@awak-app/simy-cli 0.5.38 → 0.5.40

package/src/session-supervision/action-association-host.js

@@ -0,0 +1,213 @@
+import { listRecords, updateRecord, TERMINAL, managedBudgetReason } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { createActionAssociationApi, ActionAssociationApiError } from './action-association-api.js';
+import { actionCandidateRequest, prepareActionAssociation, importActionBinding,
+  settleActionAssociation, cancelActionAssociation } from './action-association.js';
+
+const namespaceFor = (origin, scope) => JSON.stringify([new URL(origin).origin, scope.organizationId, scope.userId]);
+const identity = record => ({ provider: record.provider, session: record.session, taskId: record.run.managed.taskId });
+const eligible = record => record.run?.managed?.taskId && (!record.run.managed.handoff || record.run.managed.handoff.status === 'received');
+const publicCandidate = item => ({ id: item.id, revision: item.revision, title: item.title.slice(0,120) });
+const publicBinding = binding => binding ? { ...binding, reason: (binding.reason || '').slice(0,60), coveredWork: (binding.coveredWork || '').slice(0,60), evidence: [],
+  action: binding.action ? { ...binding.action, title: (binding.action.title || '').slice(0,120), description: null, projectName: (binding.action.projectName || '').slice(0,60) } : null } : null;
+const hardFailure = code => ['unauthorized', 'unavailable', 'invalid_request', 'invalid_response'].includes(code);
+
+// Association is optional metadata. Network failures never control the task's
+// work state; provider turns and their budgets remain owned by the supervisor.
+export function createActionAssociationHost({ root, sessionRoot, webOrigin, api = createActionAssociationApi({ webOrigin, sessionRoot }),
+  now = Date.now, refreshMs = 60_000, list = listRecords } = {}) {
+  const abort = new AbortController(), views = new Map();
+  let auth = null, closed = false, running = null, serial = Promise.resolve();
+  const enqueue = work => {
+    const result = serial.then(work); serial = result.catch(() => {}); return result;
+  };
+  const current = async () => {
+    const next = await api.authRevision();
+    if (next !== auth) {
+      auth = next; views.clear();
+      for (const record of (await list(root)).filter(eligible)) {
+        const association = record.run.managed.actionAssociation;
+        if (!association || association.authRevision === next) continue;
+        await updateRecord(root, record.provider, record.session, latest => {
+          const local = latest?.run?.managed?.actionAssociation;
+          if (!local || latest.run.managed.taskId !== record.run.managed.taskId) return latest;
+          local.invalidated = true; local.binding = null; delete local.outbox; local.status = 'unavailable';
+          return latest;
+        });
+      }
+    }
+    return next;
+  };
+  const fresh = async target => (await list(root)).find(record => eligible(record) && record.provider === target.provider && record.session === target.session && record.run.managed.taskId === target.taskId);
+  const valid = async expected => !closed && expected && await current() === expected;
+  const importEnvelope = async (record, envelope, expected, userCorrection = false) => {
+    if (!await valid(expected)) throw new ActionAssociationApiError('account_changed');
+    if (envelope.binding && envelope.binding.taskId !== record.run.managed.taskId) throw new ActionAssociationApiError('invalid_response');
+    const namespace = namespaceFor(webOrigin, envelope.scope);
+    const local = record.run.managed.actionAssociation;
+    // An empty remote binding must not erase a cached ambiguous/no-match result.
+    if (userCorrection || envelope.binding || local?.binding || local?.namespace && local.namespace !== namespace) {
+      await importActionBinding({ root, ...identity(record), namespace, binding: envelope.binding, userCorrection, now: now() });
+    }
+    await updateRecord(root, record.provider, record.session, latest => {
+      const local = latest?.run?.managed?.actionAssociation;
+      if (latest?.run?.managed?.taskId !== record.run.managed.taskId) return latest;
+      latest.run.managed.actionAssociation = { ...local, authRevision: expected };
+      if (!local?.job) delete latest.run.managed.actionAssociation.invalidated;
+      return latest;
+    });
+    return namespace;
+  };
+  async function sync(record, expected, force = false, queue = true) {
+    const target = identity(record), association = record.run.managed.actionAssociation;
+    let view = views.get(target.taskId);
+    const request = actionCandidateRequest(record);
+    const contextRevision = request?.context.revision || null;
+    if (!force && view?.auth === expected && view.contextRevision === contextRevision && now() < view.nextRefresh && (!association?.outbox || view.error)) {
+      if (queue && !view.error && view.snapshot && !association?.manualOverride && !association?.job && !association?.outbox && !TERMINAL.has(record.run.state)) await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now() });
+      return;
+    }
+    view = { ...view, auth: expected, contextRevision, nextRefresh: now() + refreshMs };
+    views.set(target.taskId, view);
+    try {
+      // Never publish an outbox from an earlier organization or login before a
+      // scoped server response confirms who owns the current request.
