@awak-app/simy-cli 0.5.71 → 0.5.73

package/src/codex-plugins/simy/hooks/outcome-progress.mjs

@@ -0,0 +1,129 @@
+import { createHash } from "node:crypto";
+
+function text(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function observed(row) {
+  return typeof row?.passed === "boolean" && Boolean(text(row.verification_method)) &&
+    Boolean(text(row.observed_result)) && Array.isArray(row.evidence_refs) &&
+    row.evidence_refs.some((ref) => Boolean(text(ref)));
+}
+
+function classifyBlockers(findings) {
+  const blockers = { machine: [], human: [], external: [] };
+  for (const finding of findings || []) {
+    if (!finding || finding.passed === true) continue;
+    const kind = ["machine", "human", "external"].includes(finding.blocker_kind)
+      ? finding.blocker_kind
+      : finding.repairability === "external" ? "external"
+      : finding.repairability === "manual" ? "human" : "machine";
+    blockers[kind].push({
+      code: text(finding.code) || "OUTCOME_UNPROVEN",
+      target: text(finding.target) || null,
+      explanation: text(finding.explanation) || text(finding.detail) || null,
+    });
+  }
+  return blockers;
+}
+
+/**
+ * Compare controller-owned independent observations against one frozen objective.
+ * Evidence references identify proof; changing their paths/hashes is not progress.
+ * This measures continuation only and never replaces the completion gates.
+ */
+export function evaluateOutcomeProgress({
+  criteria,
+  objectiveDigest = null,
+  objectiveVersion = null,
+  criterionResults = [],
+  userOutcome = null,
+  assessmentAvailable = false,
+  assessmentReason = null,
+  findings = [],
+  previous = null,
+  maxNoProgressAttempts = 3,
+}) {
+  const rows = Array.isArray(criteria) ? criteria : [];
+  if (rows.some((row) => !text(row?.id) || row.id === "USER-GOAL") ||
+      new Set(rows.map((row) => row.id)).size !== rows.length) {
+    throw new Error("Outcome progress requires unique, non-reserved criterion IDs");
+  }
+  if (!Number.isInteger(maxNoProgressAttempts) || maxNoProgressAttempts < 1) {
+    throw new Error("maxNoProgressAttempts must be a positive integer");
+  }
+  const scopeDigest = createHash("sha256").update(JSON.stringify({
+    objectiveDigest, objectiveVersion, criteria: rows,
+  })).digest("hex");
+  const comparable = previous?.scope_digest === scopeDigest;
+  const requiredIds = [...rows.map((row) => row.id), "USER-GOAL"];
+  const results = Array.isArray(criterionResults) ? criterionResults : [];
+  const criterionStates = requiredIds.map((id) => {
+    const matches = id === "USER-GOAL" ? (userOutcome ? [userOutcome] : [])
+      : results.filter((row) => row?.criterion_id === id);
+    const row = matches[0];
+    const evaluated = assessmentAvailable && matches.length === 1 && observed(row);
+    return {
+      criterion_id: id,
+      state: evaluated ? row.passed ? "verified" : "unproven" : "unassessed",
+      reason: evaluated ? null : !assessmentAvailable ? assessmentReason || "independent_assessment_unavailable"
+        : matches.length > 1 ? "duplicate_independent_results" : "independent_observation_missing",
+    };
+  });
+  const idsWithState = (state) => criterionStates.filter((row) => row.state === state)
+    .map((row) => row.criterion_id).sort();
+  const verified = idsWithState("verified");
+  const unproven = idsWithState("unproven");
+  const unassessed = idsWithState("unassessed");
+  // History is only a comparison baseline, never carried into current proof.
+  const historicalRows = comparable ? previous.verified_history_ids || previous.verified_ids : [];
+  const historical = Array.isArray(historicalRows)
+    ? historicalRows.filter((id) => requiredIds.includes(id)) : [];
+  const newlyVerified = verified.filter((id) => !historical.includes(id));
+  const hasProgress = newlyVerified.length > 0;
+  const previousNoProgress = Number.isInteger(previous?.no_progress_attempts) && previous.no_progress_attempts >= 0
+    ? previous.no_progress_attempts : 0;
+  const noProgressAttempts = comparable
+    ? hasProgress ? 0 : previousNoProgress + 1
+    : verified.length > 0 ? 0 : 1;
+  const blockers = classifyBlockers(findings);
+  const complete = rows.length > 0 && unproven.length === 0 && unassessed.length === 0;
+  const stalled = !complete && noProgressAttempts >= maxNoProgressAttempts;
+  const evaluationStatus = unassessed.length === 0 ? "assessed"
+    : verified.length + unproven.length > 0 ? "partial" : "unavailable";
+  const nextActions = [];
+  if (blockers.machine.length || unproven.length || unassessed.length) nextActions.push("repair_or_verify");
+  if (blockers.human.length) nextActions.push("request_human_input");
+  if (blockers.external.length) nextActions.push("wait_for_external_dependency");
+  if (complete) nextActions.push("check_completion_gates");
+  if (stalled) nextActions.push("reassess_approach");
+  return {
+    version: 2,
+    objective_digest: objectiveDigest,
+    objective_version: objectiveVersion,
+    scope_digest: scopeDigest,
+    objective_changed: Boolean(previous && !comparable),
+    evaluation_status: evaluationStatus,
+    status: evaluationStatus === "assessed" ? "assessed" : "insufficient_evidence",
+    criterion_states: criterionStates,
+    verified_ids: verified,
+    assessed_ids: verified,
+    evaluated_ids: [...verified, ...unproven].sort(),
+    unproven_ids: [...unproven, ...unassessed].sort(),
+    failed_ids: unproven,
+    unassessed_ids: unassessed,
+    newly_verified_ids: newlyVerified,
+    verified_history_ids: [...new Set([...historical, ...verified])].sort(),
+    regressed_ids: comparable && Array.isArray(previous.verified_ids)
+      ? unproven.filter((id) => previous.verified_ids.includes(id)) : [],
+    has_progress: hasProgress,
+    no_progress_attempts: noProgressAttempts,
+    max_no_progress_attempts: maxNoProgressAttempts,
+    stalled,
+    stall_reason: stalled ? evaluationStatus === "unavailable"
+      ? "independent_assessment_repeatedly_unavailable" : "no_new_verified_outcome" : null,
+    blockers,
+    next_actions: nextActions,
+    next_action: stalled ? "reassess_approach" : nextActions[0] || "repair_or_verify",
+  };
+}

