@awak-app/simy-cli 0.5.47 → 0.5.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.5.47",
+  "version": "0.5.48",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.5.47";
+export const CLI_VERSION = "0.5.48";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/session-supervision/codex-app-server.js

@@ -315,13 +315,16 @@ export async function readCodexConversation(candidate, { openClient = openCodexA
     for (const [index, turn] of settled.toReversed().entries()) {
       if (turn.itemsView === 'notLoaded') { truncated = true; if (turn === boundary) incomplete = true; continue; }
       if (turn.itemsView !== 'summary') throw new CodexAppServerError('context_unavailable', 'Codex did not return the requested conversation summaries.');
-      if (!Array.isArray(turn?.items)) { incomplete = true; continue; }
+      if (!Array.isArray(turn?.items)) { if (turn === boundary) incomplete = true; continue; }
       if (turn === boundary && !turn.items.length) incomplete = true;
       for (const [itemIndex, item] of turn.items.entries()) {
         const role = item?.type === 'userMessage' ? 'user' : item?.type === 'agentMessage' ? 'assistant' : null;
         if (!role) continue;
         const text = role === 'user' ? textContent(item.content) : item.text;
-        if (typeof text !== 'string' || !text.trim()) { incomplete = true; continue; }
+        // An older interrupted/empty answer is an omission in the display
+        // history, not a missing latest exchange. Retain human corrections;
+        // the classifier must still establish a self-contained current goal.
+        if (typeof text !== 'string' || !text.trim()) { if (turn === boundary) incomplete = true; continue; }
         messages.push({ role, turnRef: `${turn.id || index}:${item.id || itemIndex}`, text });
       }
     }

package/src/session-supervision/continuation-analysis.js

@@ -2,9 +2,10 @@ import { readCodexConversation } from './codex-app-server.js';
 import { readClaudeConversation } from './claude-sessions.js';
 import { boundConversation, boundProviderGoal, sanitizedText } from './conversation-context.js';
 import { runStructuredProviderReview } from '../sqm/review-worker.js';
+import { inspectProviderStatus } from '../desktop-status.js';
 import { createHash } from 'node:crypto';
 
-export const CONTINUATION_ANALYSIS_VERSION = 2;
+export const CONTINUATION_ANALYSIS_VERSION = 3;
 const BLOCKER_TYPES = ['approval', 'missing_information', 'external_dependency', 'execution_failure'];
 const STATES = ['continue', 'no_action', 'needs_user', 'waiting', 'uncertain'];
 const string = maximum => ({ type: 'string', maxLength: maximum });
@@ -50,8 +51,22 @@ Older history may be omitted. Set assessment.contextSufficient=true only if the
 Return blocker=null unless concrete unfinished original work is currently prevented by a specific unresolved approval, missing_information, external_dependency or execution_failure. State and needsUser/externalWait flags alone are not blockers. Running/status-only waiting, future reminders, voluntary pauses, budget limits, uncertainty, optional follow-ups and resolved historical failures must have blocker=null. A recoverable failure with a feasible next step is not a blocker. A blocker never changes continuation authority. Its reason must describe the actual obstacle concisely; basis must quote exact original conversation excerpts that establish the obstacle, checking all later supplied messages to establish that it is still current. Evidence may originate in an earlier turn when no later message resolves the obstacle. Goal metadata alone cannot establish a blocker. Later authorization, supplied information, resolution or completion clears older blockers. For execution_failure, require explicit evidence that the failure prevents further useful progress, not simply that a command failed.
 Return concise reasons and exact short supporting excerpts, each tied to the role and turnRef provided. Excerpts must occur verbatim in the supplied message. Do not reproduce secrets, credentials or large private passages. Set nextAction=null except for continue. Populate assessment honestly; nextActionKind names the concrete action, not merely a plan to act.`;
 
