@zq-silk/yui 2.7.1 → 2.8.1

package/dist/context/taskContext.js

@@ -4,14 +4,14 @@ import { taskNotFound, usageError } from "../errors/cliError.js";
 import { expandTaskMessageResult } from "../message/message.js";
 import { resolveManagedTaskReader } from "../runtime/managedCaller.js";
 import { hasManagedIdentity } from "../runtime/managedIdentity.js";
-import { providerRetryProjection } from "../runtime/providerRetry.js";
+import { providerRetrySummary } from "../runtime/providerRetry.js";
 import { projectTaskRemoteDeliveryFromStore } from "../task/remoteDeliveryService.js";
 import { retiredTaskRecordIds, TASK_RECORD_RETIRED_EVENT } from "../task/taskRecordRetirement.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { contextContentDigest } from "./contextSnapshot.js";
 import { buildRunContextPack } from "./runContextPack.js";
 import { sourceRunContextValue } from "./sourceRunContext.js";
-import { boundedDocument, recordPage } from "../output/boundedRead.js";
+import { boundedDocument, fitsReadBudget, summaryText, recordPage } from "../output/boundedRead.js";
 const MAX_RECORDS = 64;
 const MAX_VALUE_BYTES = 2048;
 const MAX_PAGE_BYTES = 24 * 1024;
@@ -41,13 +41,13 @@ export function readTaskContext(store, taskId, environment = {}) {
                 if (entry.ref.store === "run")
                     runtimeEvents ??= reader.listEventsByType(taskId, ["runtime.agent-error"]);
                 const valueBytes = Buffer.byteLength(JSON.stringify(entry.value));
-                const content = valueBytes > MAX_VALUE_BYTES || ["task-message", "run", "work-item", "project-knowledge"].includes(entry.ref.store)
+                const content = valueBytes > MAX_VALUE_BYTES || ["role", "task-message", "run", "work-item", "project-knowledge"].includes(entry.ref.store)
                     ? { ref: entry.ref, summary: summarize(entry.value), omitted: true }
                     : { ...entry, omitted: false };
                 const record = { ...content, ...(entry.ref.store === "run" ? {
                         execution: runExecutionObservation(entry.value, reader.getTaskRoleSessionSet(taskId, entry.value.roleName)?.providerBinding, runtimeEvents)
                     } : {}), ...(entry.ref.store === "role" ? {
-                        providerRetry: providerRetryProjection(reader.getTaskRoleSessionSet(taskId, entry.value.name)?.providerBinding)
+                        providerRetry: providerRetrySummary(reader.getTaskRoleSessionSet(taskId, entry.value.name)?.providerBinding)
                     } : {}) };
                 const size = Buffer.byteLength(JSON.stringify(record));
                 if (bytes + size > MAX_PAGE_BYTES)
@@ -55,7 +55,7 @@ export function readTaskContext(store, taskId, environment = {}) {
                 records.push(record);
                 bytes += size;
             }
-        return {
+        const result = {
             taskId, coreCursor: encode(cursor), throughCursor: encode(cursor),
             view: "current",
             collections: Object.entries(sources.reduce((counts, source) => {
@@ -79,6 +79,18 @@ export function readTaskContext(store, taskId, environment = {}) {
             limits: { records: MAX_RECORDS, valueBytes: MAX_VALUE_BYTES, pageBytes: 32 * 1024, recordBytes: MAX_PAGE_BYTES,
                 attentionRefsPerCategory: MAX_ATTENTION_REFS, attentionRefBytesPerCategory: MAX_VALUE_BYTES }
         };
+        // Account for nested retry facts, collection counts, commands and JSON
+        // structure together. Exact omitted records stay discoverable by family.
