@zq-silk/yui 0.7.1 → 0.8.2

package/dist/executor/fileRoleLaunchPlanner.js

@@ -24,6 +24,7 @@ import { parseTaskRuntimeIsolationDescriptor, taskRuntimeIsolationEnvironment }
 import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
 import { builtinAgentDriverRegistry, builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 import { managedRuntimeAdmission } from "../runtime/agentDriver.js";
+import { formatAgentRunReceiptId } from "../task/taskRecordReference.js";
 /** Builds managed native Agent launches from the authoritative Task records. */
 export class FileRoleLaunchPlanner {
     home;
@@ -223,7 +224,7 @@ export class FileRoleLaunchPlanner {
         if (input.mode === "resume" && !compatibleExisting) {
             throw new Error(`Task Role resume effective snapshot drifted: ${task.id}/${role.name}.`);
         }
-        return this.#compile(role, input, { scope: "task", taskId: task.id }, taskRoleSessionTitle(task, role.name), compatibleExisting ? existing.nativeSessionId : undefined, runWorkspace, effective, {
+        return this.#compile(role, input, { scope: "task", taskId: task.id }, taskRoleSessionTitle(task, role.name), input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, runWorkspace, effective, {
             purpose: activeRun?.purpose ?? "execution"
         });
     }
@@ -331,6 +332,9 @@ export class FileRoleLaunchPlanner {
         const managedRun = owner.scope === "task" && input.runId !== undefined
             ? this.store.getAgentRun(owner.taskId, input.runId)
             : null;
+        const managedSessionSet = owner.scope === "task" && input.runId !== undefined
+            ? this.store.getTaskRoleSessionSet(owner.taskId, role.name)
+            : null;
         const driver = builtinAgentDriverRegistry().require(builtinDriverIdForAdapter(configured.adapterId));
         if (owner.scope === "task" && input.runId !== undefined) {
             const admission = managedRuntimeAdmission(driver.capabilities);
@@ -369,12 +373,33 @@ export class FileRoleLaunchPlanner {
         const launchMode = resumeNativeSessionId === undefined
             ? "new"
             : "resume";
-        const compiled = launchMode === "resume"
-            ? adapter.compileResume({
-                ...compileInput,
-                nativeSessionId: resumeNativeSessionId
-            })
-            : adapter.compileNew(compileInput);
+        const managedControl = owner.scope === "task" && input.runId !== undefined;
+        const managedProviderEnvironment = managedControl
+            && configured.adapterId === "codex"
+            ? {
+                // Managed Codex Runs are non-interactive. Use the Codex execution
+                // identity for provider requests while clientInfo still identifies Yui.
+                CODEX_INTERNAL_ORIGINATOR_OVERRIDE: "codex_exec"
+            }
+            : {};
+        const preallocatedManagedNativeSessionId = managedControl
+            && binding.adapterId === "claude"
+            && resumeNativeSessionId === undefined
+            ? requireText(input.launchId === undefined
+                ? this.#createNativeSessionId()
+                : nativeSessionIdForLaunch(this.home, input.launchId, input.agentId, input.adapterId), "Native session id")
+            : resumeNativeSessionId;
+        const managedCompiled = managedControl
+            ? adapter.compileManagedControl(compileInput, launchMode, preallocatedManagedNativeSessionId)
+            : undefined;
+        const compiled = managedCompiled !== undefined
+            ? managedCompiled
+            : launchMode === "resume"
+                ? adapter.compileResume({
+                    ...compileInput,
+                    nativeSessionId: resumeNativeSessionId
+                })
+                : adapter.compileNew(compileInput);
         for (const path of [
             bootstrap.manifestPath,
             bootstrap.sessionCliPath,
@@ -397,39 +422,32 @@ export class FileRoleLaunchPlanner {
             if (owner.scope !== "task" || input.runId === undefined) {
                 args = addCodexSessionNotify(args, launchMode, this.#cliPath);
             }
-            // A fresh Codex TUI has no provider event before its first prompt. Carry
-            // the exact Run input as the provider's positional launch prompt so it is
-            // submitted only after Codex completes startup; never race terminal bytes
-            // and Enter against TUI initialization.
+            // Managed Codex runs use App Server lifecycle hooks and structured Turn
+            // submission. No Run prompt is placed in argv or written as terminal input.
             if (owner.scope === "task" && input.runId !== undefined) {
                 if (managedRun === null || managedRun.status !== "active") {
                     throw new Error(`Managed Codex Run is no longer active: ${input.runId}.`);
                 }
-                args = addCodexLifecycleHooks(args, launchMode, this.#cliPath);
-                // End option parsing before the opaque prompt so a wakeup beginning
-                // with '-' can never be reinterpreted as a Codex CLI flag.
-                if (managedRun.pushedAt === undefined) {
-                    args.push("--", managedRunLaunchEnvelope(managedRun, input.mode));
-                }
+                args = managedControl
+                    ? addCodexManagedLifecycleHooks(args, this.#cliPath)
+                    : addCodexLifecycleHooks(args, launchMode, this.#cliPath);
             }
             session = launchMode === "resume"
                 ? readySession(input.agentId, binding.adapterId, resumeNativeSessionId, effective)
                 : null;
         }
         else if (launchMode === "new") {
-            if (owner.scope === "task" && input.runId !== undefined) {
-                args.push("-p", "--output-format", "stream-json", "--input-format", "stream-json", "--verbose");
+            if (managedControl)
                 args.push("--plugin-dir", ensureManagedClaudeLifecyclePlugin(this.home, this.#cliPath));
-            }
-            const nativeSessionId = requireText(input.launchId === undefined
