@zq-silk/yui 2.3.0 → 2.4.0

package/dist/controller/jobControl.js

@@ -20,6 +20,7 @@ import { CliError } from "../errors/cliError.js";
 import { assertJobAssignmentScope, JobAssignmentScopeError } from "../job/jobAssignmentScope.js";
 import { assertContextRecordReadable } from "../context/taskContext.js";
 import { assertTaskProjectWriteAuthority } from "../task/taskAuthority.js";
+import { validateHttpPreview } from "../job/httpPreview.js";
 export function createDurableJobControl(store) {
     const authority = createJobCallAuthority(store);
     return {
@@ -32,6 +33,7 @@ export function createDurableJobControl(store) {
                 const context = authority.authenticate(Object.freeze({ ...params.caller }), params.taskId);
                 requireJobAssignment(tx, params, params.caller);
                 assertNonSecretJobInput(params);
+                validateHttpPreview(params.env, params.steps);
                 const baseKey = durableJobIdempotencyKey({
                     owner: params.owner,
                     projectId: params.projectId,

package/dist/controller/nativeHostInput.js

@@ -0,0 +1,37 @@
+import { applyTaskInputControl } from "../commands/taskCommands.js";
+import { applyGlobalInputControl } from "../commands/globalRoleCommands.js";
+/** The Host terminal is a human ingress, like the authenticated local Web
+ * surface. Fence that ingress before reusing the existing Message/control
+ * transaction; the Host performs the one Provider write after this returns. */
+export function prepareNativeHostSteer(store, input) {
+    return store.transaction(tx => {
+        const set = input.taskId === undefined ? tx.getGlobalRoleSessionSet(input.roleName)
+            : tx.getTaskRoleSessionSet(input.taskId, input.roleName);
+        const session = set?.sessions[input.agentId], binding = set?.providerBinding;
+        if (!session || session.status !== "active" || session.adapterId !== "codex"
+            || set?.activeAgentId !== input.agentId || session.nativeSessionId !== input.nativeSessionId
+            || binding?.run?.status !== "accepted" || binding.run.nativeTurnId !== input.nativeTurnId
+            || binding.authority.owner !== input.authorityOwner || binding.authority.epoch !== input.authorityEpoch
+            || binding.authority.holderId !== input.holderId
+            || (input.taskId !== undefined && input.roleName !== "leader")) {
+            throw new Error("Native steer carries a stale or unsupported Session/Turn/writer fence.");
+        }
+        if (!input.boundedText.trim() || input.boundedText.includes("\0") || Buffer.byteLength(input.boundedText) > 12000) {
+            throw new Error("Native steer exceeds its text bound.");
+        }
+        const control = { action: "steer", body: input.boundedText, to: input.roleName,
+            requestId: input.attemptId, expectedTarget: input.nativeTurnId, expectedSessionId: input.nativeSessionId };
+        if (input.taskId === undefined) {
+            applyGlobalInputControl(input.roleName, control, tx, { env: {} });
+        }
+        else {
+            applyTaskInputControl(input.taskId, { ...control, to: "leader" }, tx, { environment: {}, now: () => input.now });
+        }
+        const messages = input.taskId === undefined ? tx.listGlobalRoleMessages(input.roleName) : tx.listMessages(input.taskId);
+        const message = messages.find(message => message.inputControl?.requestId === input.attemptId);
+        if (message?.control?.outcome !== "pending") {
+            throw new Error("Native steer is already settled or unconfirmed; do not resubmit.");
+        }
+        return { attemptId: message.control.receiptId, boundedText: input.boundedText };
+    });
+}