+        while (!fitsReadBudget(result) && records.length > 0) {
+            records.pop();
+            result.collections.forEach(collection => {
+                collection.returned = records.filter(record => record.ref.store === collection.store).length;
+            });
+            result.omitted = { records: count - records.length, values: records.filter(record => record.omitted).length };
+        }
+        if (!fitsReadBudget(result))
+            throw usageError("Context identities exceed the response budget; use scoped discovery.");
+        return result;
     });
 }
 function summarizeAttention(store, taskId, allow) {
@@ -93,7 +105,8 @@ function summarizeAttention(store, taskId, allow) {
         ["messages", "task-message", undefined]
     ]) {
         const page = store.queryContextRecords(taskId, {
-            family, statuses, descending: category === "messages", ids: allowedIds(allow, family), limit: MAX_ATTENTION_REFS
+            family, statuses, descending: category === "messages",
+            unhandledMessages: category === "messages", ids: allowedIds(allow, family), limit: MAX_ATTENTION_REFS
         });
         const summary = attention[category];
         summary.count = page.count;
@@ -262,11 +275,11 @@ export async function withContextObservations(core, providers, timeoutMs = 250)
             if (!["known", "partial", "unknown"].includes(value.coverage)
                 || Buffer.byteLength(JSON.stringify(value)) > MAX_VALUE_BYTES)
                 throw new Error("unbounded observation");
-            return { source: provider.source.slice(0, 200), observedAt: new Date().toISOString(),
+            return { source: summaryText(provider.source, 200), observedAt: new Date().toISOString(),
                 coverage: value.coverage, status: "available", value: JSON.parse(JSON.stringify(value.value)) };
         }
         catch {
-            return { source: provider.source.slice(0, 200), observedAt: new Date().toISOString(),
+            return { source: summaryText(provider.source, 200), observedAt: new Date().toISOString(),
                 coverage: "unknown", status: "unavailable" };
         }
         finally {
@@ -275,7 +288,18 @@ export async function withContextObservations(core, providers, timeoutMs = 250)
             controller.abort();
         }
     }));
-    return { ...core, observations };
+    const result = { ...core, observations: [] };
+    for (const observation of observations) {
+        result.observations.push(observation);
+        if (!fitsReadBudget(result)) {
+            result.observations.pop();
+            const { value: _value, ...identity } = observation;
+            result.observations.push({ ...identity, omitted: true });
+            if (!fitsReadBudget(result))
+                result.observations.pop();
+        }
+    }
+    return { ...result, omittedObservations: observations.length - result.observations.length };
 }
 /** Shared current/historical Session read identity; discovery may only narrow it. */
 export function resolveContextReader(store, environment) {
@@ -513,7 +537,7 @@ function authorizedSources(store, { task, allow, caller }, current = false, requ
     }
     if (!current)
         query("change-set");
-    query("task-message", { descending: true });
+    query("task-message", { descending: true, unhandledMessages: current });
     query("run", { descending: true, ...(current ? { statuses: ["active"] } : {}) });
     for (const id of allowedIds(allow, "source-turn") ?? []) {
         const run = store.getRun(taskId, id);
@@ -585,8 +609,8 @@ function freeze(value) {
 }
 function summarize(value) {
     const record = value;
-    return ["title", "scope", "expiresWhen", "version", "objective", "question", "summary", "body", "status", "type"]
+    return summaryText(["title", "name", "activeAgentId", "scope", "expiresWhen", "version", "objective", "question", "summary", "body", "status", "type"]
         .flatMap((key) => typeof record[key] === "string" || (key === "version" && typeof record[key] === "number")
         ? [`${key}: ${record[key]}`] : [])
-        .join("; ").slice(0, 400);
+        .join("; "));
 }

package/dist/controlPlaneCli.js

@@ -22,7 +22,11 @@ import { allowsInteractiveSelection, resolveInteractiveArguments } from "./cli/i
 import { routeInvocation } from "./cli/invocationRouter.js";
 import { operatorOfflineCommand, taskDiagnosticTarget } from "./cli/managedDiagnostics.js";
 import { assertConfigurationAuthority, assertTaskInvocationScope } from "./cli/invocationAuthority.js";
-import { requireManagedGlobalCaller, ManagedRuntimeDriftError } from "./runtime/managedCaller.js";
+import { requireManagedGlobalCaller, requireManagedGlobalReader, ManagedRuntimeDriftError } from "./runtime/managedCaller.js";
+import { sessionCallerEnvironment, requireManagedCaller } from "./runtime/sessionCaller.js";
+import { maintenanceCallerEnvironment } from "./storage/maintenanceCaller.js";
+import { checkCurrentSkills, SKILL_REUSE_RULE } from "./context/currentSkills.js";
+import { roleSkillIds } from "./context/roleSessionContext.js";
 import { hasManagedIdentity } from "./runtime/managedIdentity.js";
 import { resolveOperatorWizardArguments } from "./cli/operatorWizard.js";
 import { resolveGlobalRoleAgentConfigurationArguments, resolveRoleWizardArguments } from "./cli/roleWizard.js";
@@ -63,6 +67,7 @@ import { FileCompletionManager } from "./completion/fileCompletionManager.js";
 import { CONFIG_DOMAINS } from "./config/configCatalog.js";
 import { resolveTmuxBin, resolveTmuxHistoryLimit } from "./config/yuiConfig.js";
