@awak-app/simy-cli 0.5.70 → 0.5.72

package/src/sqm/bundle-store.js

@@ -1,3 +1,4 @@
+import { safeSqmDiagnostic } from "./diagnostics.js";
 import { createHash, createPublicKey } from "node:crypto";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -83,7 +84,7 @@ export async function loadKnowledgeBundle({
     } catch (error) {
       if (error?.code === "incompatible_cli") throw error;
       if (error?.fallbackAllowed !== false && cached && !cached.bundle.system_scope && Date.parse(cached.bundle.expires_at) > now) return result(cached.bundle, [`SQM Cloud unavailable; using last verified bundle: ${message(error)}`], "stale_cache");
-      return result(null, [`SQM knowledge could not be used; shadow checks were skipped: ${message(error)}`], "unavailable");
+      return { ...result(null, [`SQM knowledge could not be used; shadow checks were skipped: ${message(error)}`], "unavailable"), diagnostic: safeSqmDiagnostic(error, "knowledge_bundle", "knowledge_bundle_unavailable") };
     }
   }
   if (cached) {
@@ -200,6 +201,8 @@ async function fetchBundle({ endpoint, repository, cliVersion, token, organizati
       );
     }
     const error = new Error(`SQM Cloud returned HTTP ${response.status}${body ? `: ${body.slice(0, 300)}` : ""}.`);
+    Object.assign(error, safeSqmDiagnostic({ status: response.status, code: parsed?.error?.code || parsed?.detail?.code,
+      requestId: response.headers?.get?.("x-request-id") }, "knowledge_bundle", "knowledge_bundle_http_error"));
     error.fallbackAllowed = response.status >= 500 && response.status <= 599;
     throw error;
   }

package/src/sqm/command.js

@@ -1,3 +1,4 @@
+import { safeSqmDiagnostic } from "./diagnostics.js";
 import { createSqmCheckRecorder } from "./history-store.js";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -49,6 +50,7 @@ export async function runSqmCommand(argv, { cliVersion }) {
 
   const save = createSqmCheckRecorder({ scope: { webOrigin, accountId, organizationId },
     phase: argv[0] === "min-check" ? "min" : "full", cwd: common.cwd, baseBranch: common.baseBranch });
+  let stage = "min_check";
   try {
     if (argv[0] === "min-check") {
       const result = await runSqmMinCheck(common);
@@ -60,6 +62,7 @@ export async function runSqmCommand(argv, { cliVersion }) {
       return result.status === "unavailable" ? 2 : result.status === "preliminary_failed" ? 1 : 0;
     }
 
+    stage = "min_result_read";
     const minPath = option(argv, "--min-result") || defaultMinResultPath();
     let minCheck;
     try {
@@ -71,11 +74,13 @@ export async function runSqmCommand(argv, { cliVersion }) {
       await atomicJson(minPath, minCheck);
     }
     if (minCheck.status === "unavailable") { await save(minCheck); return printUnavailable(minCheck, argv); }
+    stage = "full_check";
     const result = await runSqmCheck({ ...common, minCheck, deviceId, signingKeyPath: option(argv, "--signing-key") || undefined });
     if (result.status === "unavailable") { await save(result); return printUnavailable(result, argv); }
     const proofPath = path.resolve(option(argv, "--proof") || "proof.json");
     const evidencePath = path.resolve(option(argv, "--signed-evidence") || `${proofPath}.signed.json`);
     const diagnosticsPath = path.resolve(option(argv, "--diagnostics") || `${proofPath}.diagnostics.json`);
+    stage = "artifact_write";
     await Promise.all([
       atomicJson(proofPath, result.proof),
       atomicJson(evidencePath, result.signed_evidence),
@@ -87,6 +92,7 @@ export async function runSqmCommand(argv, { cliVersion }) {
     let upload = { uploaded: false, reason: "disabled" };
     if (!argv.includes("--no-upload")) {
       const evidenceEndpoint = process.env.SIMY_SQM_EVIDENCE_URL || (validSession?.api_base_url ? new URL("sqm/run-evidence", validSession.api_base_url).href : undefined);
+      stage = "evidence_upload";
       upload = await uploadRunEvidence({ endpoint: evidenceEndpoint, token, proof: result.proof, signedEvidence: result.signed_evidence });
     }
     result.upload = upload;
@@ -101,7 +107,7 @@ export async function runSqmCommand(argv, { cliVersion }) {
     else printFull(result);
     return result.proof.outcome.status === "failed" ? 1 : 0;
   } catch (error) {
-    await save({ status: "failed" });
+    await save({ status: "failed", diagnostic: safeSqmDiagnostic(error, stage) });
     throw error;
   }
 }

