@zq-silk/yui 2.0.0 → 2.1.0

package/dist/cli/commandDiscovery.js

@@ -0,0 +1,69 @@
+import { ROOT_COMMAND, findCommandNode } from "./commandCatalog.js";
+import { hasManagedIdentity } from "../runtime/managedIdentity.js";
+/** Offline presentation hints only. Execution still authenticates the original
+ * caller, including stale/incomplete identities, at its existing boundary. */
+export function discoveryAudience(env) {
+    if (!hasManagedIdentity(env))
+        return "public";
+    if (!env.YUI_ROLE || !env.YUI_NATIVE_SESSION_ID)
+        return "unbound";
+    if (env.YUI_SESSION_SCOPE === "global")
+        return env.YUI_ROLE === "operator" ? "operator" : "global";
+    if (env.YUI_SESSION_SCOPE === "task" && env.YUI_TASK_ID)
+        return env.YUI_ROLE === "leader" ? "leader" : "assignment";
+    return "unbound";
+}
+export function discoveryCommandTree(env) {
+    const audience = discoveryAudience(env);
+    const project = (node) => {
+        const children = node.children.map(project).filter((child) => child !== undefined);
+        const eligible = node.discovery?.surface !== "runtime" && node.discovery?.audiences.includes(audience);
+        if (!children.length && (!eligible || node.kind === "group") && node !== ROOT_COMMAND)
+            return undefined;
+        const executable = eligible && node.kind !== "group";
+        const kind = children.length ? executable ? "hybrid" : "group" : node.kind;
+        const template = `${node.path.join(" ")}${kind === "group" ? " <command>" : ""}`;
+        const omittedOptions = Object.entries(node.discovery?.optionAudiences ?? {})
+            .filter(([, audiences]) => !audiences.includes(audience)).map(([option]) => option);
+        const text = (value) => omittedOptions.reduce((line, option) => line.replace(new RegExp(`\\s*\\[${option}(?:\\s+[^\\]]*)?\\]`, "g"), ""), value);
+        const options = node.options.filter(option => !omittedOptions.includes(option));
+        // Group prose often contains concrete commands for several audiences.
+        // Generate its usage from the same retained children, not unfiltered text.
+        return {
+            ...node, children, hidden: false, kind,
+            usage: kind === "group" ? [template] : node.usage.map(text),
+            examples: kind === "group" ? children.slice(0, 3).map(child => child.usage[0]) : node.examples.map(text),
+            options, optionValues: Object.fromEntries(Object.entries(node.optionValues).filter(([option]) => options.includes(option))),
+            sections: node.sections.map(section => ({ ...section,
+                entries: section.entries.filter(entry => children.some(child => child.name === entry) || (executable && node.values.some(value => value.name === entry)))
+            })).filter(section => section.entries.length > 0),
+            ...(executable ? {} : { options: [], values: [], optionValues: {}, argumentValues: {} })
+        };
+    };
+    const tree = project(ROOT_COMMAND);
+    if (audience === "public") {
+        const sections = [
+            { id: "start", title: "Start work", entries: ["operator", "project"] },
+            { id: "progress", title: "Inspect progress", entries: ["task", "jobs", "execution", "telemetry"] },
+            { id: "participate", title: "Participate and control", entries: ["role", "session"] },
+            { id: "maintain", title: "Configure and maintain", entries: ["help", "version", "setup", "start", "doctor", "config", "web", "controller", "resources", "update", "upgrade", "release"] }
+        ];
+        return { ...tree, sections: sections.map(section => ({ ...section,
+                entries: section.entries.filter(entry => tree.children.some(child => child.name === entry))
+            })) };
+    }
+    // Help accepts catalog paths, and config describe accepts only retained domains.
+    const config = findCommandNode(["config"], tree);
+    if (config) {
+        const domains = config.children.filter(child => !["show", "describe"].includes(child.name)).map(child => child.name);
+        return {
+            ...tree, children: tree.children.map(child => child !== config ? child : {
+                ...config, children: config.children.map(node => node.name !== "describe" ? node : {
+                    ...node, argumentValues: { 0: domains }, usage: ["yui config describe [domain]"],
+                    examples: ["yui config describe"]
+                })
+            })
+        };
+    }
+    return tree;
+}