-                ? this.#createNativeSessionId()
-                : nativeSessionIdForLaunch(this.home, input.launchId, input.agentId, input.adapterId), "Native session id");
-            args.push("--session-id", nativeSessionId);
+            const nativeSessionId = requireText(preallocatedManagedNativeSessionId, "Native session id");
+            if (!managedControl)
+                args.push("--session-id", nativeSessionId);
+            else if (!args.includes("--session-id"))
+                args.push("--session-id", nativeSessionId);
             session = readySession(input.agentId, binding.adapterId, nativeSessionId, effective);
         }
         else {
-            if (owner.scope === "task" && input.runId !== undefined) {
-                args.push("-p", "--output-format", "stream-json", "--input-format", "stream-json", "--verbose");
+            if (managedControl) {
                 args.push("--plugin-dir", ensureManagedClaudeLifecyclePlugin(this.home, this.#cliPath));
             }
             session = readySession(input.agentId, binding.adapterId, resumeNativeSessionId, effective);
@@ -469,6 +487,36 @@ export class FileRoleLaunchPlanner {
         if (owner.scope === "task" && (input.mode === "new" || input.mode === "resume")) {
             jobCallerKey = randomBytes(32).toString("hex");
         }
+        const carriesInitialTurn = managedControl
+            && managedRun?.pushedAt === undefined
+            && (managedSessionSet?.providerBinding === null
+                || managedSessionSet?.providerBinding === undefined);
+        const providerAuthority = managedControl
+            ? this.#providerAuthorityForLaunch(owner.taskId, role.name, input.launchId)
+            : undefined;
+        const providerNativeSessionId = binding.adapterId === "claude"
+            ? preallocatedManagedNativeSessionId
+            : resumeNativeSessionId;
+        const providerControl = managedControl
+            ? {
+                schemaVersion: 1,
+                adapterId: binding.adapterId,
+                transport: managedCompiled.transport,
+                mode: resumeNativeSessionId === undefined ? "new" : "resume",
+                ...(providerNativeSessionId === undefined
+                    ? {}
+                    : { nativeSessionId: providerNativeSessionId }),
+                authority: providerAuthority,
+                ...(carriesInitialTurn
+                    ? {
+                        initialTurn: {
+                            attemptId: formatAgentRunReceiptId(owner.taskId, input.runId),
+                            boundedText: managedRunLaunchEnvelope(managedRun, input.mode)
+                        }
+                    }
+                    : {})
+            }
+            : undefined;
         const launch = {
             command,
             args,
@@ -476,16 +524,10 @@ export class FileRoleLaunchPlanner {
                 && managedRun.providerRetry.state !== "dispatching"
                 ? { deferProviderStart: true }
                 : {}),
-            ...(managedClaudeRun
-                ? {
-                    providerInput: {
-                        kind: "stdin-json-user-message",
-                        boundedText: managedRunLaunchEnvelope(managedRun, input.mode)
-                    }
-                }
-                : {}),
+            ...(providerControl === undefined ? {} : { providerControl }),
             env: {
                 ...launchEnvironment,
+                ...managedProviderEnvironment,
                 YUI_HOME: resolve(this.home),
                 YUI_SESSION_SCOPE: owner.scope,
                 ...(owner.scope === "task" ? { YUI_TASK_ID: owner.taskId } : {}),
@@ -536,12 +578,36 @@ export class FileRoleLaunchPlanner {
             },
             launch: scopedLaunch,
             session,
-            ...((binding.adapterId === "codex" && managedRun?.pushedAt === undefined
-                || managedClaudeRun) && input.runId !== undefined
-                ? { initialPromptRunId: input.runId }
+            ...(carriesInitialTurn && input.runId !== undefined
+                ? { initialTurnRunId: input.runId }
                 : {})
         };
     }
+    #providerAuthorityForLaunch(taskId, roleName, launchId) {
+        const activationId = requireText(launchId, "Managed Provider Activation id");
+        const binding = this.store.getTaskRoleSessionSet(taskId, roleName)?.providerBinding;
+        if (binding === null || binding === undefined) {
+            return { epoch: 1, owner: "controller", holderId: activationId };
+        }
+        if (binding.authority.owner === "controller") {
+            return {
+                epoch: binding.authority.epoch,
+                owner: "controller",
+                holderId: binding.authority.holderId
+            };
+        }
+        if (binding.authority.owner === "human") {
+            throw new Error(`Provider writer is held by a human: ${taskId}/${roleName}.`);
+        }
+        if (binding.authority.owner === "none") {
+            return {
+                epoch: binding.authority.epoch + 1,
+                owner: "controller",
+                holderId: activationId
+            };
+        }
+        throw new Error(`Provider writer authority is unknown: ${taskId}/${roleName}.`);
+    }
     #applyWorkspaceScope(taskId, role, launch, workspaceOverride) {
         const workspace = workspaceOverride
             ?? (role.name === "leader"
@@ -786,6 +852,18 @@ function addCodexLifecycleHooks(args, mode, cliPath) {
     }
     return [...args.slice(0, -2), ...managed, ...args.slice(-2)];
 }
+function addCodexManagedLifecycleHooks(args, cliPath) {
+    if (args.length < 2 || args.at(-2) !== "app-server" || args.at(-1) !== "--stdio") {
+        throw new Error("Managed Codex App Server launch shape is invalid.");
+    }
+    return [
+        ...args.slice(0, -2),
+        "--enable", "hooks",
+        "--config", codexLifecycleHooksConfig(cliPath),
+        "--dangerously-bypass-hook-trust",
+        ...args.slice(-2)
+    ];
+}
 function readySession(agentId, adapterId, nativeSessionId, effective) {
     return {
         agentId,