 import { checkSessionSkills, readSessionBootstrapManifest } from "./context/sessionBootstrapManifest.js";
+import { boundedDocument, readOptions } from "./output/boundedRead.js";
 import { assertFileTaskControllerStorageCompatible, ensureFileTaskController, FileTaskWorkflowRuntime, refreshRunningFileTaskControllerConfiguration, refreshRunningFileTaskControllerEnvironment, restartFileTaskController, stopFileTaskController } from "./controller/clientRuntime.js";
 import { FileSchedulerStoreAdapter } from "./controller/fileSchedulerStoreAdapter.js";
 import { createControllerIntegrationJobPort } from "./controller/jobClient.js";
@@ -796,13 +801,22 @@ export async function main() {
         }
         if (resolved[0] === "session") {
             if (resolved[1] === "skills") {
-                if (resolved.length !== 2)
-                    throw usageError("Usage: yui session skills --json");
+                const parsed = readOptions(resolved.slice(2), ["--cursor"]);
+                if (parsed.positionals.length !== 0)
+                    throw usageError("Usage: yui session skills [--cursor <cursor>] --json");
                 const path = process.env.YUI_SESSION_MANIFEST;
-                if (!["task", "global"].includes(process.env.YUI_SESSION_SCOPE ?? "") || path === undefined) {
-                    throw usageError("Skill checks require the current managed Session and its Manifest.");
-                }
-                const data = checkSessionSkills(home, path);
+                const caller = requireManagedCaller(store, process.env);
+                const set = caller.scope === "global" ? store.getGlobalRoleSessionSet(caller.roleName)
+                    : store.getTaskRoleSessionSet(caller.taskId, caller.roleName);
+                const effective = set.sessions[caller.agentId].effective;
+                const kind = caller.scope === "global" ? caller.roleName === "operator" ? "operator" : "global"
+                    : effective.reviewRoundId !== undefined ? "reviewer" : caller.roleName === "leader" ? "leader" : "worker";
+                const checked = path === undefined ? {
+                    skills: checkCurrentSkills(home, roleSkillIds(effective.context, kind)),
+                    profile: effective.context, identity: caller, rule: SKILL_REUSE_RULE,
+                    historicalPackagesAreAuditOnly: true
+                } : checkSessionSkills(home, path);
+                const data = boundedDocument(checked, "session:current-skills", parsed.cursor);
                 emit(JSON.stringify(data, null, 2), false, data);
                 return;
             }
@@ -1986,6 +2000,36 @@ async function preflightManagedTaskControlPlane() {
     if (taskFinalReviewInvocation.error !== undefined) {
         throw new Error(taskFinalReviewInvocation.error);
     }
+    if (["doctor", "upgrade", "update"].includes(args[0] ?? "")) {
+        const home = resolveYuiHome(process.env);
+        Object.assign(process.env, maintenanceCallerEnvironment(home, process.env, args[0] !== "doctor"));
+        if (!hasManagedIdentity(process.env)
+            || (process.env.YUI_SESSION_SCOPE === "global" && process.env.YUI_ROLE === "operator")) {
+            if (process.env.YUI_SESSION_SCOPE === "global") {
+                const manifest = assertManagedSessionManifest(home, "global");
+                if (manifest !== undefined && manifest.roleKind !== "operator") {
+                    throw new ManagedRuntimeDriftError("Managed global invocation does not match its Session Manifest.");
+                }
+            }
+            if (taskFinalReviewInvocation.request !== undefined) {
+                throw new Error("Task final-review contract cannot be established by Home maintenance.");
+            }
+            return { contract: undefined, verifiedStore: undefined };
+        }
+    }
+    // Desktop clients may carry only their provider-native identity. Resolve
+    // command-local hints before any public/Task/Global routing. This reads this
+    // Home only, and never creates a Session or mutates its registration.
+    if ((process.env.CODEX_THREAD_ID !== undefined || process.env.YUI_NATIVE_SESSION_ID !== undefined)
+        && (process.env.YUI_SESSION_SCOPE === undefined || process.env.YUI_ROLE === undefined)) {
+        const registry = openCurrentTaskStore(resolveYuiHome(process.env));
+        try {
+            Object.assign(process.env, sessionCallerEnvironment(registry, process.env));
+        }
+        finally {
+            registry.close();
+        }
+    }
     if (process.env.YUI_SESSION_SCOPE !== "task") {
         if (process.env.YUI_SESSION_SCOPE === "global") {
             return await preflightManagedGlobalControlPlane();
@@ -2064,24 +2108,25 @@ async function preflightManagedGlobalControlPlane() {
     const home = resolveYuiHome(process.env);
     const manifest = assertManagedSessionManifest(home, "global");
     const expectedRoleKind = process.env.YUI_ROLE === "operator" ? "operator" : "global";
-    if (manifest.owner.scope !== "global"
-        || manifest.roleKind !== expectedRoleKind) {
+    if (manifest !== undefined && (manifest.owner.scope !== "global"
+        || manifest.roleKind !== expectedRoleKind)) {
         throw new ManagedRuntimeDriftError("Managed global invocation does not match its Session Manifest.");
     }
-    if (expectedRoleKind === "operator" && ["doctor", "upgrade", "update"].includes(args[0] ?? "")) {
-        // These commands inspect/adopt the storage contract themselves. Requiring
-        // current storage before reaching upgrade would make recovery impossible.