+      const snapshot = request ? await api.candidates(request, { signal: abort.signal }) : await api.readBinding(target.taskId, { signal: abort.signal });
+      const namespace = await importEnvelope(record, snapshot, expected);
+      view.namespace = namespace; view.error = null;
+      view.candidates = (snapshot.candidates || []).map(publicCandidate);
+      view.candidateTruncated = snapshot.retrieval?.truncated === true || view.candidates.length > 5;
+      view.snapshot = request ? snapshot : null;
+      let latest = await fresh(target);
+      if (!latest || !await valid(expected)) return;
+      const pending = latest.run.managed.actionAssociation?.outbox;
+      if (pending && pending.namespace === namespace && latest.run.managed.actionAssociation.authRevision === expected) {
+        if (snapshot.binding?.origin === 'automatic' && snapshot.binding.action?.id === pending.actionId && snapshot.binding.contextRevision === pending.contextRevision && snapshot.binding.candidateRevision === pending.candidateRevision) {
+          await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: snapshot.binding, now: now() }); return;
+        }
+        if (snapshot.contextRevision !== pending.contextRevision || snapshot.candidateRevision !== pending.candidateRevision) {
+          await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, unavailable: true, now: now() });
+          view.nextRefresh = 0; return;
+        }
+        const payload = Object.fromEntries(['expectedRevision', 'contextRevision', 'candidateRevision', 'actionId', 'actionRevision', 'relation', 'coveredWork', 'reason', 'evidence'].map(key => [key, pending[key]]));
+        const saved = await api.saveBinding(target.taskId, { ...payload, origin: 'automatic' }, { signal: abort.signal });
+        if (!await valid(expected) || namespaceFor(webOrigin, saved.scope) !== namespace) return;
+        await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: saved.binding, now: now() });
+        return;
+      }
+      if (queue && request && !latest.run.managed.actionAssociation?.manualOverride && !TERMINAL.has(latest.run.state)) {
+        // A read turn is queued only at the original session's safe boundary.
+        // Blocked tasks retain candidates for auxiliary correction in the UI.
+        await prepareActionAssociation({ root, record: latest, snapshot, webOrigin, now: now() });
+        await updateRecord(root, latest.provider, latest.session, currentRecord => {
+          if (currentRecord?.run?.managed?.taskId === target.taskId && currentRecord.run.managed.actionAssociation) currentRecord.run.managed.actionAssociation.authRevision = expected;
+          return currentRecord;
+        });
+      }
+    } catch (error) {
+      if (!await valid(expected)) return;
+      view.error = error.code || 'offline';
+      const latest = await fresh(target);
+      if (!latest) return;
+      if (error.code === 'conflict') {
+        try {
+          const remote = await api.readBinding(target.taskId, { signal: abort.signal });
+          const namespace = await importEnvelope(latest, remote, expected);
+          const box = latest.run.managed.actionAssociation?.outbox;
+          if (box && remote.binding) await settleActionAssociation({ root, ...target, outboxId: box.id, namespace, binding: remote.binding, now: now() });
+          else if (box) await settleActionAssociation({ root, ...target, outboxId: box.id, namespace, unavailable: true, now: now() });
+          view.namespace = namespace; view.nextRefresh = 0;
+        } catch { view.error = 'offline'; }
+      } else if (hardFailure(error.code)) {
+        view.candidates = []; view.snapshot = null;
+        await importActionBinding({ root, ...target, namespace: view.namespace || null, unavailable: true, now: now() });
+      } else view.nextRefresh = now() + Math.min(refreshMs, 15_000);
+    }
+  }
+  async function reconcile() {
+    const expected = await current(), records = (await list(root)).filter(eligible).slice(0, 30);
+    let cursor = 0;
+    await Promise.all(Array.from({ length: Math.min(3, records.length) }, async () => {
+    while (!closed && cursor < records.length) {
+      const record = records[cursor++];
+      const managed = record.run.managed, job = managed.actionAssociation?.job;
+      if (job && !managed.resumeLease && (!expected || TERMINAL.has(record.run.state) || ['paused', 'blocked'].includes(record.run.state) || record.run.state === 'recovery_required' && record.run.recoveryCause !== 'session_supervision' ||
+          managedBudgetReason(record.run, now()) || now() >= record.run.deadline || record.run.continuations >= record.run.maxContinuations ||
+          managed.understandingRevision !== job.understandingRevision || record.run.revision !== job.runRevision || managed.actionAssociation.invalidated)) {
+        await cancelActionAssociation({ root, ...identity(record), now: now() });
+      }
+      if (!expected) {
+        if (managed.actionAssociation?.namespace) await importActionBinding({ root, ...identity(record), namespace: null, unavailable: true, now: now() });
+        continue;
+      }
+      try { await sync(await fresh(identity(record)) || record, expected); } catch { /* Optional metadata never stops other task drives. */ }
+    }
+    }));
+  }
+  return {
+    async prepareCached(record) {
+      const view = views.get(record?.run?.managed?.taskId), request = actionCandidateRequest(record);
+      if (closed || !auth || !view || view.auth !== auth || view.error || !view.snapshot || !request || view.contextRevision !== request.context.revision || view.snapshot.contextRevision !== request.context.revision || view.namespace !== namespaceFor(webOrigin, view.snapshot.scope)) return record;
+      try {
+        const prepared = await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now() });
+        return prepared || record;
+      } catch { return record; }
+    },
+    tick() {
+      if (closed) return Promise.resolve();
+      if (!running) running = reconcile().finally(() => { running = null; });
+      return running;
+    },
+    async decorate(status) {
+      const expected = await current();
+      let remainingBytes = 24 * 1024;
+      const perRunBytes = Math.floor(remainingBytes / Math.max(1,(status.runs || []).filter(run => run.managed).length));
+      for (const run of status.runs || []) {
+        if (!run.managed) continue;
+        const local = run.actionAssociation, view = views.get(run.taskId);
+        // Durable caches alone are not authorization to disclose Action text.