package/src/sqm/diagnostics.js

@@ -0,0 +1,23 @@
+// Persist machine diagnostics only. Provider/server response text can contain
+// repository content or credentials and must never enter durable check history.
+export function safeSqmDiagnostic(error, stage = "check", code = "sqm_check_failed") {
+  const value = error?.diagnostic || (error?.error && typeof error.error === "object" ? error.error : error) || {};
+  const machine = (candidate, fallback) => typeof candidate === "string" && /^[a-zA-Z][a-zA-Z0-9_]{0,79}$/.test(candidate) ? candidate : fallback;
+  const status = [value.status, value.errorStatus, value.httpStatus, value.error_status].find(candidate => Number.isInteger(candidate) && candidate >= 400 && candidate <= 599);
+  const requestId = value.requestId ?? value.request_id;
+  return {
+    stage: machine(value.stage ?? value.errorStage ?? value.error_stage, stage),
+    code: machine(value.code ?? value.errorCode ?? value.error_code, code),
+    ...(Number.isInteger(status) && status >= 400 && status <= 599 ? { status } : {}),
+    ...(typeof requestId === "string" && /^(?:[a-f0-9]{16,64}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$/i.test(requestId) ? { requestId } : {}),
+  };
+}
+
+export function formatSqmDiagnostic(value) {
+  const hint = value.status === 401 ? "Reconnect your SIMY session."
+    : value.status === 403 ? "Check access to SQM in the selected organization."
+    : value.code === "repository_scope_unresolved" ? "Connect this repository to a system in SIMY."
+    : value.code === "knowledge_bundle_changed" || value.code === "repository_identity_changed" ? "Run min-check again for the current repository and knowledge version."
+    : "Inspect the command diagnostics for this stage before retrying.";
+  return `${value.stage} · ${value.code}${value.status ? ` · HTTP ${value.status}` : ""}${value.requestId ? ` · Request ${value.requestId}` : ""}\n${hint}`;
+}

package/src/sqm/evidence-client.js

@@ -1,3 +1,4 @@
+import { safeSqmDiagnostic } from "./diagnostics.js";
 export async function uploadRunEvidence({ endpoint, token, proof, signedEvidence, fetchImpl = globalThis.fetch }) {
   if (!endpoint || !token) return { uploaded: false, reason: "authenticated_cloud_session_unavailable" };
   const response = await fetchImpl(endpoint, {
@@ -7,6 +8,6 @@ export async function uploadRunEvidence({ endpoint, token, proof, signedEvidence
     signal: AbortSignal.timeout(10_000),
   });
   const payload = await response.json().catch(() => null);
-  if (!response.ok) throw new Error(`SQM run evidence upload failed with HTTP ${response.status}${payload?.error ? `: ${typeof payload.error === "string" ? payload.error : payload.error.message || "unknown error"}` : ""}.`);
+  if (!response.ok) throw Object.assign(new Error(`SQM run evidence upload failed with HTTP ${response.status}${payload?.error ? `: ${typeof payload.error === "string" ? payload.error : payload.error.message || "unknown error"}` : ""}.`), safeSqmDiagnostic({ status: response.status, code: payload?.error?.code, requestId: response.headers?.get?.("x-request-id") }, "evidence_upload", "evidence_upload_failed"));
   return { uploaded: true, ...payload };
 }

package/src/sqm/history-store.js

@@ -1,7 +1,8 @@
+import { safeSqmDiagnostic, formatSqmDiagnostic } from "./diagnostics.js";
 import { createHash, randomUUID } from "node:crypto";
 import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
-import { formatSqmCoverage } from "./report.js";
+import { formatSqmCoverage, sqmCoverageWarnings } from "./report.js";
 import { defaultSessionRoot } from "../session-store.js";
 
 const LIMIT = 100;
@@ -69,9 +70,10 @@ function metadata(entry) {
   if (!entry || !["analysis", "check"].includes(entry.kind) || typeof entry.key !== "string" || !entry.key.startsWith(entry.kind === "analysis" ? "sqm:" : "sqm-check:")) return null;
   if (!["running", "completed", "failed", "unavailable", "interrupted", "verification_pending"].includes(entry.state) || !Number.isFinite(Date.parse(entry.startedAt))) return null;
   const item = {};
-  for (const name of ["key", "id", "kind", "label", "state", "provider", "phase", "repository", "startedAt", "finishedAt", "instruction", "result", "error", "errorCode", "webUrl"]) {
+  for (const name of ["key", "id", "kind", "label", "state", "provider", "phase", "repository", "startedAt", "finishedAt", "instruction", "result", "error", "errorCode", "errorStage", "requestId", "webUrl"]) {
     if (typeof entry[name] === "string") item[name] = entry[name].slice(0, ["instruction", "result", "error"].includes(name) ? 4096 : 512);
   }
+  if (Number.isInteger(entry.errorStatus) && entry.errorStatus >= 400 && entry.errorStatus <= 599) item.errorStatus = entry.errorStatus;
   return item;
 }
 
