@awak-app/simy-cli 0.5.35 → 0.5.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.5.35",
+  "version": "0.5.37",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.5.35";
+export const CLI_VERSION = "0.5.37";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -6,6 +6,7 @@ import { homedir } from 'node:os';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { acquireWorkspaceLease, releaseWorkspaceLease } from './workspace-lease.mjs';
 
 export const TERMINAL = new Set(['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted']);
 const EVENTS = new Set(['SessionStart', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'PermissionRequest', 'Notification']);
@@ -29,12 +30,75 @@ async function read(file) {
   try { const raw = await readFile(file, 'utf8'); if (Buffer.byteLength(raw) > MAX_BYTES) throw new Error('State exceeds limit.'); return JSON.parse(raw); }
   catch (e) { if (e.code === 'ENOENT') return null; throw e; }
 }
-export async function updateRecord(root, provider, session, mutate) {
+async function lockOwner(lock) {
+  try {
+    const owner = await read(join(lock, 'owner.json'));
+    return Number.isSafeInteger(owner?.pid) && owner.pid > 1 && typeof owner.token === 'string' && owner.token &&
+      (owner.identity === null || typeof owner.identity === 'string') ? owner : null;
+  } catch { return null; }
+}
+async function ownerDefinitelyDead(owner, inspectProcess) {
+  const identity = await inspectProcess(owner.pid);
+  if (identity === '') return true;
+  if (identity !== null && owner.identity && identity !== owner.identity) return true;
+  // Windows has no ps identity, but ESRCH is authoritative process absence.
+  if (process.platform === 'win32') {
+    try { process.kill(owner.pid, 0); } catch (error) { return error.code === 'ESRCH'; }
+  }
+  return false;
+}
+async function releaseStateLock(lock, token) {
+  if ((await lockOwner(lock))?.token === token) await rm(lock, { recursive: true, force: true });
+}
+async function acquireStateLock(lock, inspectProcess, depth = 0) {
+  const owner = { pid: process.pid, identity: await inspectProcess(process.pid), token: randomUUID() };
+  const create = async (reclaiming = false) => {
+    await mkdir(lock, { mode: 0o700 });
+    try { await writeFile(join(lock, 'owner.json'), JSON.stringify(owner), { mode: 0o600, flag: 'wx' }); }
+    catch (error) { await rm(lock, { recursive: true, force: true }); throw error; }
+    if (!reclaiming) {
+      // A reclaimer may have moved the dead directory but not recreated it
+      // yet. Winning mkdir in that gap does not grant mutation authority.
+      try {
+        await stat(`${lock}.reclaim`);
+        await releaseStateLock(lock, owner.token);
+        throw new Error('Delivery state is busy; retry the command.');
+      } catch (error) {
+        if (error.code !== 'ENOENT') {
+          await releaseStateLock(lock, owner.token);
+          throw error;
+        }
+      }
+    }
+    return owner.token;
+  };
+  try { return await create(); } catch (error) { if (error.code !== 'EEXIST') throw error; }
+  const prior = await lockOwner(lock);
+  if (!prior) throw new Error('Delivery state lock owner is unavailable; inspect the lock before retrying.');
+  if (!await ownerDefinitelyDead(prior, inspectProcess)) throw new Error('Delivery state is busy; retry the command.');
+  if (depth >= 4) throw new Error('Delivery state reclaim lock requires inspection.');
+  const reclaim = `${lock}.reclaim`, token = await acquireStateLock(reclaim, inspectProcess, depth + 1);
+  let stale;
+  try {
+    const current = await lockOwner(lock);
+    if (!current || current.token !== prior.token || !await ownerDefinitelyDead(current, inspectProcess)) throw new Error('Delivery state is busy; retry the command.');
+    stale = `${lock}.stale-${randomUUID()}`;
+    await rename(lock, stale);
+    try { return await create(true); } catch (error) {
+      if (error.code === 'EEXIST') throw new Error('Delivery state is busy; retry the command.');
+      throw error;
+    }
+  } finally {
+    if (stale) await rm(stale, { recursive: true, force: true });
+    await releaseStateLock(reclaim, token);
+  }
+}
+export async function updateRecord(root, provider, session, mutate, { inspectProcess = processIdentity } = {}) {
   await mkdir(root, { recursive: true, mode: 0o700 });
   const file = recordPath(root, provider, session), lock = `${file}.lock`;
-  // Short, non-waiting critical sections keep hooks bounded. A crashed writer's
-  // stale lock is surfaced, never silently removed while a writer may own it.
-  try { await mkdir(lock); } catch (e) { if (e.code === 'EEXIST') throw new Error('Delivery state is busy; retry the command.'); throw e; }
+  // Recovery requires positive process-death evidence and a serialized second
+  // observation. Unknown/legacy owners are never reclaimed by age.
