@zq-silk/yui 2.11.0 → 2.14.0

package/dist/web/assets/client/views/jobs.js

@@ -1,6 +1,7 @@
 export const JOBS_SCRIPT = String.raw `
 import { h } from "/assets/js/lib/dom.js";
 import { requestJson, submitMutation } from "/assets/js/lib/api.js";
+import { drawArtifact } from "/assets/js/views/task/files.js";
 
 // One view for two server-fixed scopes. Refresh only reads facts; it never
 // admits due work, derives nextDue or replaces a selected exact Run with latest.
@@ -11,7 +12,17 @@ export function mountJobs(root, t, taskId) {
   const list = h("div.jobs-list");
   const detail = h("section.jobs-detail", { "aria-label": copy("details") });
   const editor = h("section");
-  let jobs = [], schedules = [], selected, selectedRun, generation = 0, pending = false, dirty = false;
+  const params = new URLSearchParams(location.search);
+  let jobs = [], schedules = [], selected = params.get("job") || undefined,
+    selectedRun = params.get("jobRun") || undefined, generation = 0, runGeneration = 0, pending = false, dirty = false;
+  const artifactState = {};
+  try { artifactState.reference = JSON.parse(params.get("artifact") || "null"); } catch {}
+  function pinSelection() {
+    const url = new URL(location.href);
+    if (selected) url.searchParams.set("job", selected); else url.searchParams.delete("job");
+    if (selectedRun) url.searchParams.set("jobRun", selectedRun); else url.searchParams.delete("jobRun");
+    history.replaceState(history.state, "", url);
+  }
   const blocked = new Set();
   const read = (family, input) => requestJson(base + "/" + family + "?" + new URLSearchParams(input));
   const button = (text, action, primary = false) => h("button.btn" + (primary ? ".btn-primary" : ""), {
@@ -40,6 +51,11 @@ export function mountJobs(root, t, taskId) {
     status(copy("submitting"));
     try {
       const result = await submitMutation(key, base + "/" + family, payload);
+      if (result.status === "saved-unregistered") {
+        status(copy("registerHelp") + "\n" + result.error, true);
+        await refresh(false);
+        return;
+      }
       status(payload.op === "run"
         ? (result.reason === "overlap" ? copy("overlap") : copy("admitted")) + " · " + result.run.id + " · " + result.run.status
         : payload.op === "run-cancel" ? copy("cancelRequested") : copy("saved"));
@@ -73,39 +89,53 @@ export function mountJobs(root, t, taskId) {
   function editJob(job) {
     const id = input(job?.id || "", { required: true, pattern: "[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}", disabled: !!job });
     const title = input(job?.title || "", { required: true });
+    const kind = choose(taskId ? ["shell", "task", "agent"] : ["builtin", "task", "agent"], job?.configuration.kind);
+    kind.disabled = !!job;
     const action = choose(["system.noop", "project.refresh"], job?.configuration.action);
     const project = input(job?.configuration.projectId || "");
     const configuration = h("textarea", { rows: 12, required: true });
     configuration.value = JSON.stringify(job?.configuration || { kind: "shell", owner: { kind: "task" },
       projectId: "", head: "", workspace: "", env: {}, steps: [{ name: "check", command: "true" }] }, null, 2);
-    const fields = [field("ID", id), field(copy("name"), title)];
-    if (taskId) fields.push(h("p", null, copy("taskConfig")), field(copy("configuration"), configuration));
-    else {
-      fields.push(field(copy("action"), action), field(copy("project"), project), h("p", null, copy("rebind")));
-      const sync = () => { project.disabled = action.value !== "project.refresh"; project.required = !project.disabled; };
-      action.addEventListener("change", sync); sync();
-    }
+    const controlled = h("div", null, field(copy("action"), action), field(copy("project"), project), h("p", null, copy("rebind")));
+    const configured = h("div", null, h("p", null, copy("taskConfig")), field(copy("configuration"), configuration));
+    const fields = [field("ID", id), field(copy("name"), title), field(copy("executor"), kind), controlled, configured];
+    const sync = () => {
+      controlled.hidden = kind.value !== "builtin"; configured.hidden = !controlled.hidden;
+      project.disabled = controlled.hidden || action.value !== "project.refresh"; project.required = !project.disabled;
+      configuration.required = !configured.hidden;