@@ -94,15 +96,25 @@ export function createSqmCheckRecorder({ root, scope, phase, cwd, baseBranch, on
     const repository = identity?.repository || result.repository;
     const outcome = proof?.outcome.status || result.min_check?.status || result.status;
     const state = outcome === "unavailable" ? "unavailable" : ["failed", "preliminary_failed"].includes(outcome) ? "failed" : ["requires_human", "requires_post_deploy"].includes(outcome) ? "verification_pending" : "completed";
+    const failure = result.upload?.diagnostic ? safeSqmDiagnostic(result.upload.diagnostic, "evidence_upload", "evidence_upload_failed") : ["failed", "unavailable"].includes(state) && (result.diagnostic || result.error || result.errorCode || !identity)
+      ? safeSqmDiagnostic(result, phase, state === "unavailable" ? "sqm_check_unavailable" : "sqm_check_failed") : null;
+    const minCheck = result.min_check || result;
+    const minWarnings = !proof && Array.isArray(minCheck.matched_modules)
+      ? sqmCoverageWarnings({ moduleCount: minCheck.matched_modules.length,
+        scenarioCount: Array.isArray(minCheck.full_check_plan) ? minCheck.full_check_plan.length :
+          minCheck.matched_modules.reduce((total, module) => total + (module.scenario_ids?.length || 0), 0),
+        noSystemKnowledge: minCheck.matched_modules.length === 0 && minCheck.coverage_reasons?.includes("no_system_knowledge") === true,
+        outcomeStatus: minCheck.status }) : [];
     const summary = proof ? [`Full check: ${proof.outcome.status}`, formatSqmCoverage(proof), `Evidence upload: ${result.upload?.uploaded ? "uploaded" : "kept locally"}`].join("\n")
-      : state === "unavailable" ? "SQM could not obtain a verified result. Retry the command to see current diagnostics."
-      : state === "failed" && !identity ? "The command did not finish. Retry it to see current diagnostics."
+      : state === "unavailable" ? "SQM could not obtain a verified result. See the recorded diagnostics below."
+      : state === "failed" && !identity ? "The command did not finish. See the recorded diagnostics below."
       : `Min-check: ${result.min_check?.status || result.status} · ${(result.preliminary_findings || result.min_check?.preliminary_findings)?.length || 0} preliminary finding(s) · ${(result.matched_modules || result.min_check?.matched_modules)?.length || 0} matched module(s).\nThis is a preflight; run the full check for signed verification.`;
     try {
       await history.record(scope, { key, id: key, kind: "check", phase, state, startedAt, finishedAt: new Date().toISOString(), repository,
         label: `${phase === "min" ? "Min-check" : "Check"} · ${repository || basename(cwd)}`,
         instruction: [repository || basename(cwd), `Base: ${identity?.base_ref || baseBranch}`, identity?.head_commit ? `Head: ${identity.head_commit}` : ""].filter(Boolean).join("\n"),
-        result: summary });
+        result: [summary, ...minWarnings].join("\n"),
+        ...(failure ? { error: formatSqmDiagnostic(failure), errorCode: failure.code, errorStage: failure.stage, errorStatus: failure.status, requestId: failure.requestId } : {}) });
     } catch { onError(); }
   };
 }

package/src/sqm/index.js

@@ -1,3 +1,5 @@
+import { sqmCoverageWarnings } from "./report.js";
+import { safeSqmDiagnostic } from "./diagnostics.js";
 import { createSqmCheckRecorder } from "./history-store.js";
 import { evaluateKnowledgeBundle } from "./checkers.js";
 import { loadKnowledgeBundle } from "./bundle-store.js";
@@ -35,7 +37,7 @@ export function createSqmChecker({
     try {
       repository = await inspectRepositoryImpl(cwd, { baseBranch, runCommand: dependencies.runCommand });
     } catch (error) {
-      return unavailable(`SQM repository inspection failed: ${message(error)}`);
+      return { ...unavailable(`SQM repository inspection failed: ${message(error)}`), diagnostic: safeSqmDiagnostic(error, "repository", "repository_inspection_failed") };
     }
     if (pinnedRepository && pinnedRepository !== repository.repository) return unavailable(`SQM repository changed during a pinned run (${pinnedRepository} to ${repository.repository}).`, repository.repository);
     if (!pinnedLoad) {
@@ -43,7 +45,7 @@ export function createSqmChecker({
       pinnedLoad = loadKnowledgeBundleImpl({ repository: repository.repository, cliVersion, offline, refresh, token, endpoint, accountId, organizationId, ...dependencies });
     }
     const loaded = await pinnedLoad;
-    if (!loaded.bundle) return { ...unavailable(loaded.warnings[0], repository.repository), warnings: loaded.warnings };
+    if (!loaded.bundle) return { ...unavailable(loaded.warnings[0], repository.repository), warnings: loaded.warnings, diagnostic: loaded.diagnostic };
     try {
       const evaluate = executeKnowledgeBundleImpl
         ? async (bundle, currentRepository) => ({ findings: await executeKnowledgeBundleImpl(bundle, currentRepository), modules: [] })
@@ -56,7 +58,7 @@ export function createSqmChecker({
         try {
           full.upload = await uploadRunEvidenceImpl({ endpoint: evidenceEndpoint, token, proof: full.proof, signedEvidence: full.signed_evidence });
         } catch (error) {
-          full.upload = { uploaded: false, reason: `upload_failed: ${message(error)}` };
+          full.upload = { uploaded: false, reason: `upload_failed: ${message(error)}`, diagnostic: safeSqmDiagnostic(error, "evidence_upload", "evidence_upload_failed") };
           full.warnings.push(`SQM signed evidence remains local because Cloud upload failed: ${message(error)}`);
         }
         return full;
@@ -64,7 +66,7 @@ export function createSqmChecker({
       latestMinCheck = await buildMinCheck({ repository, bundle: loaded.bundle, evaluation: await evaluate(loaded.bundle, repository), organizationId: organizationId || loaded.bundle.organization_id, cliVersion });
       return toLegacyCheck(latestMinCheck, loaded);
     } catch (error) {
-      return { ...unavailable(`SQM ${phase} execution failed: ${message(error)}`, repository.repository), bundle: bundleIdentity(loaded.bundle), warnings: [...loaded.warnings, `SQM ${phase} execution failed: ${message(error)}`] };
+      return { ...unavailable(`SQM ${phase} execution failed: ${message(error)}`, repository.repository), bundle: bundleIdentity(loaded.bundle), diagnostic: safeSqmDiagnostic(error, phase, "sqm_execution_failed"), warnings: [...loaded.warnings, `SQM ${phase} execution failed: ${message(error)}`] };
     }
   };
   return async (attempt, options = {}) => {
@@ -72,23 +74,23 @@ export function createSqmChecker({
     try {
       const result = await checkCurrentRepository(attempt, options);
       await save(result); return result;
-    } catch (error) { await save({ status: "failed" }); throw error; }
+    } catch (error) { await save({ status: "failed", diagnostic: safeSqmDiagnostic(error, options.phase || "min") }); throw error; }
   };
 }
 