package/dist/cli/completion.js

@@ -1,235 +1,30 @@
-import { ROOT_COMMAND, listPublicCommandPaths, orderedImmediateTokens, visibleChildren } from "./commandCatalog.js";
-import { findInteractionPolicy } from "./interactionPolicy.js";
+/** Resolve the current caller on every completion, never the installer's view.
+ * Command names are local; target selectors use authenticated scoped reads. */
 export function renderCompletion(shell) {
-    const entries = collectEntries(ROOT_COMMAND);
     switch (shell) {
-        case "bash": return renderBash(entries);
-        case "zsh": return renderZsh(entries);
-        case "fish": return renderFish(entries);
-        default: throw new Error("Completion shell must be one of bash, zsh, fish.");
-    }
-}
-function collectEntries(root) {
-    const entries = [];
-    const visit = (node) => {
-        if (!node.hidden && !node.commandPathArguments) {
-            const policy = findInteractionPolicy(node);
-            entries.push({
-                path: node.path.slice(1).join(" "),
-                immediate: orderedImmediateTokens(node),
-                options: node.options,
-                dynamicArguments: policy?.selectors.flatMap((selector) => selector.argumentIndex === undefined ? [] : [selector.argumentIndex]) ?? [],
-                dynamicOptions: policy?.selectors.flatMap((selector) => selector.option === undefined ? [] : [selector.option]) ?? []
-            });
-        }
-        visibleChildren(node).forEach(visit);
-    };
-    visit(root);
-    return entries;
-}
-function manifest(prefix) {
-    return listPublicCommandPaths().map((path) => `${prefix} ${path}`).join("\n");
-}
-function renderBash(entries) {
-    const functionName = "_yui";
-    return `${manifest("# yui command:")}
-${functionName}() {
-  local current path previous dynamic_candidate dynamic=false
-  local -a candidates dynamic_candidates
-  current="\${COMP_WORDS[COMP_CWORD]}"
-  path=""
-  if (( COMP_CWORD > 1 )); then
-    path="\${COMP_WORDS[*]:1:COMP_CWORD-1}"
-  fi
-  previous="\${COMP_WORDS[COMP_CWORD-1]}"
-  if [[ "$current" != -* ]]; then
-    case "$COMP_CWORD:$path" in
-${bashDynamicArgumentCases(entries)}
-    esac
-  fi
-  if [[ "$dynamic" == false ]]; then
-    case "$previous:$path" in
-${bashDynamicOptionCases(entries)}
-    esac
-  fi
-  if [[ "$dynamic" == true ]]; then
-    while IFS= read -r dynamic_candidate; do
-      [[ -n "$dynamic_candidate" ]] && dynamic_candidates+=("$dynamic_candidate")
-    done < <(command yui config completion candidates "$current" -- "\${COMP_WORDS[@]:1:COMP_CWORD-1}" 2>/dev/null)
-    candidates=("\${dynamic_candidates[@]}")
-  elif [[ "$current" == -* ]]; then
-    case "$path" in
-${bashStaticOptionCases(entries)}
-      *) candidates=();;
-    esac
-  else
-    case "$path" in
-${entries.map((entry) => `      ${bashPattern(entry.path)}) candidates=(${[...entry.immediate, ...entry.options].map(shellQuote).join(" ")});;`).join("\n")}
-      *) candidates=();;
-    esac
-  fi
-  COMPREPLY=( $(compgen -W "\${candidates[*]}" -- "$current") )
-}
-complete -F ${functionName} yui
+        case "bash": return `_yui() {
+  local candidate current="\${COMP_WORDS[COMP_CWORD]}"
+  COMPREPLY=()
+  while IFS= read -r candidate; do
+    [[ -n "$candidate" ]] && COMPREPLY+=("$candidate")
+  done < <(command yui config completion candidates "$current" -- "\${COMP_WORDS[@]:1:COMP_CWORD-1}" 2>/dev/null)
+}
+complete -F _yui yui
 `;
-}
-function renderZsh(entries) {
-    return `#compdef yui
-${manifest("# yui command:")}
-local current command_path previous dynamic_output dynamic=false
+        case "zsh": return `#compdef yui
+local output
 local -a candidates
-current="$words[CURRENT]"
