@zq-silk/yui 2.19.0 → 2.21.0

package/dist/context/taskContext.js

@@ -9,7 +9,6 @@ import { projectTaskRemoteDeliveryFromStore } from "../task/remoteDeliveryServic
 import { retiredTaskRecordIds, TASK_RECORD_RETIRED_EVENT } from "../task/taskRecordRetirement.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { contextContentDigest } from "./contextSnapshot.js";
-import { buildRunContextPack } from "./runContextPack.js";
 import { sourceRunContextValue } from "./sourceRunContext.js";
 import { boundedDocument, fitsReadBudget, summaryText, recordPage } from "../output/boundedRead.js";
 import { taskBriefGuard, taskPhase } from "./taskPhase.js";
@@ -27,12 +26,12 @@ export function readTaskContext(store, taskId, environment = {}) {
         const sources = authorizedSources(reader, scope, true);
         const count = sources.reduce((total, source) => total + source.count, 0);
         const cursor = currentCursor(reader, taskId);
-        const phase = scope.allow === undefined ? taskPhase(reader, scope.task) : undefined;
+        const phase = taskPhase(reader, scope.task);
         const phaseSource = phase?.activation?.source;
         const priorMessageId = phaseSource?.priorMessageId;
         // Reserve a small, classified view before ordinary history consumes the
         // page. Counts and samples come from the exact same authorized read.
-        const attention = summarizeAttention(reader, taskId, scope.allow);
+        const attention = summarizeAttention(reader, taskId);
         let bytes = Buffer.byteLength(JSON.stringify(attention));
         const records = [];
         let runtimeEvents;
@@ -75,13 +74,13 @@ export function readTaskContext(store, taskId, environment = {}) {
         const result = {
             taskId, coreCursor: encode(cursor), throughCursor: encode(cursor),
             view: "current",
-            ...(scope.allow === undefined ? {
-                phase,
-                briefWriteGuard: taskBriefGuard(reader, scope.task)
-            } : {}),
+            phase,
+            briefWriteGuard: taskBriefGuard(reader, scope.task),
             caller: scope.caller === undefined ? { kind: "unmanaged-or-global" } : {
+                taskId: scope.caller.taskId,
                 role: scope.caller.roleName,
-                executionAuthority: currentManagedRuntime(reader, environment, taskId)?.executionAuthority ?? "historical-read-only"
+                executionAuthority: scope.caller.taskId !== taskId ? "reference-only"
+                    : currentManagedRuntime(reader, environment, taskId)?.executionAuthority ?? "historical-read-only"
             },
             collections: Object.entries(sources.reduce((counts, source) => {
                 counts[source.family] = (counts[source.family] ?? 0) + source.count;
@@ -118,7 +117,7 @@ export function readTaskContext(store, taskId, environment = {}) {
         return result;
     });
 }
-function summarizeAttention(store, taskId, allow) {
+function summarizeAttention(store, taskId) {
     const group = () => ({ count: 0, refs: [], omittedRefs: 0 });
     const attention = {
         openInputs: group(), pendingOperations: group(), unknownOperations: group(), messages: group()
@@ -131,7 +130,7 @@ function summarizeAttention(store, taskId, allow) {
     ]) {
         const page = store.queryContextRecords(taskId, {
             family, statuses, descending: category === "messages",
-            unhandledMessages: category === "messages", ids: allowedIds(allow, family), limit: MAX_ATTENTION_REFS
+            unhandledMessages: category === "messages", limit: MAX_ATTENTION_REFS
         });
         const summary = attention[category];
         summary.count = page.count;
@@ -154,7 +153,7 @@ function summarizeAttention(store, taskId, allow) {
  */
 export function readTaskContextDelta(store, taskId, input, environment = {}) {
     return store.readTransaction((reader) => {
-        const { allow } = authorizeContext(reader, taskId, environment);
+        authorizeContext(reader, taskId, environment);
         const start = decode(input.after, taskId);
         const now = currentCursor(reader, taskId);
         const continuation = input.continuation === undefined ? undefined : decodePage(input.continuation, taskId);
@@ -174,7 +173,7 @@ export function readTaskContextDelta(store, taskId, input, environment = {}) {
             throw usageError(`Context delta limit must be between 1 and ${MAX_EVENTS}.`);
         }
         const selected = reader.queryContextRecords(taskId, {
-            family: "task-event", ids: allowedIds(allow, "task-event"),
+            family: "task-event",
             afterSequence: after, throughSequence: bound.sequence, limit
         });
         const page = [];
@@ -213,8 +212,7 @@ export function inspectTaskContext(store, taskId, selector, environment = {}) {
 export function readTaskContextResource(store, taskId, selector, environment = {}) {
     return store.readTransaction((reader) => {
         const scope = authorizeContext(reader, taskId, environment);
-        const value = isAllowed(scope.allow, selector.store, selector.refId)
-            ? inspectValue(reader, scope, selector) : null;
+        const value = inspectValue(reader, scope, selector);
         if (value === null)
             throw usageError("Context reference is unavailable in the caller's current scope.");
         const entry = materialize(selector.store, selector.refId, value);
@@ -280,9 +278,8 @@ export const CONTEXT_FAMILIES = [
 ];
 export function listContextMessages(store, taskId, environment = {}) {
     return store.readTransaction((reader) => {
-        const { allow } = authorizeContext(reader, taskId, environment);