 export async function runSqmMinCheck(options) {
   const context = await loadContext(options);
-  if (!context.loaded.bundle) return { ...unavailable(context.loaded.warnings[0], context.repository.repository), warnings: context.loaded.warnings };
+  if (!context.loaded.bundle) return { ...unavailable(context.loaded.warnings[0], context.repository.repository), warnings: context.loaded.warnings, diagnostic: context.loaded.diagnostic };
   const evaluation = await (options.evaluateKnowledgeBundleImpl || evaluateKnowledgeBundle)(context.loaded.bundle, context.repository);
   return buildMinCheck({ repository: context.repository, bundle: context.loaded.bundle, evaluation, organizationId: options.organizationId, cliVersion: options.cliVersion });
 }
 
 export async function runSqmCheck(options) {
   const context = await loadContext(options);
-  if (!context.loaded.bundle) return { ...unavailable(context.loaded.warnings[0], context.repository.repository), warnings: context.loaded.warnings };
+  if (!context.loaded.bundle) return { ...unavailable(context.loaded.warnings[0], context.repository.repository), warnings: context.loaded.warnings, diagnostic: context.loaded.diagnostic };
   verifyMinCheck(options.minCheck);
-  if (!sameRepositoryIdentity(options.minCheck.repository_identity, repositoryIdentity(context.repository))) throw new Error("Repository identity changed after min-check; run `simy sqm min-check` again.");
-  if (options.minCheck.knowledge_bundle.digest !== context.loaded.bundle.integrity.digest) throw new Error("Knowledge bundle changed after min-check; run `simy sqm min-check` again so both phases use one pinned bundle.");
+  if (!sameRepositoryIdentity(options.minCheck.repository_identity, repositoryIdentity(context.repository))) throw Object.assign(new Error("Repository identity changed after min-check; run `simy sqm min-check` again."), { code: "repository_identity_changed", stage: "identity_validation" });
+  if (options.minCheck.knowledge_bundle.digest !== context.loaded.bundle.integrity.digest) throw Object.assign(new Error("Knowledge bundle changed after min-check; run `simy sqm min-check` again so both phases use one pinned bundle."), { code: "knowledge_bundle_changed", stage: "identity_validation" });
   const evaluation = await (options.evaluateKnowledgeBundleImpl || evaluateKnowledgeBundle)(context.loaded.bundle, context.repository);
   return buildFullCheck({ repository: context.repository, bundle: context.loaded.bundle, minCheck: options.minCheck, evaluation, organizationId: options.organizationId, cliVersion: options.cliVersion, deviceId: options.deviceId, accountId: options.accountId, signingKeyPath: options.signingKeyPath });
 }
@@ -113,6 +115,13 @@ async function buildMinCheck({ repository, bundle, evaluation, organizationId, c
     preliminary_findings: evaluation.findings,
     matched_modules: evaluation.modules.map((module) => ({ module_id: module.module_id, module_version: module.module_version, state_model_ids: module.state_models.map((model) => model.id), transition_ids: module.state_models.flatMap((model) => model.transitions.map((transition) => transition.id)), stressor_ids: module.stressors.map((stressor) => stressor.id), scenario_ids: module.scenarios.map((scenario) => scenario.id) })),
     full_check_plan: plan,
+    coverage_reasons: [
+      ...(evaluation.modules.length === 0 ? ["no_applicable_rules"] : []),
+      ...(bundle.modules?.length === 0 ? ["no_system_knowledge"] : []),
+    ],
+    warnings: sqmCoverageWarnings({ moduleCount: evaluation.modules.length, scenarioCount: plan.length,
+      noSystemKnowledge: bundle.modules?.length === 0,
+      outcomeStatus: evaluation.findings.some(finding => finding.enforcement === "blocking") ? "preliminary_failed" : "passed" }),
   });
 }
 
