@zq-silk/yui 2.22.0 → 2.25.0

package/dist/controller/hostLifecycle.js

@@ -0,0 +1,153 @@
+import { createRuntimeBinding } from "../runtime/runtimeBinding.js";
+import { normalizeRuntimeOwner } from "../runtime/runtimeOwner.js";
+import { RuntimeHostContentionError } from "../runtime/ports.js";
+const states = ["unavailable", "stopped", "starting", "running", "stopping"];
+export const CONTROLLER_HOST_TRANSITIONS = {
+    launch: { from: ["unavailable", "stopped", "running"], to: "starting" },
+    launched: { from: ["starting"], to: "running" },
+    stop: { from: states, to: "stopping" },
+    "exit-sent": { from: ["stopping"], to: "stopping" },
+    stopped: { from: ["stopping"], to: "stopped" },
+    failed: { from: ["starting", "stopping"], to: "unavailable" },
+    observed: { from: states, to: (current, observed) => current === "stopping" && (observed.state === "running" || observed.state === "starting")
+            ? "stopping" : observed.state }
+};
+/** All physical effects still require their existing durable caller authority.
+ * This process-local FSM gates competing effects at the shared Host port.
+ * Recovery observes current custody; it never invents a launch or replays one.
+ * Observation revisions reject late reads, not external process identities:
+ * exact OS/native identities remain owned by SessionOwner/Host fences. */
+export function createControllerHostLifecycle(raw, hooks = {}) {
+    const entries = new Map();
+    let nextOperation = 0;
+    const entryFor = (input) => {
+        const owner = normalizeRuntimeOwner(input);
+        const key = JSON.stringify(owner);
+        let entry = entries.get(key);
+        if (!entry) {
+            entry = { owner: Object.freeze(owner), state: "unavailable", revision: 0 };
+            entries.set(key, entry);
+        }
+        return entry;
+    };
+    const send = (entry, event, observed, binding) => {
+        const rule = CONTROLLER_HOST_TRANSITIONS[event];
+        if (!rule.from.includes(entry.state))
+            throw new RuntimeHostContentionError("previous-process", `Host lifecycle cannot ${event} from ${entry.state}.`);
+        const to = typeof rule.to === "function" ? rule.to(entry.state, observed) : rule.to;
+        const nativeSessionId = to === "stopped" ? undefined
+            : binding?.nativeSessionId ?? observed?.nativeSessionId ?? entry.nativeSessionId;
+        const bindingId = to === "stopped" ? undefined
+            : observed?.nativeSessionId && observed.nativeSessionId !== entry.nativeSessionId
+                ? undefined : binding?.id ?? entry.bindingId;
+        if (event === "observed" && to === entry.state && nativeSessionId === entry.nativeSessionId)
+            return;
+        const transition = Object.freeze({ owner: entry.owner, from: entry.state, to, event,
+            revision: entry.revision + 1, operationId: entry.operationId, nativeSessionId, bindingId });
+        hooks.before?.notify(transition);
+        entry.state = to;
+        entry.revision = transition.revision;
+        entry.nativeSessionId = nativeSessionId;
+        entry.bindingId = bindingId;
+        hooks.after?.notify(transition);
+    };
+    const observe = (entry, revision, inspection) => {
+        if (entry.revision === revision && entry.operationId === undefined)
+            send(entry, "observed", inspection);
+        return inspection;
+    };
+    const effect = async (owner, event, run) => {
+        const entry = entryFor(owner);
+        if (entry.operationId !== undefined)
+            throw new RuntimeHostContentionError("previous-process", `Host lifecycle already has an in-flight operation for ${owner.roleName}.`);
+        // Check state before reserving the operation; a rejected edge owns nothing.