+        run.actionAssociation = !expected ? { status: 'signed_out', binding: null, candidates: [], canCorrect: false } :
+          !view || view.auth !== expected ? { status: 'loading', binding: null, candidates: [], canCorrect: false } : {
+            status: view.error || local?.status || 'waiting_boundary',
+            binding: view.namespace && local?.namespace === view.namespace ? publicBinding(local.binding) : null,
+            candidates: (view.candidates || []).slice(0,5), canCorrect: !view.error,
+            retryOn: local?.retryOn || null, truncated: view.candidateTruncated || false,
+          };
+        let bytes = Buffer.byteLength(JSON.stringify(run.actionAssociation));
+        if (bytes > Math.min(remainingBytes,perRunBytes)) { run.actionAssociation.candidates = []; run.actionAssociation.truncated = true; bytes = Buffer.byteLength(JSON.stringify(run.actionAssociation)); }
+        if (bytes > Math.min(remainingBytes,perRunBytes) && run.actionAssociation.binding) {
+          const binding = run.actionAssociation.binding;
+          run.actionAssociation.binding = { taskId: binding.taskId, revision: binding.revision, origin: binding.origin, locked: binding.locked, relation: binding.relation, action: binding.action ? { id: binding.action.id, revision: binding.action.revision, title: binding.action.title.slice(0,40), status: binding.action.status, dueAt: binding.action.dueAt, timeZone: binding.action.timeZone } : null };
+          bytes = Buffer.byteLength(JSON.stringify(run.actionAssociation));
+        }
+        remainingBytes = Math.max(0,remainingBytes - bytes);
+      }
+      return status;
+    },
+    correct(command) {
+      return enqueue(async () => {
+        const expected = await current(), record = await fresh(command);
+        if (!expected) throw new ActionAssociationApiError('signed_out');
+        if (!record) throw new ActionAssociationApiError('invalid_request');
+        await sync(record, expected, true, false);
+        const view = views.get(command.taskId);
+        if (!await valid(expected) || !view?.namespace || view.error) throw new ActionAssociationApiError(view?.error || 'unavailable');
+        if (command.action === 'session_action_refresh') { view.nextRefresh = 0; return; }
+        const latest = await fresh(command), binding = latest?.run.managed.actionAssociation?.binding;
+        if ((binding?.revision ?? null) !== command.expectedBindingRevision) throw new ActionAssociationApiError('conflict');
+        const selected = command.action === 'session_action_select' ? view.snapshot?.candidates.find(item => item.id === command.actionId) || (!view.snapshot && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(command.actionId || '') ? { id: command.actionId, revision: null } : null) : null;
+        if (command.action !== 'session_action_unlink' && !selected) throw new ActionAssociationApiError('invalid_request');
+        const envelope = await api.saveBinding(command.taskId, {
+          expectedRevision: command.expectedBindingRevision, contextRevision: view.contextRevision,
+          candidateRevision: view.snapshot?.candidateRevision || null, origin: 'user', actionId: selected?.id || null,
+          actionRevision: selected?.revision || null, relation: selected ? 'part_of' : null,
+          coveredWork: latest.run.managed.sessionUnderstanding?.objective || latest.run.objective,
+          reason: selected ? 'Selected by the user.' : 'Unlinked by the user.', evidence: [],
+        }, { signal: abort.signal });
+        if (namespaceFor(webOrigin, envelope.scope) !== view.namespace) throw new ActionAssociationApiError('account_changed');
+        await importEnvelope(latest, envelope, expected, true);
+        view.error = null; view.nextRefresh = 0;
+      });
+    },
+    async close() { closed = true; abort.abort(); await Promise.allSettled([serial, running]); views.clear(); },
+  };
+}

package/src/session-supervision/action-association.js

@@ -0,0 +1,114 @@
+import { randomUUID } from 'node:crypto';
+import { listRecords, updateRecord, TERMINAL } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { associationSignals, associationRevision } from '../codex-plugins/simy/hooks/action-association.mjs';
+export { associationSignals, associationRevision, associationContract, validateAssociationResult } from '../codex-plugins/simy/hooks/action-association.mjs';
+
+function stable(run) {
+  return run?.managed && (run.state === 'active' || run.state === 'recovery_required' && run.recoveryCause === 'session_supervision' && run.managed.autoRecovery === true) && !TERMINAL.has(run.state) && run.managed.phase === 'active' && !run.managed.resumeLease && (!run.managed.handoff || run.managed.handoff.status === 'received') && !run.managed.pendingApproval && !run.managed.approvedAction && !run.managed.providerWarning && !run.managed.executionUncertain && (!run.managed.executionAttempt || run.managed.executionAttempt.phase === 'checkpointed');
+}
+function restoreAssociationWork(run, saved) {
+  const managed = run.managed;
+  managed.phase = saved.phase; managed.plan = saved.plan; managed.decision = saved.decision;
+  run.nextStep = saved.nextStep; run.checkpoint = saved.checkpoint;
+  if (run.state === saved.state) run.reason = saved.reason;
+  if (run.state === 'recovery_required' && run.recoveryCause === 'provider_error' && !managed.providerWarning && !managed.attempts?.at(-1)?.restorationUnverified && run.failures < run.maxFailures) {
+    run.state = saved.state; run.reason = saved.reason; run.recoveryCause = saved.recoveryCause; run.blocker = saved.blocker; managed.autoRecovery = saved.autoRecovery;
+  }
+  managed.awaitingAssociationHook = false;
+}
+export async function queueActionAssociation({ root, provider, session, taskId, expectedRevision, candidates, candidateRevision, scope, namespace = null, remoteBinding = null, now = Date.now() }) {
+  return updateRecord(root, provider, session, record => {
+    const run = record?.run, managed = run?.managed;
+    if (!managed || managed.taskId !== taskId || run.revision !== expectedRevision) return record;
+    if (!stable(run) || now >= run.deadline || run.continuations >= run.maxContinuations) {