+    };
+    kind.addEventListener("change", () => {
+      configuration.value = JSON.stringify(kind.value === "agent"
+        ? { kind: "agent", target: { kind: "job", agentId: "" }, input: "", concurrency: "serial" }
+        : kind.value === "task" ? { kind: "task", goal: "delivery", target: {
+          kind: "new", title: "", description: "", projectBindings: [] } }
+        : { kind: "shell", owner: { kind: "task" }, projectId: "", head: "", workspace: "", env: {},
+          steps: [{ name: "check", command: "true" }] }, null, 2);
+      sync();
+    });
+    action.addEventListener("change", sync); sync();
     form(job ? copy("editJob") : copy("newJob"), fields, () => {
-      const config = taskId ? JSON.parse(configuration.value) : {
+      const config = kind.value !== "builtin" ? JSON.parse(configuration.value) : {
         kind: "builtin", action: action.value, input: {},
         ...(action.value === "project.refresh" ? { projectId: project.value.trim() } : {})
       };
       void mutate("jobs", { op: job ? "update" : "define", id: id.value.trim(), title: title.value.trim(),
         configuration: config, ...(job ? { expectedRevision: job.revision } : {}) }, result => {
-        selected = result.id; selectedRun = undefined; closeEditor();
+          selected = result.id; selectedRun = undefined; pinSelection(); closeEditor();
       });
     });
   }
   function editSchedule(schedule) {
     const id = input(schedule?.id || "", { required: true, disabled: !!schedule });
-    const jobId = choose(jobs.map(j => j.id), schedule?.jobId || selected);
-    const kind = choose(["once", "interval", "cron"], schedule?.rule.kind || "interval");
+    const jobId = choose(jobs.filter(j => !j.builtin || j.id === schedule?.jobId).map(j => j.id), schedule?.jobId || selected);
+    jobId.disabled = !!schedule?.builtin;
+    const kind = choose(schedule?.builtin ? ["interval", "cron"] : ["once", "interval", "cron"], schedule?.rule.kind || "interval");
     const rule = schedule?.rule;
     const at = input(rule?.at || rule?.anchor || "", { placeholder: "2026-10-17T09:00:00+08:00" });
-    const every = input(String(rule?.everyMs || 3600000), { type: "number", min: 1000, step: 1 });
+    const every = input(String(rule?.everyMs || 3600000), { type: "number", min: schedule?.builtin ? 60000 : 1000, step: 1 });
     const expression = input(rule?.expression || "0 9 * * *");
     const timezone = input(rule?.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC");
-    const when = field(copy("instant"), at), interval = field(copy("every"), every);
+    const when = field(copy("instant"), at), interval = field(copy(schedule?.builtin ? "syncEvery" : "every"), every);
     const cron = field(copy("cron"), expression), zone = field(copy("timezone"), timezone);
     const sync = () => {
       when.hidden = kind.value === "cron"; interval.hidden = kind.value !== "interval";
@@ -118,31 +148,119 @@ export function mountJobs(root, t, taskId) {
       const rule = kind.value === "once" ? { kind: "once", at: at.value }
         : kind.value === "interval" ? { kind: "interval", anchor: at.value, everyMs: Number(every.value) }
         : { kind: "cron", expression: expression.value, timezone: timezone.value };
-      void mutate("schedules", { op: schedule ? "update" : "create", id: id.value.trim(), jobId: jobId.value, rule,
+      void mutate("schedules", { op: schedule ? "update" : "create", id: id.value.trim(), rule,
+        ...(schedule?.builtin ? {} : { jobId: jobId.value, ...(!taskId ? { authorization: "service" } : {}) }),
         ...(schedule ? { expectedRevision: schedule.revision } : {}) }, closeEditor);
     });
   }
   async function showRun(jobId, runId, target) {
+    const epoch = ++runGeneration;
     selectedRun = runId;
+    pinSelection();
     target.replaceChildren(h("p", null, copy("loading")));
     try {
-      const [run, logs] = await Promise.all([read("jobs", { op: "run-get", id: jobId, runId }),
-        read("jobs", { op: "logs", id: jobId, runId })]);
-      if (selected !== jobId || selectedRun !== runId) return;
-      target.replaceChildren(h("h4", null, run.id), fact(copy("state"), run.status),
+      const run = await read("jobs", { op: "run-get", id: jobId, runId });
+      if (epoch !== runGeneration || selected !== jobId || selectedRun !== runId) return;