package/dist/lifecycle/canonicalLifecycleEvent.js

@@ -185,9 +185,12 @@ export function foldCanonicalLifecycleEvent(event, expectation) {
             // Only an identity-matched durable native event can move accepted/delivered,
             // and only after the independently committed transport receipt. Provider
             // acceptance and transport acknowledgement are deliberately separate
-            // evidence layers: neither may repair or infer the other.
+            // evidence layers: neither may repair or infer the other. A fresh managed
+            // Host can publish native acceptance immediately before its launch call
+            // returns and lets the scheduler persist the transport receipt. Retain
+            // that exact fenced fact for replay instead of misclassifying it as stale.
             if (!expectation.pushed)
-                return { outcome: "fail-closed", reason: "accept-without-push" };
+                return { outcome: "deferred", reason: "accept-before-push" };
             if (expectation.terminal)
                 return { outcome: "obsolete", reason: "accept-after-terminal" };
             if (expectation.accepted)

package/dist/resources/autoResourceGc.js

@@ -11,7 +11,7 @@
  * sources) applies identically.
  */
 import { applyResourceGc, planResourceGc } from "./resourceGc.js";
-import { resolveResourcesGcAutoQuarantine, resolveResourcesGcMode } from "../config/yuiConfig.js";
+import { resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours } from "../config/yuiConfig.js";
 /**
  * Create the Controller's automatic Resource GC hook. The hook self-skips
  * unless `resourcesGcMode=quarantine` and `resourcesGcAutoQuarantine=true`.
@@ -35,6 +35,7 @@ export function createResourceAutoGc(options) {
             taskStatusById,
             mode: "quarantine",
             now,
+            quarantineTtlHours: resolveResourcesQuarantineTtlHours(config.resourcesQuarantineTtlHours),
             environment,
             activeWorkspaceOwnerPaths: collectActiveWorkspaceOwnerPaths(store)
         };
@@ -75,6 +76,7 @@ export async function runAutoResourceGc(store, options = {}) {
         taskStatusById,
         mode: "quarantine",
         now,
+        quarantineTtlHours: resolveResourcesQuarantineTtlHours(config.resourcesQuarantineTtlHours),
         activeWorkspaceOwnerPaths: collectActiveWorkspaceOwnerPaths(store)
     };
     const plan = await planResourceGc(input);

package/dist/review/reviewConfig.js

@@ -11,8 +11,6 @@ export const REVIEW_DELTA_RECHECK_MODES = ["enabled", "disabled"];
 /** Issue 07: conservative defaults for whether a delta attempt is allowed. */
 export const DEFAULT_DELTA_RECHECK_MAX_CHANGED_LINES = 200;
 export const DEFAULT_DELTA_RECHECK_MAX_CHANGED_FILES = 5;
-/** The Reviewer Role seeded in a new Home by `yui setup`. */
-export const DEFAULT_REVIEWER_ROLE = "reviewer";
 export function validateReviewConfig(config) {
     requireIdentity(config.roleName, "Review Role");
     if (!REVIEW_TRIGGERS.includes(config.trigger)) {

package/dist/run/agentRun.js

@@ -329,7 +329,7 @@ export function withProviderRetry(run, retry) {
  * remain historical facts; the new delivery receipt and `dispatching` retry
  * state make the delivery path send only the short continuation envelope.
  */
-export function reopenRunForProviderRetry(run, receiptId, now) {
+export function reopenRunForProviderRetry(run, receiptId, now, mode = "resume") {
     if (run.status !== "active" || run.providerRetry === undefined) {
         throw new Error(`Agent run is not waiting for a provider retry: ${run.id}.`);
     }
@@ -337,7 +337,7 @@ export function reopenRunForProviderRetry(run, receiptId, now) {
     const { providerRetry, ...rest } = run;
     return validateAgentRun({
         ...rest,
-        mode: "resume",
+        mode,
         deliveryReceiptId: receiptId,
         updatedAt: timestamp,
         providerRetry: prepareProviderRetryDispatch(providerRetry, receiptId, now)

