@zq-silk/yui 0.8.1 → 0.8.3

package/dist/runtime/builtinAgentDrivers.js

@@ -7,7 +7,7 @@ export function builtinDriverIdForAdapter(adapterId) {
     return builtinAgentDriverRegistry().requireByAdapterId(adapterId).id;
 }
 const STRUCTURED_CLI_CAPABILITIES = Object.freeze({
-    surfaces: Object.freeze(["interactive-cli"]),
+    surfaces: Object.freeze(["interactive-cli", "managed-protocol"]),
     lifecycle: Object.freeze({
         host: "persistent",
         providerProcess: "persistent",
@@ -67,10 +67,6 @@ export const BUILTIN_AGENT_DRIVERS = Object.freeze([
         adapterId: "claude",
         capabilities: Object.freeze({
             ...STRUCTURED_CLI_CAPABILITIES,
-            lifecycle: Object.freeze({
-                ...STRUCTURED_CLI_CAPABILITIES.lifecycle,
-                providerProcess: "per-turn"
-            }),
             observation: Object.freeze({
                 ...STRUCTURED_CLI_CAPABILITIES.observation,
                 sessionBootstrap: "preallocated",

package/dist/runtime/codexAppServerRuntime.js

@@ -15,6 +15,7 @@ export class CodexAppServerRequestError extends Error {
  */
 export class CodexAppServerRuntime {
     transport;
+    providerNamespace = "openai/codex";
     constructor(transport) {
         this.transport = transport;
     }
@@ -46,18 +47,59 @@ export class CodexAppServerRuntime {
         });
         return parseThreadSnapshot(result, id, "unknown");
     }
+    async inspectConversation(conversationId) {
+        const id = text(conversationId, "Codex thread id");
+        try {
+            const snapshot = await this.readConversation(id);
+            return {
+                state: "exists",
+                conversationId: snapshot.threadId,
+                ...(snapshot.activeTurnId === undefined ? {} : { activeTurnId: snapshot.activeTurnId })
+            };
+        }
+        catch (error) {
+            return {
+                state: codexAppServerErrorIsMissing(error) ? "missing" : "unknown",
+                conversationId: id
+            };
+        }
+    }
+    async submitTurn(input) {
+        return this.startTurn({
+            conversationId: input.conversationId,
+            text: input.text,
+            expectedNoActiveTurn: input.expectedNoActiveTurn,
+            clientUserMessageId: input.attemptId
+        });
+    }
     async startTurn(input) {
-        const snapshot = await this.readConversation(input.conversationId);
-        if (input.expectedNoActiveTurn && snapshot.activeTurnId !== undefined) {
-            return { status: "not-accepted", reason: `active-turn:${snapshot.activeTurnId}` };
+        const requestedThreadId = text(input.conversationId, "Codex thread id");
+        let threadId = requestedThreadId;
+        try {
+            const snapshot = await this.readConversation(requestedThreadId);
+            threadId = snapshot.threadId;
+            if (input.expectedNoActiveTurn && snapshot.activeTurnId !== undefined) {
+                return { status: "not-accepted", reason: `active-turn:${snapshot.activeTurnId}` };
+            }
+        }
+        catch (error) {
+            // A new App Server thread has no materialized Turn history yet. This
+            // exact response proves there cannot be an active Turn, so its first
+            // mutation can proceed without weakening unknown-delivery handling.
+            if (!codexAppServerErrorIsUnmaterialized(error))
+                throw error;
         }
         try {
             const result = await this.transport.request("turn/start", {
-                threadId: snapshot.threadId,
+                threadId,
                 ...(input.clientUserMessageId === undefined
                     ? {}
                     : { clientUserMessageId: text(input.clientUserMessageId, "Codex input attempt id") }),
-                input: [{ type: "text", text: text(input.text, "Codex Turn input") }]
+                input: [{
+                        type: "text",
+                        text: text(input.text, "Codex Turn input"),
+                        text_elements: []
+                    }]
             });
             const turnId = optionalId(result.turnId)
                 ?? optionalId(objectMember(result, "turn")?.id);
@@ -88,7 +130,11 @@ export class CodexAppServerRuntime {
                 ...(input.clientUserMessageId === undefined
                     ? {}
                     : { clientUserMessageId: text(input.clientUserMessageId, "Codex input attempt id") }),