+      const evidence = h("section"), artifacts = h("section"), session = h("section");
+      target.replaceChildren(h("div.settings-stack", null, h("h4", null, run.id), fact(copy("state"), run.status),
+        fact(copy("executor"), run.executor || (run.delegation ? "task" : "process")),
+        run.delegation ? h("a.btn", { href: "/?task=" + encodeURIComponent(run.delegation.taskId) },
+          copy("executionTask") + " · " + run.delegation.taskId) : null,
+        ...(run.businessResult ? [h("div", null, fact(copy("result"), run.businessResult.summary),
+          raw(copy("result"), run.businessResult))] : []),
+        run.cancelRequestedAt ? fact(copy("cancelRequested"), run.cancelRequestedAt) : null,
         fact(copy("trigger"), run.trigger.source + " · " + run.trigger.key),
         fact(copy("created"), run.createdAt), fact(copy("finished"), run.terminalAt),
-        raw(copy("snapshot"), run),
-        h("h4", null, copy("logs")), logs.length ? h("div", null, logs.map(log => h("section", null,
-          h("h5", null, log.step + (log.truncated ? " · " + copy("truncated") : "")),
-          h("pre.settings-observation", null, log.text)))) : h("p", null, copy("noLogs")));
+        raw(copy("snapshot"), run), artifacts, evidence, session));
       if (["queued", "running", "unknown-needs-attention"].includes(run.status)) target.prepend(
-        button(copy("cancelRun"), () => void mutate("jobs", { op: "run-cancel", id: jobId, runId })));
-    } catch (error) { target.replaceChildren(h("p.settings-error", null, error.message)); }
+        button(copy("cancelRun"), () => {
+          if (window.confirm(copy("cancelBoundary") + "\n" + runId))
+            void mutate("jobs", { op: "run-cancel", id: jobId, runId });
+        }));
+      drawArtifacts(artifacts, jobId, run, epoch);
+      if (run.executor === "agent" && run.configuration.target.kind === "job") drawSession(session, jobId, runId);
+      try {
+        const value = await read("jobs", { op: "run-evidence", id: jobId, runId });
+        if (epoch !== runGeneration) return;
+        evidence.append(raw(copy("diagnostics"), value));
+        if (run.executor !== "agent" && !run.delegation) {
+          const logs = await read("jobs", { op: "logs", id: jobId, runId });
+          if (epoch !== runGeneration) return;
+          evidence.append(h("h4", null, copy("logs")), logs.length ? h("div", null, logs.map(log => h("section", null,
+            h("h5", null, log.step + (log.truncated ? " · " + copy("truncated") : "")),
+            h("pre.settings-observation", null, log.text)))) : h("p", null, copy("noLogs")));
+        }
+      } catch (error) { if (epoch === runGeneration) evidence.append(h("p.settings-error", null, copy("diagnostics") + ": " + error.message)); }
+    } catch (error) { if (epoch === runGeneration) target.replaceChildren(h("p.settings-error", null, error.message)); }
+  }
+  function drawArtifacts(target, jobId, run, epoch) {
+    const refs = run.artifacts || [];
+    const viewer = h("div.file-viewer");
+    const readRef = async (ref, offset = 0) => {
+      const value = await read("jobs", { op: "artifact-preview", id: jobId, runId: run.id,
+        reference: JSON.stringify(ref), offset: String(offset) });
+      return { ...value, relativePath: ref.relativePath, commit: ref.version };
+    };
+    const select = async (ref, offset = 0) => {
+      artifactState.reference = ref;
+      const url = new URL(location.href);
+      url.searchParams.set("artifact", JSON.stringify(ref));
+      history.replaceState(history.state, "", url);
+      const key = JSON.stringify(ref);
+      viewer.replaceChildren(h("p", null, copy("loading")));
+      try {
+        const value = await readRef(ref, offset);
+        if (epoch !== runGeneration || JSON.stringify(artifactState.reference) !== key) return;
+        drawArtifact(viewer, value, JSON.stringify(ref.owner), t, {
+          compare: false,
+          readArtifact: async (_owner, path, commit, page) => {
+            const exact = refs.find(r => r.relativePath === path && r.version === commit
+              && JSON.stringify(r.owner) === JSON.stringify(ref.owner));
+            if (!exact) throw new Error(copy("registeredOnly"));
+            return readRef(exact, page);
+          }
+        }, (_path, _commit, page) => void select(ref, page), artifactState);
