@zq-silk/yui 0.7.1 → 0.8.2

package/dist/controller/resourceInventory.js

@@ -113,16 +113,17 @@ export function buildControllerResourceInventory(facts) {
             for (const process of paneProcesses)
                 claimed.add(process.pid);
             const role = findRole(homeFact.roles, pane);
-            const archived = role?.taskStatus === "archived";
+            const terminalIsolation = role?.taskStatus === "retired"
+                || role?.taskStatus === "archived";
             resources.push(processResource({
                 kind: "agent-session",
                 state: pane.dead ? "dead" : role === undefined ? "orphaned" : "running",
                 disposition: role === undefined
                     ? pane.dead ? "safe" : "review"
-                    : archived ? "safe" : "protected",
+                    : terminalIsolation ? "safe" : "protected",
                 reasonCode: role === undefined
                     ? pane.dead ? "dead-orphan-pane" : "orphan-pane"
-                    : archived ? "archived-task-pane" : "owned-role-pane",
+                    : terminalIsolation ? `${role.taskStatus}-task-pane` : "owned-role-pane",
                 yuiHome,
                 owner: role === undefined ? { kind: "none" } : roleOwner(role),
                 processes: paneProcesses,
@@ -359,7 +360,10 @@ function artifactResource(artifact, yuiHome, domain, homeId) {
         ...(domain === undefined ? {} : { domain })
     };
 }
-function domainDisposition(base, _reason, domain, target) {
+function domainDisposition(base, reason, domain, target) {
+    if (reason === "retired-task-pane" || reason === "archived-task-pane") {
+        return "safe";
+    }
     if (domain === undefined)
         return base;
     if (domain.disposition === "safe") {
@@ -377,7 +381,7 @@ function domainDisposition(base, _reason, domain, target) {
             // A tmux server with panes is protected until the pane resources have
             // been removed and a later bounded pass can revalidate the empty
             // server. This avoids killing a server while a target race is in flight.
-            if (base === "protected" && _reason === "owned-tmux-server")
+            if (base === "protected" && reason === "owned-tmux-server")
                 return "protected";
             // `report-only` is deliberately reserved for an unrecognized process;
             // the YUI_HOME environment alone is not a cleanup ownership proof.

package/dist/controller/runtime.js

@@ -1,4 +1,4 @@
-import { reconciliationIntervalMilliseconds, resolveTmuxBin } from "../config/yuiConfig.js";
+import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveRuntimeHealth, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
 import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
@@ -17,9 +17,9 @@ import { AsyncTaskStoreClient, resolveStoreWorkerEnabledForHome } from "../stora
 import { FileTaskWorkspacePreparer } from "../repository/taskWorkspacePreparer.js";
 import { NodeCommandExecutor } from "../tmux/commandExecutor.js";
 import { TmuxManager, yuiTmuxServerName } from "../tmux/tmuxManager.js";
-import { FileTaskRuntimeIsolation, TmuxPromptPushAdapter, TmuxSessionHost, ProviderContinuationReconciliationService } from "../runtime/index.js";
+import { AgentHostPromptPushAdapter, FileTaskRuntimeIsolation, TmuxSessionHost, ProviderContinuationReconciliationService } from "../runtime/index.js";
 import { startFileTaskController } from "./controller.js";
-import { FileSchedulerStoreAdapter } from "./fileSchedulerStoreAdapter.js";
+import { AgentHostProviderTurnFenceError, FileSchedulerStoreAdapter } from "./fileSchedulerStoreAdapter.js";
 import { openSchedulerTelemetry } from "../telemetry/telemetryWiring.js";
 import { createFileArtifactPort, createLinuxProcessPort, DurableJobSupervisor } from "./jobSupervisor.js";
 import { createDurableJobControl } from "./jobControl.js";
@@ -38,7 +38,7 @@ import { launchBrokerForHome } from "../runtime/launchBroker.js";
 import { classifyRuntimeProcessExit, validateRuntimeProcessExitObservation } from "../runtime/processExitObservation.js";
 import { appendGlobalProcessExitObservation } from "../runtime/globalProcessExitStore.js";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
-import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
+import { createRuntimeObservation, runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
 import { createTaskEvent } from "../event/taskEvent.js";
 /** Refreshes only the exact Task runtime generation folded by the event transaction. */
 export function refreshAppliedTaskRuntimeDescriptor(store, planner, input) {
@@ -92,6 +92,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             ? new SqliteTaskStore(home)
             : openCompatibleFileTaskStore(home));
     const homeId = store.getHomeIdentity().homeId;
+    const durableConfig = store.getConfig();
     // When the worker backend is active, the db-touching observer folds run in
     // the worker (off the main event loop). The client is closed on shutdown.
