@zq-silk/yui 2.16.0 → 2.18.0

package/dist/executor/fileRoleLaunchPlanner.js

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 import { runPurposeAdmitsTaskState } from "../agentRun/agentRun.js";
 import { assertExecutionEnvironmentCurrent } from "../runtime/executionEnvironment.js";
+import { assertRoleEnabled } from "../role/availability.js";
 import { configuredAgentToDefinition, resolveAgentEnvironment } from "../agent/agent.js";
 import { NATIVE_AGENT_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, operationalAgentEnvironment, selectEnvironment } from "../agent/launchEnvironment.js";
 import { compileRoleSessionContext, roleSessionKind } from "../context/roleSessionContext.js";
@@ -106,6 +107,7 @@ export class FileRoleLaunchPlanner {
         const role = this.store.getRole(input.taskId, input.roleName);
         if (role === null)
             throw new Error(`Role not found: ${input.taskId}/${input.roleName}.`);
+        assertRoleEnabled(role);
         const activeRun = this.store.getActiveRun(task.id, role.name);
         if (input.runId !== undefined && activeRun?.id !== input.runId) {
             throw new Error(`Role AgentRun is no longer current: ${input.runId}.`);
@@ -226,6 +228,7 @@ export class FileRoleLaunchPlanner {
         const role = this.store.getGlobalRole(input.roleName);
         if (role === null)
             throw new Error(`Global Role not found: ${input.roleName}.`);
+        assertRoleEnabled(role);
         const sessionSet = this.store.getGlobalRoleSessionSet(role.name);
         if (activeLiveRoleAgentSession(sessionSet) !== null && sessionSet?.providerBinding == null) {
             throw new Error("Global Role has an unmanaged live Session. Stop that exact Session before opening controlled input; it will not be silently replaced.");

package/dist/job/globalShell.js

@@ -0,0 +1,51 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { requireKnownFields } from "../domain/validation.js";
+import { validateJobExecutionConfiguration } from "./durableJob.js";
+export function validateJobScriptFiles(files) {
+    if (!Array.isArray(files) || files.length > 64)
+        throw new Error("Job supports at most 64 script files.");
+    const paths = new Set();
+    let bytes = 0;
+    for (const file of files) {
+        requireKnownFields(file, ["path", "content"], "Job script file");
+        if (typeof file.path !== "string" || file.path.length > 240
+            || !/^[a-zA-Z0-9_-][a-zA-Z0-9._/-]*$/u.test(file.path)
+            || file.path.split("/").some((part) => !part || part === "." || part === "..")) {
+            throw new Error("Script paths must be safe relative paths, for example scripts/check.sh.");
+        }
+        if (paths.has(file.path) || [...paths].some(path => path.startsWith(file.path + "/") || file.path.startsWith(path + "/"))) {
+            throw new Error("Script paths must be unique and cannot overlap directories.");
+        }
+        if (typeof file.content !== "string" || file.content.includes("\0"))
+            throw new Error("Scripts must be UTF-8 text without NUL.");
+        bytes += Buffer.byteLength(file.content);
+        if (bytes > 512 * 1024)
+            throw new Error("Job scripts exceed 512 KiB.");
+        paths.add(file.path);
+    }
+}
+export function prepareGlobalShell(configuration, workspace) {
+    requireKnownFields(configuration, ["kind", "env", "steps", "files"], "Global Shell Job");
+    if (configuration.kind !== "shell")
+        throw new Error("Not a Shell Job.");
+    validateJobScriptFiles(configuration.files);
+    // No repository applies. This hash identifies executable configuration,
+    // never a Project commit or an Integration candidate.
+    const head = createHash("sha1").update(JSON.stringify(configuration)).digest("hex");
+    const spec = { workspace, env: configuration.env, steps: configuration.steps, head };
+    validateJobExecutionConfiguration(spec);
+    return spec;
+}
+/** A fresh per-Run directory; never overwrite another run's files or follow
+ * a pre-existing workspace. The runner's exclusive ready receipt fences replay. */
+export function materializeJobScripts(workspace, files) {
+    validateJobScriptFiles(files);
+    mkdirSync(workspace, { mode: 0o700 });
+    for (const file of files) {
+        const path = join(workspace, file.path);
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        writeFileSync(path, file.content, { flag: "wx", mode: 0o700 });
+    }
+}

