@zq-silk/yui 2.11.0 → 2.14.0

package/dist/web/webJobs.js

@@ -5,8 +5,8 @@ import { requireKnownFields } from "../domain/validation.js";
 import { WebRequestRejected, webLocalMutation } from "./webMutation.js";
 /** Local-user ingress only, behind the Web token/origin boundary. Never use
  * this adapter for managed RPC callers. The route fixes scope; the server
- * resolves the current Operator binding on every request. No invented Session
- * or durable second authority: the public services revalidate the binding.
+ * uses public user authority for global controlled actions. Task shell access
+ * still resolves the current Operator binding; no invented Session.
  */
 export function createWebJobs(store, home) {
     function invoke(scope, family, value, write, now) {
@@ -14,21 +14,31 @@ export function createWebJobs(store, home) {
             if (!value || typeof value !== "object" || Array.isArray(value))
                 throw new Error("Expected an operation.");
             requireKnownFields(value, family === "jobs"
-                ? ["op", "id", "title", "configuration", "expectedRevision", "runId", "requestId"]
-                : ["op", "id", "jobId", "rule", "expectedRevision"], "Web Job/Schedule request");
+                ? ["op", "id", "title", "configuration", "expectedRevision", "runId", "requestId",
+                    "reference", "offset", "expectedSessionId"]
+                : ["op", "id", "jobId", "rule", "expectedRevision", "authorization", "target"], "Web Job/Schedule request");
             const input = value;
-            const reads = family === "jobs" ? ["list", "show", "runs", "run-get", "logs"] : ["list", "show"];
-            const writes = family === "jobs" ? ["define", "update", "run", "run-cancel"] : ["create", "update", "enable", "disable"];
+            const reads = family === "jobs" ? ["list", "show", "runs", "run-get", "run-result", "run-evidence",
+                "run-delegation", "logs", "artifact-list", "artifact-preview", "session-inspect"] : ["list", "show"];
+            const writes = family === "jobs" ? ["define", "update", "run", "run-cancel", "artifact-register",
+                "session-stop", "session-new"] : ["create", "update", "enable", "disable"];
             if (!(write ? writes : reads).includes(String(input.op)))
                 throw new Error("Operation is not available on this endpoint.");
             if (scope.kind === "task" && !tx.getTask(scope.taskId))
                 throw new Error("Task not found.");
-            const session = activeLiveRoleAgentSession(tx.getGlobalRoleSessionSet("operator"));
-            if (!session)
-                throw new Error("A current Operator Session is required for Job management.");
-            const caller = { scope: "global", role: "operator", nativeSessionId: session.nativeSessionId,
-                agentId: session.agentId, adapterId: session.adapterId };
+            const session = scope.kind === "task" ? activeLiveRoleAgentSession(tx.getGlobalRoleSessionSet("operator")) : null;
+            if (scope.kind === "task" && !session)
+                throw new Error("A current Operator Session is required for Task Job management.");
+            const caller = session ? { scope: "global", role: "operator", nativeSessionId: session.nativeSessionId,
+                agentId: session.agentId, adapterId: session.adapterId } : { scope: "user" };
             const { requestId, ...fields } = input;
+            if (typeof fields.reference === "string")
+                fields.reference = JSON.parse(fields.reference);
+            if (fields.offset !== undefined) {
+                if (!/^\d{1,9}$/u.test(String(fields.offset)))
+                    throw new Error("Invalid artifact offset.");
+                fields.offset = Number(fields.offset);
+            }
             if (input.op === "run" && (typeof requestId !== "string" || !requestId.trim() || requestId.length > 200)) {
                 throw new Error("Immediate execution requires a stable requestId.");
             }
@@ -36,6 +46,21 @@ export function createWebJobs(store, home) {
                 ...(input.op === "run" ? { trigger: { source: "manual", key: requestId } } : {}) };
             return (family === "jobs" ? createJobDefinitionControl(tx, home) : createScheduleControl(tx, home))(params, now);
         };
+        // Artifact Git I/O is asynchronous, with its own authorization recheck and
+        // short publication transaction. Never keep a SQLite transaction across it.
+        if (family === "jobs" && value && typeof value === "object"
+            && "op" in value && String(value.op).startsWith("artifact-")) {
+            try {
+                return Promise.resolve(apply(store)).catch(error => {
+                    if (!write)
+                        throw new WebRequestRejected(error instanceof Error ? error.message : String(error));
+                    throw error; // A Git/publication failure is not proof of non-submission.
+                });
+            }
+            catch (error) {
+                throw new WebRequestRejected(error instanceof Error ? error.message : String(error));
+            }
+        }
         if (write)
             return webLocalMutation(store, apply);
         try {