+  const lockToken = await acquireStateLock(lock, inspectProcess);
   let temporary;
   try {
     const next = await mutate(await read(file));
@@ -54,7 +118,7 @@ export async function updateRecord(root, provider, session, mutate) {
       await rename(temporary, file);
     }
     return next;
-  } finally { if (temporary) await rm(temporary, { force: true }); await rm(lock, { recursive: true, force: true }); }
+  } finally { if (temporary) await rm(temporary, { force: true }); await releaseStateLock(lock, lockToken); }
 }
 export async function listRecords(root = rootDirectory()) {
   let names; try { names = await readdir(root); } catch (e) { if (e.code === 'ENOENT') return []; throw e; }
@@ -133,7 +197,7 @@ export function evaluateAssessedPlan(plan, policy, scopes, now = Date.now()) {
 // Shared by live Stop hooks and cold exact-session recovery. Keep the result
 // contract identical across transports; the host still verifies acceptance.
 export function assessedCheckpointContract(decision) {
-  return `Return ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened",evidence:["concrete observation"]} for THIS selected action. This is provider-reported, not independent verification. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. Missing facts are unknown. Completed requires evidence, and SIMY independently checks frozen acceptance. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. missing_information requires a specific question.`;
+  return `Return ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened",evidence:["concrete observation"]} for THIS selected action. This is provider-reported, not independent verification. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. Missing facts are unknown. Completed requires evidence, and SIMY independently checks frozen acceptance. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. missing_information requires a specific question. external_dependency requires waitCondition:{condition,owner,nextCheck} with the observable resumption condition, dependency owner, and bounded recheck instruction, plus nextStep.`;
 }
 export function understandingCheckpointContract(decision) {
   return `This is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; do not edit files, call external services, or start the proposed next action. Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require review. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. For semantic conditions use manual. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. If material context is missing, set exactly one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification.`;
@@ -213,7 +277,7 @@ export function notifyState(run, now) {
   run.managed.notificationKey = key;
   run.managed.notification = { key, kind: run.state, message: run.reason, at: now };
 }
-function managedSpec(spec, session, provider, observedProcess, admission) {
+function managedSpec(spec, session, provider, observedProcess, admission, now) {
   if (!spec) return null;
   if (spec !== true && (typeof spec !== 'object' || Array.isArray(spec))) throw new Error('Invalid managed task specification.');
   const config = spec === true ? {} : spec;
@@ -248,10 +312,13 @@ function managedSpec(spec, session, provider, observedProcess, admission) {
   const appServerChannel = config.resumeChannel === 'codex_app_server' && admission?.source === 'codex_app_server' && admission.session === session;
   const autoRecovery = config.autoRecovery === true && exactCodexSession && Boolean(resumeModel) &&
     (appServerChannel || config.resumeChannel === 'codex_exec' && Boolean(observedProcess?.identity));
+  if (config.maxTokens !== undefined && !(provider === 'codex' && appServerChannel)) throw new Error('Provider token budgets require the host-observed Codex app-server channel.');
   const managed = { taskId: randomUUID(), thread: { provider, id: session },
     actionId: text(config.actionId, 200) || null, actionDueAt, acceptanceCriteria: criteria, verified: {}, remainingWork: text(config.remainingWork, 4000) || null,
     initialAction, proposedAction: initialAction, approvalPolicy, approvalScopes: [...new Set(scopes)].slice(0, 20),
     grants: Object.fromEntries(scopes.map(scope => [scope, { decision: approvalPolicy }])), maxNoProgress: positive(config.maxNoProgress, 3, 20),
+    maxNoProgressMinutes: positive(config.maxNoProgressMinutes, 30, 1440), lastVerifiedProgressAt: now,
+    maxTokens: config.maxTokens === undefined ? null : positive(config.maxTokens, null, Number.MAX_SAFE_INTEGER), tokensUsed: 0, usageAvailable: null,
     noProgress: 0, verifiedRevision: 0, consumedVerifiedRevision: 0, notification: null, notificationKey: null,
     autoRecovery, resumeModel, autoRecoveryUnavailableReason: config.autoRecovery === true && !autoRecovery ? 'Exact Codex process, session UUID, and resumeModel are required.' : null,
     autoRecoverySandbox: config.autoRecoverySandbox || 'read-only', resumeChannel: config.resumeChannel || null,
@@ -277,7 +344,7 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     }
     if ((!previous?.observedAt && !admitted) || previous.cwd !== cwd) throw new Error('No matching verified provider session observed here. Select an exact discovered session or enable SIMY hooks.');
     if (previous.run) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
-    const managedState = managedSpec(managed, session, provider, previous.process, admitted ? admission : null);
+    const managedState = managedSpec(managed, session, provider, previous.process, admitted ? admission : null, now);
     if (liveHookAdmission && managedState) managedState.liveHookOwner = { pid: liveHookAdmission.pid,