-command_path=""
-if (( CURRENT > 2 )); then
-  command_path="\${(j: :)words[2,CURRENT-1]}"
-fi
-previous="$words[CURRENT-1]"
-if [[ "$current" != -* ]]; then
-  case "$CURRENT:$command_path" in
-${zshDynamicArgumentCases(entries)}
-  esac
-fi
-if [[ "$dynamic" == false ]]; then
-  case "$previous:$command_path" in
-${zshDynamicOptionCases(entries)}
-  esac
-fi
-if [[ "$dynamic" == true ]]; then
-  dynamic_output="$(command yui config completion candidates "$current" -- "\${(@)words[2,CURRENT-1]}" 2>/dev/null)"
-  candidates=("\${(@f)dynamic_output}")
-elif [[ "$current" == -* ]]; then
-  case "$command_path" in
-${zshStaticOptionCases(entries)}
-    *) candidates=();;
-  esac
-else
-  case "$command_path" in
-${entries.map((entry) => `    ${zshPattern(entry.path)}) candidates=(${[...entry.immediate, ...entry.options].map(shellQuote).join(" ")});;`).join("\n")}
-    *) candidates=();;
-  esac
-fi
+output="$(command yui config completion candidates "$words[CURRENT]" -- "\${(@)words[2,CURRENT-1]}" 2>/dev/null)"
+candidates=("\${(@f)output}")
 (( \${#candidates[@]} > 0 )) && compadd -- "$candidates[@]"
 `;
-}
-function renderFish(entries) {
-    const prefix = "__yui";
-    const lines = [
-        manifest("# yui command:"),
-        `function ${prefix}_at_path`,
-        "  set -l actual (commandline -opc)",
-        "  set -e actual[1]",
-        "  test (count $actual) -eq (count $argv); or return 1",
-        "  for index in (seq (count $argv))",
-        "    test \"$actual[$index]\" = \"$argv[$index]\"; or return 1",
-        "  end",
-        "end",
-        `function ${prefix}_at_command_options`,
-        "  string match -q -- '-*' (commandline -ct); or return 1",
-        "  set -l actual (commandline -opc)",
-        "  set -e actual[1]",
-        "  test (count $actual) -ge (count $argv); or return 1",
-        "  for index in (seq (count $argv))",
-        "    test \"$actual[$index]\" = \"$argv[$index]\"; or return 1",
-        "  end",
-        "end",
-        `function ${prefix}_needs_dynamic`,
-        "  set -l mode $argv[1]",
-        "  set -l expected $argv[2]",
-        "  set -l expected_path $argv[3..-1]",
-        "  set -l actual (commandline -opc)",
-        "  set -e actual[1]",
-        "  test (count $actual) -ge (count $expected_path); or return 1",
-        "  for index in (seq (count $expected_path))",
-        "    test \"$actual[$index]\" = \"$expected_path[$index]\"; or return 1",
-        "  end",
-        "  if test \"$mode\" = argument",
-        "    string match -q -- '-*' (commandline -ct); and return 1",
-        "    test (count $actual) -eq \"$expected\"",
-        "  else",
-        "    test \"$actual[-1]\" = \"$expected\"",
-        "  end",
-        "end",
-        `function ${prefix}_dynamic`,
-        "  set -l words (commandline -opc)",
-        "  yui config completion candidates (commandline -ct) -- $words[2..-1] 2>/dev/null",
-        "end"
-    ];
-    for (const entry of entries) {
-        for (const argument of entry.dynamicArguments) {
-            const condition = `${prefix}_needs_dynamic argument ${argument} ${fishPath(entry.path)}`;
-            lines.push(`complete -c yui -f -n ${fishQuote(condition)} -a '(${prefix}_dynamic)'`);
-        }
-        for (const option of entry.dynamicOptions) {
-            const condition = `${prefix}_needs_dynamic option ${option} ${fishPath(entry.path)}`;
-            lines.push(`complete -c yui -f -n ${fishQuote(condition)} -a '(${prefix}_dynamic)'`);
-        }
-    }
-    for (const entry of entries) {
-        if (entry.immediate.length > 0) {
-            const condition = entry.path.length === 0
-                ? "__fish_use_subcommand"