+      if (!managed.actionAssociation?.job && !managed.actionAssociation?.outbox && !managed.actionAssociation?.manualOverride) managed.actionAssociation = { ...managed.actionAssociation, status: 'waiting_boundary', retryOn: 'original_session_safe_boundary', updatedAt: now };
+      return record;
+    }
+    if (managed.actionAssociation?.manualOverride && !managed.actionAssociation.namespace) return record;
+    if (managed.actionAssociation?.namespace !== namespace) managed.actionAssociation = { status: 'unavailable', namespace };
+    if (managed.actionAssociation.manualOverride || managed.actionAssociation.binding?.locked) return record;
+    if (remoteBinding && managed.actionAssociation.binding?.revision > remoteBinding.revision) return record;
+    if (remoteBinding?.taskId === taskId) { managed.actionAssociation.binding = remoteBinding; managed.actionAssociation.manualOverride = remoteBinding.locked === true; managed.actionAssociation.status = remoteBinding.action ? 'bound' : 'unlinked'; if (remoteBinding.action && remoteBinding.contextRevision === associationSignals(managed.sessionUnderstanding)?.revision) return record; }
+    if (managed.actionAssociation?.manualOverride || managed.actionAssociation?.job || managed.actionAssociation?.outbox) return record;
+    const signals = associationSignals(managed.sessionUnderstanding);
+    if (!signals || !Array.isArray(candidates) || candidates.length > 10 || !candidateRevision || !scope) return record;
+    const key = associationRevision({ context: signals, candidateRevision, scope, namespace });
+    if (managed.actionAssociation?.cacheKey === key) return record;
+    const job = { id: randomUUID(), taskId, provider, session, runRevision: run.revision, understandingRevision: managed.understandingRevision, context: signals, candidates, candidateRevision, scope, namespace, cacheKey: key,
+      saved: { phase: managed.phase, plan: managed.plan, decision: managed.decision, nextStep: run.nextStep, state: run.state, reason: run.reason, checkpoint: run.checkpoint, recoveryCause: run.recoveryCause, blocker: run.blocker, autoRecovery: managed.autoRecovery }, createdAt: now };
+    managed.actionAssociation = { ...managed.actionAssociation, status: candidates.length ? 'assessing' : 'no_match', namespace, cacheKey: key, ...(candidates.length ? { job } : {}) };
+    if (!candidates.length) return record;
+    managed.phase = 'action_association';
+    managed.decision = { id: job.id, outcome: 'proceed', action: { kind: 'read', scope: 'task', summary: 'Compare scoped Action candidates with the original user request' } };
+    run.nextStep = managed.decision.action.summary;
+    if (managed.capability === 'live_hook') managed.awaitingAssociationHook = true;
+    return record;
+  });
+}
+export async function importActionBinding({ root, provider, session, taskId, namespace, binding = null, unavailable = false, userCorrection = false, now = Date.now() }) {
+  return updateRecord(root, provider, session, record => {
+    const run = record?.run, managed = run?.managed;
+    if (managed?.taskId !== taskId || managed.handoff && managed.handoff.status !== 'received') return record;
+    const previous = managed.actionAssociation || {};
+    if (previous.namespace && previous.namespace !== namespace && previous.job && managed.resumeLease) { previous.namespace = namespace; previous.binding = null; previous.status = 'unavailable'; previous.invalidated = true; delete previous.outbox; return record; }
+    if (userCorrection && previous.job && !managed.resumeLease) {
+      const saved = previous.job.saved;
+      restoreAssociationWork(run, saved);
+      delete previous.job;
+    }
+    if (binding && binding.taskId !== taskId) throw new Error('Remote binding task differs.');
+    const association = previous.namespace && previous.namespace !== namespace ? {} : previous;
+    association.namespace = namespace;
+    if (binding && association.binding?.revision > binding.revision) return record;
+    if (binding) {
+      association.binding = binding; association.manualOverride = binding.locked === true;
+      association.status = binding.action ? 'bound' : 'unlinked';
+      if (userCorrection || binding.locked) delete association.outbox;
+    } else if (unavailable) { association.binding = null; association.status = 'unavailable'; delete association.outbox; }
+    else { association.binding = null; association.manualOverride = false; if (!association.job && !association.outbox) association.status = 'waiting_boundary'; }
+    association.updatedAt = now; managed.actionAssociation = association;
+    return record;
+  });
+}
+export const correctActionAssociation = options => importActionBinding({ ...options, userCorrection: true });
+export async function pendingAssociationTasks(root) {
+  return (await listRecords(root)).filter(record => stable(record.run) && !record.run.managed.actionAssociation?.manualOverride && !record.run.managed.actionAssociation?.job && !record.run.managed.actionAssociation?.outbox && associationSignals(record.run.managed.sessionUnderstanding));
+}
+
+export function actionCandidateRequest(record) {
+  const context = associationSignals(record?.run?.managed?.sessionUnderstanding);
+  return context ? { taskId: record.run.managed.taskId, context, limit: 10 } : null;
+}
+export async function prepareActionAssociation({ root, record, snapshot, webOrigin, now = Date.now() }) {
+  const request = actionCandidateRequest(record);
+  if (!request || snapshot?.schemaVersion !== 1 || snapshot.taskId !== request.taskId || snapshot.contextRevision !== request.context.revision || !snapshot.scope?.organizationId || !snapshot.scope?.userId) return null;
+  if (!Array.isArray(snapshot.candidates) || snapshot.candidates.length > 10 || new Set(snapshot.candidates.map(item => item.id)).size !== snapshot.candidates.length) return null;
+  for (const item of snapshot.candidates) {
+    if (typeof item.id !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(item.id) || typeof item.revision !== 'string' || item.revision.length > 200 || typeof item.title !== 'string' || item.title.length > 500 || typeof item.description === 'string' && item.description.length > 2000 || !Array.isArray(item.evidence) || item.evidence.length > 10 || new Set(item.evidence.map(fact => fact.ref)).size !== item.evidence.length || item.evidence.some(fact => typeof fact.ref !== 'string' || fact.ref.length > 200 || !['goal','deliverable','project','source'].includes(fact.kind) || typeof fact.text !== 'string' || fact.text.length > 2000)) return null;
