@awak-app/simy-cli 0.5.72 → 0.5.73

package/src/delivery-hooks/command.js

@@ -18,12 +18,15 @@ async function readCheckpointInput(input) {
 export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = process.cwd(), input = process.stdin, output = console.log } = {}) {
   const [action, ...args] = argv;
   if (!action || action === '--help') {
+    output('Progress: --continuation-policy progress [--hard-max-minutes 1440] [--hard-max-continuations 50] [--provider-token-ceiling 15000000 (Codex only)]. Soft thresholds warn; approvals, missing usage and no verified progress still stop.');
+    output('simy delivery continuation_policy --provider PROVIDER --session ID --task-id ID --continuation-policy bounded|progress');
+    output('simy delivery extend --provider PROVIDER --session ID --task-id ID --hard-max-minutes N|--hard-max-continuations N|--provider-token-ceiling N');
     output('simy delivery continue --provider codex|claude --session ID [--max-no-progress-minutes 30] [--max-tokens N (Codex only)]\nsimy delivery dependency_ready --provider PROVIDER --session ID --task-id ID --wait-id ID --answer TEXT\nsimy delivery handoff|handoff_cancel --provider codex --session ID --task-id ID --target-session ID');
     output('simy delivery start --provider codex|claude --session ID --objective TEXT --next-step TEXT [--managed-file task.json] [--max-continuations 6] [--max-failures 3] [--max-minutes 30]\nsimy delivery checkpoint --provider codex|claude --session ID --file checkpoint.json|-\nsimy delivery status\nsimy delivery stop|pause|resume --provider codex|claude --session ID [--task-id ID]\nsimy delivery replan --provider PROVIDER --session ID --task-id ID\nsimy delivery approve|reject --provider PROVIDER --session ID --task-id ID --approval-id ID\nsimy delivery verify --provider PROVIDER --session ID --task-id ID --criterion-id ID\nsimy delivery set_policy --provider PROVIDER --session ID --task-id ID --autonomy-policy strict|balanced|autonomous\nEnable and review SIMY hooks in your provider first. Manual managed start requires an acceptance specification. Desktop Continue infers the original conversation goal first. Resume preserves original budgets.');
     return 0;
   }
   const options = {};
-  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-continuations', 'max-failures', 'max-minutes', 'max-no-progress-minutes', 'max-tokens', 'file', 'managed-file', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
+  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-continuations', 'max-failures', 'max-minutes', 'max-no-progress-minutes', 'max-tokens', 'continuation-policy', 'hard-max-minutes', 'hard-max-continuations', 'provider-token-ceiling', 'file', 'managed-file', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
   for (let i = 0; i < args.length; i += 2) {
     const key = args[i]?.replace(/^--/, '');
     if (!args[i]?.startsWith('--') || !allowed.has(key) || args[i + 1] === undefined || Object.hasOwn(options, key)) throw new Error('Invalid delivery option. Use simy delivery --help.');
@@ -32,8 +35,9 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
   const base = { root, cwd, provider: options.provider, session: options.session };
   let result;
   if (action === 'status') result = (await listRecords(root)).filter(r => (!options.provider || r.provider === options.provider) && (!options.session || r.session === options.session));
-  else if (action === 'continue') result = await continueSession({ ...base, autonomyPolicy: options['autonomy-policy'],
+  else if (action === 'continue') result = await continueSession({ ...base, autonomyPolicy: options['autonomy-policy'], continuationPolicy: options['continuation-policy'],
     ...Object.fromEntries([['max-continuations', 'maxContinuations'], ['max-failures', 'maxFailures'], ['max-minutes', 'maxMinutes'],
+      ['hard-max-minutes', 'hardMaxMinutes'], ['hard-max-continuations', 'hardMaxContinuations'], ['provider-token-ceiling', 'providerTokenCeiling'],
       ['max-no-progress-minutes', 'maxNoProgressMinutes'], ['max-tokens', 'maxTokens']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
   else if (action === 'handoff') result = await handoffSession({ ...base, taskId: options['task-id'], targetSession: options['target-session'] });
   else if (action === 'handoff_cancel') result = await cancelHandoffSession({ ...base, taskId: options['task-id'], targetSession: options['target-session'] });
@@ -49,15 +53,17 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
       managed = { ...managed, ...Object.fromEntries([['max-tokens', 'maxTokens'], ['max-no-progress-minutes', 'maxNoProgressMinutes']]
         .filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) };
     }
-    result = await startDelivery({ ...base, objective: options.objective, nextStep: options['next-step'], managed,
-    ...Object.fromEntries([['max-continuations', 'maxContinuations'], ['max-failures', 'maxFailures'], ['max-minutes', 'maxMinutes']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
+    result = await startDelivery({ ...base, objective: options.objective, nextStep: options['next-step'], managed, continuationPolicy: options['continuation-policy'],
+    ...Object.fromEntries([['max-continuations', 'maxContinuations'], ['max-failures', 'maxFailures'], ['max-minutes', 'maxMinutes'],
+      ['hard-max-minutes', 'hardMaxMinutes'], ['hard-max-continuations', 'hardMaxContinuations'], ['provider-token-ceiling', 'providerTokenCeiling']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
   }
   else if (action === 'checkpoint') {
     if (!options.file) throw new Error('--file is required.');
     const data = options.file === '-' ? await readCheckpointInput(input) : await readFile(options.file, 'utf8');
     if (Buffer.byteLength(data) > 64 * 1024) throw new Error('Checkpoint exceeds 64 KiB.');
     result = await checkpointDelivery({ ...base, checkpoint: JSON.parse(data) });
-  } else if (['stop', 'pause', 'resume', 'replan', 'approve', 'reject', 'set_policy', 'dependency_ready'].includes(action)) result = await controlDelivery({ ...base, taskId: options['task-id'], approvalId: options['approval-id'], autonomyPolicy: options['autonomy-policy'], waitId: options['wait-id'], answer: options.answer, action });
+  } else if (['stop', 'pause', 'resume', 'replan', 'approve', 'reject', 'set_policy', 'dependency_ready', 'extend', 'continuation_policy'].includes(action)) result = await controlDelivery({ ...base, taskId: options['task-id'], approvalId: options['approval-id'], autonomyPolicy: options['autonomy-policy'], continuationPolicy: options['continuation-policy'],
+    limits: Object.fromEntries([['hard-max-minutes', 'hardMaxMinutes'], ['hard-max-continuations', 'hardMaxContinuations'], ['provider-token-ceiling', 'providerTokenCeiling']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])), waitId: options['wait-id'], answer: options.answer, action });
   else if (action === 'verify') result = await verifyDelivery({ ...base, taskId: options['task-id'], criterionId: options['criterion-id'] });
   else throw new Error('Unknown delivery command.');
   output(JSON.stringify(result, null, 2));

