@zq-silk/yui 2.12.0 → 2.15.0

package/dist/web/webServer.js

@@ -1,7 +1,7 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import WebSocket, { WebSocketServer } from "ws";
-import { createWebAccess, validateWebAccessOptions } from "./webAccess.js";
+import { createWebAccess, safeReturnPath, validateWebAccessOptions } from "./webAccess.js";
 import { CliError, usageError } from "../errors/cliError.js";
 import { parseTaskCatalogOptions } from "../context/taskCatalog.js";
 import { parseTaskSearchOptions, searchTaskBodies } from "../context/taskSearch.js";
@@ -10,9 +10,11 @@ import { readWebTaskActivity } from "./webTaskActivity.js";
 import { WebRequestRejected } from "./webMutation.js";
 import { MODELS_HTML } from "./assets/shell/models.js";
 import { TASK_SUBMISSION_INTENTS } from "../message/message.js";
-import { DASHBOARD_HTML, findWebAsset, prepareWebDocument, WEB_ASSET_VERSION } from "./assets/assetManifest.js";
+import { DASHBOARD_HTML, findWebAsset, isLoginAsset, LOGIN_HTML, prepareWebDocument, WEB_ASSET_VERSION } from "./assets/assetManifest.js";
 import { buildWebTaskCatalog, buildWebPageSessions, buildWebTaskDetail } from "./webSnapshot.js";
 const MAX_JSON_BODY_BYTES = 16 * 1024;
+const MAX_LOGIN_BODY_BYTES = 4 * 1024;
+const TERMINAL_SESSION_SWEEP_MS = 30 * 1000;
 const MAX_TERMINAL_MESSAGE_BYTES = 64 * 1024;
 const MAX_TERMINAL_BUFFERED_BYTES = 1024 * 1024;
 export function parseWebCommandOptions(args) {
@@ -57,8 +59,19 @@ export function createYuiWebServer(store, dependencies = {}, options = { host: "
         perMessageDeflate: false,
         maxPayload: MAX_TERMINAL_MESSAGE_BYTES
     });
+    // Terminal sockets outlive their handshake: bind each to its browser session
+    // and close it when that session is signed out or expires.
+    const terminalSessions = new WeakMap();
+    const sweepTerminals = () => {
+        for (const socket of webSocketServer.clients) {
+            if (!access.sessionActive(terminalSessions.get(socket)))
+                socket.terminate();
+        }
+    };
+    const sweep = access.passwordRequired ? setInterval(sweepTerminals, TERMINAL_SESSION_SWEEP_MS) : undefined;
+    sweep?.unref();
     const server = createServer((request, response) => {
-        void handleHttpRequest(request, response, store, httpDependencies, token, now, access).catch(() => {
+        void handleHttpRequest(request, response, store, httpDependencies, token, now, access, sweepTerminals).catch(() => {
             if (!response.headersSent)
                 setSecurityHeaders(response);
             if (!response.writableEnded) {
@@ -67,13 +80,15 @@ export function createYuiWebServer(store, dependencies = {}, options = { host: "
         });
     });
     server.on("upgrade", (request, socket, head) => {
-        void handleTerminalUpgrade(request, socket, head, webSocketServer, dependencies.terminal, token, access);
+        void handleTerminalUpgrade(request, socket, head, webSocketServer, dependencies.terminal, token, access, terminalSessions);
     });
     let terminalsClosed = false;
     const closeTerminals = () => {
         if (terminalsClosed)
             return;
         terminalsClosed = true;
+        if (sweep)
+            clearInterval(sweep);
         for (const socket of webSocketServer.clients)
             socket.terminate();
         webSocketServer.close();
@@ -98,7 +113,7 @@ export async function startYuiWebServer(store, options, dependencies = {}) {
     }
     return server;
 }
-async function handleHttpRequest(request, response, store, dependencies, token, now, access) {
+async function handleHttpRequest(request, response, store, dependencies, token, now, access, sweepTerminals) {
     setSecurityHeaders(response);
     const method = request.method ?? "GET";
     const previewAuthenticated = dependencies.previews?.authenticated(request) === true;
@@ -106,19 +121,54 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         sendJson(response, 403, { error: "Invalid Host or Origin.", disposition: "not-submitted" }, method === "HEAD");
         return;
     }
-    if (!previewAuthenticated && !access.authenticated(request)) {
-        response.setHeader("www-authenticate", 'Basic realm="Yui Web", charset="UTF-8"');
-        sendJson(response, 401, { error: "Web authentication required. Use username yui and the configured password. To revoke access, stop Web; to rotate the password, replace the credential file and restart Web.", disposition: "not-submitted" }, method === "HEAD");
-        return;
-    }
     let pathname;
+    let search;
     try {