+        authorizeContext(reader, taskId, environment);
         return reader.listMessages(taskId)
-            .filter((message) => isAllowed(allow, "task-message", message.id))
             .sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.id.localeCompare(b.id));
     });
 }
@@ -334,7 +331,11 @@ export async function withContextObservations(core, providers, timeoutMs = 250)
     }
     return { ...result, omittedObservations: observations.length - result.observations.length };
 }
-/** Shared current/historical Session read identity; discovery may only narrow it. */
+/** Authenticate ordinary reads of the local user's resource. Task/Assignment
+ * ownership is execution scope, not a confidentiality boundary. This does not
+ * switch Home, impersonate a target Role, or relax explicit global Job limits.
+ * Filesystem access and the authenticated Web/Controller transport remain the
+ * resource boundary of this single-user local product. */
 export function resolveContextReader(store, environment) {
     const caller = resolveManagedTaskReader(store, environment);
     if (caller === undefined && environment.YUI_SESSION_SCOPE === "global" && environment.YUI_ROLE !== "operator") {
@@ -351,57 +352,14 @@ export function resolveContextReader(store, environment) {
 }
 function authorizeContext(store, taskId, environment) {
     const caller = resolveContextReader(store, environment);
-    if (caller !== undefined && caller.taskId !== taskId)
-        throw usageError("Context is outside the caller's Task.");
     const task = store.getTask(taskId);
     if (task === null)
         throw taskNotFound(taskId);
-    let allow;
-    if (caller !== undefined && caller.roleName !== "leader") {
-        if (caller.currentRunId === undefined)
-            throw usageError("A managed Role needs a current AgentRun to read its scoped Context.");
-        const pack = buildRunContextPack(store, taskId, caller.currentRunId);
-        allow = new Set(pack.pointers.map((ref) => `${ref.store}:${ref.refId}`));
-        allow.add(`role:${caller.roleName}`);
-        allow.add(`turn:${caller.currentRunId}`);
-        // Shared current user intent and this exact Assignment's live steers augment
-        // the frozen refs. Query identities only: another Role's results, ordinary
-        // addressed messages and Leader steers remain outside this scope.
-        const run = store.getRun(taskId, caller.currentRunId);
-        const current = store.contextInputReferences(taskId, {
-            roleName: caller.roleName, workItemId: run?.workItemId, reviewRoundId: run?.reviewRoundId
-        });
-        for (const id of current.messages)
-            allow.add(`task-message:${id}`);
-        for (const id of current.events)
-            allow.add(`task-event:${id}`);
-        if (run?.workItemId !== undefined) {
-            for (const job of store.listDurableJobs(taskId)) {
-                if (job.owner.kind === "work-item" && job.owner.workItemId === run.workItemId)
-                    allow.add(`job:${job.id}`);
-            }
-        }
-    }
-    return { task, allow, caller };
-}
-/** Independent record commands share Context's exact read boundary, not a
- * second role-based approximation of Assignment visibility. */
-export function contextRecordReader(store, taskId, environment = {}) {
-    const { allow } = authorizeContext(store, taskId, environment);
-    return (family, id) => isAllowed(allow, family, id);
-}
-export function assertContextRecordReadable(store, taskId, family, id, environment = {}) {
-    if (!contextRecordReader(store, taskId, environment)(family, id)) {
-        throw usageError("Context reference is outside the caller's Assignment.");
-    }
+    return { task, caller };
 }
-function isAllowed(allow, family, id) {
-    return allow === undefined || allow.has(`${family}:${id}`);
-}
-function allowedIds(allow, family) {
-    const prefix = `${family}:`;
-    return allow === undefined ? undefined : [...allow]
-        .filter(ref => ref.startsWith(prefix)).map(ref => ref.slice(prefix.length));
+/** Independent record commands authenticate against the same resource boundary. */
+export function assertTaskReadable(store, taskId, environment = {}) {
+    authorizeContext(store, taskId, environment);
 }
 function roleProfile(role) {
     return {
@@ -413,12 +371,12 @@ function roleProfile(role) {
 /** Resolve just the requested family. Families without a singular Store read
  * use their existing list primitive, without constructing unrelated Context.
  */
-function inspectValue(store, { task, allow, caller }, { store: family, refId }) {
+function inspectValue(store, { task, caller }, { store: family, refId }) {
     const taskId = task.id;
     switch (family) {
         case "task": return refId === taskId ? task : null;
         case "task-brief": return refId === taskId ? store.getTaskBrief(taskId) : null;
-        case "remote-delivery": return refId === taskId && allow === undefined
+        case "remote-delivery": return refId === taskId
             ? projectTaskRemoteDeliveryFromStore(store, task) : null;
         case "role": return store.getRole(taskId, refId);
         case "role-profile": {
@@ -442,8 +400,10 @@ function inspectValue(store, { task, allow, caller }, { store: family, refId })
         }
         case "input-request": return store.getInputRequest(taskId, refId);
         case "work-item": return store.getWorkItem(taskId, refId);
-        case "accepted-work-item":
-            return allow?.has(`accepted-work-item:${refId}`) ? store.getWorkItem(taskId, refId) : null;
+        case "accepted-work-item": {