+  }
+  const namespace = JSON.stringify([new URL(webOrigin).origin,snapshot.scope.organizationId,snapshot.scope.userId]);
+  return queueActionAssociation({ root, provider: record.provider, session: record.session, taskId: request.taskId, expectedRevision: record.run.revision,
+    candidates: snapshot.candidates, candidateRevision: snapshot.candidateRevision, scope: snapshot.scope, namespace, remoteBinding: snapshot.binding, now });
+}
+export async function settleActionAssociation({ root, provider, session, taskId, outboxId, namespace, binding = null, unavailable = false, now = Date.now() }) {
+  return updateRecord(root, provider, session, record => {
+    const association = record?.run?.managed?.actionAssociation;
+    if (record?.run?.managed?.taskId !== taskId || association?.outbox?.id !== outboxId || association.outbox.namespace !== namespace || record.run.managed.handoff && record.run.managed.handoff.status !== 'received') return record;
+    if (binding && binding.taskId === taskId) {
+      association.binding = binding; association.manualOverride = binding.locked === true;
+      association.status = binding.action ? 'bound' : 'unlinked'; delete association.outbox;
+    } else if (unavailable) { association.status = 'unavailable'; association.binding = null; delete association.outbox; }
+    association.updatedAt = now;
+    return record;
+  });
+}
+export async function cancelActionAssociation({ root, provider, session, taskId, now = Date.now() }) {
+  return updateRecord(root, provider, session, record => {
+    const run = record?.run, managed = run?.managed, association = managed?.actionAssociation;
+    if (managed?.taskId !== taskId || managed.resumeLease || !association?.job) return record;
+    const saved = association.job.saved;
+    restoreAssociationWork(run, saved);
+    managed.awaitingAssociationHook = false; association.status = 'unavailable'; delete association.job; association.updatedAt = now;
+    return record;
+  });
+}

package/src/session-supervision/analysis-manager.js

@@ -9,7 +9,7 @@ const RESULT_STATES = new Set(['continue', 'no_action', 'needs_user', 'waiting',
 const keyOf = candidate => `${candidate.provider}:${candidate.session}`;
 const activityOf = candidate => Number.isFinite(candidate.lastActivityAt) ? candidate.lastActivityAt : 0;
 export const continuationAnalysisRevision = candidate => createHash('sha256')
-  .update(JSON.stringify([candidate.provider, candidate.session, candidate.cwd, activityOf(candidate)]))
+  .update(JSON.stringify([candidate.provider, candidate.session, candidate.cwd, activityOf(candidate), ...(candidate.isRunning === true ? ['running'] : [])]))
   .digest('hex');
 const eligible = candidate => candidate.capabilities?.canAnalyze === true &&
   ['unmanaged', 'monitor'].includes(candidate.binding?.mode || 'unmanaged');
@@ -60,15 +60,19 @@ export async function createContinuationAnalysisManager({ root, analyze = analyz
     } finally { await rm(temporary, { force: true }); }
   };
   const changed = () => { void Promise.resolve().then(onChange).catch(() => {}); };
-  const enqueue = (candidate, force = false) => {
+  const enqueue = (candidate, force = false, forceAnalysis = false) => {
     const key = keyOf(candidate), revision = continuationAnalysisRevision(candidate);
     const entry = entries.get(key);
     if (entry?.revision === revision && (['queued', 'analyzing'].includes(entry.result?.state) ||
       !force && !['failed', 'uncertain'].includes(entry.result?.state))) return false;
     entries.delete(key);
-    entries.set(key, { revision, result: { state: 'queued' } });
+    entries.set(key, { revision, cwd: candidate.cwd, forceAnalysis, settledResult: entry?.cwd === candidate.cwd ? entry.settledResult : null,
+      result: { state: 'queued' } });
     return true;
   };
+  const finishedAnalysis = (result, previous) => result.contextDigest && result.settledTurnId
+    ? { ...result, awaitingTurn: false, analyzedAt: result.contextDigest === previous?.contextDigest ? previous.analyzedAt : now() }
+    : previous;
   const startDrain = () => {
     if (closed || draining) return;
     draining = (async () => {
@@ -80,7 +84,7 @@ export async function createContinuationAnalysisManager({ root, analyze = analyz
             if (entry.result?.state !== 'queued' || !candidate || !eligible(candidate) || entry.revision !== continuationAnalysisRevision(candidate)) continue;
             entry.result = { state: 'analyzing' };
             await persist(); changed();
-            return { key, revision: entry.revision, candidate };
+            return { key, revision: entry.revision, candidate, previousAnalysis: entry.forceAnalysis ? null : entry.settledResult };
           }
           return null;
         });
@@ -96,7 +100,7 @@ export async function createContinuationAnalysisManager({ root, analyze = analyz
         });
         let result, inference;
         try {
-          inference = Promise.resolve(analyze(selected.candidate, { signal }));
+          inference = Promise.resolve(analyze(selected.candidate, { signal, previousAnalysis: selected.previousAnalysis }));
           result = await Promise.race([inference, cancellation]);
           if (!RESULT_STATES.has(result?.state) || typeof result.reason !== 'string' ||
             (result.state === 'continue' && (!result.objective || !result.remaining?.length || !result.nextAction || !result.basis?.some(item => item.role === 'user')))) {
@@ -114,12 +118,22 @@ export async function createContinuationAnalysisManager({ root, analyze = analyz
           const current = candidates.get(selected.key), entry = entries.get(selected.key);
           if (closed) return;
           if (!current || !eligible(current) || continuationAnalysisRevision(current) !== selected.revision || entry?.revision !== selected.revision) {
+            // Live timestamps may advance during inference while the completed
+            // boundary stays identical. Retain that snapshot for display/reuse;
+            // never publish it as a current actionable recommendation.