       identity: liveHookAdmission.identity, hookStartedAt: liveHookAdmission.hookStartedAt };
     const waiting = managedState?.decision?.outcome === 'wait';
@@ -299,7 +366,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
   if (['in_progress', 'error'].includes(checkpoint.status) && !text(checkpoint.nextStep)) throw new Error('A concrete nextStep is required.');
   if (checkpoint.status === 'blocked' && !['authorization', 'missing_information', 'external_dependency'].includes(checkpoint.blocker)) throw new Error('Specify authorization, missing_information, or external_dependency.');
   const evidence = Array.isArray(checkpoint.evidence) ? checkpoint.evidence.map(v => text(v, 1000)).filter(Boolean).slice(0, 20) : [];
-  return updateRecord(root, provider, session, async record => {
+  const settled = await updateRecord(root, provider, session, async record => {
     const run = record?.run;
     let effectiveStatus = checkpoint.status;
     let nextStep = text(checkpoint.nextStep);
@@ -370,6 +437,11 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
         run.managed.userQuestion = text(checkpoint.question, 1000);
       }
     }
+    if (run.managed && checkpoint.status === 'blocked' && checkpoint.blocker === 'external_dependency') {
+      const wait = checkpoint.waitCondition;
+      if (!text(wait?.condition, 1000) || !text(wait?.owner, 200) || !text(wait?.nextCheck, 1000) || !nextStep) throw new Error('External dependency needs waitCondition {condition, owner, nextCheck} and a nextStep.');
+      run.managed.dependencyWait = { id: randomUUID(), condition: text(wait.condition, 1000), owner: text(wait.owner, 200), nextCheck: text(wait.nextCheck, 1000), createdAt: now };
+    }
     run.checkpoint = { status: effectiveStatus, summary: text(checkpoint.summary), nextStep, blocker: checkpoint.blocker, evidence, acceptanceMet: checkpoint.acceptanceMet === true };
     run.revision += 1; run.updatedAt = now;
     if (run.managed && effectiveStatus === 'completed') {
@@ -379,9 +451,19 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
         run.state = 'reported_done'; run.reason = 'Original session reported the goal done; no independent acceptance check was available.';
       }
     }
+    if (run.managed?.liveWorkspaceLease) {
+      run.managed.executionAttempt = { ...run.managed.executionAttempt, phase: 'checkpointed', checkpointRevision: run.revision, endedAt: now };
+      run.managed.liveWorkspaceLease.checkpointRevision = run.revision;
+    }
+    if (run.managed?.executionUncertain && run.managed.recoveryDiagnosisDecisionId === checkpoint.actionResult?.decisionId && checkpoint.actionResult?.status === 'observed' && checkpoint.actionResult?.evidence?.length && run.managed.workHistory?.at(-1)?.action.kind === 'read') {
+      run.managed.recoveryEvidence = { decisionId: checkpoint.actionResult.decisionId, source: 'provider_reported_read', checkedAt: now };
+      delete run.managed.executionUncertain;
+      delete run.managed.recoveryDiagnosisDecisionId;
+    }
     notifyState(run, now);
     return record;
   });
+  return settled;
 }
 async function checkpointUnderstanding({ root, provider, session, cwd, checkpoint, expectedLease, now }) {
   try { cwd = await realpath(cwd); } catch { throw new Error('No matching active Delivery Loop.'); }
@@ -418,9 +500,9 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
     if (understanding.state === 'clear') {
       run.objective = understanding.objective;
       run.managed.remainingWork = understanding.remaining.join(' ').slice(0, 4000);
-      // Only mechanical checks tied to a cited user message become frozen
-      // acceptance. Semantic/provider-proposed criteria remain visible above.
-      run.managed.acceptanceCriteria = understanding.criteria.filter(item => item.source === 'user_grounded' && item.check.type !== 'manual')
+      // User-grounded semantic criteria remain frozen for explicit human
+      // verification; provider-proposed criteria remain interpretation only.
+      run.managed.acceptanceCriteria = understanding.criteria.filter(item => item.source === 'user_grounded')
         .map(item => ({ id: item.id, description: item.description, check: item.check.type === 'file_equals'
           ? { type: 'file_equals', exactPath: item.check.path, text: item.check.text } : item.check }));
       run.managed.verified = {};
@@ -464,7 +546,10 @@ export async function verifyAutomaticCriteria(record, now) {
       const content = await readFile(actual);
       if (criterion.check.type === 'file_contains' && !content.toString('utf8').includes(criterion.check.text)) { delete managed.verified[criterion.id]; continue; }
       if (criterion.check.type === 'file_equals' && !content.equals(Buffer.from(criterion.check.text, 'utf8'))) { delete managed.verified[criterion.id]; continue; }
-      if (!Object.hasOwn(managed.verified, criterion.id)) managed.verifiedRevision += 1;
+      if (!Object.hasOwn(managed.verified, criterion.id)) {
+        managed.verifiedRevision += 1;
+        managed.lastVerifiedProgressAt = Math.max(managed.lastVerifiedProgressAt ?? record.run.startedAt, now);
+      }
       managed.verified[criterion.id] = { source: criterion.check.type, checkedAt: now, path, sha256: digest(content) };
     } catch { delete managed.verified[criterion.id]; }
   }
@@ -476,7 +561,10 @@ export async function verifyDelivery({ root = rootDirectory(), provider, session
     if (taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
     const criterion = run.managed.acceptanceCriteria.find(item => item.id === criterionId);
     if (!criterion || criterion.check.type !== 'manual') throw new Error('Only manual criteria can be verified by the user.');