package/dist/job/jobBusinessResult.js

@@ -62,9 +62,10 @@ export function jobRunSnapshot(run) {
         ...runReference(run), definitionId: run.definitionId, definitionRevision: run.definitionRevision,
         owner: "owner" in run ? run.owner : null,
         trigger: run.trigger, retryOf: run.retryOf ?? null,
-        executor: run.delegation ? { kind: "task", delegation: run.delegation } : "taskId" in run ? { kind: "shell" } : {
-            kind: "builtin", action: run.action, input: run.actionInput
-        },
+        executor: run.delegation ? { kind: "task", delegation: run.delegation } : "taskId" in run ? { kind: "shell" }
+            : run.action === "shell.exec" ? { kind: "shell", configuration: run.actionInput } : {
+                kind: "builtin", action: run.action, input: run.actionInput
+            },
         target: run.delegation ? { taskId: run.delegation.taskId, workItemId: run.delegation.workItemId ?? null }
             : { projectId: run.projectId ?? null, workspace: run.workspace, head: run.head },
         execution: run.delegation ? null : { env: run.env, steps: run.steps, implementation: run.operation.implementation }

package/dist/job/jobDefinition.js

@@ -2,6 +2,7 @@ import { requireIdentity, requireKnownFields, requirePositiveInteger, requireTex
 import { validateJobExecutionConfiguration, validateDurableJobOwner } from "./durableJob.js";
 import { validateAgentJobConfiguration } from "./agentJob.js";
 import { validateTaskJobConfiguration } from "./taskDelegation.js";
+import { prepareGlobalShell } from "./globalShell.js";
 export function jobScopeKey(scope) {
     if (scope.kind === "global")
         return "global";
@@ -44,6 +45,10 @@ export function validateJobDefinition(job) {
         validateTaskJobConfiguration(config);
     }
     else if (job.scope.kind === "global") {
+        if (config.kind === "shell") {
+            prepareGlobalShell(config, "/job-validation");
+            return job;
+        }
         if (config.kind !== "builtin")
             throw new Error("Global Jobs require a controlled builtin action.");
         requireKnownFields(config, ["kind", "action", "projectId", "input"], "Builtin Job");
@@ -54,7 +59,7 @@ export function validateJobDefinition(job) {
             throw new Error("Builtin Job input is required.");
     }
     else {
-        if (config.kind !== "shell")
+        if (config.kind !== "shell" || !("owner" in config))
             throw new Error("Task Jobs require a managed shell configuration.");
         requireKnownFields(config, ["kind", "owner", "projectId", "head", "workspace", "env", "steps"], "Task Job");
         requireIdentity(config.projectId, "Job Project id");

package/dist/job/jobRunner.js

@@ -13,6 +13,7 @@ import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { jobStepDirectory } from "./stepDirectory.js";
 import { prepareHttpPreview, isHttpPreview } from "./httpPreview.js";
+import { materializeJobScripts, validateJobScriptFiles } from "./globalShell.js";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
 import { currentProcessStartIdentity } from "../core/fileLockOwner.js";
 const DEFAULT_STEP_TIMEOUT_MS = 30 * 60_000;
@@ -112,6 +113,8 @@ export async function runDurableJobRunner(specPath) {
     let failedStep;
     let preview;
     try {
+        if (spec.files !== undefined)
+            materializeJobScripts(spec.workspace, spec.files);
         for (let index = 0; index < spec.steps.length; index += 1) {
             if (cancelled || existsSync(cancelPath)) {
                 cancelled = true;
@@ -278,6 +281,12 @@ function readSpec(specPath) {
     if (typeof spec.artifactDir !== "string" || !spec.artifactDir.startsWith("/")) {
         throw new Error("DurableJob spec artifactDir must be an absolute path.");
     }
+    if (spec.files !== undefined) {
+        if (spec.scope !== "global" || spec.workspace !== join(spec.artifactDir, "workspace")) {
+            throw new Error("Job script snapshots require their own global Run workspace.");
+        }
+        validateJobScriptFiles(spec.files);
+    }
     if (typeof spec.head !== "string" || spec.head.length === 0) {
         throw new Error("DurableJob spec is missing head.");
     }

