delegation-layer 0.3.1 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "delegation-layer",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Multi-provider AI agent delegation CLI and Agent Skill for running bounded coding tasks across provider CLIs.",
   "keywords": [
     "ai-agents",

package/plugins/delegation-layer/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "delegation-layer",
   "displayName": "Delegation Layer",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Consult external AI harnesses and CCR-configured models for reviews, research, implementation, and debate through the resumable Delegate CLI.",
   "author": {
     "name": "Hesham Karam",

package/plugins/delegation-layer/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "delegation-layer",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Consult external AI harnesses and CCR-configured models for reviews, research, implementation, and debate through the resumable Delegate CLI.",
   "author": {
     "name": "Hesham Karam",

package/plugins/delegation-layer/skills/agent-integration/references/command-reference.md

@@ -295,6 +295,32 @@ Missing task files and corrupt evidence are distinct; see
 [scheduled result handling](result-handling.md#scheduled-execution-results)
 for freshness, no-result states, response bounds, exit codes and recovery.
 
+## Supervisor owner control
+
+```sh
+delegate supervisor stop-owner --json
+```
+
+Use only when the installed build advertises this command. Preserve the explicit
+root for work bound to a custom or historical root. This command contacts one
+existing infrastructure owner; it does not initialize, repair or start one.
+It leaves Pueue and admitted tasks running. Startup, accepted operations and
+unresolved cleanup can make the owner busy.
+
+The `supervisor_owner` response separates `state` (`serving_released`,
+`not_initialized`, `busy` or `unknown`) from `process_closure` (`closed`,
+`pending` or `unknown`). A released owner can remain alive as the sole waiter for
+its daemon; serving release is not proof of process exit or root quiescence.
+The optional `process` value (`pid`, `start_token`) identifies the validated
+selected `startup`; it does not establish liveness. It is omitted when no owner
+was selected or validated. Observe that exact incarnation after daemon shutdown;
+a new root-selected stop can address a newer owner.
+An absent root reports `not_initialized` with unknown process closure.
+Exit `0` reports the observed release or uninitialized state, `3` reports busy,
+and `1` reports a control or observation fault. Preserve an uncertain result;
+the command does not resend an uncertain stop request. Human output exposes
+the same separate observations.
+
 ## Scheduler runtime
 
 Check `delegate help` for the installed build's command surface. Use `serve`,
@@ -487,9 +513,11 @@ Inspection-backed admission can return `status: "ready"` with
 `verification: "runtime"` after its probe. Managed runtime-only admission
 keeps the catalog projection; its supervised worker checks compatibility before
 provider execution. Collect the created task to establish the result.
-Optional protocol members `version` and `executable_sha256` are diagnostics,
-not launch authority. Live acceptance remains separate (`not_run`, `passed`,
-or `blocked`); a blocked prerequisite is unresolved.
+Provider versions are optional diagnostics. Historical executable-digest members
+remain readable as recorded data. Do not depend on these fields or calculate new
+executable fingerprints for diagnostics or admission. Required behavior and the
+selected installed executable govern compatibility. Live acceptance remains separate (`not_run`,
+`passed`, or `blocked`); a blocked prerequisite is unresolved.
 
 ## Choosing models and effort
 

package/plugins/delegation-layer/skills/agent-integration/scripts/delegate-routing-context.sh

@@ -5,11 +5,11 @@ case "${1:-}" in
     SessionStart|SubagentStart) event=$1 ;;
     *) printf '%s\n' 'Expected SessionStart or SubagentStart.' >&2; exit 2 ;;
 esac
-script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
 rule_file="$script_dir/../references/routing-rule.json"
 # Read before emitting anything so a missing asset cannot produce partial JSON.
 rule=$(cat "$rule_file")
-skill_file="$(CDPATH= cd -- "$script_dir/.." && pwd)/SKILL.md"
+skill_file="$(CDPATH='' cd -- "$script_dir/.." && pwd)/SKILL.md"
 DELEGATE_ROUTING_EVENT="$event" DELEGATE_ROUTING_RULE="$rule" DELEGATE_ROUTING_SKILL="$skill_file" awk '
 BEGIN {
     # Paths are task data, not shell code. Escape every JSON control character.

package/scripts/installer/routing-store.mjs

@@ -5,7 +5,7 @@ import { assertNoSymlinkComponents, existingPath } from "./filesystem.mjs";
 import { countRoutingEvents, createRoutingPlan, routingPath, validateHookConfig } from "./routing-rules.mjs";
 import { targetFor } from "./selection.mjs";
 