-                : `${prefix}_at_path ${fishPath(entry.path)}${fishInitialDynamicExclusion(entry, prefix)}`;
-            lines.push(`complete -c yui -f -n ${fishQuote(condition)} -a '${escapeSingle(entry.immediate.join(" "))}'`);
-        }
-        if (entry.options.length > 0) {
-            const path = fishPath(entry.path);
-            const exact = `${prefix}_at_path ${path}${fishInitialDynamicExclusion(entry, prefix)}`;
-            const condition = `begin; ${exact}; end; or ${prefix}_at_command_options ${path}`;
-            lines.push(`complete -c yui -f -n ${fishQuote(condition)} -a '${escapeSingle(entry.options.join(" "))}'`);
-        }
+        case "fish": return `function __yui_candidates
+  set -l words (commandline -opc)
+  set -l current (commandline -ct)
+  command yui config completion candidates "$current" -- $words[2..-1] 2>/dev/null
+end
+complete -c yui -f -a '(__yui_candidates)'
+`;
+        default: throw new Error("Completion shell must be one of bash, zsh, fish.");
     }
-    return `${lines.join("\n")}\n`;
-}
-function bashDynamicArgumentCases(entries) {
-    return entries.flatMap((entry) => entry.dynamicArguments.map((argument) => `    ${dynamicArgumentPattern(argument + 1, entry.path)}) dynamic=true;;`)).join("\n");
-}
-function zshDynamicArgumentCases(entries) {
-    return entries.flatMap((entry) => entry.dynamicArguments.map((argument) => `  ${dynamicArgumentPattern(argument + 2, entry.path)}) dynamic=true;;`)).join("\n");
-}
-function dynamicArgumentPattern(position, path) {
-    return `${position}:${shellQuote(path)}|${position}:${shellQuote(`${path} `)}*`;
-}
-function bashDynamicOptionCases(entries) {
-    return entries.flatMap((entry) => entry.dynamicOptions.map((option) => `      ${dynamicOptionPattern(option, entry.path)}) dynamic=true;;`)).join("\n");
-}
-function zshDynamicOptionCases(entries) {
-    return entries.flatMap((entry) => entry.dynamicOptions.map((option) => `    ${dynamicOptionPattern(option, entry.path)}) dynamic=true;;`)).join("\n");
-}
-function dynamicOptionPattern(option, path) {
-    return `${shellQuote(`${option}:${path}`)}|${shellQuote(`${option}:${path} `)}*`;
-}
-function bashStaticOptionCases(entries) {
-    return staticOptionEntries(entries).map((entry) => `      ${commandPrefixPattern(entry.path)}) candidates=(${entry.options.map(shellQuote).join(" ")});;`).join("\n");
-}
-function zshStaticOptionCases(entries) {
-    return staticOptionEntries(entries).map((entry) => `    ${commandPrefixPattern(entry.path)}) candidates=(${entry.options.map(shellQuote).join(" ")});;`).join("\n");
-}
-function staticOptionEntries(entries) {
-    return entries.filter((entry) => entry.options.length > 0)
-        .sort((left, right) => right.path.split(" ").length - left.path.split(" ").length);
-}
-function commandPrefixPattern(path) {
-    return `${shellQuote(path)}|${shellQuote(`${path} `)}*`;
-}
-function fishInitialDynamicExclusion(entry, prefix) {
-    const initial = entry.dynamicArguments.filter((position) => position === entry.path.split(" ").filter(Boolean).length);
-    return initial.map((position) => `; and not ${prefix}_needs_dynamic argument ${position} ${fishPath(entry.path)}`).join("");
-}
-function fishPath(path) {
-    return path.split(" ").filter(Boolean).join(" ");
-}
-function bashPattern(path) {
-    return path.length === 0 ? '""' : shellQuote(path);
-}
-function zshPattern(path) {
-    return path.length === 0 ? '""' : shellQuote(path);
-}
-function shellQuote(value) {
-    return `'${escapeSingle(value)}'`;
-}
-function fishQuote(value) {
-    return `'${escapeSingle(value)}'`;
-}
-function escapeSingle(value) {
-    return value.replaceAll("'", "'\\''");
 }