-        return { contract: undefined, verifiedStore: undefined };
-    }
     await assertRuntimeCoherence({ actualHome: home }, {
         checkController: !(expectedRoleKind === "operator" && operatorOfflineCommand(args))
     });
     const verifiedStore = openCurrentTaskStore(home);
     const internalCallback = args[0] === "internal"
         && ["agent-host", "session-notify", "runtime-hook"].includes(args[1] ?? "");
-    if (!internalCallback && !operatorOfflineCommand(args)) {
+    if (!internalCallback) {
+        const selfRead = args[0] === "session" && args[1] === "context" && args[2] === process.env.YUI_ROLE
+            || args[0] === "role" && args[1] === "message" && ["list", "show"].includes(args[2] ?? "")
+                && args[3] === process.env.YUI_ROLE;
         try {
-            requireManagedGlobalCaller(verifiedStore, process.env);
+            if (selfRead)
+                requireManagedGlobalReader(verifiedStore, process.env);
+            else
+                requireManagedGlobalCaller(verifiedStore, process.env);
         }
         catch (error) {
             verifiedStore.close();
@@ -2093,7 +2138,9 @@ async function preflightManagedGlobalControlPlane() {
 function assertManagedSessionManifest(home, scope) {
     const manifestPath = process.env.YUI_SESSION_MANIFEST;
     if (manifestPath === undefined) {
-        throw new ManagedRuntimeDriftError("Managed control-plane invocation requires its Session Manifest.");
+        // A Manifest is a context pointer, not an authority credential. Native
+        // identity is validated against the current Home immediately below.
+        return undefined;
     }
     let manifest;
     try {

package/dist/controller/controller.js

@@ -692,6 +692,7 @@ export class FileTaskController {
     #globalInputDelivery;
     #providerRetry;
     #continuationReconciler;
+    #hostTerminalRecovery;
     #current;
     #operatorCurrent;
     #runtimeObserverCurrent;
@@ -741,6 +742,7 @@ export class FileTaskController {
         this.#leaderWakeFence = options.leaderWakeFence;
         this.#jobSupervisor = options.jobSupervisor;
         this.#continuationReconciler = options.continuationReconciler;
+        this.#hostTerminalRecovery = options.hostTerminalRecovery;
         this.#globalInputDelivery = options.globalInputDelivery;
         this.#providerRetry = options.providerRetry;
         this.#signalScheduler = new MailboxScheduler(async (keys) => { await this.#requestPass({ kind: "dirty", keys }); }, {
@@ -995,6 +997,9 @@ export class FileTaskController {
                         }
                     }
                     const firstRuntimeDrain = await this.#drainRuntimeEvents();
+                    if (scope.kind === "full" && this.#hostTerminalRecovery !== undefined) {
+                        await this.#observeMaintenance("Host terminal recovery", this.#hostTerminalRecovery);
+                    }
                     await this.#providerRetry?.reconcile();
                     await this.#globalInputDelivery?.({ reconcile: scope.kind === "full", now: this.#now() });
                     for (const taskId of runtimeTaskFailureIds(firstRuntimeDrain)) {

package/dist/controller/fileSchedulerStoreAdapter.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
-import { taskMessageInboxReceipt, unfinishedLeaderInbox } from "../message/taskInboxOwnership.js";
+import { deliveredMessageWake, pinMessageRevisions, taskMessageInboxReceipt, unfinishedLeaderInbox } from "../message/taskInboxOwnership.js";
 import { contextSnapshotRef } from "../context/contextSnapshot.js";
 import { freezeRunContextSnapshot } from "../context/runContextPack.js";
 import { taskNotificationPresentation } from "../interaction/notificationPresentation.js";
@@ -29,7 +29,7 @@ import { activeRoleAgentBinding } from "../role/role.js";
 import { SYSTEM_OPERATOR_ROLE } from "../role/systemRoles.js";
 import { standardAgentError } from "../runtime/agentError.js";
 import { recordTaskAgentError } from "./taskAgentError.js";
-import { recordGlobalRuntimeAttention, recordGlobalRuntimeFailure } from "./globalRuntimeAttention.js";
+import { recordGlobalRuntimeAttention, recordGlobalRuntimeFailure, recordGlobalRuntimeRecovery } from "./globalRuntimeAttention.js";
 import { queueOperatorNotification } from "./operatorNotification.js";
 import { claimOperatorAttention } from "../scheduler/operatorEvent.js";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
@@ -450,6 +450,10 @@ export class FileSchedulerStoreAdapter {
                 binding = settleProviderTurn(binding, { attemptId: receipt, nativeTurnId: fence.nativeTurnId,
