@zq-silk/yui 2.0.0 → 2.2.0

package/dist/task/taskAuthority.js

@@ -1,5 +1,6 @@
+import { hasManagedIdentity } from "../runtime/managedIdentity.js";
 import { usageError } from "../errors/cliError.js";
-import { MANAGED_NATIVE_SESSION_ENV, currentManagedRuntime } from "../runtime/managedCaller.js";
+import { currentManagedRuntime } from "../runtime/managedCaller.js";
 const LEADER_ROLE = "leader";
 export function taskActor(environment, taskId) {
     const env = environment ?? {};
@@ -16,9 +17,7 @@ export function taskActor(environment, taskId) {
             return "operator";
         throw usageError("A managed global Session may perform this action only as Operator.");
     }
-    if (env.YUI_ROLE !== undefined
-        || env.YUI_AGENT_ID !== undefined
-        || env[MANAGED_NATIVE_SESSION_ENV] !== undefined) {
+    if (hasManagedIdentity(env)) {
         throw usageError("Managed Agent identity is incomplete; refusing to infer user authority.");
     }
     return "user";
@@ -52,6 +51,62 @@ export function assertTaskDeliveryAuthority(store, environment, taskId) {
     }
     return actor;
 }
+/** Project effects consume the current Session's captured scope, never the
+ * Role's desired configuration or the mere presence of a writable directory.
+ * Task management (including abort/inspection) remains a separate authority. */
+export function assertTaskProjectWriteAuthority(store, environment, taskId, projectId) {
+    const actor = assertTaskDeliveryAuthority(store, environment, taskId);
+    if (actor !== "leader")
+        return actor;
+    const caller = currentManagedRuntime(store, environment, taskId, LEADER_ROLE);
+    const session = store.getTaskRoleSessionSet(taskId, LEADER_ROLE)?.sessions[caller.agentId];
+    const effective = session?.effective;
+    const task = store.getTask(taskId);
+    const main = store.getTaskWorkspace(taskId);
+    const entry = main?.entries.find(entry => entry.projectId === projectId);
+    if (task?.status !== "active" || task.executionGate.state !== "enabled"
+        || !task.projectBindings.some(binding => binding.projectId === projectId)
+        || effective?.profileAccess !== "write" || !effective.writeProjectIds.includes(projectId)
+        || main?.owner.type !== "task" || main.owner.taskId !== taskId
+        || effective.workspace.root !== main.root || entry?.access !== "write"
+        || !effective.workspace.entries.some(captured => captured.projectId === projectId
+            && captured.access === "write" && captured.path === entry.path)) {
+        throw usageError("Project write requires this Task's current delivery Session with a captured writable Project in its Task-main workspace. Read the Session scope; use formal Session replacement to adopt a new boundary.");
+    }
+    return actor;
+}
+/** A managed Leader integrates into its captured Task-main, not any branch
+ * reachable through the same Git repository. The executor also verifies that
+ * this ref is physically checked out here immediately before target effects. */
+export function taskIntegrationTargetCheckout(store, environment, taskId, projectId, targetRef) {
+    if (assertTaskProjectWriteAuthority(store, environment, taskId, projectId) !== "leader") {
+        return undefined;
+    }
+    return taskIntegrationSettlementCheckout(store, environment, taskId, projectId, targetRef);
+}
+/** Confirming an already-applied CAS is Task management, not a Project write
+ * grant. Keep the current delivery identity and captured target ownership, but
+ * do not require or change its declared write scope. Never use this for CAS. */
+export function taskIntegrationSettlementCheckout(store, environment, taskId, projectId, targetRef) {
+    if (assertTaskDeliveryAuthority(store, environment, taskId) !== "leader")
+        return undefined;
+    const task = store.getTask(taskId);
+    const main = store.getTaskWorkspace(taskId);
+    const entry = main?.entries.find(entry => entry.projectId === projectId);