package/dist/run/providerRetry.js

@@ -1,24 +1,22 @@
 import { createHash } from "node:crypto";
+import { DEFAULT_PROVIDER_RETRY_DELAYS_SECONDS, DEFAULT_PROVIDER_RETRY_MAX_WINDOW_SECONDS, MAX_PROVIDER_RETRY_ATTEMPTS } from "../config/yuiConfig.js";
 import { requireIdentity, requireText, requireTimestamp } from "../domain/validation.js";
-export const PROVIDER_RETRY_DELAYS_MS = Object.freeze([2_000, 5_000, 15_000]);
-export const PROVIDER_RETRY_MAX_DISPATCHES = PROVIDER_RETRY_DELAYS_MS.length;
-export const PROVIDER_RETRY_EPISODE_WINDOW_MS = 600_000;
-/** Durable configuration keeps the historical name for compatibility. */
-export const PROVIDER_RETRY_MAX_WINDOW_MS = PROVIDER_RETRY_EPISODE_WINDOW_MS;
-export function nextProviderRetryDelayMs(retryIndex) {
+export const PROVIDER_RETRY_DELAYS_MS = Object.freeze(DEFAULT_PROVIDER_RETRY_DELAYS_SECONDS.map((seconds) => seconds * 1_000));
+export const PROVIDER_RETRY_EPISODE_WINDOW_MS = DEFAULT_PROVIDER_RETRY_MAX_WINDOW_SECONDS * 1_000;
+export function nextProviderRetryDelayMs(retryIndex, delaysMs = PROVIDER_RETRY_DELAYS_MS) {
     if (!Number.isSafeInteger(retryIndex)
         || retryIndex < 1
-        || retryIndex > PROVIDER_RETRY_MAX_DISPATCHES) {
+        || retryIndex > delaysMs.length) {
         throw new Error(`Provider retry index is out of range: ${String(retryIndex)}.`);
     }
-    return PROVIDER_RETRY_DELAYS_MS[retryIndex - 1];
+    return delaysMs[retryIndex - 1];
 }
 /**
  * True when the retry lineage has used its total wall-clock budget. The
  * budget is measured from the first classified failure, so repeated failures
  * never extend it.
  */
-export function providerRetryBudgetExhausted(value, now, maxWindowMs = PROVIDER_RETRY_MAX_WINDOW_MS) {
+export function providerRetryBudgetExhausted(value, now, maxWindowMs = PROVIDER_RETRY_EPISODE_WINDOW_MS) {
     if (!Number.isSafeInteger(maxWindowMs) || maxWindowMs <= 0) {
         throw new Error(`Provider retry max window must be a positive integer: ${String(maxWindowMs)}.`);
     }
@@ -43,7 +41,9 @@ export function validateAgentRunProviderRetry(value) {
         || value.dispatchedRetries > value.maxRetries) {
         throw new Error("Agent run providerRetry dispatchedRetries is invalid.");
     }
-    if (value.maxRetries !== PROVIDER_RETRY_MAX_DISPATCHES) {
+    if (!Number.isSafeInteger(value.maxRetries)
+        || value.maxRetries < 1
+        || value.maxRetries > MAX_PROVIDER_RETRY_ATTEMPTS) {
         throw new Error("Agent run providerRetry maxRetries is invalid.");
     }
     requireTimestamp(value.firstFailureAt, "Agent run providerRetry firstFailureAt");
@@ -83,18 +83,22 @@ export function validateAgentRunProviderRetry(value) {
     return value;
 }
 /** Advance one failure episode without ever changing the native Session. */
-export function scheduleProviderRetry(previous, input, now) {
+export function scheduleProviderRetry(previous, input, now, policy = {
+    delaysMs: PROVIDER_RETRY_DELAYS_MS,
+    maxWindowMs: PROVIDER_RETRY_EPISODE_WINDOW_MS
+}) {
+    validateRetrySchedulePolicy(policy);
     const at = now.toISOString();
     const firstFailureAt = previous?.firstFailureAt ?? at;
     const episodeDeadlineAt = previous?.episodeDeadlineAt
-        ?? new Date(now.getTime() + PROVIDER_RETRY_EPISODE_WINDOW_MS).toISOString();