+      } catch (error) { if (epoch === runGeneration && JSON.stringify(artifactState.reference) === key)
+        viewer.replaceChildren(h("p.settings-error", null, error.message)); }
+    };
+    target.append(h("h4", null, copy("artifacts")), h("p", null, copy("registeredOnly")),
+      ...refs.map(ref => button(ref.relativePath + " · " + ref.version.slice(0, 12), () => void select(ref))), viewer);
+    if (artifactState.reference && refs.some(ref => JSON.stringify(ref) === JSON.stringify(artifactState.reference)))
+      void select(artifactState.reference);
+    const recovery = h("div");
+    target.append(button(copy("inspectSaved"), async () => {
+      recovery.replaceChildren();
+      try {
+        const result = await read("jobs", { op: "artifact-list", id: jobId, runId: run.id });
+        const missing = result.repository.saved.filter(ref => !result.artifacts.some(r => JSON.stringify(r) === JSON.stringify(ref)));
+        recovery.append(raw(copy("artifacts"), result), h("p", null, copy("registerHelp")),
+          ...missing.map(ref => button(copy("register") + " · " + ref.relativePath, () => {
+            if (window.confirm(copy("registerHelp") + "\n" + ref.version))
+              void mutate("jobs", { op: "artifact-register", id: jobId, runId: run.id, reference: ref });
+          })));
+      } catch (error) { recovery.append(h("p.settings-error", null, error.message)); }
+    }), recovery);
+  }
+  function drawSession(target, jobId, runId) {
+    target.append(button(copy("inspectSession"), async () => {
+      try {
+        const value = await read("jobs", { op: "session-inspect", id: jobId, runId });
+        const set = value.sessions, current = set?.sessions?.[set.activeAgentId];
+        target.replaceChildren(raw(copy("inspectSession"), value), h("p", null, copy("sessionBoundary")));
+        if (current) target.append(...["session-stop", "session-new"].map(op =>
+          button(copy(op === "session-stop" ? "stopSession" : "newSession"), () => {
+            if (window.confirm(copy("sessionBoundary") + "\n" + current.nativeSessionId))
+              void mutate("jobs", { op, id: jobId, runId, expectedSessionId: current.nativeSessionId });
+          })));
+      } catch (error) { target.append(h("p.settings-error", null, error.message)); }
+    }));
   }
   async function showDetail(epoch) {
     const job = jobs.find(j => j.id === selected);
-    if (!job) { detail.replaceChildren(); return; }
+    if (!job) {
+      detail.replaceChildren(...(selected ? [h("p.settings-error", null, copy("unavailable") + " · " + selected)] : []));
+      return;
+    }
     const [runs, plans] = await Promise.all([
       read("jobs", { op: "runs", id: job.id }),
       Promise.all(schedules.filter(s => s.jobId === job.id).map(s => read("schedules", { op: "show", id: s.id })))
@@ -150,38 +268,43 @@ export function mountJobs(root, t, taskId) {
     if (epoch !== generation) return;
     runs.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
     const summary = run => run ? (run.id || run.runId) + " · " + run.status + " · "
-      + (run.terminalAt || run.finishedAt || run.createdAt || run.attemptedAt) : null;
+      + (run.terminalAt || run.finishedAt || run.createdAt || run.attemptedAt)
+      + (run.summary || run.businessResult?.summary ? " · " + (run.summary || run.businessResult.summary) : "") : null;
     const runDetail = h("section.job-run");
     detail.replaceChildren(h("div.settings-stack", null, h("h3", null, job.title), fact("ID", job.id),
       fact(copy("scope"), taskId || "global"), fact(copy("project"), job.configuration.projectId),
+      job.builtin ? h("p", null, copy("builtinSync")) : null,
       fact(copy("revision"), job.revision),
+      fact(copy("executor"), job.configuration.kind),
       fact(copy("recentRun"), summary(runs[0])),
+      fact(copy("recentSuccess"), summary(runs.find(run => run.businessResult?.outcome === "succeeded"))),
       job.refresh ? h("div", null,
         fact(copy("refreshAttempt"), summary(job.refresh.lastAttempt)),
         fact(copy("refreshSuccess"), summary(job.refresh.lastSuccessfulRefresh))) : null,
       h("div.settings-actions", null,
         button(copy("runNow"), () => void mutate("jobs", { op: "run", id: job.id, requestId: crypto.randomUUID() }, result => {
-          selectedRun = result.run.id;
+          selectedRun = result.run.id; pinSelection();