package/dist/cli/dynamicCompletion.js

@@ -5,7 +5,16 @@ export async function resolveCompletionCandidates(input) {
     const words = input.words[0] === "yui"
         ? input.words.slice(1)
         : [...input.words];
-    const { node, consumed } = resolveCommand(words);
+    const root = input.root ?? ROOT_COMMAND;
+    if (words[0] === "help") {
+        const { node, consumed } = resolveCommand(words.slice(1), root);
+        return consumed === words.length - 1 ? prefix(visibleChildren(node).map(child => child.name), input.current) : [];
+    }
+    const { node, consumed } = resolveCommand(words, root);
+    if (node.kind === "group" && consumed < words.length)
+        return [];
+    if (input.current.startsWith("-"))
+        return prefix(node.options, input.current);
     if (consumed === words.length && node.children.length > 0) {
         return prefix(visibleChildren(node).map((child) => child.name), input.current);
     }
@@ -13,9 +22,6 @@ export async function resolveCompletionCandidates(input) {
     if (previous !== undefined && Object.hasOwn(node.optionValues, previous)) {
         return prefix(node.optionValues[previous] ?? [], input.current);
     }
-    if (input.current.startsWith("-")) {
-        return prefix(node.options, input.current);
-    }
     const argumentPosition = words.length;
     const policy = findInteractionPolicy(node);
     const selector = policy?.selectors.find((candidate) => selectorApplies(candidate, previous, argumentPosition));
@@ -31,8 +37,8 @@ function selectorApplies(selector, previous, argumentPosition) {
         return selector.option === previous;
     return selector.argumentIndex === argumentPosition;
 }
-function resolveCommand(words) {
-    let node = ROOT_COMMAND;
+function resolveCommand(words, root) {
+    let node = root;
     let consumed = 0;
     while (consumed < words.length && node.kind !== "leaf") {
         const child = findChild(node, words[consumed] ?? "");

package/dist/cli/invocationAuthority.js

@@ -1,4 +1,5 @@
 import { usageError } from "../errors/cliError.js";
+import { hasManagedIdentity } from "../runtime/managedIdentity.js";
 import { requireManagedGlobalCaller } from "../runtime/managedCaller.js";
 import { routeInvocation } from "./invocationRouter.js";
 import { findInteractionPolicy } from "./interactionPolicy.js";
@@ -17,8 +18,7 @@ export function assertConfigurationAuthority(args, store, env) {
         requireManagedGlobalCaller(store, env);
         return;
     }
-    if (env.YUI_SESSION_SCOPE !== undefined || env.YUI_ROLE !== undefined
-        || env.YUI_AGENT_ID !== undefined || env.YUI_NATIVE_SESSION_ID !== undefined) {
+    if (hasManagedIdentity(env)) {
         throw usageError("Home configuration and resource mutations require the user or current Operator, not a Task Assignment.");
     }
 }

package/dist/cli/invocationRouter.js

@@ -1,16 +1,27 @@
 import { findChild, ROOT_COMMAND } from "./commandCatalog.js";
-export function routeInvocation(args) {
+export function routeInvocation(args, discoveryRoot = ROOT_COMMAND) {
     if (args.length === 0)
         return { kind: "execute", node: ROOT_COMMAND };
     if (args[0] === "help")
-        return resolveHelpPath(args.slice(1));
-    return resolveExecutionPath(args);
+        return resolveHelpPath(args.slice(1), discoveryRoot);
+    const result = resolveExecutionPath(args);
+    if (result.kind === "execute" || result.kind === "help")
+        return result;
+    const path = result.helpNode.path.slice(1);
+    let helpNode = discoveryRoot;
+    for (const segment of path) {
+        const child = findChild(helpNode, segment);
+        if (!child)
+            break;
+        helpNode = child;
+    }
+    return { ...result, helpNode };
 }
-function resolveHelpPath(path) {
+function resolveHelpPath(path, root) {
     if (path.length === 0)
-        return { kind: "help", node: ROOT_COMMAND };
-    let node = ROOT_COMMAND;
-    let nearestGroup = ROOT_COMMAND;
+        return { kind: "help", node: root };
+    let node = root;
+    let nearestGroup = root;
     for (const segment of path) {
         const child = findChild(node, segment);
         if (child === undefined || child.hidden) {