@@ -133,12 +142,12 @@ async function buildFullCheck({ repository, bundle, minCheck, evaluation, organi
     proof,
     signed_evidence: signedEvidence,
     signature_verification: verification,
-    warnings: [],
+    warnings: sqmCoverageWarnings({ moduleCount: evaluation.modules.length, scenarioCount: evaluation.modules.reduce((count, module) => count + module.scenarios.length, 0), noSystemKnowledge: bundle.modules?.length === 0, outcomeStatus: proof.outcome.status }),
   };
 }
 
 function toLegacyCheck(minCheck, loaded) {
-  return { status: "checked", mode: "min", repository: minCheck.repository_identity.repository, base_ref: minCheck.repository_identity.base_ref, source: loaded.source, warnings: loaded.warnings, bundle: minCheck.knowledge_bundle, findings: minCheck.preliminary_findings, min_check: minCheck };
+  return { status: "checked", mode: "min", repository: minCheck.repository_identity.repository, base_ref: minCheck.repository_identity.base_ref, source: loaded.source, warnings: [...loaded.warnings, ...(minCheck.warnings || [])], bundle: minCheck.knowledge_bundle, findings: minCheck.preliminary_findings, min_check: minCheck };
 }
 
 function bundleIdentity(bundle) {

package/src/sqm/proof.js

@@ -73,6 +73,7 @@ export function buildProof({ organizationId, repository, bundle, minCheck, evalu
         ...(hasFailure ? ["one_or_more_blocking_checks_failed"] : []),
         ...(advisoryFindingCount > 0 ? ["advisory_findings_observed"] : []),
         ...(evaluation.modules.length === 0 ? ["no_applicable_rules"] : []),
+        ...(bundle.modules?.length === 0 ? ["no_system_knowledge"] : []),
         ...(requiresHuman ? ["human_evidence_required"] : []),
         ...(requiresPostDeploy ? ["post_deploy_evidence_required"] : []),
       ],

package/src/sqm/report.js

@@ -15,9 +15,16 @@ export function formatSqmCoverage(proof) {
   ];
   if (scenarios.length) lines.push(`Scenario evaluations: ${[...statusCounts].map(([status, count]) => `${status}=${count}`).join(" · ")}`);
   if (proof.outcome.reasons.length) lines.push(`Outcome reasons: ${proof.outcome.reasons.join(", ")}`);
-  if (!modules.length) lines.push("No applicable rules: this result does not establish feature or historical incident coverage.");
-  else if (!scenarios.length) lines.push("No scenario evaluations: rule results alone do not establish scenario coverage.");
+  lines.push(...sqmCoverageWarnings({ moduleCount: modules.length, scenarioCount: scenarios.length,
+    noSystemKnowledge: proof.outcome.reasons.includes("no_system_knowledge"), outcomeStatus: proof.outcome.status }));
   if (modules.length && !blocking) lines.push("Advisory-only scope: findings do not block this outcome.");
   lines.push("Scenario evaluations are deterministic checks, not browser/provider/deployed journey evidence. Record incident coverage and delivery acceptance separately.");
   return lines.join("\n");
 }
+
+export function sqmCoverageWarnings({ moduleCount, scenarioCount, noSystemKnowledge, outcomeStatus = "passed" }) {
+  if (noSystemKnowledge) return [`Warning: the selected system/repository's downloaded SQM knowledge bundle has no published knowledge. ${outcomeStatus === "passed" ? "This is a pass with 0 evaluated cases" : "This result has 0 evaluated cases"}; it does not establish feature or historical incident coverage.`];
+  if (!moduleCount) return ["Warning: no applicable rules matched this change (0 evaluated cases). This result does not establish feature or historical incident coverage; it does not mean the system has no past knowledge."];
+  if (!scenarioCount) return ["Warning: No scenario evaluations: rule results alone do not establish scenario coverage."];
+  return [];
+}

package/src/sqm/review-worker.js

@@ -14,8 +14,10 @@ const DEFAULT_LEASE_SECONDS = 300;
 // Claim can retrieve and freeze organization-scoped Slack evidence (45s budget).
 const DEFAULT_REQUEST_TIMEOUT_MS = 75_000;
 const DEFAULT_EXECUTION_TIMEOUT_MS = 240_000;
-// Pin SQM independently of the user's interactive model and CLI defaults.
-export const SQM_CODEX_MODEL = "gpt-6.1-sol";
+// Keep analysis independent of interactive config. Availability varies by
+// account and CLI; only an explicit model rejection may try the next model.
+export const SQM_CODEX_MODELS = Object.freeze(["gpt-6-astra", "gpt-6.1-sol"]);
+export const SQM_CODEX_MODEL = SQM_CODEX_MODELS[0];
 