         }), true),
-        button(copy("editJob"), () => editJob(job)),
-        button(copy("newSchedule"), () => editSchedule())),
+        !job.builtin ? button(copy("editJob"), () => editJob(job)) : null,
+        !job.builtin && !["agent", "task"].includes(job.configuration.kind) ? button(copy("newSchedule"), () => editSchedule()) : null),
       raw(copy("configuration"), job.configuration),
       job.refresh ? raw(copy("refreshFacts"), job.refresh) : null,
       h("h3", null, copy("schedules")),
       plans.length ? h("div.settings-stack", null, plans.map(({ schedule: s, lastSuccess }) => h("article.settings-card", null,
         h("h4", null, s.id), fact(copy("state"), s.state),
+        s.builtin ? fact(copy("automatic"), copy(s.builtin.enabled ? "enabled" : "disabled")) : null,
         s.state === "completed" ? h("p", null, copy("onceCompleted")) : null,
         fact(copy("rule"), s.rule.kind === "cron" ? s.rule.expression : s.rule.kind === "once" ? s.rule.at : s.rule.anchor + " + " + s.rule.everyMs + " ms"),
         fact(copy("timezone"), s.rule.timezone || "UTC / offset"),
-        fact(copy("nextDue"), s.nextDue), fact(copy("lastAttempt"), s.lastAttempt
+        fact(copy("nextDue"), s.state === "enabled" ? s.nextDue : null), fact(copy("lastAttempt"), s.lastAttempt
           ? s.lastAttempt.at + " · " + s.lastAttempt.outcome + " · " + (s.lastAttempt.runId || s.lastAttempt.reason || "") : null),
         fact(copy("lastSuccess"), lastSuccess ? lastSuccess.id + " · " + (lastSuccess.terminalAt || lastSuccess.updatedAt) : null),
         s.reason ? h("p.settings-error", null, s.reason) : null,
         h("div.settings-actions", null,
           button(copy("editSchedule"), () => editSchedule(s)),
-          button(copy(s.state === "enabled" ? "disable" : "enable"), () => void mutate("schedules", {
-            op: s.state === "enabled" ? "disable" : "enable", id: s.id, expectedRevision: s.revision
-          })), s.lastAttempt?.runId ? button(copy("inspectRun"), () => void showRun(job.id, s.lastAttempt.runId, runDetail)) : null),
+          button(copy((s.builtin ? s.builtin.enabled : s.state === "enabled") ? "disable" : "enable"), () => void mutate("schedules", {
+            op: (s.builtin ? s.builtin.enabled : s.state === "enabled") ? "disable" : "enable", id: s.id, expectedRevision: s.revision
+          })), s.lastAttempt?.runId ? h("a.btn", { href: jobLink(taskId, s.lastAttempt.jobId || job.id, s.lastAttempt.runId) }, copy("inspectRun")) : null),
         raw(copy("details"), s)))) : h("p", null, copy("noSchedules")),
       h("h3", null, copy("history")),
       runs.length ? h("div.jobs-runs", null, runs.map(run =>
@@ -201,14 +324,14 @@ export function mountJobs(root, t, taskId) {
       list.replaceChildren(...(jobs.length ? jobs.map(job => h("button.job-choice", {
         type: "button", "aria-pressed": String(selected === job.id), onclick: () => {
           if (pending || !guardDraft()) return;
-          closeEditor(); selected = job.id; selectedRun = undefined; void refresh();
+          closeEditor(); selected = job.id; selectedRun = undefined; pinSelection(); void refresh();
         }
       }, h("strong", null, job.title), h("code", null, job.id),
-        h("small", null, job.configuration.action || job.configuration.kind),
+        h("small", null, job.builtin ? copy("builtinSync") : job.configuration.action || job.configuration.kind),
         h("small", null, job.configuration.projectId || "—"))) : [h("p", null, copy("empty"))]));
       await showDetail(epoch);
       if (announce && epoch === generation) status(copy("observed") + " · " + new Date().toISOString());
-    } catch (error) { if (epoch === generation) status(error.message, true); }
+    } catch (error) { if (epoch === generation) status(copy("stale") + " " + error.message, true); }
   }
   root.classList.add("jobs-manager");
   root.replaceChildren(h("h2", null, copy("heading")),
@@ -219,4 +342,10 @@ export function mountJobs(root, t, taskId) {
   void refresh();
   return { isDirty: () => dirty, isBusy: () => pending, refresh };
 }
+
+export function jobLink(taskId, jobId, runId) {
+  const query = new URLSearchParams({ job: jobId, ...(runId ? { jobRun: runId } : {}),
+    ...(taskId ? { task: taskId, section: "jobs" } : {}) });
+  return (taskId ? "/" : "/settings/jobs") + "?" + query;
+}
 `;