package/dist/cli.js

@@ -12,6 +12,8 @@ import { nativeAgentEnvironmentNames } from "./agent/launchEnvironment.js";
 import { listArtifactsCapability, readArtifactCapability, saveArtifactCapability } from "./artifacts/artifactCapability.js";
 import { renderAgentConfigurationResolutionNotice } from "./cli/agentConfigurationPicker.js";
 import { describeCommandTree, findCommandNode } from "./cli/commandCatalog.js";
+import { discoveryCommandTree } from "./cli/commandDiscovery.js";
+import { contextRecordReader } from "./context/taskContext.js";
 import { renderCompletion } from "./cli/completion.js";
 import { runCompletionWizard } from "./cli/completionWizard.js";
 import { resolveCompletionCandidates } from "./cli/dynamicCompletion.js";
@@ -21,6 +23,7 @@ import { routeInvocation } from "./cli/invocationRouter.js";
 import { operatorOfflineCommand, taskDiagnosticTarget } from "./cli/managedDiagnostics.js";
 import { assertConfigurationAuthority, assertTaskInvocationScope } from "./cli/invocationAuthority.js";
 import { requireManagedGlobalCaller, ManagedRuntimeDriftError } from "./runtime/managedCaller.js";
+import { hasManagedIdentity } from "./runtime/managedIdentity.js";
 import { resolveOperatorWizardArguments } from "./cli/operatorWizard.js";
 import { resolveGlobalRoleAgentConfigurationArguments, resolveRoleWizardArguments } from "./cli/roleWizard.js";
 import { runUpdateCommand } from "./cli/updateCommand.js";
@@ -153,11 +156,14 @@ function failureContext() {
 }
 export async function main() {
     const home = resolveYuiHome(process.env);
+    const discovery = discoveryCommandTree(process.env);
     invocationHome = home;
     const routedForFence = args.length === 0 ? undefined : routeInvocation(args);
     const managedInvocation = process.env.YUI_SESSION_SCOPE === "task"
         || process.env.YUI_SESSION_SCOPE === "global";
     const homeFreeInvocation = args.length === 0
+        || (args[0] === "config" && (args[1] === "describe"
+            || (args[1] === "completion" && args[2] === "candidates")))
         || (args[0] === "version" && args.length === 1)
         || routedForFence?.kind === "help"
         || routedForFence?.kind === "path-error"
@@ -187,16 +193,16 @@ export async function main() {
         return;
     }
     if (args.length === 0) {
-        emit(renderCommandHelp((await import("./cli/commandCatalog.js")).ROOT_COMMAND, VERSION));
+        emit(renderCommandHelp(discovery, VERSION), false, jsonOutput ? describeCommandTree(discovery) : undefined);
         return;
     }
     if (args[0] === "version" && args.length === 1) {
         emit(VERSION, true, yuiVersionIdentity());
         return;
     }
-    const invocation = routeInvocation(args);
+    const invocation = routeInvocation(args, discovery);
     if (invocation.kind === "help") {
-        emit(renderCommandHelp(invocation.node, VERSION), true);
+        emit(renderCommandHelp(invocation.node, VERSION), true, jsonOutput ? describeCommandTree(invocation.node) : undefined);
         return;
     }
     if (invocation.kind === "path-error") {
@@ -207,11 +213,22 @@ export async function main() {
     }
     if (args[0] === "version")
         throw usageError("Version usage: yui version");
+    // Offline discovery is not an execution credential. Target selectors enter
+    // the original authenticated path lazily, only when stored data is needed.
+    if (args[0] === "config" && args[1] === "completion" && args[2] === "candidates") {
+        await completionCommand(home, invocation.node);
+        return;
+    }
+    if (args[0] === "config" && args[1] === "describe") {
+        const target = findCommandNode(args[2] === undefined ? ["config"] : ["config", args[2]], discovery);
+        if (args.length > 3 || !target)
+            throw usageError("Config describe usage: yui config describe [visible-domain].");
+        emit(renderCommandHelp(target, VERSION), false, describeCommandTree(target));
+        return;
+    }
     const { contract: taskFinalReviewContract, verifiedStore } = await preflightManagedTaskControlPlane();
     assertTaskInvocationScope(args, process.env);
-    if (["config", "resources"].includes(args[0] ?? "") && (managedInvocation
-        || process.env.YUI_ROLE !== undefined || process.env.YUI_AGENT_ID !== undefined
-        || process.env.YUI_NATIVE_SESSION_ID !== undefined)) {
+    if (["config", "resources"].includes(args[0] ?? "") && hasManagedIdentity(process.env)) {
         const ownedStore = verifiedStore === undefined ? openCurrentTaskStore(home) : undefined;
         try {
             assertConfigurationAuthority(args, verifiedStore ?? ownedStore, process.env);
@@ -268,21 +285,6 @@ export async function main() {
         await completionCommand(home, invocation.node);
         return;
     }
-    if (args[0] === "config" && args[1] === "describe") {
-        const describeNode = findCommandNode(["config", "describe"]);
-        if (describeNode === undefined)