-function uncertain(reason) {
-  return { state: 'uncertain', reason, objective: '', remaining: [], nextAction: null, basis: [], blocker: null, analysisVersion: CONTINUATION_ANALYSIS_VERSION };
+function uncertain(reason, reasonCode) {
+  return { state: 'uncertain', reason, ...(reasonCode ? { reasonCode } : {}), objective: '', remaining: [], nextAction: null, basis: [], blocker: null, analysisVersion: CONTINUATION_ANALYSIS_VERSION };
+}
+
+async function unavailableAnalysis(candidate, error, inspectProvider, signal) {
+  if (error?.code === 'analysis_cancelled') return uncertain('Conversation analysis was cancelled.', 'cancelled');
+  if (error?.code === 'analysis_timeout') return uncertain('The local AI app did not finish checking this turn in time. Retry when it is available.', 'timeout');
+  if (error?.code === `${candidate.provider}_local_unavailable`) return uncertain('The local AI app is unavailable. Open or update it, then retry.', 'unavailable');
+  let status;
+  try { status = await inspectProvider(candidate.provider); } catch { /* Unknown is never proof of sign-out. */ }
+  if (signal?.aborted) return uncertain('Conversation analysis was cancelled.', 'cancelled');
+  if (error?.code === 'provider_sign_in_required' || status?.state === 'signed_out') {
+    const label = candidate.provider === 'claude' ? 'Claude Code' : 'Codex';
+    return uncertain(`Sign in to ${label} to check this conversation and continue its unfinished work. After signing in, retry this check.`, 'provider_sign_in_required');
+  }
+  return uncertain('The local AI app could not check this turn. Check its connection, then retry.', 'analysis_unavailable');
 }
 
 function unreadableContext(error) {
@@ -143,7 +158,7 @@ export async function readContinuationContext(candidate, { signal, readContext,
 
 export async function analyzeContinuation(candidate, {
   signal, readContext, openCodexClient, claudeHome, previousAnalysis,
-  runProvider = runStructuredProviderReview, providerOptions = {},
+  runProvider = runStructuredProviderReview, providerOptions = {}, inspectProvider = inspectProviderStatus,
 } = {}) {
   if (signal?.aborted) return uncertain('Conversation analysis was cancelled.');
   if (!['codex', 'claude'].includes(candidate?.provider) || typeof candidate?.session !== 'string' || typeof candidate?.cwd !== 'string') {
@@ -172,18 +187,26 @@ export async function analyzeContinuation(candidate, {
   if (previousAnalysis?.analysisVersion === CONTINUATION_ANALYSIS_VERSION && previousAnalysis?.contextDigest === context.contextDigest && STATES.includes(previousAnalysis.state)) {
     return { ...snapshot, ...previousAnalysis };
   }
-  if (context.incomplete || !context.messages.length) return uncertain('The latest conversation request or response is missing or incomplete.');
+  if (context.incomplete || !context.messages.length) return uncertain('The latest request or reply could not be read completely. Open the original conversation to review it, then retry.', 'context_incomplete');
+  let result;
   try {
-    const result = await runProvider(candidate.provider, {
+    result = await runProvider(candidate.provider, {
       system: SYSTEM, prompt: `Classify this conversation evidence only (older history omitted: ${context.truncated}):\n${JSON.stringify(context.providerGoal ? { originalProviderGoal: context.providerGoal, messages: context.messages } : context.messages)}`, output_schema: OUTPUT_SCHEMA,
     }, { ...providerOptions, signal, readOnlyAnalysis: true });
-    if (signal?.aborted) return uncertain('Conversation analysis was cancelled.');
+  } catch (error) {
+    if (signal?.aborted) return uncertain('Conversation analysis was cancelled.', 'cancelled');
+    // Only a known machine code or the provider's own login probe can
+    // establish sign-out. SIMY account login is unrelated to local analysis.
+    return unavailableAnalysis(candidate, error, inspectProvider, signal);
+  }
+  if (signal?.aborted) return uncertain('Conversation analysis was cancelled.');
+  try {
     const analysis = validateContinuationAnalysis(result?.output, context);
     const model = typeof result?.model === 'string' && /^[a-zA-Z0-9._/-]{1,120}$/.test(result.model) ? result.model : null;
     return { ...snapshot, ...analysis, ...(model ? { model } : {}) };
   } catch {
     // Provider stderr/errors may contain transcript text or credentials. Never
     // expose them to the desktop, cache, diagnostics or control plane.
-    return uncertain('Local conversation analysis is unavailable or returned an invalid result.');
+    return uncertain('The AI app returned a check that could not be verified. Retry this check or review the original conversation.', 'analysis_invalid_result');
   }
 }