     const asyncStoreClient = useWorker
@@ -113,8 +114,9 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     const planner = options.planner ?? new FileRoleLaunchPlanner(home, store, {
         environment: options.environment
     });
-    const tmux = options.tmux ?? new TmuxManager(resolveTmuxBin(store.getConfig().tmuxBin), new NodeCommandExecutor(), {
+    const tmux = options.tmux ?? new TmuxManager(resolveTmuxBin(durableConfig.tmuxBin), new NodeCommandExecutor(), {
         yuiHome: home,
+        historyLimit: resolveTmuxHistoryLimit(durableConfig.tmuxHistoryLimit),
         ...(domainIdentity === undefined
             ? {}
             : {
@@ -181,8 +183,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             }
             throw new Error("Native session discovery was aborted.");
         },
-        inactivityTimeoutMs: positiveIntegerOption(options.environment?.YUI_LAUNCH_INACTIVITY_TIMEOUT_MS
-            ?? process.env.YUI_LAUNCH_INACTIVITY_TIMEOUT_MS, 300_000),
+        inactivityTimeoutMs: resolveAgentLaunchInactivityTimeoutSeconds(durableConfig.agentLaunchInactivityTimeoutSeconds) * 1_000,
         onHostCreated: ({ binding, pane }) => {
             sessionOwners.recordHostOwner({
                 owner: binding.owner,
@@ -197,7 +198,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         }
     });
     const promptPush = options.promptPush
-        ?? new TmuxPromptPushAdapter(tmux, agentProcessReadinessProbe);
+        ?? new AgentHostPromptPushAdapter(home);
     const runtimeIsolation = options.runtimeIsolation
         ?? new FileTaskRuntimeIsolation({
             // A sibling of the exact control Home keeps provider data/cache/tmp out
@@ -282,9 +283,6 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         sessionHost,
         promptPush,
         launchCoordinator,
-        ...(options.providerInputRouting === undefined
-            ? {}
-            : { providerInputRouting: options.providerInputRouting }),
         roleResourceInventory: async (panes, inputs) => {
             const inventory = await scanInventory(panes);
             return inventory.resources.flatMap((resource) => {
@@ -438,9 +436,16 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         intervalMs: options.intervalMs
             ?? reconciliationIntervalMilliseconds(store.getConfig().reconciliationIntervalSeconds),
         signalWindowMs: options.signalWindowMs,
-        taskConcurrency: options.taskConcurrency,
+        taskConcurrency: options.taskConcurrency
+            ?? resolveControllerTaskConcurrency(durableConfig.controllerTaskConcurrency),
         deliveryRetryMs: options.deliveryRetryMs,
         deliveryRetryLimit: options.deliveryRetryLimit,
+        deliveryTimeoutMs: options.deliveryTimeoutMs
+            ?? resolveDeliveryTimeoutSeconds(durableConfig.deliveryTimeoutSeconds) * 1_000,
+        stallWindowMs: options.stallWindowMs
+            ?? resolveRuntimeHealth(durableConfig.runtimeHealth).stallWindowMs,
+        diagnosticAfterMs: options.diagnosticAfterMs
+            ?? resolveRuntimeHealth(durableConfig.runtimeHealth).diagnosticAfterMs,
         now: options.now,
         onError: options.onError,
         lifecycleHost,
@@ -497,13 +502,28 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     catch (error) {
         (options.onError ?? (() => undefined))(error);
     }
+    let resourceClose;
+    const closeResources = () => {
+        resourceClose ??= Promise.all([
+            asyncStoreClient?.close() ?? Promise.resolve(),
+            inventoryClient?.close() ?? Promise.resolve()
+        ]).then(() => undefined);
+        return resourceClose;
+    };
+    const closed = running.closed.then(closeResources);
     return {
         ...running,
+        closed,
         close: async () => {
-            await running.close();
-            // Release the worker's database connections when the worker backend is active.