+            const item = store.getWorkItem(taskId, refId);
+            return item?.status === "accepted" ? item : null;
+        }
         case "candidate": {
             const parts = refId.split("/");
             if (parts.length !== 2)
@@ -457,8 +417,6 @@ function inspectValue(store, { task, allow, caller }, { store: family, refId })
             return store.queryContextRecords(taskId, { family, ids: [refId], limit: 1 }).records[0]?.value ?? null;
         case "run": return store.getRun(taskId, refId);
         case "source-run": {
-            if (!allow?.has(`source-turn:${refId}`))
-                return null;
             const run = store.getRun(taskId, refId);
             return run === null ? null : sourceRunContextValue(run);
         }
@@ -488,15 +446,13 @@ function inspectValue(store, { task, allow, caller }, { store: family, refId })
         case "managed-workspace": {
             // Existing frozen AgentRun overlays use the Task/Role alias; owner keys
             // identify the durable workspace in current Task reads.
-            if (caller?.currentRunId !== undefined && refId === `${taskId}/${caller.roleName}`) {
+            if (caller?.taskId === taskId && caller.currentRunId !== undefined && refId === `${taskId}/${caller.roleName}`) {
                 return store.getRun(taskId, caller.currentRunId)?.workspace ?? null;
             }
             return store.listManagedWorkspaces(taskId)
                 .find((workspace) => managedWorkspaceKey(workspace.owner) === refId) ?? null;
         }
         case "mailbox": {
-            if (allow !== undefined)
-                return null;
             if (refId === "task")
                 return store.getWorkMailbox({ kind: "task", taskId });
             const roleName = refId.startsWith("role:") ? refId.slice("role:".length) : undefined;
@@ -509,18 +465,18 @@ function inspectValue(store, { task, allow, caller }, { store: family, refId })
         default: return null;
     }
 }
-function authorizedSources(store, { task, allow, caller }, current = false, requestedFamily, discovery = false) {
+function authorizedSources(store, { task, caller }, current = false, requestedFamily, discovery = false) {
     const taskId = task.id;
     const sources = [];
     const add = (family, id, value) => {
-        if ((requestedFamily === undefined || requestedFamily === family) && value !== null && isAllowed(allow, family, id)) {
+        if ((requestedFamily === undefined || requestedFamily === family) && value !== null) {
             sources.push({ family, count: 1, read: () => [materialize(family, id, value)] });
         }
     };
     const query = (family, options = {}) => {
         if (requestedFamily !== undefined && requestedFamily !== family)
             return;
-        const selection = { ...options, family, ids: allowedIds(allow, family) };
+        const selection = { ...options, family };
         const { count } = store.queryContextRecords(taskId, { ...selection, limit: 0 });
         sources.push({ family, count, *read(offset = 0) {
                 for (const { id, value } of store.queryContextRecords(taskId, {
@@ -531,7 +487,7 @@ function authorizedSources(store, { task, allow, caller }, current = false, requ
     };
     add("task", taskId, task);
     add("task-brief", taskId, store.getTaskBrief(taskId));
-    if (allow === undefined && (requestedFamily === undefined || requestedFamily === "remote-delivery")) {
+    if (requestedFamily === undefined || requestedFamily === "remote-delivery") {
         add("remote-delivery", taskId, projectTaskRemoteDeliveryFromStore(store, task));
     }
     for (const role of store.listRoles(taskId)) {
@@ -552,9 +508,6 @@ function authorizedSources(store, { task, allow, caller }, current = false, requ
     // Current responsibilities and unanswered inputs precede historical bulk.
     query("input-request", { statuses: ["open"] });
     query("work-item", current ? { excludeStatuses: ["accepted", "retired"] } : {});
-    for (const id of allowedIds(allow, "accepted-work-item") ?? []) {
-        add("accepted-work-item", id, store.getWorkItem(taskId, id));
-    }
     if (!current)
         query("candidate");
     // File artifacts are not enumerated into the synchronous Context listing: the
@@ -565,22 +518,17 @@ function authorizedSources(store, { task, allow, caller }, current = false, requ
     if (!current)
         query("environment-preparation");
     query("managed-workspace");
-    if (caller?.currentRunId !== undefined) {
+    if (caller?.taskId === taskId && caller.currentRunId !== undefined) {
         add("managed-workspace", `${taskId}/${caller.roleName}`, store.getRun(taskId, caller.currentRunId)?.workspace ?? null);
     }
     if (!current)
         query("change-set");
     query("task-message", { descending: true, unhandledMessages: current });
     query("run", { descending: true, ...(current ? { statuses: ["active"] } : {}) });
-    for (const id of allowedIds(allow, "source-turn") ?? []) {
-        const run = store.getRun(taskId, id);
-        if (run !== null)
-            add("source-run", id, sourceRunContextValue(run));
-    }
     query("review-round", { descending: true, ...(current ? { statuses: ["pending", "running"] } : {}) });
     if (!current)
         query("input-request", { excludeStatuses: ["open"] });
-    if (!current && allow === undefined) {
+    if (!current) {
         add("mailbox", "task", store.getWorkMailbox({ kind: "task", taskId }));
         for (const role of store.listRoles(taskId)) {
             add("mailbox", `role:${role.name}`, store.getWorkMailbox({ kind: "role", taskId, roleName: role.name }));