-        pathname = new URL(request.url ?? "/", "http://localhost").pathname;
+        const url = new URL(request.url ?? "/", "http://localhost");
+        pathname = url.pathname;
+        search = url.search;
     }
     catch {
         sendJson(response, 400, { error: "Invalid URL.", disposition: "not-submitted" }, method === "HEAD");
         return;
     }
+    // The sign-in page, its static assets and the session endpoints are the only
+    // routes reachable without a session. They expose no Task data or page token.
+    if (pathname === "/login" || pathname === "/auth/login" || pathname === "/auth/logout") {
+        await handleAuthRoute(request, response, pathname, search, access, sweepTerminals);
+        return;
+    }
+    if ((method === "GET" || method === "HEAD") && isLoginAsset(pathname)) {
+        const assetVersion = new URL(request.url, "http://localhost").searchParams.get("v");
+        const asset = findWebAsset(pathname, assetVersion);
+        if (asset) {
+            sendAsset(response, asset, method === "HEAD", assetVersion === WEB_ASSET_VERSION);
+            return;
+        }
+    }
+    if (!previewAuthenticated && !access.authenticated(request)) {
+        const expired = access.presentedSession(request);
+        if (expired)
+            response.setHeader("set-cookie", access.clearCookie());
+        // Browser navigations go to the sign-in page; data, asset, preview and
+        // write requests get a plain 401. No WWW-Authenticate challenge is sent,
+        // so browsers never show their native credential prompt.
+        if ((method === "GET" || method === "HEAD") && !/^\/(?:api|assets|preview)\//u.test(pathname)) {
+            const next = safeReturnPath(pathname + search);
+            const query = new URLSearchParams({ ...(next === "/" ? {} : { next }), ...(expired ? { reason: "expired" } : {}) }).toString();
+            response.statusCode = 303;
+            response.setHeader("location", `/login${query ? `?${query}` : ""}`);
+            response.setHeader("content-length", 0);
+            response.end();
+            return;
+        }
+        sendJson(response, 401, {
+            error: expired ? "Your Yui Web session has expired. Sign in again." : "Sign in to Yui Web first.",
+            code: "authentication-required",
+            disposition: "not-submitted"
+        }, method === "HEAD");
+        return;
+    }
     // Authentication precedes every document/preview. The page token remains
     // an independent CSRF boundary. A request body cannot
     // select Operator/Leader authority; all API reads use this boundary too.
@@ -126,6 +176,44 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         sendJson(response, 403, { error: "Invalid Yui web token.", disposition: "not-submitted" }, method === "HEAD");
         return;
     }
+    if (pathname === "/api/permissions" || pathname.startsWith("/api/permissions/")) {
+        if (method !== "GET") {
+            sendJson(response, 405, { error: "Permission templates are read-only.", disposition: "not-submitted" }, method === "HEAD");
+            return;
+        }
+        const allowed = {
+            "/api/permissions": [],
+            "/api/permissions/commands": ["q", "role", "category", "cursor"],
+            "/api/permissions/command": ["id", "role"],
+            "/api/permissions/capabilities": ["q", "cursor"]
+        };
+        if (!Object.hasOwn(allowed, pathname)) {
+            sendJson(response, 404, { error: "Unknown permission template route." }, false);
+            return;
+        }
+        if (!dependencies.permissions) {
+            sendJson(response, 503, { error: "Permission templates unavailable." }, false);
+            return;
+        }
+        try {
+            const query = new URL(request.url, "http://localhost").searchParams;
+            if ([...query.keys()].some(key => !allowed[pathname].includes(key) || query.getAll(key).length !== 1)) {
+                throw new Error("Unknown or repeated template query.");
+            }
+            const params = Object.fromEntries(query);
+            const service = dependencies.permissions;
+            const value = pathname === "/api/permissions" ? service.index()
+                : pathname.endsWith("/commands") ? service.commands(params)
+                    : pathname.endsWith("/command") ? service.command(params.id ?? "", params.role)
+                        : service.capabilities(params);
+            sendJson(response, 200, value, false);
+        }
+        catch (error) {