-                input: [{ type: "text", text: text(input.text, "Codex steer input") }]
+                input: [{
+                        type: "text",
+                        text: text(input.text, "Codex steer input"),
+                        text_elements: []
+                    }]
             });
             const acceptedTurnId = optionalId(result.turnId);
             if (acceptedTurnId === expectedTurnId)
@@ -174,48 +220,6 @@ export class CodexAppServerRuntime {
         }
         return { quality: "exact", continuations: Object.freeze(observed) };
     }
-    async route(input) {
-        if (input.binding.adapterId !== "codex"
-            || input.binding.nativeSessionId !== input.fence.conversationId
-            || input.binding.launchId !== input.fence.activationId)
-            return "unsafe";
-        if (input.mode === "inject") {
-            return this.injectItems({
-                conversationId: input.fence.conversationId,
-                text: input.text
-            });
-        }
-        if (input.fence.nativeTurnId === undefined)
-            return "unsafe";
-        const outcome = await this.steerTurn({
-            conversationId: input.fence.conversationId,
-            expectedTurnId: input.fence.nativeTurnId,
-            text: input.text,
-            clientUserMessageId: input.attemptId
-        });
-        return outcome.status === "accepted" ? "accepted"
-            : outcome.status === "not-accepted" ? "not-accepted"
-                : "unknown";
-    }
-    async reconcile(input) {
-        if (input.binding.adapterId !== "codex"
-            || input.binding.nativeSessionId !== input.fence.conversationId
-            || input.binding.launchId !== input.fence.activationId)
-            return "unavailable";
-        // inject_items has no client receipt/idempotency field in the App Server
-        // protocol. A lost response therefore remains unknown and is never resent.
-        if (input.mode === "inject")
-            return "unknown";
-        try {
-            const snapshot = await this.readConversation(input.fence.conversationId);
-            return threadContainsClientInput(snapshot.raw, input.attemptId)
-                ? "accepted"
-                : "not-accepted";
-        }
-        catch (error) {
-            return isNotLoaded(error) ? "unavailable" : "unknown";
-        }
-    }
 }
 /** thread/closed means the loaded Activation ended; the durable thread remains resumable. */
 export function codexNotificationBoundary(input) {
@@ -305,18 +309,6 @@ function optionalTurnStatus(value) {
         ? value
         : undefined;
 }
-function threadContainsClientInput(raw, attemptId) {
-    const thread = objectMember(raw, "thread") ?? raw;
-    const turns = Array.isArray(thread.turns) ? thread.turns : [];
-    return turns.some((rawTurn) => {
-        const turn = object(rawTurn);
-        const items = turn === null || !Array.isArray(turn.items) ? [] : turn.items;
-        return items.some((rawItem) => {
-            const item = object(rawItem);
-            return item?.type === "userMessage" && item.clientId === attemptId;
-        });
-    });
-}
 function classifyMutationError(error) {
     if (error instanceof CodexAppServerRequestError) {
         if (["INVALID_PARAMS", "NOT_FOUND", "TURN_NOT_ACTIVE", -32602].includes(error.code)) {
@@ -330,6 +322,21 @@ function isNotLoaded(error) {
         && (String(error.code).toLowerCase().includes("not_loaded")
             || error.message.toLowerCase().includes("not loaded"));
 }
+function codexAppServerErrorIsUnmaterialized(error) {
+    if (!(error instanceof CodexAppServerRequestError) || Number(error.code) !== -32600) {
+        return false;
+    }
+    return /\bthread\b.*\bnot materialized yet\b.*\bbefore first user message\b/iu.test(error.message);
+}
+export function codexAppServerErrorIsMissing(error) {
+    if (!(error instanceof CodexAppServerRequestError))
+        return false;
+    if (error.code === "NOT_FOUND")
+        return true;
+    const message = error.message.toLowerCase();
+    return /\b(thread|conversation)\b.*\b(not found|missing|does not exist)\b/u.test(message)
+        || /\b(not found|missing|does not exist)\b.*\b(thread|conversation)\b/u.test(message);
+}
 function threadId(result) {
     return text(optionalId(result.threadId) ?? optionalId(objectMember(result, "thread")?.id), "Codex thread id");
 }