package/src/coding-run-recovery.js

@@ -0,0 +1,88 @@
+import { redactExecutionValue } from "./orchestrator/execution-io.js";
+import { objectiveValueDigest, verifyObjective } from "./orchestrator/outcome-monitor.js";
+
+// Redaction changes acceptance text, so its integrity chain must undergo the
+// same transformation. Never legitimize an already edited objective here.
+export function recoverySnapshot(snapshot) {
+  const verified = snapshot?.charter && verifyObjective(snapshot.charter);
+  const sanitized = redactExecutionValue(snapshot);
+  const contract = sanitized?.charter?.thread_state?.objective_contract;
+  const objectiveDigest = value => objectiveValueDigest(value, contract?.digest_algorithm);
+  if (!contract || verified.legacy || !verified.valid) return sanitized;
+  if (objectiveDigest(contract.current) === contract.current_digest) return sanitized;
+  for (const revision of contract.revisions) {
+    revision.previous_digest = objectiveDigest(revision.previous);
+    revision.next_digest = objectiveDigest(revision.next);
+  }
+  const previousDigest = contract.current_digest;
+  contract.current_digest = objectiveDigest(contract.current);
+  if (!verifyObjective(sanitized.charter).valid) {
+    throw new Error("The redacted objective cannot be preserved for recovery.");
+  }
+  sanitized.metadata ??= {};
+  sanitized.metadata.recovery_migrations ??= [];
+  sanitized.metadata.recovery_migrations.push({
+    kind: "objective_redaction", version: 1,
+    previous_digest: previousDigest, current_digest: contract.current_digest,
+  });
+  return sanitized;
+}
+
+export function recoveryActorBinding(session, apiOrigin, request) {
+  return {
+    device_id: session?.device_id || request?.execution_device_id || null,
+    account_id: session?.account_id || session?.auth_user_id || null,
+    organization_id: session?.organization_id || session?.org_id || null,
+    api_origin: apiOrigin || null,
+  };
+}
+
+export function assertRecoveryActor(run) {
+  const saved = run.snapshot.metadata?.recovery_actor || {
+    device_id: run.snapshot.metadata?.execution_device_id,
+  };
+  if (!saved) return;
+  const current = recoveryActorBinding(run.session, run.apiOrigin, run.request);
+  for (const field of ["device_id", "account_id", "organization_id", "api_origin"]) {
+    if (saved[field] && saved[field] !== current[field]) {
+      const error = new Error(`The saved run belongs to another ${field}; restore its original authorized session.`);
+      error.code = "recovery_actor_mismatch";
+      throw error;
+    }
+  }
+}
+
+// Current presentation can change; historical attempts and the corresponding
+// pause audit remain available for investigation.
+export function refreshRecoveryBudgetAudit(snapshot, budget) {
+  const stale = (finding) =>
+    (finding.code === "TOKEN_BUDGET_EXHAUSTED" && !budget.token_exhausted) ||
+    (finding.code === "RETRY_BUDGET_EXHAUSTED" && !budget.retry_exhausted);
+  const changed = refreshRecoveryAudit(snapshot, { reason: "budget_changed", stale,
+    summary: "The budget permits continuation; remaining verification or approval is still required." });
+  if (changed && snapshot.final_audit) snapshot.final_audit.budget = budget;
+  return changed;
+}
+
+export function refreshRecoveryAudit(snapshot, { reason, stale, summary }) {
+  const audit = snapshot.final_audit;
+  if (!audit) return false;
+  const findings = Array.isArray(audit.findings) ? audit.findings : [];
+  if (!findings.some(stale)) return false;
+  snapshot.metadata ??= {};
+  snapshot.metadata.recovery_audit_history ??= [];
+  snapshot.metadata.recovery_audit_history.push({
+    reason, recorded_at: new Date().toISOString(),
+    audit: structuredClone(audit),
+  });
+  const remaining = findings.filter((finding) => !stale(finding));
+  snapshot.final_audit = remaining.length ? {
+    ...audit, findings: remaining, passed: false,
+    auto_repairable: remaining.every(finding => finding.repairability === "auto"),
+    requires_human: remaining.some(finding => finding.repairability !== "auto"),
+    summary,
+  } : null;
+  snapshot.done_gate_passed = false;
+  snapshot.implementation_gate_passed = false;
+  return true;
+}

package/src/coding-run-store.js

@@ -3,7 +3,7 @@ import { homedir } from "node:os";
 import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
 