package/dist/web/assets/client/views/permissions.js

@@ -0,0 +1,129 @@
+export const PERMISSIONS_SCRIPT = String.raw `
+import { h } from "/assets/js/lib/dom.js";
+import { requestJson } from "/assets/js/lib/api.js";
+
+export function mountPermissions(root, t) {
+  let meta, generation = 0, timer;
+  let mode = "commands", role = "", category = "", q = "", cursor = "0", previous = [];
+  const label = r => r.name ? t("permissions.configured") + ": " + r.name : t("permissions.role." + r.id);
+  let status, results, prev, next, search, roleSelect, categorySelect;
+  function reset() { cursor = "0"; previous = []; load(); }
+  function controls() {
+    const modeSelect = h("select", { onchange: () => {
+      mode = modeSelect.value; roleSelect.disabled = categorySelect.disabled = mode !== "commands"; reset();
+    } }, ["commands", "capabilities"].map(id => h("option", { value: id }, t("permissions." + id))));
+    modeSelect.value = mode;
+    search = h("input", { type: "search", value: q, maxlength: 200, oninput: () => {
+      q = search.value; clearTimeout(timer);
+      // Invalidate any older result immediately, even during debounce.
+      generation++; prev.disabled = next.disabled = true;
+      timer = setTimeout(reset, 180);
+    } });
+    roleSelect = h("select", { onchange: () => { role = roleSelect.value; reset(); } },
+      h("option", { value: "" }, t("permissions.allRoles")),
+      meta.roles.map(r => h("option", { value: r.id }, label(r))));
+    roleSelect.value = role;
+    categorySelect = h("select", { onchange: () => { category = categorySelect.value; reset(); } },
+      h("option", { value: "" }, t("permissions.allCategories")),
+      meta.categories.map(c => h("option", { value: c }, c)));
+    categorySelect.value = category;
+    roleSelect.disabled = categorySelect.disabled = mode !== "commands";
+    status = h("p", { role: "status", "aria-live": "polite" });
+    results = h("div.permissions-results");
+    prev = h("button.btn", { type: "button", disabled: true, onclick: () => { cursor = previous.pop(); load(); } }, t("permissions.previous"));
+    next = h("button.btn", { type: "button", disabled: true }, t("permissions.next"));
+    const field = (key, input) => h("label.field", null, h("span", null, t("permissions." + key)), input);
+    root.replaceChildren(
+      h("div.card.settings-card.settings-stack", null,
+        h("p", null, t("permissions.notice")),
+        h("div.settings-grid", null, field("view", modeSelect), field("search", search),
+          field("role", roleSelect), field("category", categorySelect))),
+      status, results, h("div.settings-actions", null, prev, next),
+      h("details.settings-card", null, h("summary", null, t("permissions.legend")),
+        h("p", null, t("permissions.states")),
+        h("p", null, t("permissions.boundaries")),
+        h("p", null, t("permissions.sources") + ": " + meta.sources.join(" · "))));
+  }
+  function detailContent(data) {
+    return h("div.settings-stack", null,
+      h("p", null, t("permissions.unevaluated")),
+      h("p", null, t("permissions.boundaries")),
+      data.roles.map(r => h("div", null,
+        h("h3", null, label(meta.roles.find(item => item.id === r.role))),
+        h("p", null, t("permissions.reason." + (r.visible ? "visible" : "hidden"))),
+        h("p", null, t("permissions.boundary." + r.audience)),
+        r.usage.length ? h("pre", null, r.usage.join("\n")) : null)),
+      h("small", null, t("permissions.sources") + ": " + data.source));
+  }
+  function commandTable(page, version) {
+    const shown = role ? meta.roles.filter(r => r.id === role) : meta.roles.filter(r => !r.name);
+    const body = h("tbody");
+    page.items.forEach((item, index) => {
+      const detail = h("td", { colSpan: shown.length + 1 });
+      const detailRow = h("tr", { hidden: true, id: "permission-detail-" + version + "-" + index }, detail);
+      let loaded = false;
+      const button = h("button.permissions-command", { type: "button", "aria-expanded": "false",
+        "aria-controls": detailRow.id, onclick: async () => {
+          detailRow.hidden = !detailRow.hidden;
+          button.setAttribute("aria-expanded", String(!detailRow.hidden));
+          if (detailRow.hidden || loaded) return;
+          loaded = true; detail.textContent = t("permissions.loading");
+          try {
+            const params = new URLSearchParams({ id: item.id, ...(role ? { role } : {}) });
+            const data = await requestJson("/api/permissions/command?" + params);
+            if (version !== generation) return;
+            detail.replaceChildren(detailContent(data));
+          } catch (error) { loaded = false; detail.textContent = error.message; }
+        } }, item.id);
+      body.append(h("tr", null, h("th", { scope: "row" }, button, h("small", null, item.summary)),
+        item.roles.map(r => h("td", null, h("span", { class: r.visible ? "permissions-visible" : "permissions-hidden" },
+          t("permissions." + (r.visible ? "visible" : "hidden")))))), detailRow);
+    });
+    return h("div.permissions-scroll", { tabIndex: 0, role: "region", "aria-label": t("permissions.commands") },
+      h("table.permissions-table", null,
+        h("caption", null, t("permissions.tableHint")),
+        h("thead", null, h("tr", null, h("th", { scope: "col" }, t("permissions.command")),
+          shown.map(r => h("th", { scope: "col" }, label(r))))), body));
+  }
+  async function load() {
+    clearTimeout(timer);
+    const version = ++generation;
+    status.textContent = t("permissions.loading");
+    results.replaceChildren(); prev.disabled = next.disabled = true;
+    const params = new URLSearchParams({ q, cursor, ...(mode === "commands" ? { role, category } : {}) });
+    try {
+      const page = await requestJson("/api/permissions/" + mode + "?" + params);
+      if (version !== generation) return;
+      status.textContent = page.items.length ? (Number(cursor) + 1) + "–" + (Number(cursor) + page.items.length) + " / " + page.total : t("permissions.empty");
+      if (mode === "commands") results.append(commandTable(page, version));
+      else results.append(h("p", null, t("permissions.capabilityNotice")), ...page.items.map(item =>
+        h("details.settings-card", null, h("summary", null, item.name),
+          h("p", null, item.summary), h("p", null, t("permissions.unevaluated")),
+          h("p", null, t("permissions.effect") + ": " + item.effect),
+          h("p", null, t("permissions.requiredPermissions") + ": " + (item.requiredPermissions.join(", ") || "—")),
+          h("p", null, t("permissions.requiredInputs") + ": " + (item.requiredInputs.join(", ") || "—")),
+          h("p", null, t("permissions.inputs") + ": " + (item.inputs.join(", ") || "—")),
+          h("small", null, t("permissions.sources") + ": " + page.source + " → " + item.source))));
+      prev.disabled = previous.length === 0;
+      next.disabled = page.nextCursor === null;
+      next.onclick = () => { previous.push(cursor); cursor = page.nextCursor; load(); };
+    } catch (error) {
+      if (version !== generation) return;
+      status.textContent = error.message;
+      results.append(h("button.btn", { type: "button", onclick: load }, t("permissions.retry")));
+    }
+  }
+  async function init() {
+    root.replaceChildren(h("p", { role: "status" }, t("permissions.loading")));
+    try {
+      meta = await requestJson("/api/permissions");
+      controls(); load();
+    } catch (error) {
+      root.replaceChildren(h("p", { role: "status" }, error.message),
+        h("button.btn", { type: "button", onclick: init }, t("permissions.retry")));
+    }
+  }
+  init();
+  return { translate() { if (meta) { controls(); load(); } } };
+}
+`;