+            sendJson(response, 400, { error: error instanceof Error ? error.message : "Invalid template query.",
+                disposition: "not-submitted" }, false);
+        }
+        return;
+    }
     if (pathname.startsWith("/preview/") && dependencies.previews) {
         await dependencies.previews.serve(request, response);
         return;
@@ -632,7 +720,7 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         try {
             const assetVersion = new URL(request.url, "http://localhost").searchParams.get("v");
             const asset = findWebAsset(pathname, assetVersion);
-            const managementPage = /^\/(?:models(?:\/(?:providers|catalog|quota))?|settings(?:\/(?:preferences|skills|jobs|server|connection))?)\/?$/.test(pathname);
+            const managementPage = /^\/(?:models(?:\/(?:providers|catalog|quota))?|settings(?:\/(?:preferences|skills|jobs|permissions|server|connection))?)\/?$/.test(pathname);
             if (pathname === "/" || pathname === "/index.html" || managementPage) {
                 sendText(response, 200, "text/html; charset=utf-8", prepareWebDocument(managementPage ? MODELS_HTML.replace("__YUI_WEB_TOKEN__", token) : dashboardHtml(token), managementPage ? "/assets/js/app/manage.js" : "/assets/app.js"), method === "HEAD");
             }
@@ -736,7 +824,7 @@ async function handleHttpRequest(request, response, store, dependencies, token,
     response.setHeader("allow", "GET, HEAD");
     sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, method === "HEAD");
 }
-async function handleTerminalUpgrade(request, socket, head, webSocketServer, terminalPort, token, access) {
+async function handleTerminalUpgrade(request, socket, head, webSocketServer, terminalPort, token, access, terminalSessions) {
     try {
         const url = new URL(request.url ?? "/", "http://localhost");
         if (!access.acceptsHost(request) || !access.acceptsOrigin(request, true) || !access.authenticated(request)) {
@@ -758,15 +846,26 @@ async function handleTerminalUpgrade(request, socket, head, webSocketServer, ter
             return;
         }
         const terminalRequest = parseTerminalRequest(url.searchParams);
+        const session = access.sessionOf(request);
         webSocketServer.handleUpgrade(request, socket, head, (webSocket) => {
-            void connectTerminal(webSocket, terminalPort, terminalRequest);
+            terminalSessions.set(webSocket, session);
+            void connectTerminal(webSocket, terminalPort, terminalRequest, () => access.sessionActive(session));
         });
     }
     catch {
         rejectUpgrade(socket, 400, "Bad Request");
     }
 }
-async function connectTerminal(webSocket, terminalPort, request) {
+async function connectTerminal(webSocket, terminalPort, request, 
+// The socket's browser session is rechecked at every boundary that would
+// relay data: the periodic sweep only reclaims idle sockets, it is not the
+// authorization for input or output.
+authorized) {
+    const expire = () => {
+        if (webSocket.readyState === WebSocket.OPEN || webSocket.readyState === WebSocket.CONNECTING) {
+            webSocket.close(1008, "Session expired");
+        }
+    };
     let disconnected = false;
     const markDisconnected = () => {
         disconnected = true;
@@ -793,6 +892,11 @@ async function connectTerminal(webSocket, terminalPort, request) {
         connection.close();
         return;
     }
+    if (!authorized()) {
+        connection.close();
+        expire();
+        return;
+    }
     let closed = false;
     let stopData = () => { };
     let stopExit = () => { };
@@ -804,9 +908,20 @@ async function connectTerminal(webSocket, terminalPort, request) {
         stopExit();
         connection.close();
     };
+    const permitted = () => {
+        if (closed)
+            return false;
+        if (authorized())
+            return true;
+        close();
+        expire();
+        return false;
+    };
     webSocket.once("close", close);
     webSocket.once("error", close);
     stopData = connection.onData((data) => {
+        if (!permitted())
+            return;
         if (webSocket.bufferedAmount > MAX_TERMINAL_BUFFERED_BYTES) {
             webSocket.close(1013, "Terminal client is too slow");
             return;
@@ -818,6 +933,8 @@ async function connectTerminal(webSocket, terminalPort, request) {
         return;
     }
     stopExit = connection.onExit((exit) => {
+        if (!permitted())
+            return;
         sendWebSocket(webSocket, { type: "exit", ...exit });
         webSocket.close(1000, "Terminal detached");
         close();