+    const caller = currentManagedRuntime(store, environment, taskId, LEADER_ROLE);
+    const effective = store.getTaskRoleSessionSet(taskId, LEADER_ROLE)?.sessions[caller.agentId]?.effective;
+    const captured = effective?.workspace.entries.find(entry => entry.projectId === projectId);
+    const branchRef = (ref) => ref.startsWith("refs/heads/") ? ref : `refs/heads/${ref}`;
+    if (task?.status !== "active" || !task.projectBindings.some(binding => binding.projectId === projectId)
+        || main?.owner.type !== "task" || main.owner.taskId !== taskId
+        || effective?.workspace.root !== main.root || entry?.access !== "write"
+        || captured?.path !== entry.path || entry.branch === undefined || captured.branch === undefined
+        || branchRef(entry.branch) !== branchRef(captured.branch)
+        || branchRef(targetRef) !== branchRef(captured.branch)) {
+        throw usageError("Managed Leader Integration target must be its captured Task-main branch and checkout.");
+    }
+    return entry.path;
+}
 /**
  * Authority for a live steer/interrupt of an exact current native Turn
  * (decision-3 §1/§9, message-5 gap B). The legal evidence is the native
@@ -86,9 +141,7 @@ export function projectActor(environment) {
             return "operator";
         throw usageError("A managed global Session may manage Project Knowledge only as Operator.");
     }
-    if (env.YUI_ROLE !== undefined
-        || env.YUI_AGENT_ID !== undefined
-        || env[MANAGED_NATIVE_SESSION_ENV] !== undefined) {
+    if (hasManagedIdentity(env)) {
         throw usageError("Managed Agent identity is incomplete; refusing to infer user authority.");
     }
     return "user";
@@ -124,9 +177,7 @@ export function resolveJobCaller(environment, taskId) {
             nativeSessionId: env.CODEX_THREAD_ID ?? env.YUI_NATIVE_SESSION_ID
         };
     }
-    if (env.YUI_ROLE !== undefined
-        || env.YUI_AGENT_ID !== undefined
-        || env[MANAGED_NATIVE_SESSION_ENV] !== undefined) {
+    if (hasManagedIdentity(env)) {
         throw usageError("Managed Agent identity is incomplete; refusing to infer user authority.");
     }
     return { scope: "user" };

package/dist/web/assets/assetManifest.js

@@ -1,43 +1,59 @@
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
+import { API_SCRIPT } from "./client/api.js";
 import { APP_SCRIPT } from "./client/app.js";
 import { COMPONENTS_SCRIPT } from "./client/components.js";
+import { DETAIL_SCRIPT } from "./client/detail.js";
+import { DOCK_SCRIPT } from "./client/dock.js";
 import { DOM_SCRIPT } from "./client/dom.js";
+import { EVIDENCE_SCRIPT } from "./client/evidence.js";
 import { FORMAT_SCRIPT } from "./client/format.js";
+import { FORMS_SCRIPT } from "./client/forms.js";
 import { I18N_SCRIPT } from "./client/i18n.js";
 import { MARKDOWN_SCRIPT } from "./client/markdown.js";
+import { OVERVIEW_SCRIPT } from "./client/overview.js";
+import { RECORDS_SCRIPT } from "./client/records.js";
+import { SECTIONS_SCRIPT } from "./client/sections.js";
+import { SIDEBAR_SCRIPT } from "./client/sidebar.js";
 import { THEME_SCRIPT } from "./client/theme.js";
-import { VIEW_SCRIPT } from "./client/view.js";
-import { TASK_SURFACE_SCRIPT } from "./client/taskSurface.js";
-import { TASK_SUMMARY_SCRIPT } from "./client/taskSummary.js";
 import { DASHBOARD_HTML } from "./shell.js";
 import { FONT_FACE_STYLES } from "./fonts.js";
 import { FONT_WOFF2_BASE64 } from "./fontData.js";
-import { CARD_STYLES } from "./styles/cards.js";
+import { BASE_STYLES } from "./styles/base.js";
+import { COMPONENT_STYLES } from "./styles/components.js";
 import { LAYOUT_STYLES } from "./styles/layout.js";
 import { MARKDOWN_STYLES } from "./styles/markdown.js";
 import { RESPONSIVE_STYLES } from "./styles/responsive.js";
 import { TOKEN_STYLES } from "./styles/tokens.js";
-import { WIDGET_STYLES } from "./styles/widgets.js";
+import { VIEW_STYLES } from "./styles/views.js";
 const require = createRequire(import.meta.url);
+const CSS = "text/css; charset=utf-8";