-            throw new Error("Config describe command is missing from the catalog.");
-        const domain = args[2];
-        const domains = describeNode.argumentValues[0] ?? [];
-        if (args.length > 3 || (domain !== undefined && !domains.includes(domain))) {
-            throw usageError(`Config describe usage: ${describeNode.usage.join(" | ")}.`);
-        }
-        const target = findCommandNode(domain === undefined ? ["config"] : ["config", domain]);
-        if (target === undefined)
-            throw new Error(`Config domain is missing from the catalog: ${domain}.`);
-        emit(renderCommandHelp(target, VERSION), false, describeCommandTree(target));
-        return;
-    }
     if (args[0] === "capability") {
         const result = await runCapabilityCommand(args.slice(1), home, process.env);
         emit(JSON.stringify(result, null, 2), false, result);
@@ -1959,6 +1961,9 @@ async function preflightManagedTaskControlPlane() {
         if (process.env.YUI_SESSION_SCOPE === "global") {
             return await preflightManagedGlobalControlPlane();
         }
+        if (hasManagedIdentity(process.env)) {
+            throw usageError("Managed Agent identity is incomplete; refusing to infer user authority.");
+        }
         if (taskFinalReviewInvocation.request !== undefined) {
             throw new Error("Task final-review contract may only be established from the Task Leader's managed Session.");
         }
@@ -2594,10 +2599,23 @@ async function completionCommand(home, node) {
         if (prefix === undefined || separator !== 4) {
             throw usageError("Completion candidates usage: yui config completion candidates <prefix> -- <words...>");
         }
+        let selection;
         const candidates = await resolveCompletionCandidates({
             current: prefix,
             words: args.slice(separator + 1),
-            ports: completionSelectionPorts(home)
+            root: discoveryCommandTree(process.env),
+            ports: { call: async (method, params) => {
+                    if (!selection) {
+                        assertCliHomeReleaseFence({
+                            home, packageRoot: fileURLToPath(new URL("../", import.meta.url)),
+                            entryPath: fileURLToPath(import.meta.url), args
+                        });
+                        await preflightManagedTaskControlPlane();
+                        assertTaskInvocationScope(args.slice(separator + 1), process.env);
+                        selection = completionSelectionPorts(home);
+                    }
+                    return selection.call(method, params);
+                } }
         });
         process.stdout.write(candidates.length === 0 ? "" : `${candidates.join("\n")}\n`);
         return;
@@ -2940,7 +2958,37 @@ function completionSelectionPorts(home) {
         return { call: () => [] };
     }
     const store = readableStore(home);
-    return selectionPorts(store, new AgentConfigurationCatalogService(home, { environment: process.env }));
+    const ports = selectionPorts(store, new AgentConfigurationCatalogService(home, { environment: process.env }));
+    if (process.env.YUI_SESSION_SCOPE !== "task")
+        return ports;
+    const taskId = process.env.YUI_TASK_ID;
+    const readable = contextRecordReader(store, taskId, process.env);
+    const families = {
+        "task.list": "task", "project.list": "project-policy", "task.role.list": "role",
+        "task.work.list": "work-item", "task.message.list": "task-message", "task.input.list": "input-request",
+        "task.turn.list": "run", "task.decision.list": "task-decision", "task.milestone.list": "task-milestone",
+        "task.event.list": "task-event", "task.change-set.list": "change-set",
+        "task.integration.list": "integration-attempt"
+    };
+    return { call: async (method, params) => {
+            if (params.taskId !== undefined && params.taskId !== taskId)
+                return [];
+            const family = families[method];
+            if (!family)
+                return []; // Completion never needs broader authority than Context.
+            const scopedParams = method === "task.input.list" ? { ...params, taskId } : params;
+            const values = await ports.call(method, scopedParams);
+            if (!Array.isArray(values))
+                return [];
+            return values.filter(value => {
+                const id = String(value.id ?? value.name ?? "");
+                if (method === "task.list" && id !== taskId)
+                    return false;
+                if (method === "project.list" && !store.getTask(taskId)?.projectBindings.some(binding => binding.projectId === id))
+                    return false;
+                return readable(family, id);
+            });
+        } };
 }
 function emit(output, literal = false, data) {
     const normalized = literal ? output.trimEnd() : output.trimEnd();