@@ -827,6 +944,8 @@ async function connectTerminal(webSocket, terminalPort, request) {
         return;
     }
     webSocket.on("message", (payload, binary) => {
+        if (!permitted())
+            return;
         if (binary) {
             webSocket.close(1003, "Invalid terminal message");
             return;
@@ -844,6 +963,8 @@ async function connectTerminal(webSocket, terminalPort, request) {
             webSocket.close(1003, "Invalid terminal message");
         }
     });
+    if (!permitted())
+        return;
     sendWebSocket(webSocket, {
         type: "ready",
         readOnly: connection.readOnly,
@@ -1047,6 +1168,79 @@ async function readJsonBody(request, limit = MAX_JSON_BODY_BYTES) {
         throw new Error("Request body must be valid JSON.");
     }
 }
+/** Sign-in page and session endpoints. The page carries no page token; login
+ * and logout require a same-origin JSON POST, so a cross-site form cannot
+ * sign the browser in or out. */
+async function handleAuthRoute(request, response, pathname, search, access, sweepTerminals) {
+    const method = request.method ?? "GET";
+    if (pathname === "/login") {
+        if (method !== "GET" && method !== "HEAD") {
+            response.setHeader("allow", "GET, HEAD");
+            sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, method === "HEAD");
+            return;
+        }
+        if (!access.passwordRequired || access.authenticated(request)) {
+            response.statusCode = 303;
+            response.setHeader("location", safeReturnPath(new URLSearchParams(search).get("next")));
+            response.setHeader("content-length", 0);
+            response.end();
+            return;
+        }
+        if (access.presentedSession(request))
+            response.setHeader("set-cookie", access.clearCookie());
+        sendText(response, 200, "text/html; charset=utf-8", prepareWebDocument(LOGIN_HTML, "/assets/js/app/login.js"), method === "HEAD");
+        return;
+    }
+    if (method !== "POST") {
+        response.setHeader("allow", "POST");
+        sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, method === "HEAD");
+        return;
+    }
+    if (!access.acceptsOrigin(request, true)
+        || !/^application\/json(?:;|$)/iu.test(headerValue(request, "content-type") ?? "")) {
+        sendJson(response, 403, { error: "Sign-in requests must be same-origin JSON.", disposition: "not-submitted" }, false);
+        return;
+    }
+    if (pathname === "/auth/logout") {
+        response.setHeader("set-cookie", access.logout(request));
+        sweepTerminals();
+        sendJson(response, 200, { location: access.passwordRequired ? "/login?reason=signed-out" : "/" }, false);
+        return;
+    }
+    let body;
+    try {
+        body = await readJsonBody(request, MAX_LOGIN_BODY_BYTES);
+    }
+    catch {
+        sendJson(response, 400, { error: "Invalid sign-in request.", code: "invalid-request", disposition: "not-submitted" }, false);
+        return;
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body)
+        || Object.keys(body).some(key => key !== "password" && key !== "next")
+        || typeof body.password !== "string") {
+        sendJson(response, 400, { error: "Invalid sign-in request.", code: "invalid-request", disposition: "not-submitted" }, false);
+        return;
+    }
+    const { password, next } = body;
+    const result = access.login(request, password);
+    if (result.ok) {
+        response.setHeader("set-cookie", result.cookie);
+        sendJson(response, 200, { location: safeReturnPath(next) }, false);
+    }
+    else if (result.reason === "throttled") {
+        response.setHeader("retry-after", String(result.retryAfterSeconds));
+        sendJson(response, 429, { error: "Too many failed sign-in attempts. Wait and try again.",
+            code: "throttled", retryAfterSeconds: result.retryAfterSeconds, disposition: "not-submitted" }, false);
+    }
+    else if (result.reason === "unconfigured") {
+        sendJson(response, 404, { error: "Password sign-in is not configured for this listener.",
+            code: "password-not-configured", disposition: "not-submitted" }, false);
+    }
+    else {
+        // Never echo the submitted value.
+        sendJson(response, 401, { error: "Incorrect password.", code: "invalid-credential", disposition: "not-submitted" }, false);
+    }
+}
 function setSecurityHeaders(response) {
     response.setHeader("cache-control", "no-store");
     response.setHeader("content-security-policy", "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'");