-import { redactExecutionValue } from "./orchestrator/execution-io.js";
+import { recoverySnapshot } from "./coding-run-recovery.js";
 
 const RUN_ID = /^[A-Za-z0-9_-]{1,160}$/;
 const writes = new Map();
@@ -16,7 +16,7 @@ export async function saveCodingRunSnapshot(root, snapshot) {
   const id = String(snapshot?.id || "");
   if (!RUN_ID.test(id)) throw new Error("Invalid coding run ID for durable storage.");
   // Capture at enqueue time: later mutations must not rewrite a queued version.
-  snapshot = redactExecutionValue(snapshot);
+  snapshot = recoverySnapshot(snapshot);
   const directory = path.resolve(root);
   const key = path.join(directory, id);
   const previous = writes.get(key) || Promise.resolve();

package/src/continuation-policy.js

@@ -0,0 +1,2 @@
+// The installed provider plugins use the same continuation policy validation.
+export * from "./codex-plugins/simy/hooks/continuation-policy.mjs";

package/src/delivery-hooks/command.js

@@ -18,12 +18,15 @@ async function readCheckpointInput(input) {
 export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = process.cwd(), input = process.stdin, output = console.log } = {}) {
   const [action, ...args] = argv;
   if (!action || action === '--help') {
+    output('Progress: --continuation-policy progress [--hard-max-minutes 1440] [--hard-max-continuations 50] [--provider-token-ceiling 15000000 (Codex only)]. Soft thresholds warn; approvals, missing usage and no verified progress still stop.');
+    output('simy delivery continuation_policy --provider PROVIDER --session ID --task-id ID --continuation-policy bounded|progress');
+    output('simy delivery extend --provider PROVIDER --session ID --task-id ID --hard-max-minutes N|--hard-max-continuations N|--provider-token-ceiling N');
     output('simy delivery continue --provider codex|claude --session ID [--max-no-progress-minutes 30] [--max-tokens N (Codex only)]\nsimy delivery dependency_ready --provider PROVIDER --session ID --task-id ID --wait-id ID --answer TEXT\nsimy delivery handoff|handoff_cancel --provider codex --session ID --task-id ID --target-session ID');
     output('simy delivery start --provider codex|claude --session ID --objective TEXT --next-step TEXT [--managed-file task.json] [--max-continuations 6] [--max-failures 3] [--max-minutes 30]\nsimy delivery checkpoint --provider codex|claude --session ID --file checkpoint.json|-\nsimy delivery status\nsimy delivery stop|pause|resume --provider codex|claude --session ID [--task-id ID]\nsimy delivery replan --provider PROVIDER --session ID --task-id ID\nsimy delivery approve|reject --provider PROVIDER --session ID --task-id ID --approval-id ID\nsimy delivery verify --provider PROVIDER --session ID --task-id ID --criterion-id ID\nsimy delivery set_policy --provider PROVIDER --session ID --task-id ID --autonomy-policy strict|balanced|autonomous\nEnable and review SIMY hooks in your provider first. Manual managed start requires an acceptance specification. Desktop Continue infers the original conversation goal first. Resume preserves original budgets.');
     return 0;
   }
   const options = {};
-  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-continuations', 'max-failures', 'max-minutes', 'max-no-progress-minutes', 'max-tokens', 'file', 'managed-file', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
+  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-continuations', 'max-failures', 'max-minutes', 'max-no-progress-minutes', 'max-tokens', 'continuation-policy', 'hard-max-minutes', 'hard-max-continuations', 'provider-token-ceiling', 'file', 'managed-file', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
   for (let i = 0; i < args.length; i += 2) {
     const key = args[i]?.replace(/^--/, '');
     if (!args[i]?.startsWith('--') || !allowed.has(key) || args[i + 1] === undefined || Object.hasOwn(options, key)) throw new Error('Invalid delivery option. Use simy delivery --help.');
@@ -32,8 +35,9 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
   const base = { root, cwd, provider: options.provider, session: options.session };
   let result;
   if (action === 'status') result = (await listRecords(root)).filter(r => (!options.provider || r.provider === options.provider) && (!options.session || r.session === options.session));
-  else if (action === 'continue') result = await continueSession({ ...base, autonomyPolicy: options['autonomy-policy'],
+  else if (action === 'continue') result = await continueSession({ ...base, autonomyPolicy: options['autonomy-policy'], continuationPolicy: options['continuation-policy'],
     ...Object.fromEntries([['max-continuations', 'maxContinuations'], ['max-failures', 'maxFailures'], ['max-minutes', 'maxMinutes'],
+      ['hard-max-minutes', 'hardMaxMinutes'], ['hard-max-continuations', 'hardMaxContinuations'], ['provider-token-ceiling', 'providerTokenCeiling'],
       ['max-no-progress-minutes', 'maxNoProgressMinutes'], ['max-tokens', 'maxTokens']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
   else if (action === 'handoff') result = await handoffSession({ ...base, taskId: options['task-id'], targetSession: options['target-session'] });
   else if (action === 'handoff_cancel') result = await cancelHandoffSession({ ...base, taskId: options['task-id'], targetSession: options['target-session'] });
@@ -49,15 +53,17 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
       managed = { ...managed, ...Object.fromEntries([['max-tokens', 'maxTokens'], ['max-no-progress-minutes', 'maxNoProgressMinutes']]
         .filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) };
     }
-    result = await startDelivery({ ...base, objective: options.objective, nextStep: options['next-step'], managed,
-    ...Object.fromEntries([['max-continuations', 'maxContinuations'], ['max-failures', 'maxFailures'], ['max-minutes', 'maxMinutes']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
+    result = await startDelivery({ ...base, objective: options.objective, nextStep: options['next-step'], managed, continuationPolicy: options['continuation-policy'],
+    ...Object.fromEntries([['max-continuations', 'maxContinuations'], ['max-failures', 'maxFailures'], ['max-minutes', 'maxMinutes'],
+      ['hard-max-minutes', 'hardMaxMinutes'], ['hard-max-continuations', 'hardMaxContinuations'], ['provider-token-ceiling', 'providerTokenCeiling']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
   }
   else if (action === 'checkpoint') {
     if (!options.file) throw new Error('--file is required.');
     const data = options.file === '-' ? await readCheckpointInput(input) : await readFile(options.file, 'utf8');
     if (Buffer.byteLength(data) > 64 * 1024) throw new Error('Checkpoint exceeds 64 KiB.');
     result = await checkpointDelivery({ ...base, checkpoint: JSON.parse(data) });
-  } else if (['stop', 'pause', 'resume', 'replan', 'approve', 'reject', 'set_policy', 'dependency_ready'].includes(action)) result = await controlDelivery({ ...base, taskId: options['task-id'], approvalId: options['approval-id'], autonomyPolicy: options['autonomy-policy'], waitId: options['wait-id'], answer: options.answer, action });
+  } else if (['stop', 'pause', 'resume', 'replan', 'approve', 'reject', 'set_policy', 'dependency_ready', 'extend', 'continuation_policy'].includes(action)) result = await controlDelivery({ ...base, taskId: options['task-id'], approvalId: options['approval-id'], autonomyPolicy: options['autonomy-policy'], continuationPolicy: options['continuation-policy'],
+    limits: Object.fromEntries([['hard-max-minutes', 'hardMaxMinutes'], ['hard-max-continuations', 'hardMaxContinuations'], ['provider-token-ceiling', 'providerTokenCeiling']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])), waitId: options['wait-id'], answer: options.answer, action });
   else if (action === 'verify') result = await verifyDelivery({ ...base, taskId: options['task-id'], criterionId: options['criterion-id'] });
   else throw new Error('Unknown delivery command.');
   output(JSON.stringify(result, null, 2));