package/dist/commands/capabilityCommands.js

@@ -3,7 +3,7 @@ import { resolveJobCaller } from "../task/taskAuthority.js";
 import { callFileTaskController } from "../controller/clientRuntime.js";
 export async function runCapabilityCommand(args, home, environment) {
     const [action, ...rest] = args;
-    const usage = "yui capability search [query] --task <id> | commands --task <id> | panels --task <id> | describe <name> --task <id> [--provider <id>] [--version <version>] | call <name> --task <id> --input <json> [--provider <id>] [--version <version>] [--request-id <id>]";
+    const usage = "yui capability search [query] --task <id> | commands --task <id> | panels --task <id> | describe <name> --task <id> [--input <json>] [--provider <id>] [--version <version>] | call <name> --task <id> --input <json> [--provider <id>] [--version <version>] [--request-id <id>]";
     if (!["search", "commands", "panels", "describe", "call"].includes(action))
         throw usageError(usage);
     const surfaceList = action === "commands" || action === "panels";
@@ -29,12 +29,12 @@ export async function runCapabilityCommand(args, home, environment) {
         throw usageError(usage);
     if ((action === "search" || surfaceList) && [...flags.keys()].some((key) => key !== "--task"))
         throw usageError(usage);
-    if (action === "describe" && (flags.has("--input") || flags.has("--request-id")))
+    if (action === "describe" && flags.has("--request-id"))
         throw usageError(usage);
     let input;
-    if (action === "call") {
-        if (!flags.has("--input"))
-            throw usageError("Capability call requires --input <json>.", usage);
+    if (action === "call" && !flags.has("--input"))
+        throw usageError("Capability call requires --input <json>.", usage);
+    if (flags.has("--input")) {
         try {
             input = JSON.parse(flags.get("--input"));
         }

package/dist/commands/globalRoleCommands.js

@@ -1,4 +1,5 @@
 import { roleNotFound, usageError } from "../errors/cliError.js";
+import { hasManagedIdentity } from "../runtime/managedIdentity.js";
 import { boundedDocument, recordPage, readOptions, readDigest, messageReceipt } from "../output/boundedRead.js";
 import { controlProviderRetry, providerRetryProjection, renderProviderRetry } from "../runtime/providerRetry.js";
 import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
@@ -50,7 +51,7 @@ function assertGlobalInputAuthority(store, options, target) {
             throw usageError("Global input mutation requires the current native caller Session.");
         }
     }
-    else if (env.YUI_ROLE !== undefined || env.YUI_AGENT_ID !== undefined || env.YUI_NATIVE_SESSION_ID !== undefined) {
+    else if (hasManagedIdentity(env)) {
         throw usageError("Incomplete managed identity cannot acquire user authority.");
     }
 }