package/docs/authorization.md

@@ -111,6 +111,41 @@ remains a limited template, while execution reports the original storage/identit
 failure. Complete launch hints can still show a role's static help on a broken
 Home; they cannot authorize reads or effects.
 
+## Read-only Web templates
+
+Open **Settings → Command permissions** (`/settings/permissions`) to compare
+CLI discovery for ordinary terminals/unmanaged sessions, Operator, GlobalRole,
+Task Leader, Worker and Reviewer. Configured GlobalRole names are selectable;
+they use the existing global discovery audience, not a new role impersonation
+path. Search, category/role filters and 30-row pages keep the view bounded.
+Expand a command for its audience-filtered usage and scope explanation.
+
+“Visible” means the existing `discoveryCommandTree` retains the executable
+command; “Hidden” means it does not. Neither is an exact authorization
+assessment. Worker and Reviewer can share a template while having different
+Assignment/Review and workspace constraints. Planning/delivery, lifecycle,
+revocation and resource/Grant checks remain in their existing execution owners.
+The directory cannot express every domain condition and this page does not
+attempt to infer them from command names.
+
+The adjacent **Built-in capability contracts** view projects
+`BUILTIN_CAPABILITIES`, the same descriptors registered in `CapabilityRegistry`,
+including required permission categories, input names, declared effect and
+semantic source. It does not invent a CLI-to-capability mapping or interpret
+those categories as role grants. Task-local plugin descriptors are excluded.
+Exact `hidden` / `requestable` / `authorized` observations still require the
+existing authenticated discovery path and target input; this page performs no
+such assessment and emits no `access` field.
+
+The `/api/permissions` metadata, `/commands`, `/command` and `/capabilities`
+routes are GET-only, use the existing Web authentication, Host/Origin and page
+token protection, and reject target/identity arguments. The only Store read is
+the configured global role list, projected to names. No Session, Task contents,
+Grant, plugin instance or Provider is read/acquired, and no operation is invoked.
+New catalog commands enter automatically; do not maintain a Web ACL.
+`web-permissions.test.js` checks full projection coverage, option filtering,
+private-read/write exclusion and the HTTP read-only boundary.
+
 ## Verification and maintenance
 
 `cli-authority.test.js` exercises isolated launcher-backed public reads, Draft

package/docs/release-workflow.md

@@ -51,6 +51,76 @@ merely to avoid a version decision. Package versions remain distinct from protoc
 and persistent-storage contracts: their compatibility checks and required migrations
 are unchanged, and the storage rules below do not authorize a package release.
 