-    if (!Object.hasOwn(run.managed.verified, criterionId)) run.managed.verifiedRevision += 1;
+    if (!Object.hasOwn(run.managed.verified, criterionId)) {
+      run.managed.verifiedRevision += 1;
+      run.managed.lastVerifiedProgressAt = Math.max(run.managed.lastVerifiedProgressAt ?? run.startedAt, now);
+    }
     run.managed.verified[criterionId] = { source: 'user', checkedAt: now };
     if (run.state === 'verification_pending' && run.checkpoint?.status === 'completed') {
       await verifyAutomaticCriteria(record, now);
@@ -488,6 +576,45 @@ export async function verifyDelivery({ root = rootDirectory(), provider, session
     run.updatedAt = now; return record;
   });
 }
+function prepareWaitingDiagnosis(run, reason, now) {
+  const managed = run.managed, scope = managed.approvalScopes[0];
+  if (!scope) throw new Error('Waiting recovery needs an enrolled scope.');
+  const action = { kind: 'read', scope, summary: 'Inspect the resolved wait and current result before choosing new work; do not replay the prior action' };
+  const plan = assessedPlan({ diagnosis: reason,
+    alternatives: [{ id: 'inspect_resolved_wait', action,
+      assessment: { risk: 'low', reversibility: 'reversible', externalEffect: 'none', blastRadius: 'single_file', uncertainty: 'low', inObjective: true, userChoice: false },
+      expectedVerification: 'Read-only evidence of current workspace, the supplied information or dependency confirmation, and remaining work. Do not replay previous changes or release another dependency wait.', rollback: 'No changes to undo.' }],
+    selectedOptionId: 'inspect_resolved_wait', recommendation: { optionId: 'inspect_resolved_wait', reason: 'A resolved wait permits inspection, not replay of an already attempted action.' } });
+  recordDecision(managed, plan, now);
+  run.nextStep = action.summary;
+}
+export function recoveryDiagnosisPlan(managed) {
+  const uncertain = managed.executionUncertain;
+  const scope = managed.approvalScopes[0];
+  if (!scope) throw new Error('Recovery diagnosis needs an enrolled task scope.');
+  const action = { kind: 'read', scope, summary: 'Reconcile the prior interrupted action using read-only evidence; do not replay its side effects' };
+  return assessedPlan({ diagnosis: `Prior attempt ${text(uncertain?.attemptId, 100) || 'unknown'} may have executed decision ${text(uncertain?.decisionId, 100) || 'unknown'}. Inspect the actual result and determine what remains; never repeat the prior action during diagnosis.`,
+    alternatives: [{ id: 'reconcile_interrupted_action', action,
+      assessment: { risk: 'low', reversibility: 'reversible', externalEffect: 'none', blastRadius: 'single_file', uncertainty: 'low', inObjective: true, userChoice: false },
+      expectedVerification: 'Concrete read-only evidence of prior effects and remaining work; no side-effect replay.', rollback: 'No changes to undo.' }],
+    selectedOptionId: 'reconcile_interrupted_action', recommendation: { optionId: 'reconcile_interrupted_action', reason: 'Reconcile ambiguous execution before authorizing new changes.' } });
+}
+export function prepareRecoveryDiagnosis(run, now = Date.now()) {
+  if (!run.managed?.executionUncertain) return null;
+  const decision = recordDecision(run.managed, recoveryDiagnosisPlan(run.managed), now);
+  if (decision.outcome !== 'proceed') throw new Error('Read-only recovery diagnosis needs human review.');
+  run.managed.recoveryDiagnosisDecisionId = decision.id;
+  run.nextStep = decision.action.summary;
+  return decision;
+}
+export function managedBudgetReason(run, now = Date.now()) {
+  if (now >= run.deadline || run.continuations >= run.maxContinuations || run.failures >= run.maxFailures) return 'Original delivery time, continuation, or failure budget exhausted.';
+  const managed = run.managed;
+  if (managed?.usageBlocked || managed?.maxTokens && managed.tokensUsed >= managed.maxTokens) return 'Provider token budget exhausted or reliable usage unavailable.';
+  if (managed && now - (managed.lastVerifiedProgressAt ?? run.startedAt) >= (managed.maxNoProgressMinutes ?? 30) * 60_000) return 'No verified acceptance progress within the configured time limit.';
+  if (managed && managed.noProgress >= managed.maxNoProgress) return 'No verified acceptance progress within the configured continuation limit.';
+  return null;
+}
 export function decideStop(run, now = Date.now()) {
   if (TERMINAL.has(run.state) || ['blocked', 'recovery_required', 'paused', 'verification_pending'].includes(run.state)) return { run, output: {} };
   const next = structuredClone(run);
@@ -507,7 +634,8 @@ export function decideStop(run, now = Date.now()) {
       next.nextStep = text(cp.nextStep) || next.nextStep;
     } else { escalate(next, cp.summary); return finish('blocked', cp.summary); }
   }
-  if (now >= next.deadline || next.continuations >= next.maxContinuations) return finish('budget_exhausted', 'Delivery time or continuation budget exhausted.');
+  const budgetReason = managedBudgetReason(next, now);
+  if (budgetReason) return finish('budget_exhausted', budgetReason);
   const initialHook = next.managed?.awaitingInitialHook && next.revision === 0 && !next.checkpoint;
   const replanHook = next.managed?.capability === 'live_hook' && next.managed.awaitingReplanHook === true;
   const understandingHook = next.managed?.capability === 'live_hook' && next.managed.awaitingUnderstandingHook === true;
@@ -543,8 +671,8 @@ export function decideStop(run, now = Date.now()) {
       cp?.kind !== 'session_understanding' && cp?.status === 'in_progress' &&
       next.managed.workHistory?.at(-1)?.result?.status === 'observed' && next.managed.workHistory.at(-1).result.evidence?.length;