+        if (!CONTROLLER_HOST_TRANSITIONS[event].from.includes(entry.state))
+            throw new RuntimeHostContentionError("previous-process", `Host lifecycle cannot ${event} from ${entry.state}.`);
+        entry.operationId = ++nextOperation;
+        send(entry, event);
+        try {
+            return await run(entry);
+        }
+        catch (error) {
+            send(entry, "failed");
+            throw error;
+        }
+        finally {
+            entry.operationId = undefined;
+        }
+    };
+    const inspectOwner = async (owner) => {
+        const entry = entryFor(owner), revision = entry.revision;
+        return observe(entry, revision, await raw.inspectOwner(owner));
+    };
+    const launch = async (request, before) => {
+        await inspectOwner(request.owner);
+        return effect(request.owner, "launch", async (entry) => {
+            const binding = createRuntimeBinding(request.mode === "new"
+                ? await raw.start(request, before) : await raw.restore(request, before));
+            if (JSON.stringify(normalizeRuntimeOwner(binding.owner)) !== JSON.stringify(entry.owner)
+                || binding.agentId !== request.agentId || binding.adapterId !== request.adapterId
+                || request.mode === "resume" && binding.nativeSessionId !== request.nativeSessionId) {
+                throw new Error("Host lifecycle launch handshake has mismatched owner/native identity.");
+            }
+            send(entry, "launched", undefined, binding);
+            return binding;
+        });
+    };
+    const port = {
+        start: launch, restore: launch, inspectOwner,
+        inspect: async (binding) => {
+            const entry = entryFor(binding.owner), revision = entry.revision;
+            const inspection = await raw.inspect(binding);
+            if (entry.bindingId && entry.bindingId !== binding.id
+                || entry.nativeSessionId && binding.nativeSessionId !== entry.nativeSessionId)
+                return inspection;
+            return observe(entry, revision, inspection);
+        },
+        ...(raw.inspectOwners === undefined ? {} : {
+            inspectOwners: async (owners) => {
+                const revisions = new Map(owners.map(owner => {
+                    const entry = entryFor(owner);
+                    return [entry, entry.revision];
+                }));
+                const results = await raw.inspectOwners(owners);
+                for (const { owner, inspection } of results) {
+                    const entry = entryFor(owner), revision = revisions.get(entry);
+                    if (revision !== undefined)
+                        observe(entry, revision, inspection);
+                }
+                return results;
+            }
+        }),
+        stop: async (binding) => {
+            const current = entryFor(binding.owner);
+            if (current.nativeSessionId && binding.nativeSessionId !== current.nativeSessionId
+                || current.bindingId && binding.id !== current.bindingId) {
+                throw new Error("Host lifecycle stop carries a stale binding identity.");
+            }
+            return effect(binding.owner, "stop", async (entry) => {
+                await raw.stop(binding);
+                const observed = await raw.inspect(binding);
+                if (observed.state !== "stopped")
+                    throw new Error("Host lifecycle stop has no physical exit proof.");
+                send(entry, "stopped");
+            });
+        },
+        stopOwner: owner => effect(owner, "stop", async (entry) => {
+            const stopped = await (hooks.stopOwner ? hooks.stopOwner(owner) : raw.stopOwner(owner));
+            send(entry, stopped ? "stopped" : "failed");
+            return stopped;
+        })
+    };
+    return {
+        port,
+        snapshot: (owner) => Object.freeze({ ...entryFor(owner) }),
+        // Graceful exit acknowledgement is not exit proof. A later physical
+        // observation moves stopping -> stopped; no timer or automatic replay.
+        requestExit: (owner, run) => effect(owner, "stop", async (entry) => {
+            const result = await run();
+            send(entry, "exit-sent");
+            return result;
+        })
+    };
+}

package/dist/controller/hostLifecycleChecks.js

@@ -0,0 +1,27 @@
+import { createNonBlockingChecks } from "../runtime/lifecycleChecks.js";
+/** Checks produce a recommendation; only the separately fenced coordinator
+ * can admit/execute it. Hints contain no target identity or restart authority. */
+export function createHostLifecycleChecks(coordinator, onError = () => { }) {
+    const checks = createNonBlockingChecks([{
+            id: "host-version",
+            run: async (_hint, signal) => {
+                const observations = await coordinator.status();
+                if (signal.aborted)
+                    return;
+                const recommended = coordinator.hasPending() || observations.some(entry => entry.status === "waiting" || entry.status === "unknown" || entry.status === "failed");
+                if (!recommended)
+                    return;
+                // This await belongs exclusively to this optional check lane. Neither
+                // Host transitions nor Controller event folding wait for this operation.