+        ?? new Date(now.getTime() + policy.maxWindowMs).toISOString();
     if (now.getTime() >= Date.parse(episodeDeadlineAt)) {
         return Object.freeze({ outcome: "exhausted", reason: "window" });
     }
     const consecutiveFailures = (previous?.consecutiveFailures ?? 0) + 1;
     const dispatchedRetries = previous?.dispatchedRetries ?? 0;
     const schedule = input.scheduleNextAttempt ?? true;
-    if (schedule && dispatchedRetries >= PROVIDER_RETRY_MAX_DISPATCHES) {
+    if (schedule && dispatchedRetries >= policy.delaysMs.length) {
         return Object.freeze({ outcome: "exhausted", reason: "attempts" });
     }
     const state = schedule ? "scheduled" : "blocked";
@@ -103,7 +107,7 @@ export function scheduleProviderRetry(previous, input, now) {
         throw new Error("Provider retry Retry-After must be a positive safe integer.");
     }
     const delayMs = schedule
-        ? Math.max(nextProviderRetryDelayMs(dispatchedRetries + 1), retryAfterMs ?? 0)
+        ? Math.max(nextProviderRetryDelayMs(dispatchedRetries + 1, policy.delaysMs), retryAfterMs ?? 0)
         : undefined;
     const nextAttemptAt = delayMs === undefined
         ? undefined
@@ -125,7 +129,7 @@ export function scheduleProviderRetry(previous, input, now) {
         errorClass: input.errorClass,
         consecutiveFailures,
         dispatchedRetries,
-        maxRetries: PROVIDER_RETRY_MAX_DISPATCHES,
+        maxRetries: policy.delaysMs.length,
         firstFailureAt,
         lastFailureAt: at,
         episodeDeadlineAt,
@@ -139,6 +143,15 @@ export function scheduleProviderRetry(previous, input, now) {
     });
     return Object.freeze({ outcome: schedule ? "scheduled" : "blocked", retry });
 }
+function validateRetrySchedulePolicy(policy) {
+    if (!Number.isSafeInteger(policy.maxWindowMs) || policy.maxWindowMs < 1) {
+        throw new Error("Provider retry max window must be a positive safe integer.");
+    }
+    if (policy.delaysMs.length < 1 || policy.delaysMs.length > MAX_PROVIDER_RETRY_ATTEMPTS
+        || policy.delaysMs.some((delay) => !Number.isSafeInteger(delay) || delay < 1)) {
+        throw new Error(`Provider retry delay schedule must contain 1-${MAX_PROVIDER_RETRY_ATTEMPTS} positive safe integers.`);
+    }
+}
 /** Mark that one short continuation request was dispatched and now awaits any correlated progress. */
 export function prepareProviderRetryDispatch(value, receiptId, now) {
     if (value.state !== "scheduled" || value.nextAttemptAt === undefined)
@@ -203,7 +216,7 @@ export function serializeProviderRetryEnvelope(input) {
     return [
         "Yui managed in-Session continuation retry.",
         `task=${requireIdentity(input.taskId, "Provider retry task id")} run=${requireIdentity(input.runId, "Provider retry run id")} role=${requireIdentity(input.roleName, "Provider retry role")}`,
-        `episode=${input.retry.episodeId} retry=${retryOrdinal}/${PROVIDER_RETRY_MAX_DISPATCHES} receipt=${input.retry.lastRetryReceiptId ?? "pending"}`,
+        `episode=${input.retry.episodeId} retry=${retryOrdinal}/${input.retry.maxRetries} receipt=${input.retry.lastRetryReceiptId ?? "pending"}`,
         `failureEvent=${input.retry.failureEventId}`,
         ...(input.retry.failedNativeTurnId === undefined
             ? []