     if (next.managed.verifiedRevision > next.managed.consumedVerifiedRevision) next.managed.noProgress = 0;
-    else if (reportedStep) next.managed.reportedProgress = (next.managed.reportedProgress || 0) + 1;
     else if (!initialHook && !replanHook && !understandingHook && !approvedHook && !legacyApprovedHook && cp?.kind !== 'session_understanding') next.managed.noProgress += 1;
+    if (reportedStep) next.managed.reportedProgress = (next.managed.reportedProgress || 0) + 1;
     next.managed.consumedVerifiedRevision = next.managed.verifiedRevision;
     if (next.managed.noProgress >= next.managed.maxNoProgress) { escalate(next, 'No verified acceptance progress within the configured continuation limit.'); return finish('failed', 'No verified acceptance progress within the configured continuation limit.'); }
   }
@@ -585,17 +713,17 @@ async function providerProcess(provider) {
   }
   return null;
 }
-export async function handleHook({ input, provider, root = rootDirectory(), now = Date.now(), observedProcess = undefined }) {
+export async function handleHook({ input, provider, root = rootDirectory(), now = Date.now(), observedProcess = undefined, inspectProcess = processIdentity }) {
   if (!EVENTS.has(input?.hook_event_name) || !text(input.session_id) || !text(input.cwd)) return {};
   let cwd; try { cwd = await realpath(input.cwd); } catch { return {}; }
   const event = input.hook_event_name;
-  const identity = observedProcess === undefined && (event === 'SessionStart' || provider === 'claude' && event === 'Stop') ? await providerProcess(provider) : observedProcess;
-  let output = {};
-  await updateRecord(root, provider, input.session_id, async old => {
+  const identity = observedProcess === undefined && (event === 'SessionStart' || provider === 'claude' && ['Stop', 'StopFailure', 'SessionEnd', 'Interrupt'].includes(event)) ? await providerProcess(provider) : observedProcess;
+  let output = {}, boundaryLease = null, claimedWorkspace = null;
+  try { await updateRecord(root, provider, input.session_id, async old => {
     if (old && old.cwd !== cwd) return old;
     const record = old || { schemaVersion: 1, provider, session: input.session_id, cwd, run: null };
     const owner = record.run?.managed?.liveHookOwner;
-    if (owner && ['SessionStart', 'Stop'].includes(event) &&
+    if (owner && ['SessionStart', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt'].includes(event) &&
         (!identity || identity.pid !== owner.pid || identity.identity !== owner.identity)) {
       if (!TERMINAL.has(record.run.state) && !['paused', 'verification_pending'].includes(record.run.state)) {
         if (!(record.run.state === 'blocked' && record.run.managed.pendingApproval)) record.run.state = 'recovery_required';
@@ -614,13 +742,33 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
       output = { hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: `SIMY hooks observed this ${provider} session: ${input.session_id}. Only if the user requests SIMY Delivery Loop, use simy delivery start --provider ${provider} --session ${input.session_id} with the agreed objective and next step. Existing loop: ${record.run?.state || 'not started'}.${approved ? ` User approved exactly one ${approved.action.kind} action in scope ${approved.action.scope}: ${approved.action.summary}. Next step: ${approved.nextStep}. ${approved.dispatchedAt ? 'That approval was already dispatched; any repeated action needs a new approval.' : 'Resume the original conversation to dispatch this one action.'}` : ''} Never enable, trust, resume, or reset a loop on the user's behalf without their request.` } };
     }
     const run = record.run;
+    if (run && event === 'Stop' && input.turn_id && run.lastStopKey === `${input.turn_id}:${Boolean(input.stop_hook_active)}:${run.revision}`) return record;
+    if (run?.managed?.liveWorkspaceLease && ['Stop', 'StopFailure', 'SessionEnd', 'Interrupt'].includes(event)) {
+      const lease = run.managed.liveWorkspaceLease;
+      const settled = run.managed.executionAttempt?.id === lease.attemptId && run.managed.executionAttempt?.phase === 'checkpointed' && lease.checkpointRevision === run.managed.executionAttempt.checkpointRevision;
+      if (!settled) run.managed.executionUncertain = { attemptId: lease.attemptId, decisionId: lease.decisionId, cause: `live_${event}`, at: now };
+      boundaryLease = { ownerId: lease.ownerId, cwd: record.cwd };
+      if (settled && event === 'Stop') {
+        // The matching checkpoint was durably committed before this verified
+        // provider boundary. Releasing now permits the next write/test claim;
+        // a crash cannot reinterpret the settled action as a new dispatch.
+        await releaseWorkspaceLease({ root, cwd: record.cwd, ownerId: lease.ownerId });
+        boundaryLease = null;
+      }
+      delete run.managed.liveWorkspaceLease;
+      run.managed.executionAttempt = { ...run.managed.executionAttempt, phase: settled ? 'settled' : 'uncertain', endedAt: now };
+      if (!settled && event === 'Stop' && run.state === 'active') {
+        run.state = 'blocked'; run.blocker = 'execution_uncertain';
+        run.reason = 'Prior live action stopped without a settled checkpoint; explicitly resume read-only result diagnosis.';
+      }
+    }
     if (!run || TERMINAL.has(run.state)) return record;
     if (event === 'Interrupt') { run.state = 'stopped'; run.reason = 'User interrupted the provider.'; }
     else if (run.state === 'auto_resuming' && ['Stop', 'SessionEnd', 'StopFailure'].includes(event)) {
       // The supervisor owns this exact attempt and consumes its structured
       // final result once. Provider lifecycle hooks must not race that lease.