package/dist/controller/runtime.js

@@ -1,4 +1,5 @@
 import { isDeepStrictEqual } from "node:util";
+import { prepareNativeHostSteer } from "./nativeHostInput.js";
 import { archiveLeaderTask } from "../task/leaderArchive.js";
 import { TaskWorkspaceCoordinator } from "../repository/taskWorkspaceCoordinator.js";
 import { AGENT_OPERATIONAL_ENVIRONMENT_NAMES, NATIVE_AGENT_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, YUI_MANAGED_RUNTIME_ENVIRONMENT_NAMES } from "../agent/launchEnvironment.js";
@@ -33,8 +34,15 @@ import { openSchedulerTelemetry } from "../telemetry/telemetryWiring.js";
 import { NodeCommandExecutor } from "../tmux/commandExecutor.js";
 import { TmuxManager, yuiTmuxServerName } from "../tmux/tmuxManager.js";
 import { createControllerWeb } from "../web/controllerWeb.js";
+import { createTaskPreviews } from "../web/taskPreviews.js";
 import { TmuxWebTerminalService } from "../web/tmuxWebTerminal.js";
 import { createWebTaskSurface } from "../web/webTaskSurface.js";
+import { createWebConversationSurface } from "../web/webConversation.js";
+import { WebRequestRejected } from "../web/webMutation.js";
+import { inspectAgentHost, sendAgentHostNativeControl, AGENT_HOST_CONTROL_PROTOCOL } from "../runtime/agentHost.js";
+import { archiveOrdinaryTask } from "../task/ordinaryArchive.js";
+import { createWebSettings } from "../web/webSettings.js";
+import { createWebSkills } from "../web/webSkills.js";
 import { isTaskOwnedWorkspace, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
 import { AgentRuntimeObserver } from "./agentRuntimeObserver.js";
 import { createCapabilityDispatcher } from "./capabilityBridge.js";
@@ -378,10 +386,64 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
                         runningRuntime?.signal(`task:${target.taskId}`);
                 },
                 reconcileTask: (taskId) => runningRuntime?.signal(`task:${taskId}`)
-            }, yuiHome: home });
+            }, yuiHome: home }, [], undefined, {
+            archive: async (taskId) => {
+                if (!(workspacePreparer instanceof FileTaskWorkspacePreparer))
+                    throw new Error("Archive workspace owner unavailable.");
+                return archiveOrdinaryTask(new TaskWorkspaceCoordinator(store, workspacePreparer, webWorkflow), taskId, { environment: {}, yuiHome: home });
+            }
+        });
         const surfaces = new SurfaceContributions(kernel.capabilities.registry);
+        const validateNativeWrite = (request) => {
+            const sessions = request.scope === "task" ? store.getTaskRoleSessionSet(request.taskId, request.roleName)
+                : store.getGlobalRoleSessionSet(request.roleName);
+            const selected = sessions?.sessions[sessions.activeAgentId];
+            if (!request.nativeSessionId || selected?.nativeSessionId !== request.nativeSessionId
+                || selected.status !== "active"
+                || (request.scope === "task" && (request.roleName !== "leader"
+                    || selected.adapterId !== "codex" || !sessions?.providerBinding
+                    || !["active", "draft"].includes(store.getTask(request.taskId)?.status ?? "")
+                    || store.getTask(request.taskId)?.executionGate.state !== "enabled"))) {
+                throw new Error("Native input requires the selected current controlled Codex Operator/Leader.");
+            }
+        };
         const web = createControllerWeb(store, {
+            previews: () => createTaskPreviews(store, home),
+            skills: createWebSkills(store),
+            settings: createWebSettings(store, {
+                environment: options.environment ?? process.env, catalogs,
+                refreshConfiguration: () => {
+                    if (!runningRuntime)
+                        throw new Error("Controller runtime unavailable.");
+                    runningRuntime.reloadReconciliationInterval();
+                }
+            }),
             surface: webSurface,
+            conversation: createWebConversationSurface(store, webSurface, (owner, id) => planner.planNativeControl(owner, id), undefined, (owner) => inspectAgentHost({ home, ...owner }), {
+                hasWriter: owner => tmux.hasWritableClient(owner.scope === "task" ? owner.taskId : "operator", owner.scope === "task" ? owner.roleName : undefined),
+                respond: async (owner, id, requestId, nativeTurnId, result) => {
+                    const receipt = await sendAgentHostNativeControl({
+                        home, ...owner, control: { protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "native-respond",
+                            nativeSessionId: id, requestId, nativeTurnId, result }
+                    });
+                    if (receipt.outcome !== "accepted")
+                        throw new Error(receipt.snapshot.detail ?? "Native answer was not confirmed.");
+                    return { outcome: receipt.outcome };
+                },
+                setModel: async (owner, id, model) => {
+                    const result = await sendAgentHostNativeControl({