 export class SqmLocalReviewError extends Error {
   constructor(message, { status = null, code = "sqm_local_review_error", stage = null, jobId = null, failureRecorded = false, validationFeedback = "" } = {}) {
@@ -94,12 +96,30 @@ export function createSqmLocalReviewWorker({
   getWorkspaceUrl = () => null,
   recordHistory = async () => {},
   onHistoryError = () => {},
+  now = () => Date.now(),
+  providerFailureCooldownMs = 5 * 60_000,
+  getRecoveryKey = () => null,
 } = {}) {
   if (!api || typeof api.request !== "function") throw new TypeError("api.request is required");
   let activeJobId = null;
   let pollPromise = null;
   let closed = false;
   let issue = null;
+  let issueContext = null;
+  const failureDetails = new WeakMap();
+  const pauses = new Map();
+  const contextKey = (provider, scope) => JSON.stringify([scope?.webOrigin, scope?.accountId, scope?.organizationId, provider]);
+  const currentPause = () => pauses.get(contextKey(getProvider(), getHistoryScope()));
+  const pauseForFailure = (error, provider, scope, recoveryKey) => {
+    const failure = failureDetails.get(error) || reviewFailure(error, "claim", provider);
+    if (!["provider_sign_in_required", "provider_model_unsupported", "codex_local_unavailable", "claude_local_unavailable", "desktop_access_required"].includes(failure.code) && ![401, 403].includes(failure.status)) return;
+    const key = contextKey(provider, scope);
+    const failures = Math.min((pauses.get(key)?.failures || 0) + 1, 4);
+    const delay = Math.min(30 * 60_000, Math.max(1000, providerFailureCooldownMs) * 2 ** (failures - 1));
+    pauses.set(key, { code: failure.code, stage: failure.stage, status: failure.status, failures, recoveryKey,
+      retryAt: now() + delay, message: `${formatFailure(failure)}\nNew SQM claims are paused. After fixing this cause, refresh the local AI connection or wait for the next recovery attempt.` });
+    if (pauses.size > 32) pauses.delete(pauses.keys().next().value);
+  };
   const history = [];
   const historyScopes = new WeakMap();
   const visibleHistory = () => history.filter(item => historyScopes.get(item) === JSON.stringify(getHistoryScope()));
@@ -166,7 +186,7 @@ export function createSqmLocalReviewWorker({
         ...leaseBody(claim, provider),
         analysis_output: analysis.output,
         executor_model: analysis.model,
-      }), submitting => { stage = submitting ? "advance" : "analysis"; });
+      }), submitting => { stage = submitting ? "advance" : "analysis"; if (submitting) pauses.delete(contextKey(provider, historyScope)); });
       if (advanced.completed) { await updateTask(claim.job_id, "completed", historyScope); return advanced; }
       stage = "adjudication";
       const { response: completed } = await validatedReview(advanced.request, provider, "invalid_sqm_adjudication_output", adjudication => api.request({
@@ -175,11 +195,12 @@ export function createSqmLocalReviewWorker({
         analysis_output: analysis.output,
         adjudication_output: adjudication.output,
         executor_model: adjudication.model || analysis.model,
-      }), submitting => { stage = submitting ? "complete" : "adjudication"; });
+      }), submitting => { stage = submitting ? "complete" : "adjudication"; if (submitting) pauses.delete(contextKey(provider, historyScope)); });
       await updateTask(claim.job_id, "completed", historyScope);
       return completed;
     } catch (error) {
       const failure = reviewFailure(error, stage, provider);
+      if (error && typeof error === "object") failureDetails.set(error, failure);
       let failureReported = error.failureRecorded === true;
       if (!failureReported) {
         try {
@@ -199,7 +220,9 @@ export function createSqmLocalReviewWorker({
 