     }
-    else if (['paused', 'verification_pending'].includes(run.state) && ['SessionEnd', 'StopFailure'].includes(event)) {
+    else if (['paused', 'verification_pending'].includes(run.state) || run.state === 'blocked' && run.managed?.dependencyWait) {
       // A provider lifecycle event cannot override an explicit pause or a
       // completion candidate awaiting independent acceptance checks.
     }
@@ -646,13 +794,56 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
           run.lastStopKey = key; notifyState(run, now); return record;
         }
       }
-      const decision = decideStop(run, now); record.run = decision.run; output = decision.output;
+      if (run.managed?.executionUncertain && provider === 'claude' && owner && run.state === 'active') {
+        prepareRecoveryDiagnosis(run, now);
+        run.checkpoint = null; run.consumedRevision = run.revision;
+        run.managed.awaitingReplanHook = true;
+      }
+      const decision = decideStop(run, now);
+      const selected = decision.run.managed?.decision;
+      if (decision.output.decision === 'block' && provider === 'claude' && owner && run.managed.capability === 'live_hook' && ['local_edit', 'local_test'].includes(selected?.action.kind)) {
+        const unresolved = (await listRecords(root)).find(item => item.cwd === record.cwd && item.run?.managed?.executionUncertain);
+        if (unresolved) {
+          run.reason = 'Workspace has an unresolved prior execution; the original task must reconcile its effects using read-only evidence before another write.';
+          run.updatedAt = now; output = {}; return record;
+        }
+        const attemptId = randomUUID();
+        claimedWorkspace = await acquireWorkspaceLease({ root, record: { ...record, run: decision.run }, leaseId: attemptId, processOwner: owner, inspectProcess,
+          onRecover: async prior => {
+            const mark = priorRecord => {
+              if (priorRecord?.run?.managed?.taskId === prior.taskId) {
+                priorRecord.run.managed.executionUncertain = { attemptId: prior.leaseId, decisionId: prior.decisionId, cause: 'workspace_owner_exit', at: now };
+                delete priorRecord.run.managed.liveWorkspaceLease;
+              }
+              return priorRecord;
+            };
+            if (prior.provider === provider && prior.session === record.session) mark(record);
+            else await updateRecord(root, prior.provider, prior.session, mark);
+          } });
+        if (claimedWorkspace.busy) {
+          run.reason = claimedWorkspace.reason || 'Workspace is in use by another provider session; wait for its safe boundary.';
+          run.updatedAt = now; output = {}; return record;
+        }
+        const unresolvedAfterClaim = (await listRecords(root)).find(item => item.cwd === record.cwd && item.run?.managed?.executionUncertain);
+        if (claimedWorkspace.recoveredOwner || unresolvedAfterClaim) {
+          boundaryLease = { ownerId: claimedWorkspace.owner.id, cwd: record.cwd };
+          run.reason = 'Recovered workspace owner had unconfirmed effects; the original task must reconcile them before another write.';
+          run.updatedAt = now; output = {}; return record;
+        }
+        decision.run.managed.liveWorkspaceLease = { ownerId: claimedWorkspace.owner.id, decisionId: selected.id, attemptId };
+        decision.run.managed.executionAttempt = { id: attemptId, decisionId: selected.id, phase: 'dispatching', dispatchedAt: now, lastActivityAt: now };
+      }
+      record.run = decision.run; output = decision.output;
       record.run.lastStopKey = key;
     }
     record.run.updatedAt = now;
     notifyState(record.run, now);
     return record;
-  });
+  }); } catch (error) {
+    if (claimedWorkspace?.release) await claimedWorkspace.release();
+    throw error;
+  }
+  if (boundaryLease) await releaseWorkspaceLease({ root, cwd: boundaryLease.cwd, ownerId: boundaryLease.ownerId });
   return output;
 }
 export function canReplanDelivery(run, provider, now = Date.now()) {
@@ -661,18 +852,31 @@ export function canReplanDelivery(run, provider, now = Date.now()) {
     managed?.capability === 'live_hook' && provider === 'claude' && Boolean(managed.liveHookOwner?.identity);
   return Boolean(supported && managed.autonomyPolicy && managed.approvalScopes?.length && !managed.rejectedActionOverflow &&
     run.state === 'blocked' && managed.pendingApproval?.denied === true &&
-    now < run.deadline && run.continuations < run.maxContinuations && run.failures < run.maxFailures);
+    !managedBudgetReason(run, now));
 }
-export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, approvalId, autonomyPolicy, questionId, answer, action, now = Date.now() }) {
-  return updateRecord(root, provider, session, record => {
+export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, approvalId, autonomyPolicy, questionId, waitId, answer, action, now = Date.now() }) {
+  for (let retry = 0; ; retry += 1) {
+    try { return await updateRecord(root, provider, session, record => {
     const run = record?.run;
     if (!run) throw new Error('Delivery Loop not found.');
     if (run.managed && taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
+    if (['pending', 'pending_received'].includes(run.managed?.handoff?.status)) throw new Error('Task handoff is locked; use delivery handoff_cancel or retry the same target to complete the transfer.');