package/dist/context/taskSearch.js

@@ -1,8 +1,7 @@
 import { usageError } from "../errors/cliError.js";
 import { TASK_SEARCH_KINDS } from "../storage/taskSearch.js";
 import { contextContentDigest } from "./contextSnapshot.js";
-import { taskCatalogScope } from "./taskCatalog.js";
-import { readTaskContextResource } from "./taskContext.js";
+import { readTaskContextResource, resolveContextReader } from "./taskContext.js";
 const PAGE_BYTES = 32 * 1024;
 /** Human-readable field pages, using the same source authorization and version
  * checks as Context. Offsets are Unicode code points, like search snippets. */
@@ -67,11 +66,8 @@ export function searchTaskBodies(store, options, environment = {}) {
         ...(options.kind === undefined ? [] : ["--kind", options.kind]),
         ...(options.cursor === undefined ? [] : ["--cursor", options.cursor])]);
     return store.readTransaction(reader => {
-        const callerTask = taskCatalogScope(reader, environment);
-        if (callerTask !== undefined && valid.taskId !== undefined && callerTask !== valid.taskId) {
-            throw usageError("Search target is outside the caller's Task.");
-        }
-        const taskId = callerTask ?? valid.taskId;
+        resolveContextReader(reader, environment);
+        const taskId = valid.taskId;
         const scope = contextContentDigest({ taskId: taskId ?? null, query: valid.query, kind: valid.kind ?? null });
         const after = valid.cursor === undefined ? undefined : decodeCursor(valid.cursor, scope);
         const rows = reader.queryTaskSearch({ ...valid, taskId, after, limit: valid.limit + 1 });