+const JS = "text/javascript; charset=utf-8";
 export const WEB_ASSETS = Object.freeze({
-    "/assets/css/tokens.css": { contentType: "text/css; charset=utf-8", body: TOKEN_STYLES },
-    "/assets/css/fonts.css": { contentType: "text/css; charset=utf-8", body: FONT_FACE_STYLES },
-    "/assets/css/layout.css": { contentType: "text/css; charset=utf-8", body: LAYOUT_STYLES },
-    "/assets/css/widgets.css": { contentType: "text/css; charset=utf-8", body: WIDGET_STYLES },
-    "/assets/css/cards.css": { contentType: "text/css; charset=utf-8", body: CARD_STYLES },
-    "/assets/css/markdown.css": { contentType: "text/css; charset=utf-8", body: MARKDOWN_STYLES },
-    "/assets/css/responsive.css": { contentType: "text/css; charset=utf-8", body: RESPONSIVE_STYLES },
-    "/assets/js/dom.js": { contentType: "text/javascript; charset=utf-8", body: DOM_SCRIPT },
-    "/assets/js/format.js": { contentType: "text/javascript; charset=utf-8", body: FORMAT_SCRIPT },
-    "/assets/js/i18n.js": { contentType: "text/javascript; charset=utf-8", body: I18N_SCRIPT },
-    "/assets/js/markdown.js": { contentType: "text/javascript; charset=utf-8", body: MARKDOWN_SCRIPT },
-    "/assets/js/theme.js": { contentType: "text/javascript; charset=utf-8", body: THEME_SCRIPT },
-    "/assets/js/components.js": { contentType: "text/javascript; charset=utf-8", body: COMPONENTS_SCRIPT },
-    "/assets/js/view.js": { contentType: "text/javascript; charset=utf-8", body: VIEW_SCRIPT },
-    "/assets/js/task-surface.js": { contentType: "text/javascript; charset=utf-8", body: TASK_SURFACE_SCRIPT },
-    "/assets/js/task-summary.js": { contentType: "text/javascript; charset=utf-8", body: TASK_SUMMARY_SCRIPT },
-    "/assets/app.js": { contentType: "text/javascript; charset=utf-8", body: APP_SCRIPT },
+    "/assets/css/fonts.css": { contentType: CSS, body: FONT_FACE_STYLES },
+    "/assets/css/tokens.css": { contentType: CSS, body: TOKEN_STYLES },
+    "/assets/css/base.css": { contentType: CSS, body: BASE_STYLES },
+    "/assets/css/layout.css": { contentType: CSS, body: LAYOUT_STYLES },
+    "/assets/css/components.css": { contentType: CSS, body: COMPONENT_STYLES },
+    "/assets/css/views.css": { contentType: CSS, body: VIEW_STYLES },
+    "/assets/css/markdown.css": { contentType: CSS, body: MARKDOWN_STYLES },
+    "/assets/css/responsive.css": { contentType: CSS, body: RESPONSIVE_STYLES },
+    "/assets/js/dom.js": { contentType: JS, body: DOM_SCRIPT },
+    "/assets/js/format.js": { contentType: JS, body: FORMAT_SCRIPT },
+    "/assets/js/i18n.js": { contentType: JS, body: I18N_SCRIPT },
+    "/assets/js/markdown.js": { contentType: JS, body: MARKDOWN_SCRIPT },
+    "/assets/js/theme.js": { contentType: JS, body: THEME_SCRIPT },
+    "/assets/js/api.js": { contentType: JS, body: API_SCRIPT },
+    "/assets/js/components.js": { contentType: JS, body: COMPONENTS_SCRIPT },
+    "/assets/js/records.js": { contentType: JS, body: RECORDS_SCRIPT },
+    "/assets/js/forms.js": { contentType: JS, body: FORMS_SCRIPT },
+    "/assets/js/evidence.js": { contentType: JS, body: EVIDENCE_SCRIPT },
+    "/assets/js/sidebar.js": { contentType: JS, body: SIDEBAR_SCRIPT },
+    "/assets/js/overview.js": { contentType: JS, body: OVERVIEW_SCRIPT },
+    "/assets/js/sections.js": { contentType: JS, body: SECTIONS_SCRIPT },
+    "/assets/js/detail.js": { contentType: JS, body: DETAIL_SCRIPT },
+    "/assets/js/dock.js": { contentType: JS, body: DOCK_SCRIPT },
+    "/assets/app.js": { contentType: JS, body: APP_SCRIPT },
     ...fontAssets(),
     "/assets/vendor/xterm.mjs": vendorAsset("@xterm/xterm/lib/xterm.mjs", "text/javascript; charset=utf-8"),
     "/assets/vendor/addon-fit.mjs": vendorAsset("@xterm/addon-fit/lib/addon-fit.mjs", "text/javascript; charset=utf-8"),

package/dist/web/assets/client/api.js

@@ -0,0 +1,115 @@
+export const API_SCRIPT = String.raw `
+// Loopback API client. Every request carries the page token; a write is keyed
+// so an unresolved submission can never be silently replayed from this page.