-            await asyncStoreClient?.close();
-            await inventoryClient?.close();
+            try {
+                await running.close();
+            }
+            finally {
+                // RPC-driven Controller stops resolve `running.closed` without calling
+                // this wrapper. Share one cleanup promise so both lifecycle paths
+                // release the worker connections before the process can linger.
+                await closeResources();
+            }
         },
         store,
         schedulerStore,
@@ -527,6 +547,55 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
         });
     const lifecycleTails = new Map();
     return async (method, params) => {
+        if (method === "runtime.observation-apply") {
+            return {
+                outcome: schedulerStore.observeRuntimeObservation(createRuntimeObservation(params), new Date())
+            };
+        }
+        if (method === "runtime.provider-turn-begin") {
+            const value = providerTurnControlParams(params);
+            try {
+                schedulerStore.beginAgentHostProviderTurn({
+                    taskId: value.taskId,
+                    roleName: value.roleName,
+                    runId: value.runId,
+                    agentId: value.agentId,
+                    launchId: value.launchId,
+                    nativeSessionId: value.nativeSessionId,
+                    attemptId: value.attemptId,
+                    authorityEpoch: value.authorityEpoch,
+                    authorityOwner: value.authorityOwner,
+                    holderId: value.holderId,
+                    now: value.now
+                });
+            }
+            catch (error) {
+                if (error instanceof AgentHostProviderTurnFenceError) {
+                    throw applicationError("INVALID_PARAMS", error.message);
+                }
+                throw error;
+            }
+            return { recorded: true };
+        }
+        if (method === "runtime.provider-turn-submission-resolve") {
+            const value = providerTurnControlParams(params);
+            const status = params.status;
+            const reason = params.reason;
+            if ((status !== "rejected" && status !== "delivery-unknown")
+                || typeof reason !== "string" || reason.trim().length === 0) {
+                throw applicationError("INVALID_PARAMS", "Provider Turn resolution is invalid.");
+            }
+            schedulerStore.resolveAgentHostProviderTurnSubmission({
+                taskId: value.taskId,
+                roleName: value.roleName,
+                runId: value.runId,
+                attemptId: value.attemptId,
+                status,
+                reason,
+                now: value.now
+            });
+            return { recorded: true };
+        }
         if (method === "runtime.process-exit-observe") {
             const observation = validateRuntimeProcessExitObservation(params);
             const run = observation.taskId === undefined || observation.runId === undefined
@@ -1009,6 +1078,33 @@ function requiredParam(value) {
     }
     return value;
 }
+function providerTurnControlParams(params) {
+    if (typeof params !== "object" || params === null || Array.isArray(params)) {
+        throw applicationError("INVALID_PARAMS", "Provider Turn control params are invalid.");
+    }
+    const value = params;
+    const authorityEpoch = value.authorityEpoch;
+    const authorityOwner = value.authorityOwner;
+    const observedAt = requiredParam(value.observedAt);