package/dist/web/webMaterials.js

@@ -30,24 +30,36 @@ async function fixedImage(home, taskId, input) {
 /** One selected immutable file, never a workspace path or a remote URL.
  * Markdown is bounded and whole so fences/tables are not split by pagination. */
 export async function readArtifactPreview(home, taskId, ref, offset = 0) {
-    if (/\.(svg|gif|avif|bmp|ico|tiff?)$/iu.test(ref.relativePath)) {
+    if (ref.taskId !== taskId)
+        throw new WebRequestRejected("Materials must belong to the same Task.");
+    const valid = validateGitArtifactRef(ref);
+    const file = await resolveGitArtifact(home, valid);
+    return { ...valid, ...previewArtifactContent(file, offset) };
+}
+/** Shared data-only preview for Task and Job evidence; no path lookup or authority. */
+export function previewArtifactContent(file, offset = 0) {
+    if (/\.(svg|gif|avif|bmp|ico|tiff?)$/iu.test(file.relativePath)) {
         throw new WebRequestRejected("Unsupported image format. Save a static PNG, JPEG or WebP instead.");
     }
-    if (isRasterArtifact(ref.relativePath)) {
+    if (file.relativePath.length > 512)
+        throw new WebRequestRejected("Artifact path is too long.");
+    if (isRasterArtifact(file.relativePath)) {
         if (offset !== 0)
             throw new WebRequestRejected("Images do not have text offsets.");
-        return fixedImage(home, taskId, ref);
+        return { digest: file.digest, kind: "image", byteSize: file.bytes.length,
+            ...rasterMetadata(file.bytes), base64: file.bytes.toString("base64") };
     }
-    if (/\.md$|\.markdown$/iu.test(ref.relativePath)) {
+    textPath(file.relativePath);
+    const text = decodeText(file.bytes);
+    if (/\.md$|\.markdown$/iu.test(file.relativePath)) {
         if (offset !== 0)
             throw new WebRequestRejected("Markdown previews start at offset zero.");
-        const file = await fixedText(home, taskId, ref);
-        if (file.bytes > MAX_MATERIAL_BYTES)
+        if (file.bytes.length > MAX_MATERIAL_BYTES)
             throw new WebRequestRejected("Markdown preview exceeds 256 KiB; split the document.");
-        return { ...file.ref, kind: "markdown", byteSize: file.bytes, content: file.text,
-            offset: 0, totalCharacters: file.text.length, nextOffset: null };
+        return { digest: file.digest, kind: "markdown", byteSize: file.bytes.length, content: text,
+            offset: 0, totalCharacters: text.length, nextOffset: null };
     }
-    return readTextArtifactPage(home, taskId, ref, offset);
+    return { digest: file.digest, byteSize: file.bytes.length, ...page(text, offset) };
 }
 function textPath(path) {
     const safe = safeRelativeArtifactPath(path);