package/dist/web/assets/client/views/task/files.js

@@ -74,7 +74,7 @@ function artifactViewer(viewer, data, t, actions) {
   return { element: viewer, read: read, draw: draw };
 }
 
-function drawArtifact(viewer, value, taskId, t, actions, read, state = {}) {
+export function drawArtifact(viewer, value, taskId, t, actions, read, state = {}) {
   clear(viewer);
   if (!value) return;
   const selected = value.after || value;
@@ -121,12 +121,13 @@ function drawArtifact(viewer, value, taskId, t, actions, read, state = {}) {
   viewer.append(h("p.viewer-ref", null, mono("sha256:" + selected.digest)));
   if (value.before) viewer.append(h("p.viewer-ref", null, mono("← git:" + value.before.commit + ":" + value.before.relativePath + " · sha256:" + value.before.digest)));
   viewer.append(h("p.faint.small", null, t("evidence.fixedNote")));
-  viewer.append(h("div.record-actions", null, value.kind === "image" ? null : copyText, download, feedback));
+  viewer.append(h("div.record-actions", null, value.kind === "image" ? null : copyText, download,
+    actions.openConversation ? feedback : null));
   if (value.kind === "image") { viewer.append(imagePreview(value, t, undefined, preview)); return; }
   const before = h("input", { placeholder: t("materials.before"), "aria-label": t("materials.before"), maxLength: 64 });
   const compare = button(t("materials.compare"), { variant: "ghost" });
   compare.addEventListener("click", function () { read(selected.relativePath, selected.commit, 0, before.value); });
-  viewer.append(h("div.record-actions", null, before, compare));
+  if (actions.compare !== false) viewer.append(h("div.record-actions", null, before, compare));
   const source = h("pre.code-block.artifact-text", { tabIndex: 0, "aria-label": t("evidence.fixedText") }, value.content);
   if (!value.before && /\.md$|\.markdown$/i.test(selected.relativePath)) {
     viewer.append(markdownPreview(value, taskId, t, actions, preview));
@@ -207,7 +208,7 @@ function markdownPreview(value, taskId, t, actions, preview) {
       feedback.addEventListener("click", function () { actions.openConversation([artifactRef(value), artifactRef(image)]); });
       slot.append(imagePreview(image, t, entry.alt, saved), h("span.viewer-ref", null,
         path + " · git:" + image.commit + " · sha256:" + image.digest),
-        h("span.record-actions", null, download, feedback));
+        h("span.record-actions", null, download, actions.openConversation ? feedback : null));
     }
     async function observeRead() {
       load.disabled = true; body.dataset.reading = "true"; status.textContent = t("evidence.reading");

package/dist/web/assets/client/views/task/page.js

@@ -12,7 +12,7 @@ import { updateObservation } from "/assets/js/views/task/observation.js";
 import { renderDelivery } from "/assets/js/views/task/delivery.js";
 import { renderRuntime } from "/assets/js/views/task/runtime.js";
 import { renderRecords } from "/assets/js/views/task/records.js";
-import { mountJobs } from "/assets/js/views/jobs.js";
+import { mountJobs, jobLink } from "/assets/js/views/jobs.js";
 