                     status: input.kind === "turn.completed" ? "completed" : input.kind === "turn.cancelled" ? "cancelled" : "failed",
                     settledAt: at });
+                if (input.kind === "turn.completed")
+                    recordGlobalRuntimeRecovery(store, fence.roleName, input.eventId, {
+                        nativeSessionId: fence.nativeSessionId, evidence: `provider-structured:${receipt}`
+                    }, now);
                 if (fence.nativeTurnId !== undefined)
                     sessions = rememberRoleAgentCompletedTurn(sessions, fence.agentId, fence.nativeSessionId, fence.nativeTurnId, new Date(at));
             }
@@ -1875,7 +1879,8 @@ export class FileSchedulerStoreAdapter {
             const session = sessions?.sessions[sessions.activeAgentId];
             const obsoleteIds = new Set();
             for (const message of store.listMessages(taskId)) {
-                if (pendingMessageIds.has(message.id) && taskMessageInboxReceipt(store, message) !== undefined) {
+                if (pendingMessageIds.has(message.id) && (taskMessageInboxReceipt(store, message) !== undefined
+                    || deliveredMessageWake(store, message) !== undefined)) {
                     obsoleteIds.add(message.id);
                 }
             }
@@ -1925,7 +1930,7 @@ export class FileSchedulerStoreAdapter {
             const wakeId = store.nextTaskWakeId(taskId);
             const wake = createTaskWake({
                 id: wakeId, taskId, reasons: mailbox.pending.reasons,
-                refs: selectedRefs,
+                refs: pinMessageRevisions(store, taskId, selectedRefs),
                 fromCursor: latest?.toCursor ?? task.createdAt,
                 toCursor: new Date(Math.max(now.getTime(), Date.parse(mailbox.pending.lastQueuedAt))).toISOString(), now
             });

package/dist/controller/globalInputDelivery.js

@@ -5,15 +5,13 @@ import { markGlobalRoleMessageNotDelivered } from "../message/message.js";
 import { providerRetryPending } from "../runtime/providerRetry.js";
 import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 import { globalMessagePresentation } from "../interaction/notificationPresentation.js";
-import { recordGlobalRuntimeAttention } from "./globalRuntimeAttention.js";
+import { recordGlobalRuntimeAttention, recordGlobalRuntimeRecovery } from "./globalRuntimeAttention.js";
 /** Messages are the only queue. Host's atomic begin arbitrates native writers. */
 export async function deliverGlobalInputs(home, store, ensure, onError, options = {}) {
     for (const role of store.listGlobalRoles()) {
         try {
-            if (store.queryGlobalRoleMessages(role.name, { handling: true, limit: 0 }).count > 0)
-                continue;
             let pending = store.queryGlobalRoleMessages(role.name, { pending: true, limit: 64 }).messages;
-            if (pending.length === 0 || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name }))))
+            if (hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name }))))
                 continue;
             let sessions = store.getGlobalRoleSessionSet(role.name);
             // A detached Host keeps an active Session and may reconnect. An explicit
@@ -47,19 +45,31 @@ export async function deliverGlobalInputs(home, store, ensure, onError, options
                             authority: { epoch: bindingBefore.authority.epoch, owner: "controller",
                                 holderId: bindingBefore.authority.holderId } }
                     });
+                    if (observed.reconciliation === "unsupported") {
+                        throw new Error("Host does not advertise reconcile-turn. Preserve the accepted input and original Host; consume retained Inbox evidence or use an explicitly authorized, quiescence-verified refresh.");
+                    }
                     if (observed.outcome === "rejected" || ["idle", "failed", "exited"].includes(observed.snapshot.state)
                         && observed.reconciliation !== "terminal-republished") {
                         throw new Error(observed.failure?.detail ?? observed.snapshot.detail ?? "Host cannot reconcile this exact terminal.");
                     }
+                    if (observed.reconciliation === "terminal-republished") {
+                        store.transaction(tx => recordGlobalRuntimeRecovery(tx, role.name, `terminal-reconcile:${ownedTurn.attemptId}`, {
+                            nativeSessionId: currentProviderConversation(bindingBefore).conversationId,
+                            reason: "host-terminal-unobservable", evidence: "exact-terminal-republished"