package/dist/job/scheduleService.js

@@ -4,6 +4,8 @@ import { requireProjectSyncTarget } from "./projectSync.js";
 /** Internal compiled registration, not a caller identity accepted by RPC. */
 const actions = new Set(["system.noop", "project.refresh"]);
 export function requireServiceTarget(job) {
+    if (job.scope.kind === "global" && job.configuration.kind === "shell")
+        return;
     if (job.scope.kind !== "global" || job.configuration.kind !== "builtin"
         || !actions.has(job.configuration.action))
         throw new Error("Schedule service is not registered for this scope/action.");

package/dist/message/globalInboxRecovery.js

@@ -4,28 +4,39 @@ import { hasRuntimeCleanupObligation, runtimeLifecycleTarget } from "../runtime/
 import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
 import { INBOX_CHECK_PREFIX } from "./inboxTurn.js";
 const requestId = (agentId, nativeSessionId) => `${INBOX_CHECK_PREFIX}recovery:${createHash("sha256").update(JSON.stringify([agentId, nativeSessionId])).digest("hex")}`;
+function recoveryCandidate(store, roleName) {
+    const sessions = store.getGlobalRoleSessionSet(roleName);
+    const session = sessions?.sessions[sessions.activeAgentId];
+    const binding = sessions?.providerBinding;
+    if (!session || session.status !== "active" || !session.nativeSessionId || !binding
+        || binding.authority.owner !== "controller"
+        || currentProviderConversation(binding).conversationId !== session.nativeSessionId
+        || binding.run && ["submitting", "accepted", "delivery-unknown"].includes(binding.run.status)
+        || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName }))))
+        return;
+    if (store.queryGlobalRoleMessages(roleName, { handling: true, handlingExceptSession: {
+            agentId: session.agentId, nativeSessionId: session.nativeSessionId
+        }, limit: 0 }).count === 0)
+        return;
+    const id = requestId(session.agentId, session.nativeSessionId);
+    return { id, agentId: session.agentId, nativeSessionId: session.nativeSessionId,
+        existing: store.queryGlobalRoleMessages(roleName, { requestId: id, limit: 1 }).messages[0] };
+}
 /** Derive a single initialization notice from existing retained claims. New
  * Sessions are created only by the existing authorized lifecycle path. A
  * restart can finish notice creation, but cannot select or replace a Session. */
 export function globalInboxRecovery(store, roleName, now) {
+    // The common idle/already-notified path must not reserve SQLite's writer.
+    // This snapshot is only a preflight; creation rechecks all authority, cleanup
+    // and retained-claim facts in the original atomic transaction.
+    const candidate = store.readTransaction(tx => recoveryCandidate(tx, roleName));
+    if (!candidate || candidate.existing)
+        return candidate?.existing;
     return store.transaction(tx => {
-        const sessions = tx.getGlobalRoleSessionSet(roleName);
-        const session = sessions?.sessions[sessions.activeAgentId];
-        const binding = sessions?.providerBinding;
-        if (!session || session.status !== "active" || !session.nativeSessionId || !binding
-            || binding.authority.owner !== "controller"
-            || currentProviderConversation(binding).conversationId !== session.nativeSessionId
-            || binding.run && ["submitting", "accepted", "delivery-unknown"].includes(binding.run.status)
-            || hasRuntimeCleanupObligation(tx.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName }))))
-            return;
-        if (tx.queryGlobalRoleMessages(roleName, { handling: true, handlingExceptSession: {
-                agentId: session.agentId, nativeSessionId: session.nativeSessionId
-            }, limit: 0 }).count === 0)
-            return;
-        const id = requestId(session.agentId, session.nativeSessionId);
-        const existing = tx.queryGlobalRoleMessages(roleName, { requestId: id, limit: 1 }).messages[0];
-        if (existing)
-            return existing;
+        const latest = recoveryCandidate(tx, roleName);
+        if (!latest || latest.existing)
+            return latest?.existing;
+        const { id, agentId, nativeSessionId } = latest;
         const notice = {
             ...createGlobalRoleMessage(tx.nextGlobalRoleMessageId(), roleName, [
                 "Yui-Summary: This successor has retained inbox handling obligations; inspect original evidence before settlement.",
@@ -34,9 +45,9 @@ export function globalInboxRecovery(store, roleName, now) {
                 "After handling under current authority, explicitly acknowledge the original entry without replacing its claim.",
                 "Uncertain external effects require verification or a real user decision. New queued input remains separate."
             ].join("\n"), "system", { type: "system" }, now, {
-                inputControl: { action: "queue", requestId: id, expectedSessionId: session.nativeSessionId }
+                inputControl: { action: "queue", requestId: id, expectedSessionId: nativeSessionId }
             }),
-            deliveryTarget: { agentId: session.agentId, nativeSessionId: session.nativeSessionId }
+            deliveryTarget: { agentId, nativeSessionId }
         };
         tx.saveGlobalRoleMessage(notice);
         return notice;