package/dist/web/webPermissions.js

@@ -0,0 +1,97 @@
+import { ROOT_COMMAND } from "../cli/commandCatalog.js";
+import { discoveryCommandTree } from "../cli/commandDiscovery.js";
+import { BUILTIN_CAPABILITIES } from "../kernel/builtinCapabilities.js";
+const templates = [
+    { id: "public", audience: "public" },
+    { id: "operator", audience: "operator" },
+    { id: "global", audience: "global" },
+    { id: "leader", audience: "leader" },
+    { id: "worker", audience: "assignment" },
+    { id: "reviewer", audience: "assignment" },
+    { id: "unbound", audience: "unbound" }
+];
+function executableNodes(node) {
+    return [...(node.kind !== "group" && node.discovery?.surface !== "runtime" ? [node] : []),
+        ...node.children.flatMap(executableNodes)];
+}
+const commands = executableNodes(ROOT_COMMAND);
+// The same pure projection as CLI help/completion. No fake Session, caller
+// environment, authority issuance, registry invocation or domain assessment.
+const projections = new Map(templates.map(role => [role.audience,
+    new Map(executableNodes(discoveryCommandTree({}, role.audience)).map(node => [node.path.join(" "), node]))]));
+const pageSize = 30;
+function searchText(value = "") {
+    if (value.length > 200)
+        throw new Error("Search is limited to 200 characters.");
+    return value.trim().toLowerCase();
+}
+function page(items, cursor = "0") {
+    if (!/^(0|[1-9]\d*)$/.test(cursor) || !Number.isSafeInteger(Number(cursor)))
+        throw new Error("Invalid cursor.");
+    const start = Number(cursor);
+    return { items: items.slice(start, start + pageSize), total: items.length,
+        nextCursor: start + pageSize < items.length ? String(start + pageSize) : null };
+}
+/** Read-only metadata projection for the authenticated local Web user.
+ * Only configured GlobalRole names cross the Store boundary. Task contents,
+ * bindings, profiles, Sessions, Grants and plugin descriptors are not read.
+ * These templates deliberately have no AccessAssessment field. */
+export function createWebPermissions(store) {
+    const roles = () => [...templates, ...store.listGlobalRoles()
+            .filter(role => role.name !== "operator").map(role => ({
+            id: `global:${role.name}`, name: role.name, audience: "global"
+        }))];
+    const selected = (id) => {
+        if (!id)
+            return templates;
+        const role = roles().find(role => role.id === id);
+        if (!role)
+            throw new Error("Unknown role template.");
+        return [role];
+    };
+    const cells = (id, selectedRoles) => selectedRoles.map(role => {
+        const projected = projections.get(role.audience).get(id);
+        return { role: role.id, visible: !!projected };
+    });
+    return {
+        index() {
+            return { roles: roles(), categories: [...new Set(commands.map(node => node.path[1]))].sort(),
+                sources: ["cli/commandCatalog.ts", "cli/commandDiscovery.ts", "kernel/builtinCapabilities.ts", "docs/authorization.md"],
+                evaluation: "not-performed" };
+        },
+        commands(query = {}) {
+            const q = searchText(query.q);
+            const selectedRoles = selected(query.role);
+            return { ...page(commands.filter(node => (!query.category || node.path[1] === query.category)
+                    && `${node.path.join(" ")} ${node.summary}`.toLowerCase().includes(q))
+                    .map(node => ({ id: node.path.join(" "), summary: node.summary, category: node.path[1],
+                    roles: cells(node.path.join(" "), selectedRoles) })), query.cursor),
+                evaluation: "not-performed" };
+        },
+        command(id, role) {
+            const node = commands.find(node => node.path.join(" ") === id);
+            if (!node)
+                throw new Error("Unknown command template.");
+            return { id, summary: node.summary, evaluation: "not-performed",
+                source: "cli/commandCatalog.ts → cli/commandDiscovery.ts",
+                roles: selected(role).map(role => {
+                    const projected = projections.get(role.audience).get(id);
+                    return { role: role.id, audience: role.audience, visible: !!projected,
+                        // Use the projected usage/options, including option audience gates.
+                        usage: projected?.usage ?? [], options: projected?.options ?? [] };
+                }) };
+        },
+        capabilities(query = {}) {
+            const q = searchText(query.q);
+            return { ...page(BUILTIN_CAPABILITIES
+                    .filter(entry => `${entry.name} ${entry.summary} ${entry.requiredPermissions.join(" ")}`.toLowerCase().includes(q))
+                    .map(entry => ({
+                    name: entry.name, summary: entry.summary, effect: entry.effect, source: entry.source,
+                    requiredPermissions: entry.requiredPermissions,
+                    requiredInputs: entry.inputSchema.required ?? [],
+                    inputs: Object.keys(entry.inputSchema.properties ?? {})
+                })), query.cursor), evaluation: "not-performed",
+                source: "kernel/builtinCapabilities.ts (registry built-in descriptors)" };
+        }
+    };
+}