+                        home, ...owner, control: { protocol: AGENT_HOST_CONTROL_PROTOCOL,
+                            type: "native-model", nativeSessionId: id, model }
+                    });
+                    if (result.outcome !== "accepted") {
+                        const detail = result.snapshot.detail ?? "Model adoption is unconfirmed.";
+                        if (result.failure?.inputDisposition === "not-accepted")
+                            throw new WebRequestRejected(detail);
+                        throw new Error(detail);
+                    }
+                    return { outcome: result.outcome, runConfiguration: result.snapshot.runConfiguration };
+                }
+            }, catalogs),
             answerInput: async ({ taskId, inputId, answer }) => webSurface.answer(taskId, inputId, answer),
             panels: {
                 list: (taskId) => surfaces.listPanels(kernel.capabilities.authenticateWebQuery(taskId)),
@@ -390,6 +452,26 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             terminal: new TmuxWebTerminalService({
                 yuiHome: home, tmuxBin: resolveTmuxBin(store.getConfig().tmuxBin), tmux,
                 prepareGlobalRole: (roleName) => webWorkflow.prepareGlobalRoleEnter(roleName),
+                prepareNative: async (request) => {
+                    if (!request.nativeSessionId)
+                        return false;
+                    const sessions = request.scope === "task" ? store.getTaskRoleSessionSet(request.taskId, request.roleName)
+                        : store.getGlobalRoleSessionSet(request.roleName);
+                    const selected = sessions?.sessions[sessions.activeAgentId];
+                    if (request.scope === "task" && (request.roleName !== "leader" || selected?.adapterId !== "codex"))
+                        return false;
+                    validateNativeWrite(request);
+                    // Preserve ordinary global native access on other adapters and the
+                    // existing uncontrolled Codex TUI. No lifecycle operation on a switch.
+                    if (selected?.adapterId !== "codex" || !sessions?.providerBinding)
+                        return request.scope === "global";
+                    const result = await sendAgentHostNativeControl({ home, ...request,
+                        control: { protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "native-open", nativeSessionId: request.nativeSessionId } });
+                    if (result.outcome !== "accepted" || !result.snapshot.nativeTui)
+                        throw new Error("Native TUI could not be opened.");
+                    return true;
+                },
+                validateWrite: validateNativeWrite,
                 environment: options.environment ?? process.env, onError: options.onError
             })
         });
@@ -612,6 +694,12 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                 throw applicationError("INVALID_PARAMS", error instanceof Error ? error.message : String(error));
             }
         }
+        if (method === "runtime.native-steer-prepare") {
+            const value = providerTurnControlParams(params);
+            return prepareNativeHostSteer(store, { ...value,
+                nativeTurnId: requiredParam(params.nativeTurnId),
+                boundedText: requiredParam(value.boundedText) });
+        }
         if (method === "runtime.provider-turn-begin") {
             const value = providerTurnControlParams(params);
             try {
@@ -927,6 +1015,7 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
 function resolveRuntimeDesiredEffective(store, request, role) {
     if (request.scope === "global") {
         return resolveEffectiveLaunch({
+            store,
             role: role,
             purpose: "execution"
         });
@@ -940,6 +1029,7 @@ function resolveRuntimeDesiredEffective(store, request, role) {
         ?? store.getTaskWorkspace(request.taskId)
         ?? undefined;
     return resolveEffectiveLaunch({
+        store,
         role: taskRole,
         purpose: store.getTask(request.taskId)?.status === "draft" && request.roleName === "leader"
             ? "planning" : "execution",
@@ -1018,7 +1108,7 @@ function assertRuntimeLaunchRequestCurrent(store, request) {
 }
 function currentDesiredEffective(store, request, role) {
     if (request.owner.scope === "global") {
-        return resolveEffectiveLaunch({ role: role, purpose: "execution" });
+        return resolveEffectiveLaunch({ store, role: role, purpose: "execution" });
     }
     const item = store.listWorkItems(request.owner.taskId).find((candidate) => (candidate.assignee === request.owner.roleName
         && !["accepted", "retired"].includes(candidate.status))) ?? null;
@@ -1028,6 +1118,7 @@ function currentDesiredEffective(store, request, role) {
         ?? store.getTaskWorkspace(request.owner.taskId)
         ?? undefined;
     return resolveEffectiveLaunch({
+        store,
         role: role,
         purpose: store.getTask(request.owner.taskId)?.status === "draft" && request.owner.roleName === "leader"
             ? "planning" : "execution",