package/dist/message/globalProviderRetry.js

@@ -2,6 +2,12 @@ import { markGlobalRoleMessageNotDelivered } from "./message.js";
 /** Settle the original queue entry when recovery ends with exact nondelivery.
  * Cancellation of a submitted/unknown request is not negative Provider proof. */
 export function settleGlobalRetryInput(store, roleName, binding, now) {
+    const settlement = globalRetryInputSettlement(store, roleName, binding, now);
+    if (settlement !== undefined)
+        store.updateGlobalRoleMessage(settlement);
+}
+/** Read-only proposal; callers applying it must recheck under their transaction. */
+export function globalRetryInputSettlement(store, roleName, binding, now) {
     const retry = binding?.retry;
     if (retry === undefined || retry.input.kind !== "message" || retry.input.roleName !== roleName
         || !["cancelled", "exhausted", "needs-attention"].includes(retry.status)
@@ -11,5 +17,5 @@ export function settleGlobalRetryInput(store, roleName, binding, now) {
     const message = store.listGlobalRoleMessages(roleName).find(m => m.id === messageId);
     if (message === undefined || message.delivery !== undefined || message.notDelivered !== undefined)
         return;
-    store.updateGlobalRoleMessage(markGlobalRoleMessageNotDelivered(message, `provider-retry-${retry.status}: ${retry.reason ?? retry.failureRef}`, now));
+    return markGlobalRoleMessageNotDelivered(message, `provider-retry-${retry.status}: ${retry.reason ?? retry.failureRef}`, now);
 }

package/dist/message/messageContinuation.js

@@ -1,4 +1,5 @@
 import { isDeepStrictEqual } from "node:util";
+import { isEnabled } from "../role/availability.js";
 import { createRun } from "../agentRun/agentRun.js";
 import { createRunInput } from "../context/runInputContract.js";
 import { contextContentDigest, contextSnapshotRef, createContextSnapshot } from "../context/contextSnapshot.js";
@@ -90,6 +91,9 @@ export function messageAssignmentBlocker(store, message) {
 }
 /** Starting another Run additionally requires the reviewed candidate to remain current. */
 export function messageContinuationBlocker(store, message) {
+    const role = message.recipient === undefined ? null : store.getRole(message.taskId, message.recipient.roleName);
+    if (role !== null && !isEnabled(role))
+        return "role-disabled";
     const invalid = messageAssignmentBlocker(store, message);
     if (invalid !== undefined)
         return invalid;

package/dist/output/rolePresentation.js

@@ -1,3 +1,4 @@
+import { isEnabled, roleDisabledReason } from "../role/availability.js";
 import { activeRoleAgentSession } from "../executor/agentExecutor.js";
 import { effectiveRoleForLaunch } from "../executor/effectiveLaunch.js";
 import { defaultTableWidth, renderTable } from "./table.js";
@@ -49,6 +50,8 @@ export function renderRoleDetails(title, role, input) {
     ];
     const overview = [
         `  Kind             ${input.kind}`,
+        `  Enabled          ${isEnabled(role)}`,
+        ...(!isEnabled(role) ? [`  Availability     ${roleDisabledReason(role)}`] : []),
         `  Active Agent     ${role.activeAgentId}`,
         `  Workspace        ${role.workspace}`,
         ...("taskId" in role ? [