+            if (current && eligible(current) && current.cwd === selected.candidate.cwd && entry?.cwd === current.cwd &&
+                result.contextDigest && result.settledTurnId && ['queued', 'analyzing'].includes(entry.result?.state)) {
+              entry.settledResult = finishedAnalysis(result, selected.previousAnalysis);
+              await persist(); changed();
+            }
             if (entry?.revision === selected.revision && entry.result?.state === 'analyzing') {
               entry.result = { state: 'queued' }; await persist(); changed();
             }
             return;
           }
-          entries.set(selected.key, { revision: selected.revision, result: { ...result, analyzedAt: now() } });
+          const settledResult = finishedAnalysis(result, selected.previousAnalysis || entry.settledResult);
+          entries.set(selected.key, { revision: selected.revision, cwd: current.cwd, settledResult,
+            result: { ...result, analyzedAt: settledResult?.analyzedAt || now() } });
           await persist(); changed();
         });
       }
@@ -141,10 +155,21 @@ export async function createContinuationAnalysisManager({ root, analyze = analyz
         for (const candidate of sorted) {
           const key = keyOf(candidate), revision = continuationAnalysisRevision(candidate), previous = known.get(key);
           const active = activityOf(candidate);
-          const newActivity = document.initialized && (previous ? active > previous.activity : active > document.baselineAt);
-          if (eligible(candidate) && (backfill.has(key) || newActivity)) dirty = enqueue(candidate) || dirty;
+          const newActivity = document.initialized && (previous ? active > previous.activity || (candidate.isRunning === true) !== (previous.isRunning === true) : active > document.baselineAt);
+          const entry = entries.get(key);
+          // Migrate prior idle cache entries without treating historical sessions
+          // as fresh activity. Its old revision already proves this exact cwd.
+          if (entry && !entry.cwd && entry.revision === continuationAnalysisRevision({ ...candidate, isRunning: false })) {
+            entry.cwd = candidate.cwd;
+            entry.settledResult = entry.result?.contextDigest ? entry.result : null;
+            dirty = true;
+          }
+          // A reader that raced a terminal boundary (or a provider without live
+          // status) is retried at discovery cadence, never a busy inference loop.
+          const recheck = entry?.result?.reasonCode === 'turn_settling' || entry?.result?.awaitingTurn === true && candidate.isRunning !== true;
+          if (eligible(candidate) && (backfill.has(key) || newActivity || recheck)) dirty = enqueue(candidate, recheck) || dirty;
           if (previous?.revision !== revision) {
-            known.delete(key); known.set(key, { revision, activity: active }); dirty = true;
+            known.delete(key); known.set(key, { revision, activity: active, isRunning: candidate.isRunning }); dirty = true;
           }
         }
         // Empty discovery during provider startup must not consume backfill.
@@ -155,14 +180,23 @@ export async function createContinuationAnalysisManager({ root, analyze = analyz
     },
     project(candidate) {
       const revision = continuationAnalysisRevision(candidate), entry = entries.get(keyOf(candidate));
-      return { ...candidate, analysis: entry?.revision === revision ? { ...entry.result, revision } : { state: 'unanalysed', revision } };
+      let analysis = entry?.revision === revision ? { ...entry.result, revision } : { state: 'unanalysed', revision };
+      const previous = entry?.cwd === candidate.cwd ? entry.settledResult : null;
+      if (candidate.isRunning === true || analysis.awaitingTurn === true) {
+        analysis = { state: 'waiting', awaitingTurn: true, revision,
+          reason: 'This turn is still running. SIMY analyzes only finished turns and will update automatically when it ends.',
+          ...(previous ? { previousAnalysis: previous } : {}) };
+      } else if (previous && ['queued', 'analyzing'].includes(analysis.state)) {
+        analysis.previousAnalysis = previous;
+      }
+      return { ...candidate, analysis };
     },
     async request(candidate) {
       if (!candidate || !eligible(candidate)) throw new Error('This conversation cannot be analyzed.');
       await exclusive(async () => {
         if (closed) throw new Error('Session analysis is unavailable.');
         candidates.set(keyOf(candidate), candidate);
-        if (enqueue(candidate, true)) { await persist(); changed(); }
+        if (enqueue(candidate, true, true)) { await persist(); changed(); }
       });
       startDrain();
     },
@@ -178,7 +212,7 @@ export async function createContinuationAnalysisManager({ root, analyze = analyz
     requireRecommendation(candidate) {
       if (closed) throw new Error('Session analysis is unavailable.');
       const analysis = this.project(candidate).analysis;
-      if (!eligible(candidate) || analysis.state !== 'continue') throw new Error('Analyze this conversation before continuing; it needs a current recommendation.');
+      if (!eligible(candidate) || candidate.isRunning === true || analysis.awaitingTurn === true || analysis.state !== 'continue') throw new Error('Analyze this conversation before continuing; it needs a current recommendation.');
       return analysis;
     },
     async whenIdle() { do { await serial; await draining; } while (draining); await serial; },

package/src/session-supervision/codex-app-server.js

@@ -1,3 +1,4 @@
+import { associationContract } from '../codex-plugins/simy/hooks/action-association.mjs';
 import { spawn } from 'node:child_process';
 import { realpath } from 'node:fs/promises';
 import { inspectBackendExecutable } from '../backend-executable.js';