package/dist/controller/runtimeEventInbox.js

@@ -2,7 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { closeSync, constants, existsSync, fchmodSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { createRuntimeObservation, isRuntimeTokenEvidence } from "../runtime/runtimeObservation.js";
+import { createRuntimeObservation, isRuntimeUsageEvidence } from "../runtime/runtimeObservation.js";
 import { boundedRunFailureDiagnostic, transportAgentResult } from "../domain/agentResultTransport.js";
 import { readAgentHostObservationSource } from "../runtime/agentHostProtocol.js";
 export const MAX_RUNTIME_EVENT_FILE_BYTES = 16 * 1024 * 1024;
@@ -174,7 +174,7 @@ export class FileRuntimeEventInbox {
     publish(event) {
         this.hooks.afterAdmission?.();
         if (event.type === "runtime-observation"
-            && isRuntimeTokenEvidence(event.observation)) {
+            && isRuntimeUsageEvidence(event.observation)) {
             const existing = this.list().find((candidate) => (candidate.type === "runtime-observation"
                 && candidate.taskId === event.taskId
                 && candidate.observation.eventId === event.observation.eventId));

package/dist/controller/runtimeEventProcessor.js

@@ -1,4 +1,4 @@
-import { isRuntimeTokenEvidence } from "../runtime/runtimeObservation.js";
+import { isRuntimeUsageEvidence } from "../runtime/runtimeObservation.js";
 const DEFAULT_MAX_RUNTIME_EVENTS_PER_DRAIN = 64;
 /** Folds immutable Hook facts in one bounded transaction before acknowledging them. */
 export class FileRuntimeEventProcessor {
@@ -299,7 +299,7 @@ export function coalesceRuntimeProgress(events, instrumentation = {}) {
         }
         const representedByIndex = new Map();
         for (const indices of indicesByStream.values()) {
-            const hasUsage = isRuntimeTokenEvidence(segment[indices[0]].observation);
+            const hasUsage = isRuntimeUsageEvidence(segment[indices[0]].observation);
             // Usage facts and incomplete boundaries are authoritative history for
             // read-only Session token projection, so ingress never coalesces them.
             const retainedPositions = hasUsage ? indices.map((_, position) => position) : [];
@@ -403,7 +403,7 @@ function progressStreamKey(event) {
         fence.nativeTurnId ?? null,
         event.host ?? null,
         payload.activity,
-        isRuntimeTokenEvidence(event.observation) ? "usage" : "signal"
+        isRuntimeUsageEvidence(event.observation) ? "usage" : "signal"
     ]);
 }
 function isRuntimeActivityEvent(event) {

package/dist/doctor/doctor.js

@@ -2,6 +2,8 @@ import { accessSync, constants, existsSync, lstatSync, realpathSync } from "node
 import { isAbsolute, join } from "node:path";
 import Database from "better-sqlite3";
 import { inspectPty } from "./ptyProbe.js";
+import { gitVersionSupport } from "../repository/gitCompatibility.js";
+import { resolveExecutable } from "../external/pinnedCommandRunner.js";
 import { configuredAgentToDefinition, resolveAgentEnvironment } from "../agent/agent.js";
 import { operationalAgentEnvironment } from "../agent/launchEnvironment.js";
 import { resolveTmuxBin } from "../config/yuiConfig.js";
@@ -684,6 +686,14 @@ function checkReviewerDispatch(_policy, role, binding, agent, launch, command, c
 function checkExecutable(name, command, args, executor) {
     try {
         const output = firstLine(executor.run(command, args));
+        if (name === "git") {
+            const support = gitVersionSupport(output);
+            return {
+                name, status: support.supported ? "ok" : "invalid",
+                detail: `${resolveExecutable(command, process.env.PATH) ?? command}: ${support.detail}`
+                    + (support.supported ? "" : " Select a supported Git in PATH and rerun doctor; no upgrade was performed.")
+            };
+        }
         return {
             name,
             status: "ok",

package/dist/execution/reviewMainRun.js

@@ -65,6 +65,7 @@ export function dispatchReviewSynthesis(store, taskId, reviewRoundId, sourceRunI
         throw new Error(`Review main workspace is missing: ${taskId}/${round.id}.`);
     }
     const effective = resolveEffectiveLaunch({
+        store,
         role,
         purpose: "review",
         workspace,

package/dist/execution/workItemMainRun.js

@@ -78,6 +78,7 @@ export function dispatchWorkItemSynthesis(store, taskId, workItemId, sourceRunId
         throw new Error(`WorkItem main workspace does not match its approved scope: ${item.id}.`);
     }
     const effective = resolveEffectiveLaunch({
+        store,
         role,
         purpose: "execution",
         workspace,