   return {
     snapshot() {
-      return { active_job_id: activeJobId, polling: Boolean(pollPromise), closed, issue };
+      const pause = currentPause();
+      return { active_job_id: activeJobId, polling: Boolean(pollPromise), closed, issue: issueContext === contextKey(getProvider(), getHistoryScope()) ? issue : null,
+        ...(pause ? { provider_pause: { code: pause.code, status: pause.status, retry_at: new Date(pause.retryAt).toISOString(), message: pause.message } } : {}) };
     },
     desktopTasks() { return { activeCount: activeJobId ? 1 : 0, items: visibleHistory().map(item => ({ ...item })) }; },
     desktopTaskDetail(key) {
@@ -212,9 +235,14 @@ export function createSqmLocalReviewWorker({
       const provider = getProvider();
       if (provider == null) return Promise.resolve(null);
       assertProvider(provider);
+      const historyScope = getHistoryScope();
+      const key = contextKey(provider, historyScope);
+      const recoveryKey = getRecoveryKey(provider);
+      const pause = pauses.get(key);
+      if (pause && pause.recoveryKey === recoveryKey && now() < pause.retryAt) return Promise.resolve(null);
+      if (pause && pause.recoveryKey !== recoveryKey) pauses.delete(key);
       const releaseWork = beginWork?.();
       if (!releaseWork) return Promise.resolve(null);
-      const historyScope = getHistoryScope();
       const workspaceUrl = getWorkspaceUrl();
       pollPromise = (async () => {
         const claim = await api.request({
@@ -224,10 +252,18 @@ export function createSqmLocalReviewWorker({
           lease_seconds: leaseSeconds,
         });
         if (issue) { issue = null; onChange(); }
-        if (!claim?.claimed) return null;
-        return processClaim(claim, provider, historyScope, workspaceUrl);
+        if (!claim?.claimed) {
+          // A successful empty claim proves SIMY access recovered, but it says
+          // nothing about a local provider that has not executed again yet.
+          if (pause?.stage === "claim") pauses.delete(key);
+          return null;
+        }
+        const result = await processClaim(claim, provider, historyScope, workspaceUrl);
+        pauses.delete(key);
+        return result;
       })()
         .catch(async (error) => {
+          pauseForFailure(error, provider, historyScope, recoveryKey);
           if (error.jobId && /^[a-f0-9-]{36}$/i.test(error.jobId) && !history.some(item => item.id === error.jobId)) {
             const scope = historyScope;
             const failure = reviewFailure(error, "claim", provider);
@@ -237,6 +273,7 @@ export function createSqmLocalReviewWorker({
             history.unshift(item); historyScopes.set(item, JSON.stringify(scope)); history.splice(50);
             await persist(scope, item);
           }
+          issueContext = key;
           issue = error.status === 403 ? "forbidden" : error.status === 401 ? "signed_out" : "unavailable";
           onError(error);
           return null;
@@ -293,38 +330,54 @@ export async function runStructuredProviderReview(
       "Return only JSON that strictly matches the provided output schema.",
       request.prompt,
     ].join("\n\n");
-    await beforeDispatch();
-    if (signal?.aborted) throw new SqmLocalReviewError('Local analysis was cancelled.', { code: 'analysis_cancelled' });
-    const stdout = await spawnReview(
-      inspection.executable,
-      provider === "claude" ? [
-        "--print", "--output-format", "json",
-        "--json-schema", JSON.stringify(request.output_schema),
-        "--no-session-persistence", "--tools", "",
-        "--setting-sources", "", "--settings", '{"disableAllHooks":true}',
-        "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
-        ...(readOnlyAnalysis ? ["--system-prompt", request.system, "--max-turns", "1"] : []),
-      ] : [
-        "exec",
-        "--model",
-        SQM_CODEX_MODEL,
-        "--skip-git-repo-check",
-        "--sandbox",
-        "read-only",
-        "--ephemeral",
-        "--ignore-user-config",
-        "--ignore-rules",
-        ...(readOnlyAnalysis ? codexAnalysisArguments(request.system) : []),
-        "--output-schema",
-        schemaPath,
-        "--output-last-message",
-        outputPath,
-        "-",
-      ],
-      prompt,
-      { spawnImpl, executionTimeoutMs, label, cwd: workDir, environment, provider, signal, readOnlyAnalysis,
-        terminationGraceMs: Number.isInteger(terminationGraceMs) ? Math.max(1, Math.min(terminationGraceMs, 5_000)) : 1_000 },
-    );
+    const deadline = Date.now() + executionTimeoutMs;
+    const models = provider === "codex" ? SQM_CODEX_MODELS : [null];
+    let stdout;
+    let selectedModel;
+    for (const model of models) {
+      await beforeDispatch();
+      if (signal?.aborted) throw new SqmLocalReviewError('Local analysis was cancelled.', { code: 'analysis_cancelled' });
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) throw new SqmLocalReviewError('Local analysis timed out.', { code: 'analysis_timeout' });
+      // Never consume a partial/stale output file left by a rejected model.
+      await rm(outputPath, { force: true });
+      try {
+        stdout = await spawnReview(
+          inspection.executable,
+          provider === "claude" ? [
+            "--print", "--output-format", "json",
+            "--json-schema", JSON.stringify(request.output_schema),
+            "--no-session-persistence", "--tools", "",
+            "--setting-sources", "", "--settings", '{"disableAllHooks":true}',
+            "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
+            ...(readOnlyAnalysis ? ["--system-prompt", request.system, "--max-turns", "1"] : []),
+          ] : [
+            "exec",
+            "--model",
+            model,
+            "--skip-git-repo-check",
+            "--sandbox",
+            "read-only",
+            "--ephemeral",
+            "--ignore-user-config",
+            "--ignore-rules",
+            ...(readOnlyAnalysis ? codexAnalysisArguments(request.system) : []),
+            "--output-schema",
+            schemaPath,
+            "--output-last-message",
+            outputPath,
+            "-",
+          ],
+          prompt,
+          { spawnImpl, executionTimeoutMs: remaining, label, cwd: workDir, environment, provider, signal, readOnlyAnalysis, model,
+            terminationGraceMs: Number.isInteger(terminationGraceMs) ? Math.max(1, Math.min(terminationGraceMs, 5_000)) : 1_000 },
+        );
+        selectedModel = model;
+        break;
+      } catch (error) {
+        if (error.code !== "provider_model_unsupported" || model === models.at(-1)) throw error;
+      }
+    }
     const envelope = provider === "claude" ? JSON.parse(stdout) : null;
     if (envelope?.is_error || (envelope && envelope.subtype !== "success")) {
       if (readOnlyAnalysis && envelope?.is_error === true && providerSignInRequired(envelope.result)) {
@@ -340,7 +393,7 @@ export async function runStructuredProviderReview(
     }
     return {
       output,
-      model: provider === "codex" ? SQM_CODEX_MODEL : `${provider}-local/${inspection.installed_version || "unknown"}`,
+      model: provider === "codex" ? selectedModel : `${provider}-local/${inspection.installed_version || "unknown"}`,
     };
   } catch (error) {
     if (error instanceof SqmLocalReviewError || error?.code === 'desktop_access_required') throw error;
@@ -365,7 +418,7 @@ function codexAnalysisArguments(system) {
     '-c', `developer_instructions=${JSON.stringify(system)}`];
 }
 