+                        }, options.now ?? new Date()));
+                    }
                 }
                 catch (error) {
                     store.transaction(tx => recordGlobalRuntimeAttention(tx, role.name, `terminal-reconcile:${currentProviderConversation(bindingBefore).conversationId}:${ownedTurn.attemptId}`, { attemptId: ownedTurn.attemptId, nativeTurnId: ownedTurn.nativeTurnId,
                         nativeSessionId: currentProviderConversation(bindingBefore).conversationId,
                         reason: "host-terminal-unobservable",
                         cause: observed === undefined ? "host-control-unavailable"
-                            : observed.outcome === "rejected" ? "host-control-rejected" : "exact-terminal-not-retained",
+                            : observed.reconciliation === "unsupported" ? "host-control-unsupported"
+                                : observed.outcome === "rejected" ? "host-control-rejected" : "exact-terminal-not-retained",
                         hostState: observed?.snapshot.state ?? null,
                         endpointImplementation: observed?.snapshot.endpointImplementation ?? null,
+                        hostImplementation: observed?.snapshot.hostImplementation ?? null,
+                        controlCapabilities: observed?.snapshot.controlCapabilities ?? null,
                         eventDelivery: observed?.snapshot.eventDelivery ?? null,
                         // Endpoint generation is not a loaded Host/package version.
                         inputKind: ownedTurn.attemptId.startsWith("direct:") ? "direct" : "managed",
@@ -78,6 +88,8 @@ export async function deliverGlobalInputs(home, store, ensure, onError, options
                 if (pending.length === 0)
                     continue;
             }
+            if (store.queryGlobalRoleMessages(role.name, { handling: true, limit: 0 }).count > 0)
+                continue;
             // Interrupt-then reserves the next legal slot even behind a large queue.
             const reservedPage = store.queryGlobalRoleMessages(role.name, {
                 pending: true, interruptThen: true, limit: 64

package/dist/controller/globalRuntimeAttention.js

@@ -1,14 +1,115 @@
 import { createHash } from "node:crypto";
 import { createGlobalRoleMessage } from "../message/message.js";
-import { serializeAgentErrorRaw } from "../runtime/agentError.js";
+import { redactAgentErrorText, serializeAgentErrorRaw } from "../runtime/agentError.js";
+import { summaryMetadata, summaryText } from "../output/boundedRead.js";
+const FAILURE_HEADER = "Yui Global failure evidence ";
+const RECOVERY_HEADER = "Yui Global recovery evidence ";
+const hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+/** This is a projection of original Message documents, never a persisted
+ * aggregate or a new handling/recovery state. Exact observations remain in the
+ * existing record-only Message history. Polling the same identity is a no-op. */
+function diagnosticIdentity(store, roleName, identity, facts) {
+    const value = object(facts), fence = object(value.fence);
+    const failure = object(value.failure), retry = object(value.retry);
+    const error = object(failure.error ?? value.error ?? retry.error);
+    const sessions = store.getGlobalRoleSessionSet(roleName);
+    const binding = sessions?.providerBinding;
+    const nativeSessionId = value.nativeSessionId ?? fence.nativeSessionId ?? retry.nativeSessionId
+        ?? sessions?.sessions[sessions.activeAgentId]?.nativeSessionId;
+    const source = {
+        roleName, nativeSessionId,
+        host: binding?.authority.holderId,
+        endpointImplementation: value.endpointImplementation,
+        hostImplementation: value.hostImplementation,
+        controlCapabilities: value.controlCapabilities,
+        driverId: fence.driverId ?? binding?.providerNamespace,
+        source: error.source,
+        phase: error.phase,
+        reason: value.reason, cause: value.cause,
+        agentId: fence.agentId ?? sessions?.activeAgentId, providerNamespace: binding?.providerNamespace,
+        accountScope: binding?.accountScope
+    };
+    const classified = typeof nativeSessionId === "string" && (typeof error.code === "string" && error.code !== "unknown"
+        || value.reason === "host-terminal-unobservable" && typeof value.cause === "string");
+    const classification = {
+        ...source, category: error.category, code: error.code, cause: value.cause,
+        detail: value.reason === "host-terminal-unobservable" ? hash(value.detail ?? null) : undefined,
+        // Explicit impact, not Turn IDs or free-form provider text.