+                const results = await coordinator.request();
+                for (const entry of results) {
+                    if (entry.status === "failed" || entry.status === "unknown") {
+                        onError(new Error(`Host upgrade ${entry.owner.roleName}/${entry.nativeSessionId}: ${entry.detail}`));
+                    }
+                }
+            }
+        }], onError);
+    const close = checks.close;
+    checks.close = () => { close(); coordinator.stop(); };
+    return checks;
+}

package/dist/controller/hostUpgrade.js

@@ -0,0 +1,344 @@
+import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { isEnabled } from "../role/availability.js";
+import { createWorkMailbox, enqueueSignal, claimPending, completeProcessing, mailboxHasWork } from "../coordination/workMailbox.js";
+import { RUNTIME_HOST_UPGRADE_REASON, RUNTIME_HOST_UPGRADE_DRAINED as DRAINED, RUNTIME_HOST_UPGRADE_FAILED as FAILED, runtimeLifecycleTarget, runtimeCleanupDisposition } from "../runtime/lifecycleReservation.js";
+const SOURCE = "host-upgrade/v1:";
+/** Reuse the durable role-runtime lane and its fixed claim/settlement contract.
+ * The versioned signal source is a bounded exact request, not a second queue
+ * or writable Session state. No environment, credentials or inputs are copied.
+ * The drain signal is persisted BEFORE asking the old process to exit. */
+export class HostUpgradeCoordinator {
+    store;
+    target;
+    ports;
+    #tail = Promise.resolve();
+    #closed = false;
+    constructor(store, target, ports) {
+        this.store = store;
+        this.target = target;
+        this.ports = ports;
+    }
+    hasPending() {
+        return !this.#closed && this.store.listWorkMailboxes().some(mailbox => reasons(mailbox).includes(RUNTIME_HOST_UPGRADE_REASON));
+    }
+    stop() { this.#closed = true; }
+    async close() {
+        this.stop();
+        await this.#tail;
+    }
+    /** Read-only follow-up: never admits, drains, restores, or settles a request. */
+    async status() {
+        const results = [];
+        for (const { owner, nativeSessionId, adapterId } of this.store.listRuntimeSessionCandidates()) {
+            if (this.#closed)
+                break;
+            const result = (status, detail, snapshot) => ({
+                owner, nativeSessionId, status, detail, hostImplementation: snapshot?.hostImplementation,
+                endpointImplementation: snapshot?.endpointImplementation
+            });
+            try {
+                const mailbox = this.store.getWorkMailbox(runtimeLifecycleTarget(owner));
+                const request = readRequest(mailbox);
+                if (!this.enabled(owner)) {
+                    results.push(result("paused", "Role/Task remains paused."));
+                    continue;
+                }
+                const state = await this.ports.hostState(owner);
+                const live = state === "running" ? await this.ports.inspect(owner) : undefined;
+                if (live && this.verified(live, nativeSessionId, adapterId)) {
+                    results.push(result("current", "Loaded Host and Endpoint match this Controller.", live));
+                }
+                else if (request && (request.nativeSessionId !== nativeSessionId || live
+                    && (live.nativeSessionId !== request.nativeSessionId || live.processInstanceId !== request.processInstanceId))) {
+                    results.push(result("unknown", `Request ${request.requestId} does not match the observed Host/Session.`, live));
+                }
+                else if (request) {
+                    results.push(result(reasons(mailbox).includes(FAILED) || live?.hostUpgrade?.state === "failed" ? "failed"
+                        : state === "unavailable" ? "unknown" : "waiting", `Request ${request.requestId}; target=${request.targetGeneration}; Host=${state}; drain=${live?.hostUpgrade?.state
+                        ?? (reasons(mailbox).includes(DRAINED) ? "persisted" : "unconfirmed")}. ${live?.hostUpgrade?.detail ?? ""}`, live));
+                }
+                else {
+                    results.push(result(live && (!live.controlCapabilities?.includes("prepare-upgrade")
+                        || !live.controlCapabilities.includes("finish-upgrade")) ? "unsupported" : "unknown", "No confirmed switch to this Controller's generation.", live));
+                }
+            }
+            catch (error) {
+                results.push(result("unknown", message(error)));
+            }
+        }
+        return results;
+    }
+    request() {
+        return this.serial(async () => {
+            const results = [];
+            for (const candidate of this.store.listRuntimeSessionCandidates()) {
+                if (this.#closed)
+                    break;
+                const { owner, nativeSessionId } = candidate;
+                const result = (status, detail, snapshot) => ({
+                    owner, nativeSessionId, status, detail, hostImplementation: snapshot?.hostImplementation,
+                    endpointImplementation: snapshot?.endpointImplementation
