeYuiHome(requested);
 }
 export function ensureYuiHome(rootDir) { mkdirSync(rootDir, { recursive: true, mode: 0o700 }); }
+/**
+ * YUI_HOME is a runtime identity, not only a storage path. Resolve every
+ * existing symlink component before Controller/tmux namespaces or exact
+ * descriptors derive identity from it. A Home may not exist before `setup`,
+ * so retain proven-missing trailing components below the longest existing
+ * physical ancestor. Existing-but-unresolvable paths fail closed.
+ */
+function canonicalizeYuiHome(value) {
+    const absolute = resolve(value);
+    let current = absolute;
+    const trailing = [];
+    for (;;) {
+        try {
+            const physical = realpathSync(current);
+            return trailing.length === 0 ? physical : join(physical, ...trailing);
+        }
+        catch (realpathError) {
+            if (!isErrno(realpathError, "ENOENT")) {
+                throw unstableYuiHome(absolute, realpathError);
+            }
+            try {
+                lstatSync(current);
+            }
+            catch (lstatError) {
+                if (!isErrno(lstatError, "ENOENT")) {
+                    throw unstableYuiHome(absolute, lstatError);
+                }
+                const parent = dirname(current);
+                if (parent === current)
+                    return absolute;
+                trailing.unshift(basename(current));
+                current = parent;
+                continue;
+            }
+            throw unstableYuiHome(absolute, realpathError);
+        }
+    }
+}
+function unstableYuiHome(path, cause) {
+    return new Error(`YUI_HOME cannot be resolved to a stable physical path: ${path}.`, { cause });
+}
+function isErrno(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
 function emptyState() {
     return {
         schemaVersion: CURRENT_STORAGE_STATE_SCHEMA_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,