package/dist/run/providerRetryConfig.js

@@ -1,4 +1,4 @@
-import { resolveProviderRetryAdapters, resolveProviderRetryMaxWindowMs, resolveProviderRetryMode, resolveYieldReceiptReplay } from "../config/yuiConfig.js";
+import { resolveProviderRetryAdapters, resolveProviderRetryDelaysSeconds, resolveProviderRetryMaxWindowSeconds, resolveProviderRetryMode } from "../config/yuiConfig.js";
 /**
  * Resolves the retry flags from the durable Yui config. Homes without the
  * fields get the safe defaults: enforce mode, all supported adapters, receipt
@@ -10,8 +10,10 @@ export function providerRetryConfig(config) {
     return {
         mode: adapters.length === 0 ? "off" : mode,
         adapters,
-        yieldReceiptReplay: resolveYieldReceiptReplay(config.yieldReceiptReplay),
-        maxWindowMs: resolveProviderRetryMaxWindowMs(config.providerRetryMaxWindowMs)
+        delaysMs: resolveProviderRetryDelaysSeconds(config.providerRetryDelaysSeconds)
+            .map((seconds) => seconds * 1_000),
+        maxWindowMs: resolveProviderRetryMaxWindowSeconds(config.providerRetryMaxWindowSeconds)
+            * 1_000
     };
 }
 /** Whether the adapter has in-place retry enabled in the given mode. */