package/dist/profile/agentProfile.js

@@ -1,3 +1,4 @@
+import { validateEnabled } from "../role/availability.js";
 import { cloneJson, normalizedUniqueText, optionalText, requireIdentity, requirePositiveInteger, requireTimestamp } from "../domain/validation.js";
 export const BUILTIN_PROFILE_IDS = Object.freeze([
     "worker",
@@ -31,6 +32,7 @@ export function updateAgentProfile(profile, patch, now) {
     return validateAgentProfile(candidate);
 }
 export function validateAgentProfile(profile) {
+    validateEnabled(profile.enabled);
     if (profile.schemaVersion !== 1) {
         throw new Error("AgentProfile must use schemaVersion 1.");
     }
@@ -82,7 +84,9 @@ export function builtinAgentProfileInputs() {
     ];
 }
 function normalizeInput(input) {
+    validateEnabled(input.enabled);
     return {
+        enabled: input.enabled ?? true,
         defaultAccess: validatedAccess(input.defaultAccess ?? "read"),
         ...(input.description === undefined
             ? {}
@@ -98,6 +102,10 @@ function normalizeInput(input) {
 }
 function normalizePatch(patch) {
     const result = {};
+    if (patch.enabled !== undefined) {
+        validateEnabled(patch.enabled);
+        result.enabled = patch.enabled;
+    }
     if (Object.hasOwn(patch, "defaultAccess")) {
         result.defaultAccess = validatedAccess(patch.defaultAccess);
     }

package/dist/profile/agentProfileRuntime.js

@@ -1,3 +1,4 @@
+import { isEnabled, roleDisabledReason } from "../role/availability.js";
 import { createRoleAgentBinding } from "../role/role.js";
 /** The single read model for persisted Profile intent and current runtime. */
 export function resolveAgentProfileView(profile, store) {
@@ -13,7 +14,12 @@ export function resolveAgentProfileView(profile, store) {
  * dormant, and overlays its own model/effort; another Agent starts from its
  * provider defaults.
  */
-export function resolveAgentProfileRuntime(profile, store) {
+export function resolveAgentProfileRuntime(profile, store, options = {}) {
+    if (!options.configurationOnly && !isEnabled(profile))
+        return {
+            status: "unavailable", source: profile.runtime.source,
+            reason: `Agent Profile ${profile.id} is disabled. Use yui config profile enable ${profile.id}. Existing Task bindings are unchanged.`
+        };
     if (profile.runtime.source === "global-worker") {
         const worker = store.getGlobalRole("worker");
         if (worker === null) {
@@ -23,6 +29,11 @@ export function resolveAgentProfileRuntime(profile, store) {
                 reason: "Global Role worker is not configured."
             };
         }
+        if (!options.configurationOnly && !isEnabled(worker))
+            return {
+                status: "unavailable", source: "global-worker", workerRevision: worker.launchRevision,
+                reason: roleDisabledReason(worker)
+            };
         const binding = worker.agentBindings[worker.activeAgentId];
         if (binding === undefined) {
             return {
@@ -66,6 +77,10 @@ export function resolveAgentProfileRuntime(profile, store) {
     }
     const worker = store.getGlobalRole("worker");
     const workerBinding = worker?.agentBindings[agent.id];
+    if (!options.configurationOnly && worker !== null && workerBinding !== undefined && !isEnabled(worker)) {
+        return { status: "unavailable", source: "explicit",
+            reason: `Profile copies the matching Worker binding. ${roleDisabledReason(worker)}` };
+    }
     if (workerBinding !== undefined && workerBinding.adapterId !== agent.adapterId) {
         return {
             status: "unavailable",

package/dist/review/reviewDecision.js

@@ -1,4 +1,5 @@
 import { isDeepStrictEqual } from "node:util";
+import { isEnabled, roleDisabledReason } from "../role/availability.js";
 import { isCompletedTaskReviewEvidence } from "./reviewAcceptance.js";
 import { projectReviewerAvailability } from "./reviewerAvailability.js";
 /** Read-only facts for Leader judgment; this projection never blocks an action. */
@@ -43,6 +44,11 @@ export function projectReviewDecision(input) {
         ])].sort();
     const reviewers = reviewerNames.map((reviewerRoleName) => {
         const role = roles.find(({ name }) => name === reviewerRoleName);
+        const applicable = role ?? store.getGlobalRole(reviewerRoleName);
+        if (applicable !== null && !isEnabled(applicable))
+            return {
+                reviewerRoleName, status: "unavailable", retryable: false, reason: roleDisabledReason(applicable)
+            };
         if (role === undefined && store.getGlobalRole(reviewerRoleName) === null) {
             return {
                 reviewerRoleName,