+                });
+                try {
+                    const existing = this.store.getWorkMailbox(runtimeLifecycleTarget(owner));
+                    if (readRequest(existing)) {
+                        results.push(await this.step(owner));
+                        continue;
+                    }
+                    if (!this.enabled(owner)) {
+                        results.push(result("paused", "Role/Task remains paused; no Host is started."));
+                        continue;
+                    }
+                    const snapshot = await this.ports.inspect(owner);
+                    if (this.#closed)
+                        break;
+                    if (snapshot.nativeSessionId !== nativeSessionId) {
+                        results.push(result("unknown", "Live Host does not match the recorded native Session.", snapshot));
+                        continue;
+                    }
+                    if (this.verified(snapshot, nativeSessionId, candidate.adapterId)) {
+                        results.push(result("current", undefined, snapshot));
+                        continue;
+                    }
+                    if (this.sameImplementations(snapshot, candidate.adapterId)) {
+                        results.push(result("waiting", "Loaded implementations match; lifecycle/event readiness is not a version mismatch.", snapshot));
+                        continue;
+                    }
+                    if (!snapshot.controlCapabilities?.includes("prepare-upgrade")
+                        || !snapshot.controlCapabilities.includes("finish-upgrade")
+                        || !snapshot.hostImplementation?.generation || !snapshot.endpointImplementation?.generation
+                        || !snapshot.processInstanceId) {
+                        results.push(result("unsupported", "Old Host has no graceful-upgrade capability; retained without sending unsupported commands.", snapshot));
+                        continue;
+                    }
+                    if (existing && mailboxHasWork(existing)) {
+                        results.push(result("waiting", "Another exact lifecycle operation owns this Role.", snapshot));
+                        continue;
+                    }
+                    const session = this.session(owner, candidate.agentId);
+                    if (!session || session.nativeSessionId !== nativeSessionId)
+                        throw new Error("Session changed before upgrade admission.");
+                    const body = {
+                        nativeSessionId, processInstanceId: snapshot.processInstanceId,
+                        hostGeneration: snapshot.hostImplementation.generation, targetGeneration: this.target.generation,
+                        agentId: candidate.agentId, adapterId: candidate.adapterId, effectiveDigest: digest(session.effective)
+                    };
+                    const request = { requestId: `host-upgrade-${digest([owner, body])}`, ...body };
+                    this.store.transaction(tx => {
+                        const latest = tx.getWorkMailbox(runtimeLifecycleTarget(owner));
+                        if (latest && mailboxHasWork(latest))
+                            throw new Error("Runtime lane changed before upgrade admission.");
+                        const current = this.session(owner, candidate.agentId);
+                        if (!current || current.nativeSessionId !== nativeSessionId || digest(current.effective) !== request.effectiveDigest) {
+                            throw new Error("Session changed before upgrade admission.");
+                        }
+                        tx.saveWorkMailbox(enqueueSignal(latest ?? createWorkMailbox(runtimeLifecycleTarget(owner)), {
+                            reason: RUNTIME_HOST_UPGRADE_REASON, refs: [{ type: "session", id: nativeSessionId }],
+                            source: SOURCE + JSON.stringify(request), dedupeKey: request.requestId, occurredAt: new Date().toISOString()
+                        }));
+                    });
+                    results.push(await this.step(owner));
+                }
+                catch (error) {
+                    results.push(result("unknown", message(error)));
+                }
+            }
+            return results;
+        });
+    }
+    reconcile() {
+        return this.serial(async () => {
+            const results = [];
+            for (const mailbox of this.store.listWorkMailboxes()) {
+                if (this.#closed)
+                    break;
+                const target = mailbox.target;
+                if (target.kind !== "role-runtime" && target.kind !== "global-role-runtime")
+                    continue;
+                const owner = target.kind === "role-runtime"
+                    ? { scope: "task", taskId: target.taskId, roleName: target.roleName }
+                    : { scope: "global", roleName: target.roleName };
+                try {
+                    if (!readRequest(mailbox))
+                        continue;
+                    results.push(await this.step(owner));