@@ -6,6 +7,9 @@ import { boundConversation, textContent } from './conversation-context.js';
 
 const REQUEST_TIMEOUT = 15_000;
 const MAX_LINE = 256 * 1024;
+const ANALYSIS_MAX_LINE = 1024 * 1024;
+const ANALYSIS_MAX_TURNS = 16;
+const ANALYSIS_PAGE_SIZE = 6;
 const SOURCE_KINDS = ['cli', 'vscode', 'exec', 'appServer', 'unknown'];
 
 export class CodexAppServerError extends Error {
@@ -34,7 +38,10 @@ export class CodexAppServerClient {
         const end = newline < 0 ? chunk.length : newline;
         const piece = chunk.subarray(offset, end);
         if (!discard) {
-          if (pending.length + piece.length > this.maxLineBytes) { pending = Buffer.alloc(0); discard = true; }
+          if (pending.length + piece.length > this.maxLineBytes) {
+            pending = Buffer.alloc(0); discard = true;
+            this.rejectPending(new CodexAppServerError('response_too_large', 'Codex response exceeded the bounded context limit.'));
+          }
           else if (piece.length) pending = pending.length ? Buffer.concat([pending, piece]) : Buffer.from(piece);
         }
         if (newline >= 0) {
@@ -50,7 +57,10 @@ export class CodexAppServerClient {
   }
 
   consume(line) {
-    if (Buffer.byteLength(line) > this.maxLineBytes) return;
+    if (Buffer.byteLength(line) > this.maxLineBytes) {
+      this.rejectPending(new CodexAppServerError('response_too_large', 'Codex response exceeded the bounded context limit.'));
+      return;
+    }
     let message;
     try { message = JSON.parse(line); } catch { return; }
     if (typeof message.method === 'string') {
@@ -68,6 +78,10 @@ export class CodexAppServerClient {
   fail(error) {
     if (this.closed) return;
     this.closed = true;
+    this.rejectPending(error);
+  }
+
+  rejectPending(error) {
     for (const pending of this.pending.values()) { clearTimeout(pending.timer); pending.reject(error); }
     this.pending.clear();
   }
@@ -138,6 +152,7 @@ export function codexThreadMetadata(thread) {
     lastActivityAt: Number.isFinite(thread.updatedAt) ? thread.updatedAt * 1000 : null,
     model: typeof thread.model === 'string' ? thread.model : null,
     observation: { source: 'codex_app_server', observedAt: Date.now() },
+    ...(thread.status?.type === 'active' || thread.status?.type === 'idle' ? { isRunning: thread.status.type === 'active' } : {}),
     availability: 'unknown',
   };
 }
@@ -166,26 +181,75 @@ export async function readCodexSession(client, session) {
 
 export async function readCodexConversation(candidate, { openClient = openCodexAppServer, signal } = {}) {
   if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation analysis was cancelled.');
-  const client = await openClient({ signal, maxLineBytes: 8 * 1024 * 1024 });
+  const client = await openClient({ signal, maxLineBytes: ANALYSIS_MAX_LINE });
   const cancelled = () => { void client.close(); };
   signal?.addEventListener('abort', cancelled, { once: true });
   try {
-    const response = await client.request('thread/read', { threadId: candidate.session, includeTurns: true });
-    const metadata = codexThreadMetadata(response?.thread);
-    if (!metadata || metadata.session !== candidate.session || metadata.cwd !== candidate.cwd) {
-      throw new CodexAppServerError('identity', 'Exact conversation identity is unavailable.');
+    // Full thread history can contain tens of MiB of tool output. Analysis
+    // reads only metadata and a fixed number of recent display summaries.
+    const metadata = await readCodexSession(client, candidate.session);
+    if (metadata.cwd !== candidate.cwd) throw new CodexAppServerError('identity', 'Exact conversation identity is unavailable.');
+    if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation analysis was cancelled.');
+    const terminal = turn => ['completed', 'interrupted', 'failed'].includes(turn?.status);
+    const turns = [];
+    const turnIds = new Set(), cursors = new Set();
+    let cursor = null;
+    do {
+      if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation analysis was cancelled.');
+      const limit = Math.min(ANALYSIS_PAGE_SIZE, ANALYSIS_MAX_TURNS - turns.filter(terminal).length);
+      let page;
+      try {
+        page = await client.request('thread/turns/list', { threadId: candidate.session, cursor, limit, sortDirection: 'desc', itemsView: 'summary' });
+      } catch (error) {
+        if (String(error?.code) === '-32601' || /unknown method|method.*not found|unrecognized method/i.test(String(error?.message || ''))) {
+          throw new CodexAppServerError('unsupported', 'This Codex version does not support bounded conversation history.');
+        }
+        throw error;
+      }
+      if (!Array.isArray(page?.data) || page.data.length > limit || page.nextCursor != null && (typeof page.nextCursor !== 'string' || !page.nextCursor || page.nextCursor.length > 2048)) {
+        throw new CodexAppServerError('context_unavailable', 'Codex returned an invalid bounded conversation page.');
+      }
+      for (const turn of page.data) {
+        if (typeof turn?.id !== 'string' || !turn.id || turnIds.has(turn.id)) throw new CodexAppServerError('context_unavailable', 'Codex returned ambiguous conversation pagination.');
+        turnIds.add(turn.id); turns.push(turn);
+      }
+      cursor = page.nextCursor || null;
+      if (cursor && (!page.data.length || cursors.has(cursor))) throw new CodexAppServerError('context_unavailable', 'Codex returned ambiguous conversation pagination.');
+      if (cursor) cursors.add(cursor);
+    } while (cursor && turns.filter(terminal).length < ANALYSIS_MAX_TURNS && turns.length < ANALYSIS_MAX_TURNS + ANALYSIS_PAGE_SIZE);
+    // A timestamp covers the whole live thread. Instead pin the last terminal
+    // turn and check it again: streaming output in the newer turn is irrelevant
+    // to this read-only snapshot, but a newly settled turn must invalidate it.