+### 2.15.0 compatibility and migration notes
+
+This minor replaces the browser's HTTP Basic prompt with a standalone English/
+Chinese sign-in page, inline errors and safe return to the requested page.
+The credential file format and `--auth-file` stay unchanged, but HTTP Basic
+`Authorization` headers are no longer accepted. Scripts must obtain a session
+through same-origin JSON `POST /auth/login` and retain its cookie; status now
+reports `local`/`password`, not `local`/`basic`. See [Web access](web-access.md).
+
+Sessions are listener-local and in memory, with an 8-hour inactivity limit and
+24-hour absolute limit. There is no sign-out button; the backend logout endpoint
+and session revocation remain. Every terminal relay boundary checks the session.
+Stopping or restarting Web ends all sessions. HTTP remains unencrypted and is
+for trusted networks only; this is not multi-user authentication or public TLS
+hosting.
+
+This release also includes timezone-aligned default Project sync (PR #481):
+new defaults use `0 */6 * * *` with a captured explicit timezone. Storage moves
+from **1.20 to 1.21** through the centralized migration. Only provably unedited
+revision-1 built-in defaults are converted, with original bytes retained;
+higher revisions and customized/disabled plans are preserved. See
+[Project sync](project-sync.md) for explicit schedule updates. Earlier supported
+Homes use the existing contiguous same-major migration chain.
+
+With separate upgrade authorization, use `yui update --version 2.15.0`; the
+updater owns backup, migration and Controller handover. Do not edit storage
+manually or open upgraded Homes with an older binary. Minor numbering is not
+a blanket compatibility promise.
+
+Release gates reuse exact-commit Core CI and install the same checksummed
+runtime archive on Linux x64 and macOS x64/arm64 with Node 20/22/24/26 before
+npm publication. These are isolated deterministic checks, not real-model
+validation. Publishing does not update the global CLI, migrate a production
+Home, restart its Controller or deploy a production Web listener.
+
+### 2.14.0 compatibility and migration notes
+
+The `v2.13.0` tag is retained as failed release evidence: its publication gates
+failed before npm publication. This replacement minor retains the feature below
+and fixes the package-smoke handover observation: one Controller snapshot and a
+bounded 60-second multi-turn wait, preserving the input, Host identity, terminal
+and no-replay assertions. Production runtime timeouts and release gates are
+unchanged; the full fresh-install matrix must pass before publication.
+
+This minor adds Settings → Permissions: a read-only command-by-role discovery
+matrix and built-in capability contracts, with bounded search, filters and
+details. The view derives from the existing command catalog, discovery projection
+and capability registry; it is not a second ACL or an authorization engine.
+
+Role-template visibility is not an exact invocation's authorization result.
+Task, Project, Assignment, lifecycle, resource and Grant boundaries still apply
+at execution time. Viewing a role does not impersonate it, execute a command,
+issue or revoke authorization, or consume the viewed operation's Grant.
+The new GET endpoints retain the existing Web access and request protections.
+Existing CLI authorization, discovery and default permissions are unchanged.
+See [authorization](authorization.md).
+
+Storage remains **1.20**; this feature adds no storage migration or protocol
+change. Earlier supported Homes still use the existing contiguous same-major
+migration chain. With separate update authorization, use
+`yui update --version 2.14.0`; the updater owns preflight, backup, migration when
+needed, and Controller handover. Do not open upgraded Homes with an older binary
+or edit storage manually. Minor numbering is not a general compatibility promise.
+
+Release gates require exact-commit Core CI and fresh installation of the same
+runtime tarball on Linux x64 and macOS x64/arm64 with Node 20/22/24/26.
+These are deterministic isolated checks, not real-model validation. Publication
+does not update a global CLI, migrate a production Home, replace its Controller,
+or deploy or start a production Web listener.
+
 ### 2.12.0 compatibility and migration notes
 
 This minor completes the scoped Job platform: explicit business results and fixed
@@ -792,6 +862,16 @@ The tag-triggered `publish.yml` workflow is the only maintained release smoke.
 It reuses the exact commit that passed core CI and adds only artifact assembly,
 fresh installation, and provenance checks required to publish.
 