+    if (!Number.isSafeInteger(authorityEpoch) || authorityEpoch < 1
+        || (authorityOwner !== "controller" && authorityOwner !== "human")
+        || !Number.isFinite(Date.parse(observedAt))) {
+        throw applicationError("INVALID_PARAMS", "Provider Turn control fence is invalid.");
+    }
+    return {
+        taskId: requiredParam(value.taskId),
+        roleName: requiredParam(value.roleName),
+        runId: requiredParam(value.runId),
+        agentId: requiredParam(value.agentId),
+        launchId: requiredParam(value.launchId),
+        nativeSessionId: requiredParam(value.nativeSessionId),
+        attemptId: requiredParam(value.attemptId),
+        authorityEpoch: authorityEpoch,
+        authorityOwner,
+        holderId: requiredParam(value.holderId),
+        now: new Date(observedAt)
+    };
+}
 function abortableDelay(milliseconds, signal) {
     return new Promise((resolve, reject) => {
         const timer = setTimeout(() => {
@@ -1026,15 +1122,6 @@ function abortableDelay(milliseconds, signal) {
         signal.addEventListener("abort", onAbort, { once: true });
     });
 }
-function positiveIntegerOption(value, fallback) {
-    if (value === undefined || value.trim().length === 0)
-        return fallback;
-    const parsed = Number(value);
-    if (!Number.isSafeInteger(parsed) || parsed <= 0) {
-        throw new Error(`Invalid native session discovery timeout: ${value}`);
-    }
-    return parsed;
-}
 function applicationError(code, message) {
     const error = Object.assign(new Error(message), { code });
     error.name = "CoreApplicationError";

package/dist/controller/runtimeLaunchCoordinator.js

@@ -8,12 +8,6 @@ class RuntimeBindingContractError extends Error {
         this.name = "RuntimeBindingContractError";
     }
 }
-class LaunchSubmittedHostBusyError extends RuntimeBindingContractError {
-    constructor(message) {
-        super(message);
-        this.name = "LaunchSubmittedHostBusyError";
-    }
-}
 class RuntimeLaunchStateChangedError extends Error {
     constructor(message, options) {
         super(message, options);
@@ -103,12 +97,6 @@ export class RuntimeLaunchCoordinator {
             ...(request.runId === undefined ? {} : { runId: request.runId })
         }, assertLaunchCurrent, this.#now());
         let reusedConfirmedRunningHost = false;
-        const launchCarriesExactRunPrompt = carriesExactRunPrompt(request);
-        // Preserve the existing Codex recovery path; managed Claude is the one
-        // finite-process protocol that must never fall back to tmux key delivery
-        // when a newly-reserved Run encounters an older live pane.
-        let launchPromptAcknowledgementRequired = request.adapterId === "claude"
-            && launchCarriesExactRunPrompt;
         if (reservation.status === "existing") {
             if (!reservation.launchId.startsWith(generationPrefix)) {
                 this.#requireCleanup(request.owner);
@@ -167,12 +155,6 @@ export class RuntimeLaunchCoordinator {
                     throw new Error(`Runtime launch reservation belongs to another Run whose host is still running: ${reservation.runId}.`);
                 }
                 reusedConfirmedRunningHost = true;
-                // A fresh Codex generation carries the prompt in its launch argv. A
-                // managed Claude generation carries it through stream-json stdin for
-                // both new and native-resume modes. Only recovery of the exact same
-                // reserved Run may bridge a lost in-memory launch acknowledgement.