package/dist/web/webServer.js

@@ -126,6 +126,44 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         sendJson(response, 403, { error: "Invalid Yui web token.", disposition: "not-submitted" }, method === "HEAD");
         return;
     }
+    if (pathname === "/api/permissions" || pathname.startsWith("/api/permissions/")) {
+        if (method !== "GET") {
+            sendJson(response, 405, { error: "Permission templates are read-only.", disposition: "not-submitted" }, method === "HEAD");
+            return;
+        }
+        const allowed = {
+            "/api/permissions": [],
+            "/api/permissions/commands": ["q", "role", "category", "cursor"],
+            "/api/permissions/command": ["id", "role"],
+            "/api/permissions/capabilities": ["q", "cursor"]
+        };
+        if (!Object.hasOwn(allowed, pathname)) {
+            sendJson(response, 404, { error: "Unknown permission template route." }, false);
+            return;
+        }
+        if (!dependencies.permissions) {
+            sendJson(response, 503, { error: "Permission templates unavailable." }, false);
+            return;
+        }
+        try {
+            const query = new URL(request.url, "http://localhost").searchParams;
+            if ([...query.keys()].some(key => !allowed[pathname].includes(key) || query.getAll(key).length !== 1)) {
+                throw new Error("Unknown or repeated template query.");
+            }
+            const params = Object.fromEntries(query);
+            const service = dependencies.permissions;
+            const value = pathname === "/api/permissions" ? service.index()
+                : pathname.endsWith("/commands") ? service.commands(params)
+                    : pathname.endsWith("/command") ? service.command(params.id ?? "", params.role)
+                        : service.capabilities(params);
+            sendJson(response, 200, value, false);
+        }
+        catch (error) {
+            sendJson(response, 400, { error: error instanceof Error ? error.message : "Invalid template query.",
+                disposition: "not-submitted" }, false);
+        }
+        return;
+    }
     if (pathname.startsWith("/preview/") && dependencies.previews) {
         await dependencies.previews.serve(request, response);
         return;
@@ -284,15 +322,16 @@ async function handleHttpRequest(request, response, store, dependencies, token,
             let value;
             if (method === "GET") {
                 const query = new URL(request.url, "http://localhost").searchParams;
-                if ([...query.keys()].some(key => !["op", "id", "runId"].includes(key)))
-                    throw new WebRequestRejected("Unknown Job query.");
-                value = dependencies.jobs.read(scope, family, Object.fromEntries(query), now());
+                if ([...query.keys()].some(key => !["op", "id", "runId", "reference", "offset"].includes(key)
+                    || query.getAll(key).length !== 1))
+                    throw new WebRequestRejected("Unknown or repeated Job query.");
+                value = await dependencies.jobs.read(scope, family, Object.fromEntries(query), now());
             }
             else if (method === "POST") {
                 if (headerValue(request, "origin") !== `http://${headerValue(request, "host")}`) {
                     throw new WebRequestRejected("Job changes require a same-origin request.");
                 }
-                value = dependencies.jobs.mutate(scope, family, await readMutationBody(request), now());
+                value = await dependencies.jobs.mutate(scope, family, await readMutationBody(request), now());
             }
             else
                 throw new WebRequestRejected("Method not allowed.");
@@ -631,7 +670,7 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         try {
             const assetVersion = new URL(request.url, "http://localhost").searchParams.get("v");
             const asset = findWebAsset(pathname, assetVersion);
-            const managementPage = /^\/(?:models(?:\/(?:providers|catalog|quota))?|settings(?:\/(?:preferences|skills|server|connection))?)\/?$/.test(pathname);
+            const managementPage = /^\/(?:models(?:\/(?:providers|catalog|quota))?|settings(?:\/(?:preferences|skills|jobs|permissions|server|connection))?)\/?$/.test(pathname);
             if (pathname === "/" || pathname === "/index.html" || managementPage) {
                 sendText(response, 200, "text/html; charset=utf-8", prepareWebDocument(managementPage ? MODELS_HTML.replace("__YUI_WEB_TOKEN__", token) : dashboardHtml(token), managementPage ? "/assets/js/app/manage.js" : "/assets/app.js"), method === "HEAD");
             }