+                }
+                catch (error) {
+                    results.push({ owner, nativeSessionId: "", status: "unknown", detail: message(error) });
+                }
+            }
+            return results;
+        });
+    }
+    async step(owner) {
+        let mailbox = this.store.getWorkMailbox(runtimeLifecycleTarget(owner));
+        const request = readRequest(mailbox);
+        const result = (status, detail, snapshot) => ({
+            owner, nativeSessionId: request.nativeSessionId, status, detail,
+            hostImplementation: snapshot?.hostImplementation, endpointImplementation: snapshot?.endpointImplementation
+        });
+        try {
+            if (runtimeCleanupDisposition(mailbox) !== "upgrade-host")
+                return result("waiting", "Explicit lifecycle cleanup supersedes upgrade.");
+            if (request.targetGeneration !== this.target.generation)
+                return result("waiting", "Controller generation differs from the pinned update target.");
+            if (!this.enabled(owner))
+                return result("paused", "Role/Task remains paused; original upgrade intent retained.");
+            const assertCurrent = () => {
+                const session = this.session(owner, request.agentId);
+                const currentMailbox = this.store.getWorkMailbox(runtimeLifecycleTarget(owner));
+                if (this.#closed || !session || session.status !== "active" || session.nativeSessionId !== request.nativeSessionId
+                    || digest(session.effective) !== request.effectiveDigest || !this.enabled(owner)
+                    || runtimeCleanupDisposition(currentMailbox) !== "upgrade-host"
+                    || !isDeepStrictEqual(readRequest(currentMailbox), request)) {
+                    throw new Error("Upgrade no longer owns the original Session/configuration/lifecycle lane.");
+                }
+                return session;
+            };
+            const session = assertCurrent();
+            let live;
+            const hostState = await this.ports.hostState(owner);
+            if (hostState === "running") {
+                live = await this.ports.inspect(owner);
+                if (this.verified(live, request.nativeSessionId, request.adapterId)) {
+                    assertCurrent();
+                    this.complete(owner, request);
+                    return result("upgraded", undefined, live);
+                }
+                if (reasons(mailbox).includes(FAILED))
+                    return result("failed", "Prior upgrade failed; exact request and drain facts retained. Inspect before retrying.", live);
+                if (live.nativeSessionId !== request.nativeSessionId || live.processInstanceId !== request.processInstanceId
+                    || live.hostImplementation?.generation !== request.hostGeneration) {
+                    return result("unknown", "Host changed without the target handshake; no process was stopped.", live);
+                }
+                if (!reasons(mailbox).includes(DRAINED)) {
+                    assertCurrent();
+                    live = await this.ports.control(owner, "prepare-upgrade", request);
+                    const drain = live.hostUpgrade;
+                    if (drain?.requestId !== request.requestId)
+                        return result("unknown", "Drain acknowledgement is missing or mismatched.", live);
+                    if (drain.state === "failed") {
+                        this.signal(owner, request, FAILED);
+                        return result("failed", drain.detail, live);
+                    }
+                    if (drain.state !== "drained")
+                        return result("waiting", "Admission fenced; waiting for native terminal, event persistence and owned-resource drain.", live);
+                    assertCurrent();
+                    this.signal(owner, request, DRAINED);
+                    mailbox = this.store.getWorkMailbox(runtimeLifecycleTarget(owner));
+                }
+                if (live.hostUpgrade?.requestId !== request.requestId || live.hostUpgrade.state !== "drained") {
+                    return result("unknown", "Persisted drain receipt does not match this live Host.", live);
+                }
+                assertCurrent();
+                await this.ports.control(owner, "finish-upgrade", request);
+                return result("waiting", "Old Host drained; awaiting its graceful process exit.", live);
+            }
+            if (reasons(mailbox).includes(FAILED))
+                return result("failed", "Prior launch is unconfirmed; retained request is not automatically replayed.");
+            if (hostState !== "stopped" || !reasons(mailbox).includes(DRAINED)) {
+                return result("unknown", "No proven old Host drain/exit; original inputs and Session retained.");
+            }
+            assertCurrent();
+            // A failed or unknown launch is NOT automatically replayed. The existing
+            // Host/pane and the exact mailbox request remain available for inspection.