+const token = document.querySelector('meta[name="yui-web-token"]').content;
+const unresolved = new Set();
+
+export function pageToken() { return token; }
+
+export async function requestJson(path, options) {
+  const response = await fetch(path, {
+    ...options,
+    headers: {
+      accept: "application/json",
+      "x-yui-web-token": token,
+      ...(options && options.headers ? options.headers : {})
+    }
+  });
+  if (!response.ok) {
+    let message = "HTTP " + response.status;
+    let disposition = "unknown";
+    try {
+      const body = await response.json();
+      if (body && body.error) message = body.error;
+      if (body && body.disposition === "not-submitted") disposition = "not-submitted";
+    } catch {}
+    throw Object.assign(new Error(message), { disposition, status: response.status });
+  }
+  return response.json();
+}
+
+function postJson(path, body, signal) {
+  return requestJson(path, {
+    method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body),
+    ...(signal ? { signal } : {})
+  });
+}
+
+// A key stays blocked until the server either answers or proves the request
+// was not submitted; an unknown outcome must be inspected, not resent.
+export async function submitMutation(key, path, body) {
+  if (unresolved.has(key)) {
+    throw Object.assign(new Error("An earlier submission is unresolved; read current facts first."), { disposition: "blocked" });
+  }
+  unresolved.add(key);
+  try {
+    const receipt = await postJson(path, body);
+    unresolved.delete(key);
+    return receipt;
+  } catch (error) {
+    if (error.disposition === "not-submitted") unresolved.delete(key);
+    throw error;
+  }
+}
+
+export function releaseMutation(key) { unresolved.delete(key); }
+
+const task = function (taskId) { return "/api/tasks/" + encodeURIComponent(taskId); };
+
+export const api = {
+  dashboard: function (query) { return requestJson("/api/dashboard?" + query); },
+  pageSessions: function (query) {
+    return requestJson("/api/dashboard/sessions?" + query, { signal: AbortSignal.timeout(5000) });
+  },
+  context: function (taskId) { return requestJson(task(taskId) + "/context"); },
+  observation: function (taskId) { return requestJson(task(taskId), { signal: AbortSignal.timeout(1500) }); },
+  inspect: async function (taskId, ref) {
+    const query = new URLSearchParams({ store: ref.store, ref: ref.refId });
+    if (ref.digest) query.set("digest", ref.digest);
+    let result = await requestJson(task(taskId) + "/inspect?" + query);
+    if (!result.contentPage) return result;
+    const source = result.contentPage.source;
+    const digest = result.contentPage.digest;
+    let text = "";
+    while (true) {
+      const page = result.contentPage;
+      if (!page || page.source !== source || page.digest !== digest || page.encoding !== "json"
+        || page.offset !== text.length || typeof page.text !== "string" || !page.text.length) {
+        throw new Error("Original read changed or returned an invalid page; refresh its Context reference.");
+      }
+      text += page.text;
+      if (page.complete) return JSON.parse(text);
+      if (!page.nextCursor) throw new Error("Original read is incomplete; refresh its Context reference.");
+      query.set("cursor", page.nextCursor);
+      result = await requestJson(task(taskId) + "/inspect?" + query);
+    }
+  },
+  artifacts: function (taskId) { return requestJson(task(taskId) + "/artifacts"); },
+  artifact: function (taskId, path, commit) {
+    return requestJson(task(taskId) + "/artifacts?" + new URLSearchParams({ path, commit }));
+  },
+  evidence: function (taskId) { return requestJson(task(taskId) + "/evidence"); },
+  panels: function (taskId) { return requestJson(task(taskId) + "/panels", { signal: AbortSignal.timeout(3000) }); },
+  readPanel: function (taskId, ref, input) {
+    return postJson(task(taskId) + "/panels", { ref, input }, AbortSignal.timeout(3000));
+  },
+  sendMessage: function (taskId, body, requestId, intent) {
+    return submitMutation(taskId + "/messages", task(taskId) + "/messages",
+      { body, requestId, ...(intent === undefined ? {} : { intent }) });
+  },
+  control: function (taskId, payload) {
+    return submitMutation(taskId + "/control/" + payload.requestId, task(taskId) + "/control", payload);
+  },
+  updateTask: function (taskId, patch, requestId) {
+    return submitMutation(taskId + "/metadata", task(taskId) + "/metadata", { patch, requestId });
+  },
+  answerInput: function (taskId, inputId, answer) {
+    return submitMutation(taskId + "/input/" + inputId,
+      task(taskId) + "/inputs/" + encodeURIComponent(inputId) + "/answer", answer);
+  },
+  globalState: function (role) { return requestJson("/api/roles/" + encodeURIComponent(role) + "/control"); },
+  globalControl: function (role, input) {
+    return submitMutation("global/" + role, "/api/roles/" + encodeURIComponent(role) + "/control", input);
+  }
+};
+`;