package/dist/executor/codexConfigConflict.js

@@ -196,13 +196,15 @@ function exactTrust(directory, configured) {
     return undefined;
 }
 function resolveRepositoryRootForTrust(workspace) {
-    const result = spawnSync("git", ["-C", workspace, "rev-parse", "--path-format=absolute", "--git-common-dir"], { encoding: "utf8", timeout: 1_000, windowsHide: true });
+    const result = spawnSync("git", ["-C", workspace, "rev-parse", "--git-common-dir"], { encoding: "utf8", timeout: 1_000, windowsHide: true });
     if (result.status !== 0 || result.error !== undefined)
         return undefined;
-    const commonDirectory = result.stdout.trim();
-    if (!isAbsolute(commonDirectory) || commonDirectory.includes("\0"))
+    if (!result.stdout.endsWith("\n"))
         return undefined;
-    const normalized = resolve(commonDirectory);
+    const commonDirectory = result.stdout.slice(0, -1);
+    if (commonDirectory.length === 0 || commonDirectory.includes("\0"))
+        return undefined;
+    const normalized = resolve(workspace, commonDirectory);
     return basename(normalized) === ".git" ? dirname(normalized) : undefined;
 }
 function inspectProjectDiscovery(contents) {

package/dist/executor/effectiveLaunch.js

@@ -2,7 +2,8 @@ import { isDeepStrictEqual } from "node:util";
 import { validateExecutionEnvironmentSnapshot } from "../resources/projectResource.js";
 import { validateManagedWorkspace } from "../worktree/managedWorkspace.js";
 import { resolveAgentAdapter } from "./agentAdapter.js";
-import { roleSessionKind } from "../context/roleSessionContext.js";
+import { compileRoleSessionContext, roleSessionKind } from "../context/roleSessionContext.js";
+import { validateSkillPackageRef } from "../context/skillPackage.js";
 import { isAgentAdapterId } from "../agent/adapterCatalog.js";
 import { adapterIdForExecutionComponent, isAgentExecutionComponentId, resolveAgentExecutionComponent } from "../agent/executionComponents.js";
 import { SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION, sessionManifestCompatibilityDigest } from "../context/sessionProtocolIdentity.js";
@@ -15,6 +16,15 @@ export function resolveEffectiveLaunch(input) {
     const workspace = snapshotWorkspace(input.role.workspace, input.workspace);
     const writeProjectIds = effectiveWriteProjects(input, workspace);
     const config = resolveAgentAdapter(binding.adapterId).canonicalizeConfig(clone(binding.config));
+    const home = input.store?.rootDirectory() ?? input.yuiHome;
+    const sessions = "taskId" in input.role
+        ? input.store?.getTaskRoleSessionSet(input.role.taskId, input.role.name)
+        : input.store?.getGlobalRoleSessionSet(input.role.name);
+    const existing = sessions?.sessions[binding.agentId];
+    const continuing = existing?.status === "active";
+    const skillPackages = continuing ? existing.effective.skillPackages
+        : home === undefined ? undefined
+            : compileRoleSessionContext(home, input.role, "taskId" in input.role ? { scope: "task", taskId: input.role.taskId } : { scope: "global" }, { purpose: input.purpose }).skills.map(skill => skill.package);
     return snapshotFromConfig({
         executionAuthority: input.executionAuthority ?? (input.purpose === "planning" ? "planning" : "delivery"),
         sourceDesiredRevision: input.role.launchRevision,
@@ -28,6 +38,7 @@ export function resolveEffectiveLaunch(input) {
             ? { executionEnvironment: input.role.executionEnvironment }
             : {}),
         context: snapshotContext(input.role),
+        ...(skillPackages === undefined ? {} : { skillPackages }),
         contextProtocolVersion: SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION,
         sessionManifestCompatibilityDigest: sessionManifestCompatibilityDigest(input.role.name, roleSessionKind(input.role, "taskId" in input.role
             ? { scope: "task", taskId: input.role.taskId }
@@ -216,6 +227,17 @@ export function validateEffectiveLaunchSnapshot(snapshot) {
         throw new Error("Effective launch Session Manifest compatibility digest is invalid.");
     }
     validateWorkspace(snapshot.workspace);
+    if (snapshot.skillPackages !== undefined) {
+        if (!Array.isArray(snapshot.skillPackages))
+            throw new Error("Effective Skill packages must be an array.");
+        const ids = new Set();
+        for (const ref of snapshot.skillPackages) {
+            validateSkillPackageRef(ref);
+            if (ids.has(ref.id))
+                throw new Error("Effective Skill packages must be unique.");
+            ids.add(ref.id);
+        }
+    }
     if (snapshot.executionEnvironment !== undefined) {
         validateExecutionEnvironmentSnapshot(snapshot.executionEnvironment);
         if (snapshot.executionEnvironment.access === "read") {
@@ -299,6 +321,7 @@ function snapshotFromConfig(input) {
             ? {}
             : { executionEnvironment: clone(input.executionEnvironment) }),
         context: cloneContext(input.context),
+        ...(input.skillPackages === undefined ? {} : { skillPackages: clone(input.skillPackages) }),
         contextProtocolVersion: input.contextProtocolVersion,
         sessionManifestCompatibilityDigest: input.sessionManifestCompatibilityDigest,
         ...review