package/dist/runtime/exactControlPlane.js

@@ -361,8 +361,13 @@ export function refreshReusedTaskRuntimeDescriptorSource(source, home, store, cu
         throw new Error("A managed Task runtime descriptor must use its stable file source.");
     }
     const previous = resolved.descriptor;
-    if (previous.nativeSessionId === undefined
-        || previous.nativeSessionId !== current.nativeSessionId) {
+    if (previous.nativeSessionId === undefined) {
+        if (previous.runId !== current.runId || previous.launchId !== current.launchId) {
+            throw new Error("Task runtime descriptor source cannot bind a native Session from another generation.");
+        }
+        return refreshExactTaskRuntimeDescriptorSource(source, home, store);
+    }
+    if (previous.nativeSessionId !== current.nativeSessionId) {
         throw new Error("Task runtime descriptor source cannot jump to a replacement native Session.");
     }
     const refreshed = createExactTaskRuntimeDescriptor({

package/dist/runtime/index.js

@@ -5,12 +5,16 @@ export { normalizeRuntimeOwner } from "./runtimeOwner.js";
 export { createSessionLaunchRequest } from "./sessionLaunchRequest.js";
 export { createPendingTurnCompletion, DEFAULT_RECENT_TURN_ID_LIMIT, hasRecentTurnId, rememberRecentTurnId, validatePendingTurnCompletion, validateRecentTurnIds } from "./turnCompletion.js";
 export { RuntimeHostContentionError, RuntimeLaunchError } from "./ports.js";
-export { TmuxPromptPushAdapter, TmuxSessionHost } from "./tmuxAdapters.js";
+export { AgentHostPromptPushAdapter, TmuxSessionHost } from "./tmuxAdapters.js";
 export { FileTaskRuntimeIsolation, YUI_TASK_RUNTIME_ISOLATION_DESCRIPTOR, YUI_TASK_RUNTIME_SERVICE_NAMESPACE, assertTaskRuntimeIsolationPreflight, createTaskRuntimeIsolationDescriptor, parseTaskRuntimeIsolationDescriptor, planTaskRuntimeCleanup, taskRuntimeIsolationEnvironment, taskRuntimeIsolationFingerprint } from "./taskRuntimeIsolation.js";
 export { createSessionOwnerIdentity, discoverProviderRootByLaunchEnv, isLinuxProcessLive, listLaunchFencedProcesses, listOwnedProcessTree, readLinuxProcessIdentity } from "./sessionOwnerIdentity.js";
 export { FileSessionOwnerRegistry } from "./sessionOwnerRegistry.js";
 export { formatRuntimeLaunchDiagnostic, redactLaunchArgument, redactLaunchText, RuntimeLaunchFailure, toRuntimeLaunchFailure } from "./launchDiagnostics.js";
 export { DEFAULT_FORCED_GRACE_MS, DEFAULT_GRACEFUL_GRACE_MS, terminateSessionOwners } from "./sessionTerminationGuard.js";
 export { ProviderContinuationReconciliationService } from "./providerContinuationReconciliationService.js";
-export { codexNotificationBoundary, CodexAppServerRequestError, CodexAppServerRuntime } from "./codexAppServerRuntime.js";
+export { codexNotificationBoundary, codexAppServerErrorIsMissing, CodexAppServerRequestError, CodexAppServerRuntime } from "./codexAppServerRuntime.js";
+export { createProviderRuntimeBinding, acceptProviderTurn, beginProviderTurn, currentProviderActivation, currentProviderAuthority, currentProviderConversation, endProviderActivation, markProviderTurnDeliveryUnknown, rebindProviderRuntimeRun, rejectProviderTurn, settleProviderTurn, startProviderActivation, supersedeProviderConversation, transferProviderAuthority, updateProviderConversationRecoverability, validateProviderRuntimeBinding } from "./providerRuntimeIdentity.js";
+export { FencedProviderControl } from "./providerControl.js";
+export { sameProviderAuthorityFence, validateProviderAuthorityFence } from "./providerAuthorityFence.js";
+export { decideProviderRecovery } from "./providerRecoveryDecision.js";
 export { reconcileSessionOwners } from "./sessionReconciliation.js";