package/dist/role/availability.js

@@ -0,0 +1,28 @@
+/** Additive configuration: valid older records remain enabled. This is not
+ * Session state, launch configuration drift, or permission to stop a writer. */
+export function isEnabled(value) {
+    return value.enabled !== false;
+}
+export function validateEnabled(value) {
+    if (value !== undefined && typeof value !== "boolean") {
+        throw new Error("Enabled must be a boolean.");
+    }
+}
+export function parseEnabled(value) {
+    if (value !== "true" && value !== "false")
+        throw new Error("--enabled must be true or false.");
+    return value === "true";
+}
+export function roleDisabledReason(role) {
+    const target = role.taskId === undefined ? `config role enable ${role.name}`
+        : `task role enable ${role.taskId} ${role.name}`;
+    return `Role ${role.taskId === undefined ? "" : `${role.taskId}/`}${role.name} is disabled. `
+        + `Use yui ${target} to allow new execution; existing execution is not stopped.`;
+}
+export class RoleDisabledError extends Error {
+    name = "RoleDisabledError";
+}
+export function assertRoleEnabled(role) {
+    if (!isEnabled(role))
+        throw new RoleDisabledError(roleDisabledReason(role));
+}

package/dist/role/role.js

@@ -1,4 +1,5 @@
 import { isDeepStrictEqual } from "node:util";
+import { assertRoleEnabled, validateEnabled } from "./availability.js";
 import { requireKnownFields } from "../domain/validation.js";
 import { jobScopeKey } from "../job/jobDefinition.js";
 import { validateExecutionEnvironmentSnapshot } from "../resources/projectResource.js";
@@ -44,10 +45,12 @@ export function createGlobalRole(name, bindings, activeAgentId, workspace, now,
 }
 export function copyGlobalRoleToTaskRole(globalRole, taskId, now, name = globalRole.name) {
     validateGlobalRole(globalRole);
+    assertRoleEnabled(globalRole);
     const timestamp = now.toISOString();
     return validateTaskRole({
         ...cloneProfile(globalRole),
         schemaVersion: 1,
+        enabled: true,
         launchRevision: 1,
         defaultAccess: globalRole.defaultAccess,
         taskId: requireSafeIdentity(taskId, "Task id"),
@@ -219,6 +222,7 @@ function createRoleOwner(name, bindings, activeAgentId, workspace, now, profile,
     const timestamp = now.toISOString();
     return {
         ...cloneProfile(profile),
+        enabled: true,
         launchRevision: 1,
         defaultAccess,
         name: requireSafeIdentity(name, "Role name"),
@@ -230,6 +234,7 @@ function createRoleOwner(name, bindings, activeAgentId, workspace, now, profile,
     };
 }
 function validateRoleOwner(role) {
+    validateEnabled(role.enabled);
     if (role.schemaVersion !== 1) {
         throw new Error("Role schema version is invalid.");
     }
@@ -298,6 +303,7 @@ function assertSessionOwnerMatchesRole(role, sessions) {
 }
 function cloneRolePatch(patch) {
     return {
+        ...(patch.enabled === undefined ? {} : { enabled: patch.enabled }),
         ...(patch.name === undefined ? {} : { name: requireSafeIdentity(patch.name, "Role name") }),
         ...(patch.activeAgentId === undefined
             ? {}

package/dist/runtime/builtinAgentErrorMappers.js

@@ -30,6 +30,10 @@ export function mapCodexAgentError(input) {
 }
 function mapCodexDisplayError(input) {
     const text = `${input.message}\n${input.raw}`;
+    if (/Codex Session availability is systemError; no input was submitted\./u.test(text)) {
+        return { category: "session", code: "provider.session-system-error",
+            inputDisposition: "not-accepted", sessionDisposition: "unknown" };
+    }
     if (/^server_error$/iu.test(input.message)) {
         return recoverable("availability", "provider.server-error");
     }