package/src/delivery-hooks/desktop.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { canReplanDelivery, managedBudgetReason, reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { canChangeDeliveryContinuation, canReplanDelivery, deliveryBudgetState, managedBudgetReason, reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { originalSessionTarget } from '../session-supervision/original-session-target.js';
 
 export const HOOK_SETUP = Object.freeze({
@@ -32,6 +32,15 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
       provider: r.provider, session: r.session, originalSessionTarget: originalSessionTarget(r.provider, r.session),
       objective: r.run.objective, state: r.run.state, reason: r.run.reason,
       continuations: r.run.continuations, maxContinuations: r.run.maxContinuations, deadline: r.run.deadline,
+      continuationPolicy: r.run.managed?.continuationPolicy || 'bounded',
+      startedAt: r.run.startedAt,
+      continuationLimits: deliveryBudgetState(r.run, now),
+      canChangeContinuation: canChangeDeliveryContinuation(r.run),
+      hardDeadline: r.run.hardDeadline || null, hardMaxContinuations: r.run.hardMaxContinuations || null,
+      budgetWarnings: deliveryBudgetState(r.run, now).warnings,
+      budgetCapability: r.run.managed?.budgetCapability || null,
+      outcomeProgress: r.run.managed?.outcomeProgress || null,
+      budgetExtensionHistory: r.run.budgetExtensionHistory || [],
       needsAttention: ['blocked', 'failed', 'recovery_required', 'budget_exhausted', 'verification_pending'].includes(r.run.state), updatedAt: r.run.updatedAt,
       managed: Boolean(r.run.managed), taskId: r.run.managed?.taskId || null, actionId: r.run.managed?.actionId || null,
       actionDueAt: r.run.managed?.actionDueAt ?? null,
@@ -67,12 +76,12 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
         r.run.managed.resumeChannel === 'codex_app_server' && r.run.managed.autoRecovery),
       canResume: ['blocked', 'recovery_required', 'paused'].includes(r.run.state) && r.run.managed?.phase !== 'needs_clarification' &&
         !r.run.managed?.pendingApproval && !r.run.managed?.dependencyWait && !['pending', 'pending_received', 'transferred'].includes(r.run.managed?.handoff?.status) &&
-        !managedBudgetReason(r.run, now) && now < r.run.deadline && r.run.continuations < r.run.maxContinuations,
+        !managedBudgetReason(r.run, now),
       canApprove: r.run.state === 'blocked' && Boolean(r.run.managed?.pendingApproval) && !r.run.managed.pendingApproval.denied,
       canReject: r.run.state === 'blocked' && Boolean(r.run.managed?.pendingApproval) && !r.run.managed.pendingApproval.denied,
       canReplan: canReplanDelivery(r.run, r.provider, now),
       canAnswer: r.run.managed?.phase === 'needs_clarification' && r.run.state === 'blocked' && Boolean(r.run.managed.understandingQuestion?.id) &&
-        now < r.run.deadline && r.run.continuations < r.run.maxContinuations && r.run.failures < r.run.maxFailures,
+        !managedBudgetReason(r.run, now),
       canResolveDependency: r.run.state === 'blocked' && r.run.blocker === 'external_dependency' && Boolean(r.run.managed?.dependencyWait?.id) &&
         !managedBudgetReason(r.run, now) && !['pending', 'pending_received', 'transferred'].includes(r.run.managed?.handoff?.status),
       canSetPolicy: Boolean(r.run.managed?.autonomyPolicy) && !['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted'].includes(r.run.state),