package/dist/runtime/launchBroker.js

@@ -1,5 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { resolve } from "node:path";
+import { validateProviderAuthorityFence } from "./providerAuthorityFence.js";
 const brokers = new Map();
 const TICKET_TTL_MS = 60_000;
 /** One Controller-process broker per canonical Home. Payloads never hit disk or tmux. */
@@ -75,17 +76,38 @@ function validatePayload(payload) {
     if (payload.startMode !== "provider" && payload.startMode !== "idle") {
         throw new Error("Agent Host start mode is invalid.");
     }
-    if (payload.providerInput !== undefined) {
-        if (payload.providerInput.kind !== "stdin-json-user-message") {
-            throw new Error("Agent Host Provider input transport is invalid.");
-        }
-        if (typeof payload.providerInput.boundedText !== "string"
-            || payload.providerInput.boundedText.includes("\0")
-            || Buffer.byteLength(payload.providerInput.boundedText, "utf8") > 4 * 1024) {
+    if (payload.providerControl !== undefined)
+        validateProviderControl(payload.providerControl);
+    return payload;
+}
+function validateProviderControl(control) {
+    if (control.schemaVersion !== 1)
+        throw new Error("Agent Host Provider control version is invalid.");
+    if (control.adapterId !== "codex" && control.adapterId !== "claude") {
+        throw new Error("Agent Host Provider control adapter is invalid.");
+    }
+    if ((control.adapterId === "codex" && control.transport !== "codex-app-server-stdio")
+        || (control.adapterId === "claude" && control.transport !== "claude-stream-json")) {
+        throw new Error("Agent Host Provider control transport does not match its adapter.");
+    }
+    if (control.mode !== "new" && control.mode !== "resume") {
+        throw new Error("Agent Host Provider control mode is invalid.");
+    }
+    const requiresNativeSessionId = control.mode === "resume" || control.adapterId === "claude";
+    if (requiresNativeSessionId !== (control.nativeSessionId !== undefined)) {
+        throw new Error("Agent Host Provider resume identity is inconsistent.");
+    }
+    if (control.nativeSessionId !== undefined)
+        text(control.nativeSessionId, "nativeSessionId");
+    validateProviderAuthorityFence(control.authority);
+    if (control.initialTurn !== undefined) {
+        text(control.initialTurn.attemptId, "Provider input attemptId");
+        if (typeof control.initialTurn.boundedText !== "string"
+            || control.initialTurn.boundedText.includes("\0")
+            || Buffer.byteLength(control.initialTurn.boundedText, "utf8") > 32 * 1024) {
             throw new Error("Agent Host Provider input must be bounded bootstrap text.");
         }
     }
-    return payload;
 }
 function text(value, label) {
     if (typeof value !== "string" || value.length === 0 || value.includes("\0")) {

package/dist/runtime/providerAuthorityFence.js

@@ -0,0 +1,24 @@
+export function validateProviderAuthorityFence(value) {
+    if (!Number.isSafeInteger(value.epoch) || value.epoch < 1) {
+        throw new Error("Provider authority epoch is invalid.");
+    }
+    if (value.owner !== "controller" && value.owner !== "human") {
+        throw new Error("Provider authority owner is invalid for a writer fence.");
+    }
+    if (typeof value.holderId !== "string" || value.holderId.trim().length === 0
+        || value.holderId.includes("\0")) {
+        throw new Error("Provider authority holder is invalid.");
+    }
+    return Object.freeze({
+        epoch: value.epoch,
+        owner: value.owner,
+        holderId: value.holderId.trim()
+    });
+}
+export function sameProviderAuthorityFence(left, right) {
+    const first = validateProviderAuthorityFence(left);
+    const second = validateProviderAuthorityFence(right);
+    return first.epoch === second.epoch
+        && first.owner === second.owner
+        && first.holderId === second.holderId;
+}