+    if (action !== 'stop' && run.managed?.handoff?.status === 'transferred') throw new Error('Task handoff is locked; continue in the received target session.');
+    if (action === 'dependency_ready') {
+      const wait = run.managed?.dependencyWait;
+      if (run.state !== 'blocked' || run.blocker !== 'external_dependency' || !wait || wait.id !== waitId ||
+          typeof answer !== 'string' || !text(answer, 1000) || answer.length > 1000) throw new Error('Dependency wait changed or confirmation is empty; refresh its status.');
+      run.managed.lastDependencyResolution = { waitId, answer: contextText(answer, 1000), confirmedAt: now, source: 'user' };
+      prepareWaitingDiagnosis(run, `The user confirmed dependency ${wait.condition}: ${run.managed.lastDependencyResolution.answer}. Inspect current result and remaining work without replaying the prior action.`, now);
+      run.managed.dependencyWait = null;
+      run.blocker = null;
+      action = 'resume';
+    }
     if (action === 'session_answer') {
       const question = run.managed?.understandingQuestion;
       if (run.managed?.phase !== 'needs_clarification' || run.state !== 'blocked' || !question || question.id !== questionId ||
           !text(answer, 1000) || typeof answer !== 'string' || answer.length > 1000) throw new Error('Session question changed or answer is empty; refresh its status.');
-      if (now >= run.deadline || run.continuations >= run.maxContinuations || run.failures >= run.maxFailures) throw new Error('Original budget exhausted. Session cannot continue.');
+      if (managedBudgetReason(run, now)) throw new Error('Original budget exhausted. Session cannot continue.');
       const read = { kind: 'read', scope: 'task', summary: 'Re-examine the original conversation using the new user answer without changing files' };
       const plan = assessedPlan({ diagnosis: `Resolve the recorded question before any work: ${question.text}`,
         alternatives: [{ id: 'understand_answer', action: read,
@@ -738,11 +942,17 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       }
     }
     else if (action === 'resume') {
+      if (run.managed?.dependencyWait) throw new Error('Confirm the exact external dependency condition before resuming.');
       if (run.managed?.phase === 'needs_clarification') throw new Error('Answer the current session question before resuming.');
       if (!['blocked', 'recovery_required', 'paused'].includes(run.state)) throw new Error('Only a blocked, paused, or recoverable loop can resume.');
+      if (run.managed && run.state === 'blocked' && run.blocker === 'missing_information') {
+        prepareWaitingDiagnosis(run, `Inspect the previous information question and current conversation before choosing work: ${text(run.managed.userQuestion, 1000)}. Do not replay the prior action.`, now);
+        run.blocker = null;
+      }
+      if (run.managed?.executionUncertain) { prepareRecoveryDiagnosis(run, now); run.blocker = null; }
       if (run.managed?.pendingApproval) throw new Error('Resolve the exact pending approval before resuming.');
       if (run.managed?.autonomyPolicy && run.managed.decision?.outcome === 'wait' && (run.managed.approvedAction?.id !== run.managed.decision.id || run.managed.approvedAction.dispatchedAt)) throw new Error('Selected action requires a fresh scoped user decision.');
-      if (now >= run.deadline || run.continuations >= run.maxContinuations || run.failures >= run.maxFailures) throw new Error('Original budget exhausted. Loop cannot resume.');
+      if (managedBudgetReason(run, now)) throw new Error('Original budget exhausted. Loop cannot resume.');
       if (run.managed?.approvedAction && run.recoveryCause === 'approved_action' && !run.managed.approvedAction.dispatchedAt && run.managed.capability !== 'live_hook' && run.managed.resumeChannel !== 'codex_app_server') {
         run.managed.approvedAction.dispatchedAt = now;
         run.managed.dispatches ||= [];
@@ -765,7 +975,7 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       if (!pending || pending.id !== approvalId || pending.denied || run.state !== 'blocked') throw new Error('Pending approval changed; refresh its status.');
       run.managed.notification = { key: `approval:${pending.id}`, kind: 'approval', message: `${action === 'approve' ? 'Approved' : 'Rejected'} ${pending.scope}.`, at: now };
       if (action === 'approve') {
-        if (now >= run.deadline || run.continuations >= run.maxContinuations) throw new Error('Original budget exhausted. Task cannot resume.');
+        if (managedBudgetReason(run, now)) throw new Error('Original budget exhausted. Task cannot resume.');
         run.managed.pendingApproval = null;
         run.nextStep = run.checkpoint?.nextStep || run.nextStep;
         run.state = 'recovery_required'; run.recoveryCause = 'approved_action';
@@ -779,7 +989,13 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       }
     } else throw new Error('Unsupported control.');
     run.updatedAt = now; notifyState(run, now); return record;
-  });
+    }); } catch (error) {
+      // Explicit user controls wait briefly for a live short state writer;
+      // they never reclaim unknown owners or broaden execution authority.