package/src/delivery-hooks/supervisor.js

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { dirname } from 'node:path';
-import { automaticContinuationAllowed, assessedCheckpointContract, checkpointDelivery, decideStop, listRecords, readRecord, managedBudgetReason, notifyState, processIdentity, reconcileRecords, updateRecord, verifyAutomaticCriteria } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { automaticContinuationAllowed, assessedCheckpointContract, checkpointDelivery, decideStop, deliveryBudgetState, listRecords, readRecord, managedBudgetReason, managedDispatchDeadline, notifyState, processIdentity, reconcileRecords, updateRecord, verifyAutomaticCriteria } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { resolveBackendExecutable } from '../backend-executable.js';
 import { executeCodexAppServer } from '../session-supervision/codex-app-server.js';
 import { acquireWorkspaceLease, leaseOwnerDead } from '../session-supervision/workspace-lease.js';
@@ -38,7 +38,7 @@ async function assertActiveLease(root, provider, session, leaseId, signal, curre
   if (signal?.aborted || current?.run?.state !== 'auto_resuming' || current.run.managed?.resumeLease?.id !== leaseId) {
     throw new Error('Managed recovery lease changed before provider dispatch.');
   }
-  if (currentTime() >= current.run.deadline) throw new Error('Managed recovery deadline expired before provider dispatch.');
+  if (currentTime() >= managedDispatchDeadline(current.run)) throw new Error('Managed recovery deadline expired before provider dispatch.');
   if (!automaticContinuationAllowed(current)) throw new Error('Automatic continuation was disabled before provider dispatch.');
   if (managedBudgetReason(current.run, currentTime())) throw new Error('Managed progress budget expired before provider dispatch.');
   const managed = current.run.managed;
@@ -78,12 +78,13 @@ export async function executeCodexResume(record, { signal, root, leaseId, execut
     lastDependencyResolution: run.managed.lastDependencyResolution,
     remainingWork: run.managed.remainingWork, acceptanceCriteria: run.managed.acceptanceCriteria, proposedAction: run.managed.proposedAction,
     currentDecision: run.managed.autonomyPolicy ? run.managed.decision : undefined, diagnosis: run.managed.plan?.diagnosis,
-    budgets: { continuations: run.continuations, maxContinuations: run.maxContinuations, failures: run.failures, maxFailures: run.maxFailures, deadline: run.deadline } };
+    budgets: { ...deliveryBudgetState(run), continuations: run.continuations, failures: run.failures, maxFailures: run.maxFailures,
+      softDeadline: run.deadline, softMaxContinuations: run.maxContinuations } };
   const prompt = run.managed.autonomyPolicy ? `Continue the existing SIMY managed task in this exact session. Context: ${JSON.stringify(context)}\nExecute ONLY currentDecision.action. Its expectedVerification and rollback apply to this turn. Stay within provider permissions. End with ONLY one JSON checkpoint. ${assessedCheckpointContract(run.managed.decision)} Do not write SIMY state directly.` : `Continue the existing SIMY managed task in this exact session. Context: ${JSON.stringify(context)}\nStay within the original task and provider permissions. End with ONLY one JSON object: {"status":"in_progress|completed|blocked|error","summary":"...","nextStep":"...","remainingWork":"...","proposedAction":{"kind":"read|local_edit|local_test|external|destructive|scope_change|unknown","scope":"...","summary":"..."},"evidence":[],"acceptanceMet":false}. For blocked include blocker (authorization, missing_information, external_dependency), and for authorization include approval {kind,scope,summary}. Do not claim completion without checking frozen acceptance. SIMY independently verifies supported criteria. Do not write SIMY state directly. If approval or input is needed, return blocked and stop.`;
   const sandbox = run.managed.autonomyPolicy && run.managed.decision?.action.kind === 'read' ? 'read-only' : run.managed.autoRecoverySandbox;
   const args = ['exec', '--json', '--skip-git-repo-check', '-s', sandbox, '-m', run.managed.resumeModel, 'resume', record.session, prompt];
   if (signal?.aborted) throw new Error('Managed recovery cancelled before provider dispatch.');
-  if (currentTime() >= run.deadline) throw new Error('Managed recovery deadline expired before provider dispatch.');
+  if (currentTime() >= managedDispatchDeadline(run)) throw new Error('Managed recovery deadline expired before provider dispatch.');
   await beforeDispatch();
   if (signal?.aborted) throw new Error('Managed recovery cancelled before provider dispatch.');
   if (currentTime() >= run.deadline) throw new Error('Managed recovery deadline expired before provider dispatch.');
@@ -193,8 +194,9 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
       const approved = live?.managed?.decision?.outcome === 'wait' && ['read', 'local_edit', 'local_test'].includes(live.managed.decision.action?.kind) &&
         live.managed.approvedAction?.id === live.managed.decision.id && !live.managed.approvedAction.dispatchedAt;