-                launchPromptAcknowledgementRequired = sameRunReservation
-                    && launchCarriesExactRunPrompt;
                 runtimeIsolation = this.#preflightRuntimeIsolation(request, reservation.launchId, reservation.launchId.slice(generationPrefix.length), true);
                 assertLaunchCurrent();
             }
@@ -229,11 +211,8 @@ export class RuntimeLaunchCoordinator {
                         : { environment: request.environment }),
                     nativeSessionId: requireText(request.nativeSessionId, "Native session id")
                 }, beforeHostStart === undefined ? undefined : observePreflight);
-            binding = requireMatchingRuntimeBinding(rawBinding, request, launchId, launchPromptAcknowledgementRequired, reusedConfirmedRunningHost);
-            if (!preflightObserved
-                && !(binding.hostCreated === false
-                    && request.adapterId === "claude"
-                    && launchCarriesExactRunPrompt)) {
+            binding = requireMatchingRuntimeBinding(rawBinding, request, launchId);
+            if (!preflightObserved) {
                 throw new Error("Runtime session host did not expose a pre-host-start launch fence.");
             }
         }
@@ -244,8 +223,7 @@ export class RuntimeLaunchCoordinator {
                 // terminalize that reservation.
                 throw new RuntimeLaunchError(true, launchId, error.message, error.reason);
             }
-            if ((error instanceof LaunchSubmittedHostBusyError
-                || error instanceof RuntimeHostContentionError)
+            if (error instanceof RuntimeHostContentionError
                 && !reusedConfirmedRunningHost) {
                 let exactCleanupAttempted = false;
                 let completed = false;
@@ -266,12 +244,6 @@ export class RuntimeLaunchCoordinator {
                     this.#requireCleanup(request.owner);
                     throw new Error("Busy managed runtime launch reservation changed during retry release.");
                 }
-                if (error instanceof LaunchSubmittedHostBusyError) {
-                    // A terminal Run no longer owns its finite provider process. Move
-                    // that exact Role owner through the durable cleanup lane before a
-                    // later retry creates the successor generation.
-                    this.#requireCleanup(request.owner);
-                }
                 throw new RuntimeLaunchError(true, launchId, error.message, error instanceof RuntimeHostContentionError
                     ? error.reason
                     : "previous-process");
@@ -291,7 +263,6 @@ export class RuntimeLaunchCoordinator {
             }
             await this.#compensateStartedHost(request.owner, binding, launchId, runtimeIsolation, new Error(`Runtime host was recreated while recovering an existing generation: ${request.owner.roleName}.`));
         }
-        let reservationConfirmation;
         try {
             assertLaunchCurrent();
             if (persistence === "immediate" && binding.nativeSessionId !== undefined) {
@@ -308,7 +279,7 @@ export class RuntimeLaunchCoordinator {
                 // Deferred scheduler persistence records a known native identity while
                 // retaining the reservation until exact Run delivery. Fresh Codex has
                 // no identity yet and keeps it until its matching generation Hook.
-                reservationConfirmation = this.reservations.confirmRuntimeLaunchReservation({
+                this.reservations.confirmRuntimeLaunchReservation({
                     owner: request.owner,
                     launchId
                 }, assertLaunchCurrent);
@@ -317,18 +288,6 @@ export class RuntimeLaunchCoordinator {
         catch (error) {
             await this.#compensateStartedHost(request.owner, binding, launchId, runtimeIsolation, error);
         }
-        if (launchCarriesExactRunPrompt
-            && binding.hostCreated !== false
-            && reservationConfirmation !== "provider-bound"
-            && binding.initialPromptRunId !== request.runId) {
-            // A launch-carried prompt may return before its matching lifecycle Hook,
-            // but only an exact Run marker can bridge that asynchronous interval.
-            // This is transport evidence, never Provider acceptance; the
-            // reservation remains fenced until the matching Hook binds the native
-            // Session.