package/dist/runtime/codexNativeAccess.js

@@ -18,13 +18,23 @@ export function createCodexNativeAccess(threadId, initialized, channel, openingM
     const listeners = new Set();
     let configuration = initialConfiguration;
     let observedAt = new Date().toISOString();
-    const observed = () => typeof configuration?.model !== "string"
-        ? unknownAgentRunConfiguration("No confirmed native model response. Reconnect to restore the fixed launch configuration.")
+    // A start/resume response confirms configuration at that instant, not the
+    // current Turn or later changes made by another client. Keep its timestamp;
+    // consumers must not describe repeated reads as fresh native observations.
+    const observed = () => typeof configuration?.model !== "string" || !configuration.model.trim()
+        ? unknownAgentRunConfiguration("No confirmed native configuration response. Current model and reasoning effort are unknown.")
         : {
             status: "observed", observedAt,
             handshake: { status: "unsupported", reason: "Model reported by Codex thread/start or thread/resume; not a capability handshake." },
             requested: [],
-            axes: [{ key: "model", category: "model", current: { status: "observed", value: configuration.model }, offered: [] }]
+            axes: [
+                { key: "model", category: "model", current: { status: "observed", value: configuration.model }, offered: [] },
+                { key: "reasoningEffort", category: "effort",
+                    current: typeof configuration.reasoningEffort === "string" && configuration.reasoningEffort.trim()
+                        ? { status: "observed", value: configuration.reasoningEffort }
+                        : { status: "unobserved", reason: "The native response did not confirm reasoning effort." },
+                    offered: [] }
+            ]
         };
     const observe = (message) => {
         const params = message.params;
@@ -86,9 +96,16 @@ export function createCodexNativeAccess(threadId, initialized, channel, openingM
                 if (params.threadId !== threadId)
                     throw new Error("Select the existing Session; new/forked Threads are not supported here.");
                 const page = params.initialTurnsPage;
-                configuration = await channel.request("thread/resume", { threadId,
+                // A failed/uncertain resume cannot leave the earlier confirmation
+                // looking valid. Do not retry this potentially applied operation.
+                configuration = undefined;
+                const result = await channel.request("thread/resume", { threadId,
                     ...(typeof params.excludeTurns === "boolean" ? { excludeTurns: params.excludeTurns } : {}),
                     ...(page ? { initialTurnsPage: { ...page, limit: Math.min(40, typeof page.limit === "number" && page.limit > 0 ? page.limit : 40) } } : {}) });
+                if (result.thread?.id !== threadId) {
+                    throw new Error("Native resume did not confirm the selected Thread.");
+                }
+                configuration = result;
                 observedAt = new Date().toISOString();
                 return configuration;
             }

package/dist/runtime/globalSessionHealth.js

@@ -0,0 +1,39 @@
+import { currentProviderConversation } from "./providerRuntimeIdentity.js";
+import { providerRetrySummary } from "./providerRetry.js";
+/** Read-only provenance. Writer selection is not live Host/transport health. */
+export function globalSessionHealth(role, sessions) {
+    const session = sessions?.sessions[role.activeAgentId];
+    const binding = sessions?.providerBinding;
+    const matches = session !== undefined && binding != null
+        && sessions?.activeAgentId === role.activeAgentId
+        && currentProviderConversation(binding).conversationId === session.nativeSessionId;
+    // Conversation replacement retains the terminal Turn as audit evidence while
+    // advancing writer authority. Matching the new conversation alone is insufficient.
+    const turnMatches = matches && binding.run?.authorityEpoch === binding.authority.epoch;
+    const turn = turnMatches ? binding.run : null;
+    const retry = matches && binding.retry?.nativeSessionId === session?.nativeSessionId
+        && binding.retry?.authorityEpoch === binding.authority.epoch
+        ? providerRetrySummary(binding) : null;
+    const failure = turn?.status === "failed" || turn?.status === "rejected" ? turn.failure : undefined;
+    return {
+        desiredRevision: role.launchRevision,
+        effectiveRevision: session?.effective.sourceDesiredRevision ?? null,
+        configurationDrift: session === undefined ? null
+            : session.effective.sourceDesiredRevision !== role.launchRevision,
+        nativeSessionId: session?.nativeSessionId ?? null,
+        nativeTurn: turn == null ? null : {
+            attemptId: turn.attemptId, nativeTurnId: turn.nativeTurnId, status: turn.status
+        },
+        currentFailure: failure === undefined ? null : {
+            ref: failure.ref, source: failure.error.source, phase: failure.error.phase,
+            category: failure.error.category, code: failure.error.code,
+            inputDisposition: failure.error.inputDisposition,
+            sessionDisposition: failure.error.sessionDisposition
+        },
+        retry,
+        historicalBinding: binding != null && (!matches || (binding.run !== null && !turnMatches)),
+        hostObservation: "unobserved",
+        note: "Selected/active writer state is not delivery or terminal-observation health. "
+            + "Inspect exact Host capabilities and runtime diagnostics; Controller restart does not refresh a live Host."
+    };
+}