       if (!live?.managed?.autoRecovery || live.state !== 'recovery_required' || !allowedCause || live.managed.pendingApproval || live.managed.autonomyPolicy && (!live.managed.decision || live.managed.decision.outcome === 'wait' && !approved) || appChannel && live.managed.nextAttemptAt > currentTime()) return current;
-      if (managedBudgetReason(live, currentTime()) || currentTime() >= live.deadline || live.continuations >= live.maxContinuations || live.failures >= live.maxFailures) {
-        live.state = 'budget_exhausted'; live.reason = 'Original managed continuation budget exhausted.'; live.updatedAt = currentTime(); notifyState(live, live.updatedAt); return current;
+      const budgetReason = managedBudgetReason(live, currentTime());
+      if (budgetReason) {
+        live.state = 'budget_exhausted'; live.reason = budgetReason; live.updatedAt = currentTime(); notifyState(live, live.updatedAt); return current;
       }
       live.state = 'auto_resuming'; live.managed.resumeLease = { id: leaseId, claimedAt: currentTime(), checkpointRevision: live.revision, decisionId: live.managed.decision?.id || null,
         owner: { pid: process.pid, identity: ownerIdentity } };
@@ -220,10 +222,10 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
     const abort = () => controller.abort();
     if (signal?.aborted) controller.abort();
     else signal?.addEventListener('abort', abort, { once: true });
-    const timeout = setTimeout(abort, Math.max(1, claimed.run.deadline - currentTime()));
+    const timeout = setTimeout(abort, Math.max(1, managedDispatchDeadline(claimed.run) - currentTime()));
     const stopWatch = watchLease(root, record.provider, record.session, current => {
       if (current?.run?.state !== 'auto_resuming' || current.run.managed?.resumeLease?.id !== leaseId ||
-        managedBudgetReason(current.run, currentTime()) || !waitingForTool && currentTime() - lastActivityAt >= 5 * 60_000) controller.abort();
+        managedBudgetReason(current.run, currentTime(), { checkProgress: false }) || !waitingForTool && currentTime() - lastActivityAt >= 5 * 60_000) controller.abort();
     }, () => controller.abort());
     try {
       if (!controller.signal.aborted) await assertActiveLease(root, record.provider, record.session, leaseId, controller.signal, currentTime);
@@ -262,7 +264,8 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
           onActivity: observation => { lastActivityAt = currentTime(); waitingForTool = observation?.waitingForTool === true; },
           onUsage: observed => {
             usage = observed;
-            if (claimed.run.managed.maxTokens && (claimed.run.managed.tokensUsed || 0) + observed.tokens >= claimed.run.managed.maxTokens) {
+            const tokenCeiling = deliveryBudgetState(claimed.run).tokenCeiling;
+            if (tokenCeiling && (claimed.run.managed.tokensUsed || 0) + observed.tokens >= tokenCeiling) {
               tokenBudgetExceeded = true; controller.abort();
             }
           },
@@ -298,7 +301,7 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
         errorCode: error?.code || 'provider_error', restorationUnverified: error?.restorationUnverified === true }; }
     finally { clearTimeout(timeout); stopWatch(); signal?.removeEventListener('abort', abort); }
     if (controller.signal.aborted) result = { ...result, code: -2, cancelled: true };
-    if (claimed.run.managed.maxTokens && !usage && !result.busy && dispatched) {
+    if (deliveryBudgetState(claimed.run).tokenCeiling && !usage && !result.busy && dispatched) {
       result = { ...result, usageUnavailable: true };
     }
     if (result.code === 0) {
@@ -331,7 +334,7 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
         live.managed.tokensUsed = (live.managed.tokensUsed || 0) + usage.tokens;
         live.managed.usageAvailable = true;
         live.managed.lastUsage = { ...usage, attemptId: leaseId };
-      } else if (!result.busy && live.managed.maxTokens && dispatched) {
+      } else if (!result.busy && deliveryBudgetState(live).tokenCeiling && dispatched) {
         live.managed.usageAvailable = false; live.managed.usageBlocked = true;
       }
       const attempt = live.managed.executionAttempt;
@@ -356,7 +359,9 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
         }
         live.updatedAt = Date.now(); notifyState(live, live.updatedAt); return current;
       }
-      if (tokenBudgetExceeded || live.managed.maxTokens && live.managed.tokensUsed >= live.managed.maxTokens) {
+      live.budgetWarnings = deliveryBudgetState(live).warnings;
+      const tokenCeiling = deliveryBudgetState(live).tokenCeiling;
+      if (tokenBudgetExceeded || tokenCeiling && live.managed.tokensUsed >= tokenCeiling) {
         live.state = 'budget_exhausted'; live.managed.autoRecovery = false;
         live.reason = 'Observed provider token budget exhausted; inspect any interrupted action in the original conversation.';
       } else if (live.managed.usageBlocked) {