-function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, label, cwd, environment, provider, signal, readOnlyAnalysis, terminationGraceMs }) {
+function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, label, cwd, environment, provider, signal, readOnlyAnalysis, terminationGraceMs, model }) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) return reject(new Error('Local analysis was cancelled'));
     const child = spawnImpl(command, args, {
@@ -376,6 +429,7 @@ function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, lab
     });
     let stdout = "";
     let stderr = "";
+    let stderrPending = "";
     let settled = false;
     let terminalError = null;
     let killTimer = null;
@@ -411,9 +465,16 @@ function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, lab
         for (const line of stdout.split('\n').filter(Boolean)) {
           let event;
           try { event = JSON.parse(line); } catch { continue; }
-          if (['error', 'turn.failed'].includes(event.type) && providerSignInRequired(event.message ?? event.error?.message)) {
-            halt(new SqmLocalReviewError('Sign in to the local AI app again.', { code: 'provider_sign_in_required' }));
-            return;
+          if (['error', 'turn.failed'].includes(event.type)) {
+            const message = event.message ?? event.error?.message;
+            if (providerSignInRequired(message)) {
+              halt(new SqmLocalReviewError('Sign in to the local AI app again.', { code: 'provider_sign_in_required' }));
+              return;
+            }
+            if (providerModelUnsupported(message, model)) {
+              halt(modelUnsupportedError(model));
+              return;
+            }
           }
           if (/command_execution|mcp_tool_call|web_search|file_change|tool_call/.test(event.item?.type || '')) {
             halt(new Error('Read-only analysis attempted to use a tool'));
@@ -429,9 +490,32 @@ function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, lab
     child.stderr?.setEncoding?.("utf8");
     child.stderr?.on?.("data", (chunk) => {
       if (!readOnlyAnalysis) stderr = `${stderr}${chunk}`.slice(-4000);
+      if (provider === "codex") {
+        stderrPending = `${stderrPending}${chunk}`.slice(-8000);
+        const lines = stderrPending.split(/\r?\n/);
+        stderrPending = lines.pop() || "";
+        for (const line of lines) checkStderr(line);
+      }
     });
+    const checkStderr = line => {
+      // Native CLI diagnostics only; never match warnings or assistant text.
+      const match = line.match(/^\s*ERROR:\s*(.*)$/);
+      if (!match) return;
+      let message = match[1];
+      try {
+        const event = JSON.parse(message);
+        if (event.type !== "error") return;
+        message = event.error?.message ?? event.message;
+      } catch { /* Older CLIs print a plain native ERROR line. */ }
+      if (providerSignInRequired(message)) {
+        halt(new SqmLocalReviewError('Sign in to the local AI app again.', { code: 'provider_sign_in_required' }));
+      } else if (providerModelUnsupported(message, model)) {
+        halt(modelUnsupportedError(model));
+      }
+    };
     child.on("error", finish);
     child.on("close", (code) => {
+      if (provider === "codex") checkStderr(stderrPending);
       if (readOnlyAnalysis && provider === 'claude' && !terminalError) {
         let envelope;
         try { envelope = JSON.parse(stdout); } catch { /* Non-JSON failure remains unavailable. */ }
@@ -448,6 +532,18 @@ function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, lab
   });
 }
 
+function providerModelUnsupported(message, model) {
+  if (typeof message !== "string" || typeof model !== "string") return false;
+  const rejection = message.trim().match(/^The ['"]([^'"]+)['"] model is not supported(?: when using Codex with a ChatGPT account)?\.?$/i);
+  return rejection?.[1] === model;
+}
+
+function modelUnsupportedError(model) {
+  return new SqmLocalReviewError(`The local Codex account does not support ${model}. Update Codex or check the models available to this account.`, {
+    code: "provider_model_unsupported", status: 400,
+  });
+}
+
 function providerSignInRequired(message) {
   // Match explicit provider authentication failures only, never general 403s
   // (which can be permissions/quotas) or model-generated prose/tool output.
@@ -511,6 +607,7 @@ function reviewFailure(error, stage, provider) {
 function formatFailure(failure, failureReported = null) {
   if (!failure) return "SQM analysis failed. No failure diagnostics were recorded.";
   const hint = failure.code === "provider_sign_in_required" ? "Sign in to the local AI app again."
+    : failure.code === "provider_model_unsupported" ? "The local Codex account rejected the configured SQM models. Update Codex or check this account's available models."
     : failure.code === "analysis_timeout" ? "The local AI analysis exceeded its time limit."
     : failure.code === "sqm_source_loading_failed" ? "SIMY could not load evidence for this analysis."
     : failure.status === 403 || failure.code === "desktop_access_required" ? "Check SQM and Developer access for the selected organization."