-export async function prepareRouting(selected, action, { environment, platform, sourceDirectory }) {
+export async function prepareRouting(selected, action, { environment, platform }) {
   const plans = [];
   for (const name of new Set(selected.harnessNames)) {
     const path = routingPath(name, {
@@ -55,85 +55,118 @@ export async function prepareRouting(selected, action, { environment, platform,
   return plans;
 }
 
-async function replaceRoutingConfig(plan, before, after) {
-  await assertNoSymlinkComponents(plan.path);
-  await mkdir(dirname(plan.path), { recursive: true });
+const routingFileOperations = Object.freeze({ open, mkdir, readFile, rename, unlink, existingPath, assertNoSymlinkComponents });
+
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function combinedFailure(failures) {
+  if (failures.length === 1) return failures[0];
+  return new AggregateError(failures, failures.map(errorMessage).join("; "), { cause: failures[0] });
+}
+
+async function writeAndClose(file, contents) {
+  const failures = [];
+  try {
+    await file.writeFile(contents);
+    await file.sync();
+  } catch (error) {
+    failures.push(error);
+  }
+  try {
+    await file.close();
+  } catch (error) {
+    failures.push(error);
+  }
+  if (failures.length) throw combinedFailure(failures);
+}
+
+async function cleanupReplacement(lock, temporary, lockPath, operations) {
+  const failures = [];
+  try {
+    await operations.unlink(temporary);
+  } catch (error) {
+    if (!(error && typeof error === "object" && "code" in error && error.code === "ENOENT")) failures.push(error);
+  }
+  try {
+    await lock.close();
+  } catch (error) {
+    failures.push(error);
+  }
+  try {
+    await operations.unlink(lockPath);
+  } catch (error) {
+    failures.push(error);
+  }
+  return failures;
+}
+
+async function replaceRoutingConfig(plan, before, after, operations, onCommitted) {
+  await operations.assertNoSymlinkComponents(plan.path);
+  await operations.mkdir(dirname(plan.path), { recursive: true });
   const lockPath = plan.path + ".delegation-layer.lock";
   let lock;
   try {
-    lock = await open(lockPath, "wx", 0o600);
+    lock = await operations.open(lockPath, "wx", 0o600);
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "EEXIST") {
-      throw new Error(`routing configuration is locked: ${lockPath}; verify no other installer is running before removing a stale lock`);
+      throw new Error(`routing configuration is locked: ${lockPath}; verify no other installer is running before removing a stale lock`, { cause: error });
     }
     throw error;
   }
   const suffix = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
   const temporary = plan.path + `.delegation-layer-stage-${suffix}`;
+  const failures = [];
   try {
-    const stat = await existingPath(plan.path);
+    const stat = await operations.existingPath(plan.path);
     if (stat && (!stat.isFile() || stat.isSymbolicLink())) {
       throw new Error(`routing configuration changed during installation: ${plan.path}`);
     }
-    const current = stat ? await readFile(plan.path, "utf8") : null;
+    const current = stat ? await operations.readFile(plan.path, "utf8") : null;
     if (current !== before) throw new Error(`routing configuration changed during installation; retry: ${plan.path}`);
     if (before !== null) {
-      const backup = await open(plan.path + `.delegation-layer-backup-${suffix}`, "wx", 0o600);
-      try {
-        await backup.writeFile(before);
-        await backup.sync();
-      } finally {
-        await backup.close();
-      }
+      const backup = await operations.open(plan.path + `.delegation-layer-backup-${suffix}`, "wx", 0o600);
+      await writeAndClose(backup, before);
     }
     if (after === null) {
-      await unlink(plan.path);
-      return;
-    }
-    const staged = await open(temporary, "wx", plan.mode);
-    try {
-      await staged.writeFile(after);
-      await staged.sync();
-    } finally {
-      await staged.close();
-    }
-    await rename(temporary, plan.path);
-  } finally {
-    try {
-      try {
-        await unlink(temporary);
-      } catch (error) {
-        if (!(error && typeof error === "object" && "code" in error && error.code === "ENOENT")) throw error;
-      }
-    } finally {
-      try {
-        await lock.close();
-      } finally {
-        await unlink(lockPath);
-      }
+      await operations.unlink(plan.path);
+    } else {
+      const staged = await operations.open(temporary, "wx", plan.mode);
+      await writeAndClose(staged, after);
+      await operations.rename(temporary, plan.path);
     }
+    onCommitted?.();
+  } catch (error) {
+    failures.push(error);
   }
+  failures.push(...await cleanupReplacement(lock, temporary, lockPath, operations));
+  if (failures.length) throw combinedFailure(failures);
 }
 