package/src/sqm/review-worker.js

@@ -260,6 +260,9 @@ export async function runStructuredProviderReview(
     );
     const envelope = provider === "claude" ? JSON.parse(stdout) : null;
     if (envelope?.is_error || (envelope && envelope.subtype !== "success")) {
+      if (readOnlyAnalysis && envelope?.is_error === true && providerSignInRequired(envelope.result)) {
+        throw new SqmLocalReviewError('Sign in to the local AI app again.', { code: 'provider_sign_in_required' });
+      }
       throw new Error("Claude Code did not complete a structured review");
     }
     const output = provider === "claude"
@@ -322,7 +325,7 @@ function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, lab
     };
     const cancelled = () => halt(new Error('Local analysis was cancelled'));
     const timer = setTimeout(() => {
-      halt(new Error(`${label} timed out after ${executionTimeoutMs}ms`));
+      halt(readOnlyAnalysis ? new SqmLocalReviewError('Local analysis timed out.', { code: 'analysis_timeout' }) : new Error(`${label} timed out after ${executionTimeoutMs}ms`));
     }, executionTimeoutMs);
     timer.unref?.();
     const finish = (error = null) => {
@@ -341,6 +344,10 @@ function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, lab
         for (const line of stdout.split('\n').filter(Boolean)) {
           let event;
           try { event = JSON.parse(line); } catch { continue; }
+          if (['error', 'turn.failed'].includes(event.type) && providerSignInRequired(event.message ?? event.error?.message)) {
+            halt(new SqmLocalReviewError('Sign in to the local AI app again.', { code: 'provider_sign_in_required' }));
+            return;
+          }
           if (/command_execution|mcp_tool_call|web_search|file_change|tool_call/.test(event.item?.type || '')) {
             halt(new Error('Read-only analysis attempted to use a tool'));
             return;
@@ -358,6 +365,14 @@ function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, lab
     });
     child.on("error", finish);
     child.on("close", (code) => {
+      if (readOnlyAnalysis && provider === 'claude' && !terminalError) {
+        let envelope;
+        try { envelope = JSON.parse(stdout); } catch { /* Non-JSON failure remains unavailable. */ }
+        if (envelope?.is_error === true && providerSignInRequired(envelope.result)) {
+          finish(new SqmLocalReviewError('Sign in to the local AI app again.', { code: 'provider_sign_in_required' }));
+          return;
+        }
+      }
       finish(terminalError || (code === 0 ? null : new Error(stderr.trim() || `${label} exited with code ${code}`)));
     });
     signal?.addEventListener('abort', cancelled, { once: true });
@@ -366,6 +381,12 @@ function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, lab
   });
 }
 
+function providerSignInRequired(message) {
+  // Match explicit provider authentication failures only, never general 403s
+  // (which can be permissions/quotas) or model-generated prose/tool output.
+  return typeof message === 'string' && /(?:not logged in|please (?:log|sign) in|invalid api key|authentication token (?:is )?(?:invalid|expired)|refresh token (?:has )?expired)/i.test(message.slice(0, 4000));
+}
+
 function safeReviewEnvironment(environment, provider) {
   const allowed = [
     "HOME", "PATH", "CODEX_HOME", "CLAUDE_CONFIG_DIR",