+      if (retry >= 20 || !/^(?:Delivery state is busy; retry the command\.|Delivery state lock owner is unavailable; inspect the lock before retrying\.)$/.test(error.message)) throw error;
+      await new Promise(resolve => setTimeout(resolve, 10));
+    }
+  }
 }
 export async function reconcileRecords({ root = rootDirectory(), now = Date.now(), inspectProcess = processIdentity } = {}) {
   const records = await listRecords(root);
@@ -795,7 +1011,7 @@ export async function reconcileRecords({ root = rootDirectory(), now = Date.now(
           run.state = 'completed'; run.reason = run.checkpoint.summary; run.updatedAt = now;
         }
       }
-      if (now >= run.deadline && !TERMINAL.has(run.state) && run.state !== 'verification_pending') { run.state = 'budget_exhausted'; run.reason = 'Delivery time budget exhausted.'; run.updatedAt = now; }
+      if (managedBudgetReason(run, now) && !TERMINAL.has(run.state) && !['verification_pending', 'paused'].includes(run.state)) { run.state = 'budget_exhausted'; run.reason = managedBudgetReason(run, now); run.updatedAt = now; }
       else if (run.state === 'active' && observed !== null && observed !== current.process?.identity && current.process?.identity === record.process?.identity) {
         run.state = 'recovery_required'; run.recoveryCause = 'process_exit'; run.reason = run.managed?.autoRecovery ? 'Observed provider process exited. Managed recovery is eligible for a bounded exact-session attempt.' : 'Observed provider process exited. Reopen the existing conversation and explicitly resume.'; run.updatedAt = now;
       }

package/src/codex-plugins/simy/hooks/workspace-lease.mjs

@@ -0,0 +1,71 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { processIdentity } from './delivery-loop.mjs';
+
+export async function leaseOwnerDead(owner, inspectProcess = processIdentity) {
+  if (!owner?.identity || !Number.isSafeInteger(owner.pid) || owner.pid < 2) return false;
+  // A PID-only receipt cannot be compared with a later POSIX signature. A
+  // recovered ps result does not prove that the original process exited.
+  if (!owner.identity.startsWith('pid:')) {
+    const identity = await inspectProcess(owner.pid).catch(() => null);
+    if (identity !== null) return identity !== owner.identity;
+  }
+  try { process.kill(owner.pid, 0); return false; }
+  catch (error) { return error.code === 'ESRCH'; }
+}
+
+// Provider writer locks protect a conversation. This lock protects the files
+// shared by different conversations. Tests may write fixtures/build outputs.
+export async function acquireWorkspaceLease({ root, record, leaseId, inspectProcess = processIdentity, onRecover = async () => {}, processOwner }) {
+  if (!['local_edit', 'local_test'].includes(record.run.managed.decision?.action.kind)) return { release: async () => {} };
+  const cwd = await realpath(record.cwd);
+  const directory = join(root, 'workspace-leases');
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  const lock = join(directory, createHash('sha256').update(cwd).digest('hex'));
+  const ownerPid = processOwner?.pid || process.pid;
+  const owner = { id: randomUUID(), pid: ownerPid, identity: processOwner?.identity || await inspectProcess(ownerPid),
+    taskId: record.run.managed.taskId, session: record.session, provider: record.provider,
+    decisionId: record.run.managed.decision.id, leaseId, cwd, acquiredAt: Date.now() };
+  // On Windows no POSIX process signature is available. Never reclaim a live
+  // PID there; ESRCH is the only fallback proof of death (PID reuse stays busy).
+  owner.identity ||= `pid:${ownerPid}`;
+  const readOwner = async () => { try { return JSON.parse(await readFile(join(lock, 'owner.json'), 'utf8')); } catch { return null; } };
+  let recoveredOwner = null;
+  try { await mkdir(lock, { mode: 0o700 }); }
+  catch (error) {
+    if (error.code !== 'EEXIST') throw error;
+    // Serialize stale-owner inspection. A TTL alone never proves owner death.
+    const reclaim = `${lock}.reclaim`;
+    try { await mkdir(reclaim, { mode: 0o700 }); } catch (e) { if (e.code === 'EEXIST') return { busy: true }; throw e; }
+    try {
+      const prior = await readOwner();
+      if (!prior?.identity || !Number.isSafeInteger(prior.pid)) return { busy: true, reason: 'Workspace lock has no verifiable owner; inspect it before recovery.' };
+      if (!await leaseOwnerDead(prior, inspectProcess)) return { busy: true };
+      // Persist the prior operation's uncertainty BEFORE exposing a free lock.
+      await onRecover(prior);
+      const stale = `${lock}.${randomUUID()}.stale`;
+      await rename(lock, stale);
+      await rm(stale, { recursive: true, force: true });
+      await mkdir(lock, { mode: 0o700 });
+      recoveredOwner = prior;
+    } finally { await rm(reclaim, { recursive: true, force: true }); }
+  }
+  await writeFile(join(lock, 'owner.json'), JSON.stringify(owner), { mode: 0o600 });
+  if (!recoveredOwner && await stat(`${lock}.reclaim`).then(() => true, error => { if (error.code === 'ENOENT') return false; throw error; })) {
+    if ((await readOwner())?.id === owner.id) await rm(lock, { recursive: true, force: true });
+    return { busy: true };
+  }
+  return { recoveredOwner, owner, async release({ unconfirmed = false } = {}) {
+    // An unconfirmed provider cancellation still may own an executing turn.
+    if (unconfirmed || (await readOwner())?.id !== owner.id) return;
+    await rm(lock, { recursive: true, force: true });
+  } };
+}
+
+export async function releaseWorkspaceLease({ root, cwd, ownerId }) {
+  const lock = join(root, 'workspace-leases', createHash('sha256').update(await realpath(cwd)).digest('hex'));
+  let owner;
+  try { owner = JSON.parse(await readFile(join(lock, 'owner.json'), 'utf8')); } catch { return; }
+  if (owner.id === ownerId) await rm(lock, { recursive: true, force: true });
+}