package/dist/executor/fileRoleLaunchPlanner.js

@@ -70,11 +70,13 @@ export class FileRoleLaunchPlanner {
     }
     /** Recovery addresses the recorded Agent/Session, independent of delivery
      * admission, a missing worktree, or the old Endpoint code generation. */
-    planNativeControl(owner) {
+    planNativeControl(owner, nativeSessionId) {
         const set = owner.scope === "task"
             ? this.store.getTaskRoleSessionSet(owner.taskId, owner.roleName)
             : this.store.getGlobalRoleSessionSet(owner.roleName);
-        const session = roleSessionControlTarget(set);
+        const session = nativeSessionId === undefined ? roleSessionControlTarget(set)
+            : [...Object.values(set?.sessions ?? {}), ...Object.values(set?.history ?? {})]
+                .find(entry => entry.nativeSessionId === nativeSessionId);
         if (session?.adapterId !== "codex")
             throw new Error("Native metadata control requires a recorded Codex Session.");
         const configured = this.store.getConfiguredAgent(session.agentId);
@@ -229,7 +231,7 @@ export class FileRoleLaunchPlanner {
             throw new Error("Global Role has an unmanaged live Session. Stop that exact Session before opening controlled input; it will not be silently replaced.");
         }
         const resolvedEffective = activeLiveRoleAgentSession(sessionSet)?.effective
-            ?? resolveEffectiveLaunch({ role, purpose: "execution" });
+            ?? resolveEffectiveLaunch({ store: this.store, role, purpose: "execution" });
         if (input.effective !== undefined
             && !isDeepStrictEqual(resolvedEffective, input.effective)) {
             throw new Error(`Global Role launch effective snapshot changed: ${role.name}.`);
@@ -335,7 +337,12 @@ export class FileRoleLaunchPlanner {
         Object.assign(launchEnvironment, runtimeIsolation === undefined
             ? {}
             : taskRuntimeIsolationEnvironment(runtimeIsolation));
-        const baseSessionContext = compileRoleSessionContext(this.home, launchRole, owner, sessionPolicy);
+        const skillPackages = input.mode === "resume"
+            ? existingSession?.effective.skillPackages : effective.skillPackages;
+        if (skillPackages === undefined) {
+            throw new Error("This launch has no frozen Skill package evidence (pre-1.5 or externally recorded Session). Create a new Session from current Role configuration; historical Skill versions cannot be reconstructed.");
+        }
+        const baseSessionContext = compileRoleSessionContext(this.home, launchRole, owner, { ...sessionPolicy, skillPackages });
         const bootstrap = materializeSessionBootstrap({
             yuiHome: this.home,
             role: launchRole,
@@ -686,7 +693,7 @@ function resolveTaskRoleEffectiveLaunch(store, role, purpose = "execution") {
     if (purpose === "planning") {
         // Planning has no WorkItem assignment and no managed workspace, so it
         // resolves the Role's own configured workspace with no writable Project.
-        return resolveEffectiveLaunch({ role, purpose: "planning" });
+        return resolveEffectiveLaunch({ store, role, purpose: "planning" });
     }
     const item = store.listWorkItems(role.taskId).find((candidate) => (candidate.assignee === role.name
         && !["accepted", "retired"].includes(candidate.status))) ?? null;
@@ -696,6 +703,7 @@ function resolveTaskRoleEffectiveLaunch(store, role, purpose = "execution") {
         ?? store.getTaskWorkspace(role.taskId)
         ?? undefined;
     return resolveEffectiveLaunch({
+        store,
         role,
         purpose: "execution",
         ...(workspace === undefined ? {} : { workspace }),