+            try {
+                await this.ports.restore(owner, request, session.effective, assertCurrent);
+            }
+            catch (error) {
+                this.signal(owner, request, FAILED);
+                return result("failed", `Target Host launch/handshake failed: ${message(error)}`);
+            }
+            live = await this.ports.inspect(owner);
+            if (!this.verified(live, request.nativeSessionId, request.adapterId)) {
+                this.signal(owner, request, FAILED);
+                return result("failed", "Target Host did not prove native identity, implementations and control/event capabilities.", live);
+            }
+            assertCurrent();
+            this.complete(owner, request);
+            return result("upgraded", undefined, live);
+        }
+        catch (error) {
+            return result("unknown", message(error));
+        }
+    }
+    verified(snapshot, nativeSessionId, adapterId) {
+        return snapshot.nativeSessionId === nativeSessionId && snapshot.adapterId === adapterId
+            && this.sameImplementations(snapshot, adapterId)
+            && snapshot.controlCapabilities?.includes("reconcile-turn")
+            && snapshot.eventDelivery !== undefined && snapshot.eventDelivery.unpersisted === 0
+            && snapshot.eventDelivery.failure === undefined && ["idle", "ready", "busy"].includes(snapshot.state);
+    }
+    sameImplementations(snapshot, adapterId) {
+        return isDeepStrictEqual(snapshot.hostImplementation, this.target)
+            && isDeepStrictEqual(snapshot.endpointImplementation, this.ports.endpoint(adapterId));
+    }
+    session(owner, agentId) {
+        const set = owner.scope === "task" ? this.store.getTaskRoleSessionSet(owner.taskId, owner.roleName)
+            : this.store.getGlobalRoleSessionSet(owner.roleName);
+        return set?.activeAgentId === agentId ? set.sessions[agentId] : undefined;
+    }
+    enabled(owner) {
+        const role = owner.scope === "task" ? this.store.getRole(owner.taskId, owner.roleName) : this.store.getGlobalRole(owner.roleName);
+        if (!role || !isEnabled(role))
+            return false;
+        if (owner.scope === "global")
+            return true;
+        const task = this.store.getTask(owner.taskId);
+        return !!task && ["active", "draft"].includes(task.status) && task.executionGate.state === "enabled";
+    }
+    signal(owner, request, reason) {
+        this.store.transaction(tx => {
+            const mailbox = tx.getWorkMailbox(runtimeLifecycleTarget(owner));
+            if (!mailbox || !isDeepStrictEqual(readRequest(mailbox), request))
+                throw new Error("Upgrade mailbox changed.");
+            tx.saveWorkMailbox(enqueueSignal(mailbox, { reason, refs: [], source: "host-upgrade",
+                dedupeKey: `${request.requestId}:${reason}`, occurredAt: new Date().toISOString() }));
+        });
+    }
+    complete(owner, request) {
+        this.store.transaction(tx => {
+            let mailbox = tx.getWorkMailbox(runtimeLifecycleTarget(owner));
+            if (!mailbox || !isDeepStrictEqual(readRequest(mailbox), request)
+                || runtimeCleanupDisposition(mailbox) !== "upgrade-host")
+                throw new Error("Upgrade mailbox changed.");
+            if (mailbox.processing)
+                mailbox = completeProcessing(mailbox, mailbox.processing.batchId);
+            if (mailbox.pending) {
+                const batchId = request.requestId;
+                mailbox = completeProcessing(claimPending(mailbox, {
+                    batchId, owner: "runtime-lifecycle", startedAt: new Date().toISOString()
+                }), batchId);
+            }
+            tx.saveWorkMailbox(mailbox); // retain bounded dedupe receipts for repeated update
+        });
+    }
+    serial(run) {
+        const next = this.#tail.then(run);