+        inputDisposition: error.inputDisposition ?? failure.inputDisposition,
+        sessionDisposition: error.sessionDisposition ?? failure.sessionDisposition,
+        confirmed: ["submitting", "accepted", "delivery-unknown", "completed", "failed", "cancelled"].includes(value.confirmed)
+            ? value.confirmed : undefined,
+        status: value.status,
+        // Unclassified failures must never be guessed equivalent.
+        unclassified: classified ? undefined : identity
+    };
+    return { key: hash(classification), source, summary: summaryText(redactAgentErrorText(String(error.message ?? value.detail ?? value.reason ?? "Runtime failure; inspect original evidence"))
+            .replace(/[\u0000-\u001f\u007f]/gu, " ")) };
+}
+function evidence(message) {
+    if (message.kind !== "system" || ![FAILURE_HEADER, RECOVERY_HEADER].some(header => message.body.startsWith(header)))
+        return;
+    try {
+        return object(JSON.parse(message.body.slice(message.body.indexOf("\n") + 1)));
+    }
+    catch {
+        return;
+    }
+}
+export function runtimeDiagnosticGroups(messages) {
+    const groups = [];
+    const active = new Map();
+    for (const message of messages) {
+        const value = evidence(message);
+        if (!value)
+            continue;
+        if (message.body.startsWith(RECOVERY_HEADER)) {
+            for (const [key, group] of active) {
+                if (group.source.nativeSessionId !== value.nativeSessionId || group.source.host !== value.host
+                    || value.reason !== undefined && group.source.reason !== value.reason
+                    || value.reason === undefined && group.source.phase !== "turn-execute"
+                        && group.source.phase !== "turn-submit")
+                    continue;
+                group.recoveredAt = message.createdAt;
+                group.recoveryEvidence = message.id;
+                active.delete(key);
+            }
+            continue;
+        }
+        const diagnostic = value.diagnostic;
+        if (typeof diagnostic?.key !== "string")
+            continue; // Old evidence remains in ordinary history.
+        const existing = active.get(diagnostic.key);
+        if (existing) {
+            existing.count++;
+            existing.lastAt = message.createdAt;
+            existing.latestEvidence = message.id;
+        }
+        else {
+            const group = { ...diagnostic, episode: message.id, count: 1,
+                firstAt: message.createdAt, lastAt: message.createdAt,
+                firstEvidence: message.id, latestEvidence: message.id };
+            groups.push(group);
+            active.set(diagnostic.key, group);
+        }
+    }
+    return groups;
+}
+export function runtimeDiagnosticEvidence(messages, key) {
+    return messages.filter(message => evidence(message)?.diagnostic?.key === key);
+}
 /** Global observations have no Task event history. Keep original failed
  * attempts as ordinary record-only Messages before replacing the live binding. */
 export function recordGlobalRuntimeFailure(store, roleName, identity, facts, now) {
-    const header = `Yui Global failure evidence ${createHash("sha256").update(identity).digest("hex")}\n`;
+    const diagnostic = diagnosticIdentity(store, roleName, identity, facts);
+    const header = `${FAILURE_HEADER}${hash([identity, diagnostic.key])}\n`;
     const previous = store.listGlobalRoleMessages(roleName).find(message => message.kind === "system" && message.body.startsWith(header));
     if (previous !== undefined)
         return `${roleName}/${previous.id}`;
-    const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), roleName, header + serializeAgentErrorRaw(facts), "system", { type: "system" }, now);
+    const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), roleName, header + redactAgentErrorText(JSON.stringify({
+        ...object(facts), diagnostic
+    })), "system", { type: "system" }, now);
     store.saveGlobalRoleMessage(message);
     return `${roleName}/${message.id}`;
 }
@@ -18,17 +119,46 @@ export function recordGlobalRuntimeAttention(store, roleName, identity, facts, n
     // A Home may have a custom Global Role without an Operator. Keep its own
     // diagnostic readable; never create a Role or launch a substitute Agent.