package/dist/integration/gitIntegrationService.js

@@ -5,6 +5,8 @@ import { promisify } from "node:util";
 import { selectEnvironment } from "../agent/launchEnvironment.js";
 import { durableJobIdempotencyKey } from "../job/durableJob.js";
 import { readRuntimeIdentity } from "../release/runtimeRelease.js";
+import { compatibleGitArguments, supportedGit } from "../repository/gitCompatibility.js";
+import { readGitWorktrees } from "../repository/gitWorktreeInventory.js";
 import { NodeGitWorkspace } from "../repository/gitWorkspace.js";
 import { acquireProjectMaintenanceLocks } from "../repository/projectMaintenanceLock.js";
 import { taskWorkspaceRefSegment } from "../repository/taskWorkspaceIdentity.js";
@@ -1047,8 +1049,10 @@ function integrationCheckDirectory(home, taskId, integrationId) {
     return join(home, "artifacts", "integration-checks", taskId, integrationId);
 }
 async function git(args) {
+    const program = supportedGit();
+    const invocation = compatibleGitArguments(args);
     try {
-        const result = await executeFile("git", [...args], {
+        const result = await executeFile(program.path, invocation, {
             encoding: "utf8",
             maxBuffer: 16 * 1024 * 1024,
             timeout: 120_000
@@ -1182,15 +1186,6 @@ async function advanceTargetRef(repositoryPath, targetRef, candidateCommit, expe
     }
 }
 async function checkedOutWorktreePaths(repositoryPath, targetRef) {
-    const porcelain = (await git([
-        "-C", repositoryPath, "worktree", "list", "--porcelain"
-    ])).trim();
-    if (porcelain.length === 0)
-        return [];
-    return porcelain.split(/\n\n+/u).flatMap((record) => {
-        const lines = record.split("\n");
-        const path = lines.find((line) => line.startsWith("worktree "))?.slice("worktree ".length);
-        const branch = lines.find((line) => line.startsWith("branch "))?.slice("branch ".length);
-        return path !== undefined && branch === targetRef ? [path] : [];
-    });
+    return (await readGitWorktrees(repositoryPath))
+        .filter(record => record.branch === targetRef).map(record => record.path);
 }

package/dist/integration/integrationSourceApplication.js

@@ -3,6 +3,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { isAbsolute, resolve } from "node:path";
 import { promisify } from "node:util";
+import { gitOutputLine, supportedGit } from "../repository/gitCompatibility.js";
 import { queueLeaderWakeup } from "../scheduler/wakeupQueue.js";
 import { recordIntegrationConflict, requireResolutionDecision, updateIntegrationAttempt } from "./integrationAttempt.js";
 const execute = promisify(execFile);
@@ -281,7 +282,7 @@ async function hasExactRefReceipt(path, branch, before, action) {
 }
 const actionId = () => `yui-integration-${randomBytes(16).toString("hex")}`;
 async function gitPath(path, name) {
-    const value = (await command(path, ["rev-parse", "--git-path", name])).trim();
+    const value = gitOutputLine(await command(path, ["rev-parse", "--git-path", name]));
     return isAbsolute(value) ? value : resolve(path, value);
 }
 async function conflicts(path) {
@@ -300,8 +301,9 @@ async function succeeds(path, args, action) {
     }
 }
 async function command(path, args, action) {
+    const program = supportedGit();
     try {
-        return (await execute("git", [
+        return (await execute(program.path, [
             "-C", path, "-c", "user.name=Yui", "-c", "user.email=yui@local",
             "-c", "core.editor=true", "-c", "rebase.backend=merge", ...args
         ], {