package/dist/controlPlaneCli.js

@@ -14,14 +14,14 @@ import { renderAgentConfigurationResolutionNotice } from "./cli/agentConfigurati
 import { describeCommandTree, findCommandNode } from "./cli/commandCatalog.js";
 import { discoveryCommandTree } from "./cli/commandDiscovery.js";
 import { callerDiscoveryAudience } from "./cli/callerDiscovery.js";
-import { contextRecordReader } from "./context/taskContext.js";
+import { assertTaskReadable } from "./context/taskContext.js";
 import { renderCompletion } from "./cli/completion.js";
 import { runCompletionWizard } from "./cli/completionWizard.js";
 import { resolveCompletionCandidates } from "./cli/dynamicCompletion.js";
 import { renderCommandHelp } from "./cli/helpRenderer.js";
 import { allowsInteractiveSelection, resolveInteractiveArguments } from "./cli/interactiveSelection.js";
 import { routeInvocation } from "./cli/invocationRouter.js";
-import { operatorOfflineCommand, taskDiagnosticTarget } from "./cli/managedDiagnostics.js";
+import { operatorOfflineCommand, isTaskReadCommand } from "./cli/managedDiagnostics.js";
 import { assertConfigurationAuthority, assertTaskInvocationScope } from "./cli/invocationAuthority.js";
 import { requireManagedGlobalCaller, requireManagedGlobalReader, ManagedRuntimeDriftError } from "./runtime/managedCaller.js";
 import { assertJobAgentCommand } from "./job/agentRoleScope.js";
@@ -1094,7 +1094,7 @@ export async function main() {
                 if (taskId === undefined || action === undefined || !["list", "read", "save"].includes(action)) {
                     throw usageError(usage);
                 }
-                if (process.env.YUI_SESSION_SCOPE === "task" && process.env.YUI_TASK_ID !== taskId) {
+                if (action === "save" && process.env.YUI_SESSION_SCOPE === "task" && process.env.YUI_TASK_ID !== taskId) {
                     throw usageError("Artifact is outside the managed Task scope.");
                 }
                 if (store.getTask(taskId) === null)
@@ -2065,12 +2065,7 @@ async function preflightManagedTaskControlPlane() {
         && ["agent-host", "session-notify", "runtime-hook"].includes(args[1] ?? "");
     const home = resolveYuiHome(process.env);
     assertManagedSessionManifest(home, "task");
-    const diagnosticTarget = taskDiagnosticTarget(args);
-    const diagnostic = diagnosticTarget !== undefined
-        && diagnosticTarget === process.env.YUI_TASK_ID;
-    if (diagnosticTarget !== undefined && !diagnostic) {
-        throw usageError("Diagnostics must remain within this Session's Task.");
-    }
+    const diagnostic = isTaskReadCommand(args);
     // One gate for every managed command: the current CLI, Home, and Controller
     // must agree. Internal callbacks must still be able to append their immutable
     // fact while the Controller is offline.
@@ -2087,13 +2082,6 @@ async function preflightManagedTaskControlPlane() {
         : diagnostic
             ? resolveManagedTaskReader(verifiedStore, process.env)
             : requireManagedTaskCaller(verifiedStore, process.env);
-    if (diagnostic && runtime?.roleName !== "leader"
-        && !(args[1] === "show"
-            || (args[1] === "role" && args[2] === "session" && args[3] === "inspect"
-                && args[5] === runtime?.roleName))) {
-        // Non-Leaders keep their Assignment-scoped read authorization.
-        requireManagedTaskCaller(verifiedStore, process.env);
-    }
     const request = taskFinalReviewInvocation.request;
     if (request !== undefined && diagnostic)
         requireManagedTaskCaller(verifiedStore, process.env);
@@ -3079,7 +3067,7 @@ function completionSelectionPorts(home) {
     if (process.env.YUI_SESSION_SCOPE !== "task")
         return ports;
     const taskId = process.env.YUI_TASK_ID;
-    const readable = contextRecordReader(store, taskId, process.env);
+    assertTaskReadable(store, taskId, process.env);
     const families = {
         "task.list": "task", "project.list": "project-policy", "task.role.list": "role",
         "task.work.list": "work-item", "task.message.list": "task-message", "task.input.list": "input-request",
@@ -3103,7 +3091,7 @@ function completionSelectionPorts(home) {
                     return false;
                 if (method === "project.list" && !store.getTask(taskId)?.projectBindings.some(binding => binding.projectId === id))
                     return false;
-                return readable(family, id);
+                return true;
             });
         } };
 }