package/dist/runtime/tmuxAdapters.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { RoleDisabledError } from "../role/availability.js";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { providerDeliveryFailureFrom } from "./agentError.js";
@@ -189,6 +190,8 @@ export class TmuxSessionHost {
                 : this.planner.planGlobalRole(input);
         }
         catch (error) {
+            if (error instanceof RoleDisabledError)
+                throw error;
             throw toRuntimeLaunchFailure(error, "validation", {
                 cwd: request.workspace,
                 agentId: request.agentId
@@ -206,6 +209,8 @@ export class TmuxSessionHost {
                 await this.#validateLaunch(request);
             }
             catch (error) {
+                if (error instanceof RoleDisabledError)
+                    throw error;
                 throw toRuntimeLaunchFailure(error, "validation", launchContext);
             }
         }

package/dist/scheduler/activeRoleRunDelivery.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { isEnabled, roleDisabledReason, RoleDisabledError } from "../role/availability.js";
 import { serializeRunInputEnvelope } from "../context/runInputContract.js";
 import { readRunContextSnapshot } from "../context/runContextPack.js";
 import { roleSessionMayContinue, sameEffectiveLaunch } from "../executor/effectiveLaunch.js";
@@ -37,6 +38,8 @@ export async function processActiveRoleRunDeliveries(store, delivery, now, selec
 }
 async function deliverActiveRun(store, delivery, task, role, run, now) {
     const base = { taskId: task.id, roleName: role.name, runId: run.id };
+    if (!isEnabled(role))
+        return { ...base, status: "skipped", reason: "not-ready", error: roleDisabledReason(role) };
     if (!isSchedulerTaskWorkspaceReady(task, store.getTaskWorkspace(task.id), run.purpose)) {
         return { ...base, status: "skipped", reason: "workspace-not-ready" };
     }
@@ -231,6 +234,12 @@ async function deliverActiveRun(store, delivery, task, role, run, now) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
+        // A configuration pause before submission preserves the original intent.
+        // After submission, the existing unknown-effect fence still owns recovery.
+        if (!submitted && error instanceof RoleDisabledError) {
+            forget(delivery, task.id, role.name, run.id);
+            return { ...base, status: "skipped", reason: "not-ready", error: message };
+        }
         // Preserve the structured cause alongside the readable diagnosis.
         const causeName = innermostCauseName(error);
         store.recordAgentError({

package/dist/scheduler/leaderWakeupProcessor.js

@@ -1,4 +1,5 @@
 import { roleSessionMayContinue } from "../executor/effectiveLaunch.js";
+import { isEnabled, roleDisabledReason, RoleDisabledError } from "../role/availability.js";
 import { roleAgentSessionResumeMode } from "../executor/agentExecutor.js";
 import { isSchedulerTaskWorkspaceReady } from "./ports.js";
 import { hasImmediateWakeReason } from "./wakeReason.js";
@@ -22,6 +23,10 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
             results.push({ ...base, status: "skipped", reason: "unavailable" });
             continue;
         }
+        if (!isEnabled(role)) {
+            results.push({ ...base, status: "skipped", reason: "unavailable", error: roleDisabledReason(role) });
+            continue;
+        }
         if (!isSchedulerTaskWorkspaceReady(task, store.getTaskWorkspace(task.id), task.status === "draft" ? "planning" : "execution")) {
             results.push({ ...base, status: "skipped", reason: "workspace-not-ready" });
             continue;
@@ -104,9 +109,11 @@ export async function processLeaderWakeups(store, delivery, now, selection) {
             // permits another automatic launch. A config/auth/executable failure
             // needs correction; an exception after submit cannot authorize replay.
             const retryable = error instanceof RuntimeLifecycleBusyError
+                || error instanceof RoleDisabledError
                 || (error instanceof RuntimeLaunchError && error.retryable);
             store.settleLeaderNotification(task.id, notification.attemptId, attempted ? "unknown" : retryable ? "deferred" : "rejected", now, detail, { effective, raw: detail, phase: attempted ? "turn-submit" : "session-start" });
-            results.push({ ...base, status: "failed", reason: "not-ready", error: detail });
+            results.push({ ...base, status: !attempted && error instanceof RoleDisabledError ? "skipped" : "failed",
+                reason: "not-ready", error: detail });
         }
         finally {
             delivery.forgetPrepared?.({ taskId: task.id, roleName: role.name });