+        this.#tail = next.catch(() => undefined);
+        return next;
+    }
+}
+function reasons(mailbox) {
+    return [...mailbox?.pending?.reasons ?? [], ...mailbox?.processing?.batch.reasons ?? []];
+}
+function readRequest(mailbox) {
+    if (!reasons(mailbox).includes(RUNTIME_HOST_UPGRADE_REASON))
+        return undefined;
+    const sources = [...mailbox?.pending?.sources ?? [], ...mailbox?.processing?.batch.sources ?? []]
+        .filter(source => source.startsWith(SOURCE));
+    const unique = [...new Set(sources)];
+    if (unique.length !== 1)
+        throw new Error("Host upgrade request is missing or ambiguous.");
+    const request = JSON.parse(unique[0].slice(SOURCE.length));
+    for (const key of ["requestId", "nativeSessionId", "processInstanceId", "hostGeneration",
+        "targetGeneration", "agentId", "adapterId", "effectiveDigest"]) {
+        if (typeof request[key] !== "string" || !request[key] || request[key].includes("\0")) {
+            throw new Error("Host upgrade request is invalid.");
+        }
+    }
+    return request;
+}
+function digest(value) { return createHash("sha256").update(JSON.stringify(value)).digest("hex"); }
+function message(error) { return error instanceof Error ? error.message : String(error); }

package/dist/controller/jobArtifactControl.js

@@ -19,7 +19,7 @@ export async function controlJobArtifact(store, home, value, now) {
         op: "run-get", scope: input.scope, caller: input.caller, id: input.id, runId: input.runId
     }, now);
     const run = current(); // Both definition and historical Assignment authorization.
-    const repo = openJobArtifactRepository(home, jobArtifactOwner(run), runReference(run));
+    const repo = openJobArtifactRepository(home, jobArtifactOwner(run), runReference(run), () => store.getConfig());
     if (input.op === "artifact-list") {
         const head = await repo.head();
         const files = head === null ? [] : await repo.list(head);
@@ -45,7 +45,7 @@ export async function controlJobArtifact(store, home, value, now) {
         if (!(run.artifacts ?? []).some(item => isDeepStrictEqual(item, ref))) {
             throw new Error("Artifact reference is not registered for this exact Run.");
         }
-        const content = await readJobArtifactReference(home, ref);
+        const content = await readJobArtifactReference(home, ref, () => store.getConfig());
         current(); // A replaced Session during I/O must not receive the material.
         return boundedJobArtifactPayload({ reference: ref, ...(input.op === "artifact-preview"
                 ? previewArtifactContent(content, input.offset) : presentArtifactContent(content)) }, "Artifact response", MAX_JOB_ARTIFACT_RESPONSE_BYTES);
@@ -79,7 +79,7 @@ export async function controlJobArtifact(store, home, value, now) {
             }
             assertCallerAuthorized(store, input.caller, ref.owner.taskId);
         }
-        await readJobArtifactReference(home, ref);
+        await readJobArtifactReference(home, ref, () => store.getConfig());
     }
     try {
         return store.transaction(tx => {

package/dist/controller/jobDefinitionControl.js

@@ -303,7 +303,7 @@ export function authorizeGlobalJobStart(store, run) {
             const definition = store.getJobDefinition({ kind: "global" }, run.definitionId);
             if (definition?.builtin)
                 requireProjectSyncTarget(store, definition);
-            const project = requireRefreshProject({ listProjects: () => projects, rootDirectory: () => home }, run.projectId, true);
+            const project = requireRefreshProject({ listProjects: () => projects }, run.projectId, true);
             if (projectRefreshTargetDigest(project) !== projectRefreshDigest({
                 kind: "builtin", action: run.action, projectId: run.projectId, input: run.actionInput
             }))