package/dist/controller/fileSchedulerStoreAdapter.js

@@ -2114,8 +2114,14 @@ export class FileSchedulerStoreAdapter {
                     && existing.nativeSessionId !== input.session.nativeSessionId
                     && existing.status === "active";
                 if (!defersConversationReplacement && (existing?.nativeSessionId !== input.session.nativeSessionId || existing.status !== "active")) {
+                    // Preparation reactivates the fixed native identity, not its name.
+                    // Preserve the stored title even for an ended Session; only the
+                    // naming receipt may advance it on resume.
+                    const { title, ...preparedSession } = input.session;
                     saveTaskSession(store, role, {
-                        ...input.session,
+                        ...preparedSession,
+                        ...(existing?.nativeSessionId !== input.session.nativeSessionId && title !== undefined
+                            ? { title } : {}),
                         nativeSessionId: input.session.nativeSessionId
                     }, "active", input.now);
                 }
@@ -2180,7 +2186,7 @@ export class FileSchedulerStoreAdapter {
     recordLaunchedRuntimeNativeSession(input, assertCurrent, now = new Date()) {
         return this.store.transaction((store) => {
             assertCurrent();
-            const session = input.owner.scope === "task"
+            let session = input.owner.scope === "task"
                 ? recordTaskRuntimeNativeSession(store, {
                     taskId: input.owner.taskId,
                     roleName: input.owner.roleName,
@@ -2196,6 +2202,20 @@ export class FileSchedulerStoreAdapter {
                     nativeSessionId: input.nativeSessionId,
                     effective: input.effective
                 }, now);
+            if (input.generatedTitle !== undefined && (session.title === undefined
+                || session.title === session.generatedTitle || session.title === input.generatedTitle)) {
+                const set = input.owner.scope === "task"
+                    ? store.getTaskRoleSessionSet(input.owner.taskId, input.owner.roleName)
+                    : store.getGlobalRoleSessionSet(input.owner.roleName);
+                const titled = recordRoleAgentSession(set, {
+                    ...session, title: input.generatedTitle, generatedTitle: input.generatedTitle
+                }, now);
+                if (titled.owner.scope === "task")
+                    store.saveTaskRoleSessionSet(titled);
+                else
+                    store.saveGlobalRoleSessionSet(titled);
+                session = titled.sessions[input.agentId];
+            }
             if (input.owner.scope === "global") {
                 let sessions = store.getGlobalRoleSessionSet(input.owner.roleName);
                 let binding = sessions.providerBinding;

package/dist/controller/jobClient.js

@@ -1,4 +1,4 @@
-import { resolveJobCaller } from "../task/taskAuthority.js";
+import { resolveJobCaller, resolveJobReadCaller } from "../task/taskAuthority.js";
 import { callFileTaskController } from "./clientRuntime.js";
 export async function startDurableJob(home, params, clientOptions = {}) {
     // rr6/f2: Route through callFileTaskController so an Integration-issued
@@ -89,7 +89,7 @@ export function createControllerIntegrationJobPort(home, clientOptions = {}) {
             return job;
         },
         async getJob(taskId, jobId) {
-            return getDurableJob(home, taskId, jobId, resolveJobCaller(clientOptions.environment, taskId), clientOptions);
+            return getDurableJob(home, taskId, jobId, resolveJobReadCaller(clientOptions.environment, taskId), clientOptions);
         },
         async cancelJob(taskId, jobId) {
             // rr8/rr12: Bind the cancel request to the caller's managed identity.

package/dist/controller/jobControl.js

@@ -18,7 +18,7 @@ import { redactLaunchText } from "../runtime/launchDiagnostics.js";
 import { requireManagedTaskCaller, ManagedRuntimeDriftError } from "../runtime/managedCaller.js";
 import { CliError } from "../errors/cliError.js";
 import { assertJobAssignmentScope, JobAssignmentScopeError } from "../job/jobAssignmentScope.js";
-import { assertContextRecordReadable } from "../context/taskContext.js";
+import { assertTaskReadable } from "../context/taskContext.js";
 import { assertTaskProjectWriteAuthority } from "../task/taskAuthority.js";
 import { validateHttpPreview } from "../job/httpPreview.js";
 import { definitionFromTaskRun } from "../job/jobDefinition.js";
@@ -134,7 +134,7 @@ export function createDurableJobControl(store) {
             if (caller === undefined)
                 throw jobControlError("UNAUTHORIZED", "Job reads require an explicit caller.");
             try {
-                assertContextRecordReadable(store, taskId, "job", jobId, caller.scope === "user" ? {} : {
+                assertTaskReadable(store, taskId, caller.scope === "user" ? {} : {
                     YUI_SESSION_SCOPE: caller.scope, YUI_TASK_ID: caller.taskId, YUI_ROLE: caller.role,
                     YUI_AGENT_ID: caller.agentId, YUI_ADAPTER_ID: caller.adapterId, YUI_NATIVE_SESSION_ID: caller.nativeSessionId
                 });