 // Overview: where it stands. Delivery: what it produced. Runtime: what is
 // live now. Records: what happened. Retired section names stay addressable.
@@ -94,6 +94,10 @@ function dockToggle(mode, iconName, title, t, ctx) {
 
 function taskMeta(task, t, locale) {
   return h("div.task-meta", null,
+    task.source?.kind === "job-run" ? h("a.btn", {
+      href: jobLink(task.source.run.scope.kind === "task" ? task.source.run.scope.taskId : undefined,
+        task.source.jobId, task.source.run.runId)
+    }, t("jobs.sourceJob") + " · " + task.source.jobId + " / " + task.source.run.runId) : null,
     statusBadge(t, "task", "status", task.status),
     h("span", { dataset: { slot: "exec-badge" } }),
     task.priority ? badge(label(t, "priority", task.priority), task.priority === "urgent" || task.priority === "high" ? "accent" : "idle") : null,

package/dist/web/assets/shared/manageNav.js

@@ -8,6 +8,7 @@ export const MANAGE_SECTIONS = Object.freeze({
         { page: "settings", section: "preferences", key: "settings.section.preferences", label: "Preferences" },
         { page: "settings", section: "skills", key: "settings.section.skills", label: "Skills" },
         { page: "settings", section: "jobs", key: "settings.section.jobs", label: "Jobs & schedules" },
+        { page: "settings", section: "permissions", key: "settings.section.permissions", label: "Command permissions" },
         { page: "settings", section: "server", key: "settings.section.server", label: "Agents & server" },
         { page: "models", section: "connection", key: "models.section.connection", label: "Model connection" }
     ]

package/dist/web/assets/shell/settingsContent.js

@@ -30,4 +30,8 @@ export const SETTINGS_MAIN = `
         <label class="field settings-search"><span data-i18n="settings.search">Find a setting</span><input id="settings-search" type="search" autocomplete="off"></label>
         <p id="settings-status" role="status"></p>
         <div id="settings-groups" class="settings-stack"></div>
+      </section>
+      <section class="manage-section" data-section="permissions" aria-labelledby="settings-permissions-title" hidden>
+        ${manageHead("settings-permissions-title", "settings.section.permissions", "Command permissions", "permissions.intro", "Read-only discovery templates, not authorization for a specific call. No rules or Grants are changed.")}
+        <section id="permission-browser" class="settings-stack"></section>
       </section>`;

package/dist/web/assets/styles/views/settings.js

@@ -33,6 +33,19 @@ export const SETTINGS_STYLES = `
 .settings-search input{width:100%;max-width:520px}
 #settings-status:empty,#browser-receipt:empty{display:none}
 .mono-line{overflow-wrap:anywhere}
+.permissions-results{display:grid;gap:12px;min-width:0}
+.permissions-scroll{overflow:auto;border:1px solid var(--line);border-radius:var(--r-lg);background:var(--surface)}
+.permissions-table{border-collapse:collapse;width:100%;font-size:var(--fs-xs)}
+.permissions-table caption{text-align:left;padding:14px;color:var(--ink-2)}
+.permissions-table th,.permissions-table td{text-align:left;vertical-align:top;padding:12px;border-bottom:1px solid var(--line)}
+.permissions-table thead th{background:var(--surface-2);min-width:100px;font-weight:600}
+.permissions-table th[scope=row]{min-width:240px;max-width:360px;font-weight:400}
+.permissions-table small{display:block;color:var(--ink-3);margin-top:6px;overflow-wrap:anywhere}
+.permissions-command{font-family:var(--font-mono);color:var(--accent);background:none;border:0;padding:4px 0;cursor:pointer;text-align:left;overflow-wrap:anywhere}
+.permissions-command:hover{text-decoration:underline}
+.permissions-table pre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:var(--fs-xs);max-width:700px}
+.permissions-visible{color:var(--ink);white-space:nowrap}
+.permissions-hidden{color:var(--ink-3);white-space:nowrap}
 @media(max-width:${BREAKPOINTS.small}px){
   .settings-grid{grid-template-columns:minmax(0,1fr)}
   .settings-card{padding:14px}

package/dist/web/taskPreviews.js

@@ -25,7 +25,7 @@ export function createTaskPreviews(store, home) {
     };
     const registered = (taskId, jobId) => {
         const job = store.getDurableJob(taskId, jobId);
-        if (!store.getTask(taskId) || !job || job.taskId !== taskId || !isHttpPreview(job.env)) {
+        if (!store.getTask(taskId) || !job || job.delegation || job.taskId !== taskId || !isHttpPreview(job.env)) {
             throw new WebRequestRejected("Registered Task preview not found.");
         }
         validateHttpPreview(job.env, job.steps);
@@ -69,7 +69,7 @@ export function createTaskPreviews(store, home) {
         async list(taskId) {
             if (!store.getTask(taskId))
                 throw new WebRequestRejected("Task not found.");
-            const jobs = store.listDurableJobs(taskId).filter(job => isHttpPreview(job.env)).reverse();
+            const jobs = store.listDurableJobs(taskId).filter((job) => !job.delegation && isHttpPreview(job.env)).reverse();
             const services = await Promise.all(jobs.slice(0, 16).map(async (job) => {
                 let current = state(job);
                 let detail = job.result?.unknownReason ?? `Job: ${job.status}`;