     const recipient = store.getGlobalRole("operator") === null ? roleName : "operator";
-    const requestId = `runtime-attention:${createHash("sha256").update(`${roleName}\0${identity}`).digest("hex")}`;
+    const failureRef = recordGlobalRuntimeFailure(store, roleName, identity, facts, now);
+    const diagnostic = diagnosticIdentity(store, roleName, identity, facts);
+    const group = runtimeDiagnosticGroups(store.listGlobalRoleMessages(roleName))
+        .reverse().find(group => group.key === diagnostic.key && group.recoveredAt === undefined);
+    const requestId = `runtime-attention:${hash([roleName, diagnostic.key, group?.episode ?? identity])}`;
     if (store.queryGlobalRoleMessages(recipient, { requestId, limit: 1 }).messages.length > 0)
         return;
     const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), recipient, [
+        `Yui-Summary: ${diagnostic.summary}`,
         `Global Role ${roleName} needs attention. No recovery or new authority is implied.`,
         "Inspect the exact Session and original input before choosing a next action; unknown effects must not be replayed.",
         `Original failed attempts remain in Role ${roleName}'s record-only failure Messages; failureRef names the latest evidence.`,
-        serializeAgentErrorRaw(facts)
+        redactAgentErrorText(JSON.stringify({ diagnosticKey: diagnostic.key, source: summaryMetadata(diagnostic.source), failureRef,
+            read: `yui role message list ${roleName} --diagnostic ${diagnostic.key}` }))
     ].join("\n"), "system", { type: "system" }, now, { inputControl: { action: "queue", requestId } });
     store.saveGlobalRoleMessage(recipient === roleName ? {
         ...message,
         notDelivered: { reason: "runtime-needs-attention; retained for user or successor inspection", at: now.toISOString() }
     } : message);
 }
+/** Called only on an established exact successful observation. A diagnostic
+ * recovery says nothing about Message handling, prior effects or Task outcome. */
+export function recordGlobalRuntimeRecovery(store, roleName, identity, facts, now) {
+    const messages = store.listGlobalRoleMessages(roleName);
+    const host = store.getGlobalRoleSessionSet(roleName)?.providerBinding?.authority.holderId;
+    const active = runtimeDiagnosticGroups(messages).filter(group => !group.recoveredAt
+        && group.source.nativeSessionId === facts.nativeSessionId && group.source.host === host
+        && (facts.reason !== undefined ? group.source.reason === facts.reason
+            : ["turn-execute", "turn-submit"].includes(group.source.phase)));
+    if (active.length === 0)
+        return;
+    const header = `${RECOVERY_HEADER}${hash(identity)}\n`;
+    if (messages.some(message => message.body.startsWith(header)))
+        return;
+    const message = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), roleName, header + serializeAgentErrorRaw({ ...facts, host }), "system", { type: "system" }, now);
+    store.saveGlobalRoleMessage(message);
+    const recipient = store.getGlobalRole("operator") === null ? roleName : "operator";
+    const notice = createGlobalRoleMessage(store.nextGlobalRoleMessageId(), recipient, `Yui-Summary: Global Role ${roleName} has new runtime recovery evidence; no input handling or Task completion is implied.\n`
+        + JSON.stringify({ evidence: `${roleName}/${message.id}`, recoveredGroups: active.length }), "system", { type: "system" }, now, { inputControl: { action: "queue", requestId: `runtime-recovery:${hash([roleName, identity])}` } });
+    store.saveGlobalRoleMessage(recipient === roleName ? { ...notice,
+        notDelivered: { reason: "runtime-recovery; retained for user or successor inspection", at: now.toISOString() }
+    } : notice);
+}

package/dist/controller/runtime.js

@@ -40,8 +40,10 @@ import { createWebTaskSurface } from "../web/webTaskSurface.js";
 import { createWebConversationSurface } from "../web/webConversation.js";
 import { WebRequestRejected } from "../web/webMutation.js";
 import { inspectAgentHost, sendAgentHostNativeControl, AGENT_HOST_CONTROL_PROTOCOL } from "../runtime/agentHost.js";
+import { recoverTaskHostTerminals } from "./taskHostTerminalRecovery.js";
 import { archiveOrdinaryTask } from "../task/ordinaryArchive.js";
 import { createWebSettings } from "../web/webSettings.js";
+import { createModelManagement } from "../models/modelManagement.js";
 import { createWebSkills } from "../web/webSkills.js";
 import { isTaskOwnedWorkspace, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
 import { AgentRuntimeObserver } from "./agentRuntimeObserver.js";
@@ -410,6 +412,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         const web = createControllerWeb(store, {
             previews: () => createTaskPreviews(store, home),
             skills: createWebSkills(store),
+            models: createModelManagement(store),
             settings: createWebSettings(store, {
                 environment: options.environment ?? process.env, catalogs,
                 refreshConfiguration: () => {
@@ -560,6 +563,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
                 }
             }),
             jobSupervisor,
+            hostTerminalRecovery: () => recoverTaskHostTerminals(home, store, options.onError ?? (() => undefined)),
             globalInputDelivery: (deliveryOptions) => deliverGlobalInputs(home, store, async (roleName) => {
                 await lifecycleDispatcher("runtime.ensure-role-session", { scope: "global", roleName });
             }, options.onError ?? (() => undefined), deliveryOptions),