package/dist/controller/jobDefinitionControl.js

@@ -137,7 +137,7 @@ export function authorizeRunRead(store, run, caller) {
             throw new Error("Task delegation is not an Assignment grant.");
         return;
     }
-    // A revised definition's Assignment does not grant access to earlier Runs.
+    // Ordinary process-Run evidence does not transfer its execution Assignment.
     if ("taskId" in run)
         createDurableJobControl(store).getJob(run.taskId, run.id, caller);
 }
@@ -168,6 +168,8 @@ export function admitJobRun(store, home, scope, definitionId, caller, trigger, n
         const same = runs.find(run => run.trigger.key === trigger.key && run.trigger.source === trigger.source);
         if (same !== undefined) {
             authorizeRunRead(tx, same, caller);
+            if ("taskId" in same && !same.delegation)
+                requireJobAssignment(tx, same, caller);
             if (same.definitionRevision !== job.revision || same.retryOf !== retryOf) {
                 throw new Error(`JobRun trigger conflicts with its original snapshot: ${same.id}.`);
             }
@@ -178,6 +180,8 @@ export function admitJobRun(store, home, scope, definitionId, caller, trigger, n
             || run.status === "unknown-needs-attention");
         if (occupied !== undefined) {
             authorizeRunRead(tx, occupied, caller);
+            if ("taskId" in occupied && !occupied.delegation)
+                requireJobAssignment(tx, occupied, caller);
             return { run: occupied, created: false, reason: "overlap" };
         }
         if (retryOf !== undefined && !runs.some(run => run.id === retryOf

package/dist/controller/runtimeLaunchCoordinator.js

@@ -69,6 +69,7 @@ export class RuntimeLaunchCoordinator {
             }
         }
         let preflightObserved = beforeHostStart === undefined;
+        let generatedTitle;
         const observePreflight = (preflight) => {
             if (preflightObserved || !sameOwner(preflight.owner, request.owner)
                 || preflight.runId !== request.runId
@@ -80,6 +81,7 @@ export class RuntimeLaunchCoordinator {
             }
             assertLaunchCurrent();
             preflightObserved = true;
+            generatedTitle = preflight.generatedTitle;
             beforeHostStart?.(preflight);
         };
         const shared = {
@@ -94,7 +96,9 @@ export class RuntimeLaunchCoordinator {
         };
         // Even without a startup-facts consumer, recheck after asynchronous Host
         // validation and immediately before creating the process.
-        const callback = beforeHostStart === undefined ? () => assertLaunchCurrent() : observePreflight;
+        const callback = beforeHostStart === undefined
+            ? (preflight) => { assertLaunchCurrent(); generatedTitle = preflight.generatedTitle; }
+            : observePreflight;
         if (request.mode === "resume" && !request.nativeSessionId) {
             throw new Error("Restoring a Session requires its native session id.");
         }
@@ -109,11 +113,18 @@ export class RuntimeLaunchCoordinator {
             throw new Error("Session host returned facts inconsistent with the requested launch.");
         }
         if (binding.nativeSessionId !== undefined) {
+            // A live Host may reuse its Provider without applying the new plan.
+            // Codex reports the actual naming effect; other adapters can only name
+            // at creation and must not overwrite native user names on resume.
+            const recordedTitle = request.adapterId === "codex"
+                ? binding.appliedGeneratedTitle
+                : request.mode === "new" ? generatedTitle : undefined;
             this.sessions.recordLaunchedRuntimeNativeSession({
                 owner: request.owner,
                 agentId: request.agentId,
                 adapterId: request.adapterId,
                 nativeSessionId: binding.nativeSessionId,
+                ...(recordedTitle === undefined ? {} : { generatedTitle: recordedTitle }),
                 effective
             }, assertLaunchCurrent, this.options.now?.() ?? new Date());
         }

package/dist/executor/agentExecutor.js

@@ -111,6 +111,8 @@ export function recordRoleAgentSession(set, input, now) {
         adapterId,
         nativeSessionId,
         ...optionalSessionText("title", input.title ?? continuing?.title),
+        ...((input.generatedTitle ?? continuing?.generatedTitle) === undefined ? {}
+            : { generatedTitle: input.generatedTitle ?? continuing?.generatedTitle }),
         ...optionalSessionText("preview", input.preview ?? continuing?.preview),
         policy: input.policy,
         effective: continuing?.effective ?? effective,
@@ -567,6 +569,11 @@ export function validateRoleAgentSession(session, expectedAgentId = session.agen
         throw new Error(`Role Agent session effective identity is inconsistent: ${agentId}.`);
     }
     requireText(session.nativeSessionId, "Native session id");
+    if (session.generatedTitle !== undefined
+        && (typeof session.generatedTitle !== "string" || session.generatedTitle.length > 80
+            || optionalSessionText("title", session.generatedTitle).title !== session.generatedTitle)) {
+        throw new Error("Role Agent generated title is invalid.");
+    }
     if (session.title !== undefined
         && optionalSessionText("title", session.title).title !== session.title) {
         throw new Error("Role Agent session title is invalid.");