package/dist/job/httpPreview.js

@@ -0,0 +1,61 @@
+import { join } from "node:path";
+import { lstatSync, mkdirSync, rmdirSync, unlinkSync } from "node:fs";
+import { jobPreviewSocketRoot } from "../storage/homeLayout.js";
+/** An opt-in launch contract, not a second service registry. The Job remains
+ * the sole owner of the process, cancellation and exit evidence. */
+export function isHttpPreview(env) {
+    return env.YUI_HTTP_PREVIEW === "1";
+}
+export function validateHttpPreview(env, steps) {
+    if (env.YUI_HTTP_PREVIEW !== undefined && !isHttpPreview(env)) {
+        throw new Error("YUI_HTTP_PREVIEW must be 1 when supplied.");
+    }
+    if (env.YUI_PREVIEW_SOCKET !== undefined || steps.some(step => step.env?.YUI_PREVIEW_SOCKET !== undefined || step.env?.YUI_HTTP_PREVIEW !== undefined)) {
+        throw new Error("Preview environment is Job-scoped; YUI_PREVIEW_SOCKET is assigned by the runner.");
+    }
+    if (isHttpPreview(env) && steps.length !== 1) {
+        throw new Error("An HTTP preview Job must have exactly one foreground service step.");
+    }
+}
+export function httpPreviewSocket(artifactDir) {
+    return join(jobPreviewSocketRoot(artifactDir), "http.sock");
+}
+export function assertHttpPreviewSocket(artifactDir) {
+    const dir = jobPreviewSocketRoot(artifactDir);
+    return assertSocketAt(dir);
+}
+function assertSocketAt(dir) {
+    const parent = lstatSync(dir);
+    const path = join(dir, "http.sock");
+    const socket = lstatSync(path);
+    if (!parent.isDirectory() || parent.uid !== process.getuid?.() || (parent.mode & 0o077)
+        || !socket.isSocket() || socket.uid !== parent.uid) {
+        throw new Error("Preview endpoint is not an owned Unix socket.");
+    }
+    return path;
+}
+/** Exclusive creation; never adopt or unlink another process's old endpoint.
+ * Cleanup checks the exact directory inode and removes no unknown contents. */
+export function prepareHttpPreview(artifactDir) {
+    const dir = jobPreviewSocketRoot(artifactDir);
+    mkdirSync(dir, { mode: 0o700 });
+    const owner = lstatSync(dir);
+    return {
+        socket: join(dir, "http.sock"),
+        cleanup() {
+            const current = lstatSync(dir);
+            if (!current.isDirectory() || current.dev !== owner.dev || current.ino !== owner.ino) {
+                throw new Error(`Preview owner changed; retained endpoint: ${dir}`);
+            }
+            try {
+                const path = assertSocketAt(dir);
+                unlinkSync(path);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            rmdirSync(dir);
+        }
+    };
+}

package/dist/job/jobRunner.js

@@ -12,6 +12,7 @@ import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, ut
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { jobStepDirectory } from "./stepDirectory.js";
+import { prepareHttpPreview, isHttpPreview } from "./httpPreview.js";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
 import { readLinuxProcessStartIdentity } from "../controller/domainIdentity.js";
 const DEFAULT_STEP_TIMEOUT_MS = 30 * 60_000;
@@ -108,6 +109,7 @@ export async function runDurableJobRunner(specPath) {
     let exitCode = 0;
     let signal = null;
     let failedStep;
+    let preview;
     try {
         for (let index = 0; index < spec.steps.length; index += 1) {
             if (cancelled || existsSync(cancelPath)) {
@@ -134,13 +136,16 @@ export async function runDurableJobRunner(specPath) {
                 const stepEnv = step.env === undefined
                     ? spec.env
                     : { ...spec.env, ...step.env };
+                const launchEnv = isHttpPreview(spec.env)
+                    ? { ...stepEnv, YUI_PREVIEW_SOCKET: (preview ??= prepareHttpPreview(artifactDir)).socket }
+                    : stepEnv;
                 // f4: a new process group (detached) lets the runner kill the whole
                 // step tree on timeout or cancel, for both argv and shell forms.
                 if (step.argv !== undefined) {
                     const [file, ...args] = step.argv;
                     child = spawn(file, args, {
                         cwd: stepCwd,
-                        env: stepEnv,
+                        env: launchEnv,
                         stdio: ["ignore", logFd, logFd],
                         detached: true
                     });
@@ -148,13 +153,14 @@ export async function runDurableJobRunner(specPath) {
                 else {
                     child = spawn("/bin/sh", ["-lc", step.command], {
                         cwd: stepCwd,
-                        env: stepEnv,
+                        env: launchEnv,
                         stdio: ["ignore", logFd, logFd],
                         detached: true
                     });
                 }
             }
             catch (error) {
+                writeFileSync(logFd, `Unable to start Job step: ${error instanceof Error ? error.message : String(error)}\n`);
                 closeSync(logFd);
                 completedSteps.push({
                     name: step.name,
@@ -231,6 +237,10 @@ export async function runDurableJobRunner(specPath) {
     }
     finally {
         clearInterval(heartbeatTimer);
+        // The foreground step has settled. Withdraw only its exact endpoint;
+        // existing Job/resource checks still own surviving descendant evidence.
+        // Failed socket cleanup retains evidence instead of publishing success.
+        preview?.cleanup();
         // f2/rr5: Do NOT remove the signal handlers here. A repeated SIGTERM
         // between the step loop and the exit.json write must still hit the
         // idempotent handler (which ignores it) rather than the default handler