package/src/desktop-host.js

@@ -18,6 +18,7 @@ import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { startAgent } from "./agent.js";
+import { createRuntimeDiagnostics } from "./runtime-diagnostics.js";
 import { createCliAutoUpdater, readCliPackageInfo } from "./auto-update.js";
 import { createAgentShutdown } from "./shutdown.js";
 import { resolveWebOrigin } from "./web-origin.js";
@@ -51,7 +52,7 @@ function desktopActionError(action, error) {
       ? "Wait for running tasks to finish before switching organizations."
       : "Could not switch organization. Refresh organizations and try again.";
   }
-  if (action === "sqm_set_enabled") {
+  if (["sqm_set_enabled", "sqm_set_engine_fallback", "sqm_retry_environment"].includes(action)) {
     return "Could not save SQM settings. Check your SIMY connection and try again.";
   }
   return "Action could not finish. Refresh the status and try again; active tasks must finish before quitting.";
@@ -74,6 +75,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     output.write(`{"type":"status","status":{${observation}${encodedStatus}}}\n`);
   };
   const root = env.SIMY_HOME?.trim() || join(homedir(), ".simy");
+  const diagnostics = createRuntimeDiagnostics(root, { name: "desktop-host" });
   const webOrigin = resolveWebOrigin(null, env);
   const candidate = Boolean(env.SIMY_DESKTOP_SUPERVISOR_TOKEN);
   if (candidate && !await validateDesktopSupervisor(root, env.SIMY_DESKTOP_SUPERVISOR_TOKEN)) {
@@ -189,6 +191,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     } catch { pluginSetup = { state: "error" }; }
   };
   const packageInfo = dependencies.packageInfo || await readCliPackageInfo();
+  diagnostics.write(`desktop starting version=${packageInfo.version} pid=${process.pid} role=${candidate ? "update-candidate" : "supervisor"}`);
   const makeAnalysisManager = () => (dependencies.createAnalysisManager || createContinuationAnalysisManager)({
     root: join(root, 'session-analysis'), analyze: async (...args) => {
       const scope = await authorizeWork();
@@ -291,7 +294,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     updater = await (dependencies.createUpdater || (process.platform === "win32" ? (() => createWindowsDesktopUpdater({ version: packageInfo.version, disabled: env.SIMY_AUTO_UPDATE === "0" })) : createCliAutoUpdater))({
       daemon: true, interactive: true, webOrigin,
       disabled: env.SIMY_AUTO_UPDATE === "0",
-      dependencies: { packageInfo, logger() {} },
+      dependencies: { packageInfo, logger: message => diagnostics.write(`update: ${message}`) },
     });
     agent = await (dependencies.startAgent || startAgent)({
       daemon: true, webOrigin, sessionRoot: root, quiet: true, updateManager: updater,
@@ -317,12 +320,17 @@ export async function startDesktopHost({ input = process.stdin, output = process
       let child;
       try { child = (dependencies.spawn || spawn)(installation.executablePath,
         [join(dirname(installation.entryPath), "desktop-host.js")], {
-          stdio: ["pipe", "pipe", "ignore"],
+          stdio: ["pipe", "pipe", "pipe"],
           env: { ...env, SIMY_DESKTOP_SUPERVISOR_TOKEN: supervisorToken },
         }); } catch (error) {
           actionAssociations = makeActionAssociations();
           analysisManager = await makeAnalysisManager(); automaticContinuation = makeAutomaticContinuation(); discoveryStopped = false; refreshSessions(true); throw error;
         }
+      const stderr = diagnostics.stream("updated-runtime stderr");
+      child.stderr?.on("data", stderr.write);
+      child.stderr?.on("end", stderr.flush);
+      child.once("error", error => diagnostics.write(`updated-runtime error: ${error.code || "unknown"} ${error.message}`));
+      child.once("exit", (code, signal) => { stderr.flush(); diagnostics.write(`updated-runtime exit: code=${code} signal=${signal || "none"}`); });
       const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
       let accepted = false;
       child.stdin.on("error", () => {
@@ -444,6 +452,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
         }
         else if (action === "organizations_refresh") await agent.refreshOrganizations();
         else if (action === "sqm_set_enabled") await agent.setSqmEnabled(command.enabled);
+        else if (action === "sqm_set_engine_fallback") await agent.setSqmEngineFallback({ enabled: command.enabled, allowedProviders: command.allowedProviders });
+        else if (action === "sqm_retry_environment") await agent.retrySqmEnvironment();
         else if (action === "organization_cancel") agent.cancelOrganizationSelection();
         else if (action === "login" || action === "organization_select" || action === "authorization_open") {
           if (action === "organization_select" && (typeof command.organizationId !== "string" || !command.organizationId)) throw new Error("Select an organization first.");
@@ -490,9 +500,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
         else if (action === "codex_hooks" || action === "claude_hooks") {
           const provider = action === "codex_hooks" ? "codex" : "claude";
           await (dependencies.openHookSettings || openHookSetup)(provider);
-        } else if (["delivery_stop", "delivery_resume", "delivery_pause", "delivery_approve", "delivery_reject", "delivery_replan", "delivery_set_policy", "delivery_dependency_ready"].includes(action)) {
+        } else if (["delivery_stop", "delivery_resume", "delivery_pause", "delivery_approve", "delivery_reject", "delivery_replan", "delivery_set_policy", "delivery_dependency_ready", "delivery_extend", "delivery_continuation_policy"].includes(action)) {
           await controlDelivery({ root: join(root, "delivery-hooks"), provider: command.provider, session: command.session,
-            taskId: command.taskId, approvalId: command.approvalId, autonomyPolicy: command.autonomyPolicy, waitId: command.waitId, answer: command.answer, action: action.slice("delivery_".length) });
+            taskId: command.taskId, approvalId: command.approvalId, autonomyPolicy: command.autonomyPolicy, limits: command.limits, continuationPolicy: command.continuationPolicy, waitId: command.waitId, answer: command.answer, action: action.slice("delivery_".length) });
         } else if (action === "delivery_verify") {
           await verifyDelivery({ root: join(root, "delivery-hooks"), provider: command.provider, session: command.session,
             taskId: command.taskId, criterionId: command.criterionId });
@@ -508,7 +518,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           }
           if (command.enabled) await authorizeWork(commandScope);
           await (dependencies.setSessionAutoContinue || setSessionAutoContinue)({ root: join(root, 'delivery-hooks'),
-            provider: command.provider, session: command.session, enabled: command.enabled });
+            provider: command.provider, session: command.session, enabled: command.enabled, continuationPolicy: command.continuationPolicy, hardMaxMinutes: command.hardMaxMinutes, hardMaxContinuations: command.hardMaxContinuations, providerTokenCeiling: command.providerTokenCeiling });
           if (!command.enabled) automaticContinuation.revoke(command.provider, command.session);
           // Acknowledge the durable preference before discovery or analysis.
           emit({ type: "result", id: command.id, ok: true });
@@ -544,7 +554,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await (dependencies.enrollSession || enrollSession)({ root: join(root, "delivery-hooks"), provider: command.provider,
             session: command.session, objective: command.objective, acceptanceCriteria: command.acceptanceCriteria,
             autonomyPolicy: command.autonomyPolicy, maxMinutes: command.maxMinutes,
-            maxContinuations: command.maxContinuations, maxFailures: command.maxFailures, maxNoProgressMinutes: command.maxNoProgressMinutes, maxTokens: command.maxTokens });
+            maxContinuations: command.maxContinuations, maxFailures: command.maxFailures, maxNoProgressMinutes: command.maxNoProgressMinutes, maxTokens: command.maxTokens, continuationPolicy: command.continuationPolicy, hardMaxMinutes: command.hardMaxMinutes, hardMaxContinuations: command.hardMaxContinuations, providerTokenCeiling: command.providerTokenCeiling });
           await refreshSessions(true);
         } else if (action === "session_analyze") {
           const candidate = await selectedSession(command, { reuseDiscovery: true });
@@ -558,7 +568,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
             enroll: async options => { await authorizeWork(commandScope); return guardedEnroll(options); }, beforeEnroll: () => authorizeWork(commandScope),
             settings: { autonomyPolicy: command.autonomyPolicy, maxMinutes: command.maxMinutes,
               maxContinuations: command.maxContinuations, maxFailures: command.maxFailures,
-              maxNoProgressMinutes: command.maxNoProgressMinutes, maxTokens: command.maxTokens } });
+              maxNoProgressMinutes: command.maxNoProgressMinutes, maxTokens: command.maxTokens, continuationPolicy: command.continuationPolicy, hardMaxMinutes: command.hardMaxMinutes, hardMaxContinuations: command.hardMaxContinuations, providerTokenCeiling: command.providerTokenCeiling } });
           await refreshSessions(true);
         } else if (action === "session_answer") {
           await (dependencies.answerSession || answerSession)({ root: join(root, "delivery-hooks"), provider: command.provider,
@@ -668,6 +678,7 @@ if (isDesktopHostEntry()) {
   const stop = () => { void host?.close().finally(() => process.exit(0)); };
   process.once("SIGTERM", stop); process.once("SIGINT", stop);
   startDesktopHost().then((value) => { host = value; }).catch((error) => {
+    createRuntimeDiagnostics(process.env.SIMY_HOME?.trim() || join(homedir(), ".simy"), { name: "desktop-host" }).write(`startup failed: ${error?.stack || error}`);
     const conflict = error?.code === PROCESS_CONFLICT_CODE;
     process.stdout.write(`${JSON.stringify({
       type: "error",