-export async function applyRouting(plans) {
+export async function applyRouting(plans, fileOperations = {}) {
+  const operations = { ...routingFileOperations, ...fileOperations };
+  // This transaction owns committed mutations, including commits followed by a cleanup failure.
   const applied = [];
   try {
     for (const plan of plans) {
       if (!plan.path || plan.before === plan.after) continue;
-      await replaceRoutingConfig(plan, plan.before, plan.after);
-      applied.push(plan);
+      await replaceRoutingConfig(plan, plan.before, plan.after, operations, () => applied.push(plan));
     }
   } catch (error) {
     const failures = [];
     for (const plan of applied.reverse()) {
       try {
-        await replaceRoutingConfig(plan, plan.after, plan.before);
+        await replaceRoutingConfig(plan, plan.after, plan.before, operations);
       } catch (rollbackError) {
-        failures.push(rollbackError instanceof Error ? rollbackError.message : String(rollbackError));
+        failures.push(rollbackError);
       }
     }
-    const reason = error instanceof Error ? error.message : String(error);
-    throw new Error(`${reason}${failures.length ? `; rollback needs attention: ${failures.join("; ")}` : "; earlier routing changes rolled back"}`);
+    const reason = errorMessage(error);
+    if (failures.length) {
+      throw new AggregateError([error, ...failures], `${reason}; rollback needs attention: ${failures.map(errorMessage).join("; ")}`, { cause: error });
+    }
+    throw new Error(`${reason}; earlier routing changes rolled back`, { cause: error });
   }
 }
 

package/skills/agent-integration/references/command-reference.md

@@ -295,6 +295,32 @@ Missing task files and corrupt evidence are distinct; see
 [scheduled result handling](result-handling.md#scheduled-execution-results)
 for freshness, no-result states, response bounds, exit codes and recovery.
 
+## Supervisor owner control
+
+```sh
+delegate supervisor stop-owner --json
+```
+
+Use only when the installed build advertises this command. Preserve the explicit
+root for work bound to a custom or historical root. This command contacts one
+existing infrastructure owner; it does not initialize, repair or start one.
+It leaves Pueue and admitted tasks running. Startup, accepted operations and
+unresolved cleanup can make the owner busy.
+
+The `supervisor_owner` response separates `state` (`serving_released`,
+`not_initialized`, `busy` or `unknown`) from `process_closure` (`closed`,
+`pending` or `unknown`). A released owner can remain alive as the sole waiter for
+its daemon; serving release is not proof of process exit or root quiescence.
+The optional `process` value (`pid`, `start_token`) identifies the validated
+selected `startup`; it does not establish liveness. It is omitted when no owner
+was selected or validated. Observe that exact incarnation after daemon shutdown;
+a new root-selected stop can address a newer owner.
+An absent root reports `not_initialized` with unknown process closure.
+Exit `0` reports the observed release or uninitialized state, `3` reports busy,
+and `1` reports a control or observation fault. Preserve an uncertain result;
+the command does not resend an uncertain stop request. Human output exposes
+the same separate observations.
+
 ## Scheduler runtime
 
 Check `delegate help` for the installed build's command surface. Use `serve`,
@@ -487,9 +513,11 @@ Inspection-backed admission can return `status: "ready"` with
 `verification: "runtime"` after its probe. Managed runtime-only admission
 keeps the catalog projection; its supervised worker checks compatibility before
 provider execution. Collect the created task to establish the result.
-Optional protocol members `version` and `executable_sha256` are diagnostics,
-not launch authority. Live acceptance remains separate (`not_run`, `passed`,
-or `blocked`); a blocked prerequisite is unresolved.
+Provider versions are optional diagnostics. Historical executable-digest members
+remain readable as recorded data. Do not depend on these fields or calculate new
+executable fingerprints for diagnostics or admission. Required behavior and the
+selected installed executable govern compatibility. Live acceptance remains separate (`not_run`,
+`passed`, or `blocked`); a blocked prerequisite is unresolved.
 
 ## Choosing models and effort
 

package/skills/agent-integration/scripts/delegate-routing-context.sh

@@ -5,11 +5,11 @@ case "${1:-}" in
     SessionStart|SubagentStart) event=$1 ;;
     *) printf '%s\n' 'Expected SessionStart or SubagentStart.' >&2; exit 2 ;;
 esac
-script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
 rule_file="$script_dir/../references/routing-rule.json"
 # Read before emitting anything so a missing asset cannot produce partial JSON.
 rule=$(cat "$rule_file")
-skill_file="$(CDPATH= cd -- "$script_dir/.." && pwd)/SKILL.md"
+skill_file="$(CDPATH='' cd -- "$script_dir/.." && pwd)/SKILL.md"
 DELEGATE_ROUTING_EVENT="$event" DELEGATE_ROUTING_RULE="$rule" DELEGATE_ROUTING_SKILL="$skill_file" awk '
 BEGIN {
     # Paths are task data, not shell code. Escape every JSON control character.