-            this.#requireCleanup(request.owner);
-            throw new RuntimeBindingContractError(`Session host cannot acknowledge the exact launch-carried prompt: ${request.owner.roleName}.`);
-        }
         return binding;
     }
     async #settleFailedStart(request, launchId, reusedConfirmedRunningHost, runtimeIsolation) {
@@ -461,12 +420,12 @@ function validateRuntimeLaunchPreflight(preflight, request, launchId) {
         || !effectiveLaunchSnapshotsCompatible(preflight.effective, request.effective)
         || (request.mode === "resume"
             && preflight.nativeSessionId !== request.nativeSessionId)
-        || (preflight.initialPromptRunId !== undefined
-            && preflight.initialPromptRunId !== request.runId)) {
+        || (preflight.initialTurnRunId !== undefined
+            && preflight.initialTurnRunId !== request.runId)) {
         throw new Error(`Session host pre-start launch fence does not match the requested runtime: ${request.owner.roleName}.`);
     }
 }
-function requireMatchingRuntimeBinding(raw, request, launchId, launchPromptAcknowledgementRequired, launchPromptUncertaintyAllowed) {
+function requireMatchingRuntimeBinding(raw, request, launchId) {
     let binding;
     try {
         binding = createRuntimeBinding(raw);
@@ -479,9 +438,17 @@ function requireMatchingRuntimeBinding(raw, request, launchId, launchPromptAckno
         && (binding.owner.scope === "global"
             || (request.owner.scope === "task"
                 && binding.owner.taskId === request.owner.taskId));
-    if (binding.initialPromptRunId !== undefined
-        && binding.initialPromptRunId !== request.runId) {
-        throw new RuntimeBindingContractError(`Session host returned a launch-carried prompt for another Run: ${request.owner.roleName}.`);
+    if (binding.initialTurnRunId !== undefined
+        && binding.initialTurnRunId !== request.runId) {
+        throw new RuntimeBindingContractError(`Session host returned an initial structured Turn for another Run: ${request.owner.roleName}.`);
+    }
+    if (binding.initialTurnDeliveryUnknownRunId !== undefined
+        && binding.initialTurnDeliveryUnknownRunId !== request.runId) {
+        throw new RuntimeBindingContractError(`Session host returned a delivery-unknown initial structured Turn for another Run: ${request.owner.roleName}.`);
+    }
+    if (binding.initialTurnRejectedRunId !== undefined
+        && binding.initialTurnRejectedRunId !== request.runId) {
+        throw new RuntimeBindingContractError(`Session host returned a rejected initial structured Turn for another Run: ${request.owner.roleName}.`);
     }
     if (binding.launchId !== launchId
         || !ownerMatches
@@ -491,35 +458,8 @@ function requireMatchingRuntimeBinding(raw, request, launchId, launchPromptAckno
             && binding.nativeSessionId !== request.nativeSessionId)) {
         throw new RuntimeBindingContractError(`Session host returned a binding that does not match the requested runtime: ${request.owner.roleName}.`);
     }
-    if (launchPromptAcknowledgementRequired
-        && binding.initialPromptRunId !== request.runId
-        && !(launchPromptUncertaintyAllowed && binding.hostCreated === false)) {
-        throw binding.hostCreated === false
-            ? new LaunchSubmittedHostBusyError(`An earlier managed runtime is still exiting: ${request.owner.roleName}.`)
-            : new RuntimeBindingContractError(`Session host cannot acknowledge the exact launch-carried prompt: ${request.owner.roleName}.`);
-    }
-    if (launchPromptAcknowledgementRequired
-        && launchPromptUncertaintyAllowed
-        && binding.hostCreated === false
-        && request.runId !== undefined
-        && binding.initialPromptRunId !== request.runId) {
-        // A Controller restart can lose only the in-memory fact that a still-
-        // running generation carried this Run at process launch. Keep the
-        // uncertainty explicitly tied to the exact reservation/Run; the matching
-        // Provider Hook remains the sole acceptance authority.
-        return {
-            ...binding,
-            launchPromptUncertainRunId: request.runId
-        };
-    }
     return binding;
 }
-function carriesExactRunPrompt(request) {
-    if (request.owner.scope !== "task" || request.runId === undefined)
-        return false;
-    return request.adapterId === "claude"
-        || (request.adapterId === "codex" && request.mode === "new");
-}
 function defaultLaunchFingerprint(request) {
     return createHash("sha256").update(JSON.stringify([
         request.owner,