package/src/desktop-sqm-settings.js

@@ -1,4 +1,4 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
@@ -8,16 +8,33 @@ export function sqmSettingsPath(root, origin, session) {
   return join(root, 'sqm-settings', `${key}.json`);
 }
 export async function readSqmEnabled(root, origin, session) {
+  return (await readSqmSettings(root, origin, session)).enabled;
+}
+export async function readSqmSettings(root, origin, session) {
   const path = sqmSettingsPath(root, origin, session);
-  if (!path) return false;
-  try { return JSON.parse(await readFile(path, 'utf8')).enabled === true; }
-  catch (error) { if (error.code === 'ENOENT' || error instanceof SyntaxError) return false; throw error; }
+  if (!path) return { enabled: false, enable_engine_fallback: false, allowed_fallback_providers: [] };
+  try {
+    const settings = JSON.parse(await readFile(path, 'utf8'));
+    return { enabled: settings.enabled === true, enable_engine_fallback: settings.enable_engine_fallback === true,
+      allowed_fallback_providers: Array.isArray(settings.allowed_fallback_providers)
+        ? [...new Set(settings.allowed_fallback_providers.filter(provider => ['codex', 'claude'].includes(provider)))] : [] };
+  } catch (error) { if (error.code === 'ENOENT' || error instanceof SyntaxError) return { enabled: false, enable_engine_fallback: false, allowed_fallback_providers: [] }; throw error; }
 }
 export async function writeSqmEnabled(root, origin, session, enabled) {
+  return writeSqmSettings(root, origin, session, { enabled });
+}
+export async function writeSqmEngineFallback(root, origin, session, { enabled, allowedProviders } = {}) {
+  if (typeof enabled !== 'boolean' || !Array.isArray(allowedProviders) || allowedProviders.some(provider => !['codex', 'claude'].includes(provider))) {
+    throw new Error('Select allowed local SQM fallback providers explicitly.');
+  }
+  return writeSqmSettings(root, origin, session, { enable_engine_fallback: enabled, allowed_fallback_providers: [...new Set(allowedProviders)] });
+}
+async function writeSqmSettings(root, origin, session, update) {
   const path = sqmSettingsPath(root, origin, session);
-  if (!path || typeof enabled !== 'boolean') throw new Error('Sign in to an organization before enabling SQM.');
+  if (!path || ('enabled' in update && typeof update.enabled !== 'boolean')) throw new Error('Sign in to an organization before enabling SQM.');
+  const current = await readSqmSettings(root, origin, session);
   await mkdir(join(root, 'sqm-settings'), { recursive: true, mode: 0o700 });
-  const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile(temporary, JSON.stringify({ enabled }), { mode: 0o600 });
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  await writeFile(temporary, JSON.stringify({ ...current, ...update }), { mode: 0o600 });
   await rename(temporary, path);
 }