package/dist/executor/fileRoleLaunchPlanner.js

@@ -17,7 +17,7 @@ import { managedRuntimeAdmission } from "../runtime/agentDriver.js";
 import { builtinAgentEndpointImplementation, validateAgentEndpointImplementation } from "../runtime/agentEndpointIdentity.js";
 import { builtinAgentDriverRegistry, builtinDriverIdForAdapter } from "../runtime/builtinAgentDrivers.js";
 import { assertProviderConversationReplaceable } from "../runtime/providerRuntimeIdentity.js";
-import { operatorSessionTitle, resolveTaskRoleSessionTitle } from "../runtime/sessionTitle.js";
+import { globalRoleSessionTitle, resolveTaskRoleSessionTitle } from "../runtime/sessionTitle.js";
 import { parseTaskRuntimeIsolationDescriptor, taskRuntimeIsolationEnvironment } from "../runtime/taskRuntimeIsolation.js";
 import { planningRuntimeCwd } from "../storage/homeLayout.js";
 import { resolveAgentAdapter } from "./agentAdapter.js";
@@ -220,7 +220,11 @@ export class FileRoleLaunchPlanner {
             // attempt was rejected, cancelled, or completed.
             assertProviderConversationReplaceable(sessionSet.providerBinding);
         }
-        return this.#compile(role, input, { scope: "task", taskId: task.id }, resolveTaskRoleSessionTitle(input.mode === "resume" ? existing?.title : undefined, task, role.name), input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, effective, {
+        return this.#compile(role, input, { scope: "task", taskId: task.id }, resolveTaskRoleSessionTitle(input.mode === "resume" ? existing?.title : undefined, task, role.name, {
+            executionAuthority: (input.mode === "resume" ? existing?.effective : effective)?.executionAuthority,
+            instanceCode: role.instanceCode,
+            generatedTitle: existing?.generatedTitle
+        }), input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, effective, {
             purpose
         });
     }
@@ -249,9 +253,12 @@ export class FileRoleLaunchPlanner {
         if (input.mode === "new" && sessionSet?.providerBinding != null) {
             assertProviderConversationReplaceable(sessionSet.providerBinding);
         }
-        return this.#compile(role, input, { scope: "global" }, input.mode === "new" && role.name === "operator"
-            ? operatorSessionTitle(this.#now(), this.store.getConfig().timeZone)
-            : undefined, input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, effective, { purpose: "execution" });
+        return this.#compile(role, input, { scope: "global" }, input.mode === "new"
+            ? globalRoleSessionTitle(role.name, this.#now(), this.store.getConfig().timeZone, role.instanceCode)
+            : existing?.generatedTitle !== undefined && existing.title === existing.generatedTitle
+                ? globalRoleSessionTitle(role.name, new Date(existing.createdAt), this.store.getConfig().timeZone, role.instanceCode)
+                    ?? `Yui ${role.name}`
+                : undefined, input.mode === "resume" && compatibleExisting ? existing.nativeSessionId : undefined, effective, { purpose: "execution" });
     }
     #compile(role, input, owner, sessionTitle, knownNativeSessionId, effective, sessionPolicy) {
         const launchRole = effectiveRoleForLaunch(role, effective);
@@ -385,7 +392,9 @@ export class FileRoleLaunchPlanner {
             agent,
             config: effectiveConfig,
             workspace: agentWorkspace,
-            ...(sessionTitle === undefined || postCreateOperatorTitle
+            // CLI --name has no ownership check on resume. Only the Codex native
+            // metadata path below may rename an existing conversation.
+            ...(sessionTitle === undefined || postCreateOperatorTitle || input.mode === "resume"
                 ? {}
                 : { sessionTitle }),
             ...sessionContext
@@ -510,6 +519,9 @@ export class FileRoleLaunchPlanner {
                 mode: "resume",
                 nativeSessionId: requireText(providerNativeSessionId, "Managed Provider restore native session id"),
                 ...(sessionTitle === undefined ? {} : { sessionTitle }),
+                ...(existingSession?.generatedTitle !== undefined
+                    && existingSession.title === existingSession.generatedTitle
+                    ? { previousSessionTitle: existingSession.generatedTitle } : {}),
                 ...(managedCompiled.codexThread === undefined
                     ? {}
                     : { codexThread: managedCompiled.codexThread }),
@@ -594,6 +606,10 @@ export class FileRoleLaunchPlanner {
             },
             launch: ordinaryConversationLaunch,
             session,
+            ...(sessionTitle !== undefined && (input.mode === "new"
+                || existingSession?.title === undefined
+                || existingSession.title === existingSession.generatedTitle)
+                ? { generatedTitle: sessionTitle } : {}),
             ...(sessionTitle === undefined ? {} : { sessionTitle })
         };
     }