+Business contracts and full Jobs/Schedules wiring run once in Core CI on Linux
+Node 24. Release still installs the same checksummed archive on all three
+platforms × Node 20/22/24/26: every install checks CLI/setup/native helpers,
+Doctor/PTY and real SQLite SQL/GC. Node 24 additionally checks real process
+lifecycle on each platform. See the [coverage table](testing/verification-levels.md#ci-and-release).
+Dependency installation does not build the project; each source job builds once
+and verifies native dependencies afterwards. Smoke logs separate phase timings.
+Post-publication registry checks and byte-identical GitHub assets are distinct
+evidence and are not replaced by pre-publication smoke.
+
 That workflow authenticates through npm Trusted Publishing (OIDC), so the
 release identity lives in two places outside the tag: `repository`, `bugs`, and
 `homepage` are copied verbatim from the source `package.json` into the published

package/docs/release-workflow.zh-CN.md

@@ -36,6 +36,59 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 不能将不兼容冒称为兼容，也不为回避版本选择新增历史兼容机制。包版本与协议、
 持久存储契约仍然独立：兼容性检查和必要迁移要求不变，下文存储规则不授予发版权限。
 
+### 2.15.0 兼容性及迁移说明
+
+本 minor 以独立中英文登录页替代浏览器 HTTP Basic 弹窗，支持页内错误提示及安全回跳。
+凭证文件格式和 `--auth-file` 不变，但不再接受 HTTP Basic `Authorization` 请求头。
+脚本须通过同源 JSON `POST /auth/login` 获取会话并保留 Cookie；状态中的认证方式改为
+`local`/`password`，不再是 `local`/`basic`。详见 [Web 访问](web-access.md)。
+
+会话仅保存在当前监听器内存中，闲置上限为 8 小时，绝对上限为 24 小时。
+界面不提供登出按钮，但保留后端注销与会话撤销能力；终端每个数据转发边界均检查会话。
+停止或重启 Web 会结束所有会话。HTTP 仍未加密，只用于可信网络；
+本功能不是多用户认证或公网 TLS 托管。
+
+本版本也包含按时区时钟对齐的默认 Project 同步（PR #481）：
+新默认规则使用 `0 */6 * * *`，保存明确的时区。存储通过集中迁移从 **1.20 升至 1.21**。
+仅转换可证明未编辑过的 revision-1 内置默认规则，并保留原始字节；
+更高修订以及自定义、禁用计划保持不变。显式切换计划的方法见
+[Project 同步](project-sync.zh-CN.md)。更早的受支持 Home 使用既有同 major 连续迁移链。
+
+获得独立升级授权后可执行 `yui update --version 2.15.0`，由 updater 负责备份、
+迁移及 Controller 交接。不要手工修改存储或以旧二进制打开已升级 Home；
+minor 编号不是一般性的向后兼容承诺。
+
+发布门禁复用精确 commit 的 Core CI，并在 Linux x64、macOS x64/arm64 与
+Node 20/22/24/26 的组合上全新安装同一份带校验和的运行时包，全部通过后发布 npm。
+这些是隔离、确定性验证，不是真实模型验证。发布不会更新全局 CLI、迁移生产 Home、
+重启其 Controller 或部署生产 Web 监听器。
+
+### 2.14.0 兼容性及迁移说明
+
+保留 `v2.13.0` 标签作为失败发布证据：其发布门禁在 npm 发布前失败。
+本次替代 minor 保留下述功能，并修正包 smoke 的接续观察方式：使用一次 Controller
+快照和有界的 60 秒多回合等待，保留输入、Host 身份、终态及不重放断言。
+生产运行时超时和发布门禁不变；发布前仍须通过完整的全新安装矩阵。
+
+本 minor 新增 Settings → Permissions：命令×角色的只读发现矩阵与内置能力契约，
+支持有界搜索、筛选和详情。视图派生自现有 command catalog、discovery 投影及
+capability registry，不维护第二份 ACL，也不是新的授权引擎。
+
+角色模板的可见性不代表某次具体调用已获授权。Task、Project、Assignment、生命周期、
+资源和 Grant 边界仍在执行时检查。查看角色不会冒充该角色、执行命令、签发或撤销授权，
+也不会消费被查看操作的 Grant。新增 GET 接口沿用现有 Web 访问及请求保护。
+既有 CLI 授权、命令发现和默认权限不变。参见[授权说明](authorization.md)。
+
+存储保持 **1.20**；本功能不新增存储迁移或协议变更。更早的受支持 Home 仍通过现有
+连续同 major 迁移链升级。另获更新授权后使用 `yui update --version 2.14.0`；
+更新器负责预检、备份、必要迁移及 Controller 接续。不要用旧二进制打开已升级的 Home，
+也不要手改存储。minor 编号不是通用的兼容性承诺。
+
+发布门禁要求精确提交的 Core CI，并在 Linux x64、macOS x64/arm64 与
+Node 20/22/24/26 上全新安装同一个 runtime tarball。这些是确定性隔离检查，
+不是真实模型验证。发布不会更新全局 CLI、迁移生产 Home、替换其 Controller，
+也不会部署或启动生产 Web。
+
 ### 2.12.0 兼容性及迁移说明
 