package/dist/web/webTaskSurface.js

@@ -53,6 +53,7 @@ export function createWebTaskSurface(store, options = {}, observations = [], hos
                 core: readTaskContext(tx, taskId, environment),
                 task: {
                     id: task.id, title: clip(task.title), status: task.status, updatedAt: task.updatedAt,
+                    source: task.source,
                     executionGate: task.executionGate, priority: task.priority, tags: task.tags?.slice(0, 16).map(value => clip(value)),
                     projectBindings: task.projectBindings.slice(0, 32),
                     description: clip(task.description), completionSummary: clip(task.completionSummary),

package/docs/authorization.md

@@ -111,6 +111,41 @@ remains a limited template, while execution reports the original storage/identit
 failure. Complete launch hints can still show a role's static help on a broken
 Home; they cannot authorize reads or effects.
 
+## Read-only Web templates
+
+Open **Settings → Command permissions** (`/settings/permissions`) to compare
+CLI discovery for ordinary terminals/unmanaged sessions, Operator, GlobalRole,
+Task Leader, Worker and Reviewer. Configured GlobalRole names are selectable;
+they use the existing global discovery audience, not a new role impersonation
+path. Search, category/role filters and 30-row pages keep the view bounded.
+Expand a command for its audience-filtered usage and scope explanation.
+
+“Visible” means the existing `discoveryCommandTree` retains the executable
+command; “Hidden” means it does not. Neither is an exact authorization
+assessment. Worker and Reviewer can share a template while having different
+Assignment/Review and workspace constraints. Planning/delivery, lifecycle,
+revocation and resource/Grant checks remain in their existing execution owners.
+The directory cannot express every domain condition and this page does not
+attempt to infer them from command names.
+
+The adjacent **Built-in capability contracts** view projects
+`BUILTIN_CAPABILITIES`, the same descriptors registered in `CapabilityRegistry`,
+including required permission categories, input names, declared effect and
+semantic source. It does not invent a CLI-to-capability mapping or interpret
+those categories as role grants. Task-local plugin descriptors are excluded.
+Exact `hidden` / `requestable` / `authorized` observations still require the
+existing authenticated discovery path and target input; this page performs no
+such assessment and emits no `access` field.
+
+The `/api/permissions` metadata, `/commands`, `/command` and `/capabilities`
+routes are GET-only, use the existing Web authentication, Host/Origin and page
+token protection, and reject target/identity arguments. The only Store read is
+the configured global role list, projected to names. No Session, Task contents,
+Grant, plugin instance or Provider is read/acquired, and no operation is invoked.
+New catalog commands enter automatically; do not maintain a Web ACL.
+`web-permissions.test.js` checks full projection coverage, option filtering,
+private-read/write exclusion and the HTTP read-only boundary.
+
 ## Verification and maintenance
 
 `cli-authority.test.js` exercises isolated launcher-backed public reads, Draft