package/dist/runtime/providerControl.js

@@ -0,0 +1,63 @@
+import { currentProviderActivation, currentProviderAuthority, currentProviderConversation, validateProviderRuntimeBinding } from "./providerRuntimeIdentity.js";
+/**
+ * Applies the durable single-writer fence before any Provider mutation. The
+ * Adapter never receives authority to infer or repair identity.
+ */
+export class FencedProviderControl {
+    adapter;
+    constructor(adapter) {
+        this.adapter = adapter;
+    }
+    async submitTurn(input) {
+        this.#assertWriter(input.binding, input.fence);
+        return this.adapter.submitTurn({
+            conversationId: input.fence.conversationId,
+            attemptId: identity(input.attemptId, "Provider input attempt id"),
+            text: text(input.text, "Provider Turn input"),
+            expectedNoActiveTurn: input.expectedNoActiveTurn ?? true
+        });
+    }
+    async interruptTurn(input) {
+        this.#assertWriter(input.binding, input.fence);
+        return this.adapter.interruptTurn({
+            conversationId: input.fence.conversationId,
+            turnId: identity(input.turnId, "Provider Turn id")
+        });
+    }
+    async inspectConversation(binding) {
+        const normalized = validateProviderRuntimeBinding(binding);
+        this.#assertNamespace(normalized);
+        return this.adapter.inspectConversation(currentProviderConversation(normalized).conversationId);
+    }
+    #assertWriter(binding, fence) {
+        const normalized = validateProviderRuntimeBinding(binding);
+        this.#assertNamespace(normalized);
+        const conversation = currentProviderConversation(normalized);
+        const activation = currentProviderActivation(normalized);
+        const authority = currentProviderAuthority(normalized);
+        if (conversation.conversationId !== fence.conversationId
+            || activation?.activationId !== fence.activationId
+            || authority.epoch !== fence.authorityEpoch
+            || authority.owner !== fence.authorityOwner
+            || authority.holderId !== fence.holderId) {
+            throw new Error("Provider writer fence is stale.");
+        }
+    }
+    #assertNamespace(binding) {
+        if (binding.providerNamespace !== this.adapter.providerNamespace) {
+            throw new Error("Provider control Adapter does not match its Runtime Binding.");
+        }
+    }
+}
+function identity(value, label) {
+    if (typeof value !== "string" || value.trim().length === 0 || value.includes("\0")) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return value.trim();
+}
+function text(value, label) {
+    if (typeof value !== "string" || value.trim().length === 0 || value.includes("\0")) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return value;
+}

package/dist/runtime/providerRecoveryDecision.js

@@ -0,0 +1,55 @@
+import { currentProviderActivation, currentProviderConversation, validateProviderRuntimeBinding } from "./providerRuntimeIdentity.js";
+/**
+ * Exact tri-state recovery policy. Unknown is a terminal decision for the
+ * automatic recovery attempt, not permission to create another Conversation.
+ */
+export function decideProviderRecovery(input) {
+    const binding = validateProviderRuntimeBinding(input.binding);
+    const conversation = currentProviderConversation(binding);
+    if (input.probe.conversationId !== conversation.conversationId) {
+        throw new Error("Provider recovery probe targets a different Conversation.");
+    }
+    if (input.probe.state === "unknown") {
+        return {
+            action: "attention",
+            conversationId: conversation.conversationId,
+            reason: "Provider Conversation existence is unknown; replacement is fenced."
+        };
+    }
+    if (input.probe.state === "exists") {
+        if (input.probe.activeTurnId !== undefined) {
+            return {
+                action: "observe-active-turn",
+                conversationId: conversation.conversationId,
+                turnId: input.probe.activeTurnId
+            };
+        }
+        if (input.unsettledInputDelivery || providerTurnIsUnsettled(binding)) {
+            return {
+                action: "attention",
+                conversationId: conversation.conversationId,
+                reason: "Provider Conversation exists but prior input delivery is still unsettled."
+            };
+        }
+        return { action: "resume", conversationId: conversation.conversationId };
+    }
+    if (input.unsettledInputDelivery || providerTurnIsUnsettled(binding)) {
+        return {
+            action: "attention",
+            conversationId: conversation.conversationId,
+            reason: "Provider Conversation is missing but input delivery remains unsettled."
+        };
+    }
+    if (currentProviderActivation(binding) !== null || binding.authority.owner !== "none") {
+        return {
+            action: "attention",
+            conversationId: conversation.conversationId,
+            reason: "Provider Conversation is missing but its Activation writer has not ended."
+        };
+    }
+    return { action: "replace", conversationId: conversation.conversationId };
+}
+function providerTurnIsUnsettled(binding) {
+    return binding.turn !== null
+        && ["submitting", "accepted", "running", "delivery-unknown"].includes(binding.turn.status);
+}