 本 minor 完成作用域明确的 Job 平台：显式业务结果及固定产物、Schedule 目标与服务
@@ -601,6 +654,13 @@ yui task grant revoke task-15 capability-grant-1
 由 tag 触发的 `publish.yml` 工作流是唯一维护的发布冒烟。它复用那个通过了 core CI 的
 确切 commit，只增加发布所需的产物装配、全新安装和 provenance 检查。
 
+业务契约与完整 Jobs/Schedules 链路仅在 Core CI 的 Linux Node 24 执行一次。
+发布仍在三平台 × Node 20/22/24/26 全部安装同一个已校验 tarball：每组都验证
+CLI/setup/原生 helper、Doctor/PTY 和真实 SQLite SQL/GC；各平台 Node 24 额外验证
+真实进程生命周期。参见[分层覆盖表](testing/verification-levels.zh-CN.md#ci-与发布)。
+依赖安装不再隐含构建，每个源码作业只构建一次，再验证原生依赖；smoke 输出分段耗时。
+发布后的 registry 检查和 GitHub 资产逐字节核验是独立证据，不被发布前 smoke 替代。
+
 该工作流通过 npm Trusted Publishing（OIDC）认证，因此发布身份存在于 tag 之外的两处：
 `repository`、`bugs` 和 `homepage` 由 `assemble-runtime-package.mjs` 从源 `package.json`
 逐字复制进已发布 manifest，而该包的 npm Trusted Publisher 条目点明 GitHub owner、

package/docs/storage-baseline.md

@@ -2,7 +2,13 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.20. The 1.19 → 1.20 transition adds Agent Job configurations,
+Current storage is 1.21. The 1.20 → 1.21 transition converts provably unedited
+built-in Project sync defaults to timezone-explicit clock schedules, archiving
+their original bytes under migration 21. Ambiguous higher revisions and custom
+plans remain unchanged; no Git work or reauthorization occurs. See
+[Project sync](project-sync.md) for the conservative upgrade boundary.
+
+The 1.19 → 1.20 transition adds Agent Job configurations,
 optional Job ownership on Global Roles, and the `agent_job_runs` table for
 exact original-message/native-attempt evidence and explicit business results.
 Existing Role, Session, process Run and artifact identities are unchanged;

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,12 @@
 
 # 存储基线 1.0
 
-当前存储为 1.20。1.19 → 1.20 增加 Agent Job 配置、Global Role 的可选 Job
+当前存储为 1.21。1.20 → 1.21 将可证明未经修改的旧内置 Project 同步默认计划
+转换为显式时区的整点计划，在 migration 21 下归档原始字节。更高 revision 的
+来源不明确计划及自定义计划保留，不执行 Git 或重新授权。保守转换边界见
+[Project 同步](project-sync.zh-CN.md)。
+
+1.19 → 1.20 增加 Agent Job 配置、Global Role 的可选 Job
 归属和 `agent_job_runs` 表，保存原始消息、准确原生尝试与显式业务结果。
 保留现有 Role、Session、进程 Run 和固定产物身份；迁移不创建 Agent 或原生会话。