+    const settled = turns.filter(terminal).slice(0, ANALYSIS_MAX_TURNS);
+    const boundary = settled[0];
+    const verification = await client.request('thread/turns/list', {
+      threadId: candidate.session, cursor: null, limit: ANALYSIS_PAGE_SIZE, sortDirection: 'desc', itemsView: 'summary',
+    });
+    if (!Array.isArray(verification?.data) || verification.data.length > ANALYSIS_PAGE_SIZE) {
+      throw new CodexAppServerError('context_unavailable', 'Codex returned an invalid snapshot check.');
+    }
+    const latestBoundary = verification.data.find(terminal);
+    // Compare the immutable settled summary, never the running turn's prose.
+    if (JSON.stringify(boundary) !== JSON.stringify(latestBoundary)) {
+      throw new CodexAppServerError('turn_settling', 'The latest turn settled during the snapshot read.');
     }
-    if (Number.isFinite(candidate.lastActivityAt) && metadata.lastActivityAt !== candidate.lastActivityAt) {
-      throw new CodexAppServerError('revision_changed', 'Conversation changed since discovery.');
+    const latestMetadata = await readCodexSession(client, candidate.session);
+    if (latestMetadata.cwd !== candidate.cwd) throw new CodexAppServerError('identity', 'Exact conversation identity is unavailable.');
+    if (latestMetadata.model !== metadata.model) {
+      throw new CodexAppServerError('revision_changed', 'Conversation changed while reading recent history.');
     }
     if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation analysis was cancelled.');
-    const turns = response.thread.turns;
-    if (!Array.isArray(turns)) return boundConversation(null);
     const messages = [];
-    let incomplete = false;
-    for (const [index, turn] of turns.entries()) {
-      if (['inProgress', 'in_progress'].includes(turn?.status)) incomplete = true;
+    // A display summary omits intermediate reasoning/tool context even when
+    // every turn fits. Never represent it as the complete conversation; the
+    // classifier must establish a self-contained objective from retained text.
+    const awaitingTurn = latestMetadata.isRunning === true || [...turns, ...verification.data].some(turn => ['inProgress', 'in_progress'].includes(turn?.status));
+    let incomplete = !settled.length || turns.some(turn => !terminal(turn) && !['inProgress', 'in_progress'].includes(turn?.status)), truncated = true;
+    for (const [index, turn] of settled.toReversed().entries()) {
+      if (turn.itemsView === 'notLoaded') { truncated = true; if (turn === boundary) incomplete = true; continue; }
+      if (turn.itemsView !== 'summary') throw new CodexAppServerError('context_unavailable', 'Codex did not return the requested conversation summaries.');
       if (!Array.isArray(turn?.items)) { incomplete = true; continue; }
+      if (turn === boundary && !turn.items.length) incomplete = true;
       for (const [itemIndex, item] of turn.items.entries()) {
         const role = item?.type === 'userMessage' ? 'user' : item?.type === 'agentMessage' ? 'assistant' : null;
         if (!role) continue;
@@ -194,7 +258,7 @@ export async function readCodexConversation(candidate, { openClient = openCodexA
         messages.push({ role, turnRef: `${turn.id || index}:${item.id || itemIndex}`, text });
       }
     }
-    return boundConversation(messages, { incomplete });
+    return { ...boundConversation(messages, { incomplete, truncated }), awaitingTurn, settledTurnId: boundary?.id || null };
   } finally {
     signal?.removeEventListener('abort', cancelled);
     await client.close();
@@ -235,7 +299,7 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
       ...(authorizedWait ? { approvedAction: { approvalId: approved.id, action: approved.action, oneShot: true } } : {}),
       budgets: { deadline: run.deadline, continuations: run.continuations, maxContinuations: run.maxContinuations, failures: run.failures, maxFailures: run.maxFailures } };
     const approvalInstruction = authorizedWait ? `SIMY recorded a matching, one-shot scoped user approval ${approved.id} for this exact selected action. The decision outcome "wait" describes its pre-approval assessment; the approved action is authorized now. Execute it once, then report what actually happened. ` : '';
-    const prompt = run.managed.phase === 'understanding' ? `Understand the ORIGINAL user request in this exact Codex conversation. This first/clarifying turn is read-only and must not perform task work. Context: ${JSON.stringify({ ...context, priorUnderstanding: run.managed.sessionUnderstanding, userAnswer: run.managed.understandingAnswer })}\n${understandingCheckpointContract(decision)} Do not write SIMY state directly.` : `Continue this existing SIMY managed task in the exact Codex conversation. Context: ${JSON.stringify(context)}\n${approvalInstruction}Execute ONLY the selected decision action. Do not perform any action from the NEXT plan in this turn. For a next local action within the enrolled task use the exact scope "task"; do not relabel external, broad, or destructive work as local. Preserve provider permissions. End with one JSON checkpoint. ${assessedCheckpointContract(decision)} Do not write SIMY state directly.`;
+    const prompt = run.managed.phase === 'action_association' ? associationContract(run.managed.actionAssociation.job) : run.managed.phase === 'understanding' ? `Understand the ORIGINAL user request in this exact Codex conversation. This first/clarifying turn is read-only and must not perform task work. Context: ${JSON.stringify({ ...context, priorUnderstanding: run.managed.sessionUnderstanding, userAnswer: run.managed.understandingAnswer })}\n${understandingCheckpointContract(decision)} Do not write SIMY state directly.` : `Continue this existing SIMY managed task in the exact Codex conversation. Context: ${JSON.stringify(context)}\n${approvalInstruction}Execute ONLY the selected decision action. Do not perform any action from the NEXT plan in this turn. For a next local action within the enrolled task use the exact scope "task"; do not relabel external, broad, or destructive work as local. Preserve provider permissions. End with one JSON checkpoint. ${assessedCheckpointContract(decision)} Do not write SIMY state directly.`;
     const initialSandbox = run.managed.providerSandbox || resumed.sandbox;
     const currentSandbox = resumed.sandbox;
     originalSandbox = currentSandbox;