package/src/delivery-hooks/desktop.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { canReplanDelivery, managedBudgetReason, reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { canChangeDeliveryContinuation, canReplanDelivery, deliveryBudgetState, managedBudgetReason, reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { originalSessionTarget } from '../session-supervision/original-session-target.js';
 
 export const HOOK_SETUP = Object.freeze({
@@ -32,6 +32,15 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
       provider: r.provider, session: r.session, originalSessionTarget: originalSessionTarget(r.provider, r.session),
       objective: r.run.objective, state: r.run.state, reason: r.run.reason,
       continuations: r.run.continuations, maxContinuations: r.run.maxContinuations, deadline: r.run.deadline,
+      continuationPolicy: r.run.managed?.continuationPolicy || 'bounded',
+      startedAt: r.run.startedAt,
+      continuationLimits: deliveryBudgetState(r.run, now),
+      canChangeContinuation: canChangeDeliveryContinuation(r.run),
+      hardDeadline: r.run.hardDeadline || null, hardMaxContinuations: r.run.hardMaxContinuations || null,
+      budgetWarnings: deliveryBudgetState(r.run, now).warnings,
+      budgetCapability: r.run.managed?.budgetCapability || null,
+      outcomeProgress: r.run.managed?.outcomeProgress || null,
+      budgetExtensionHistory: r.run.budgetExtensionHistory || [],
       needsAttention: ['blocked', 'failed', 'recovery_required', 'budget_exhausted', 'verification_pending'].includes(r.run.state), updatedAt: r.run.updatedAt,
       managed: Boolean(r.run.managed), taskId: r.run.managed?.taskId || null, actionId: r.run.managed?.actionId || null,
       actionDueAt: r.run.managed?.actionDueAt ?? null,
@@ -67,12 +76,12 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
         r.run.managed.resumeChannel === 'codex_app_server' && r.run.managed.autoRecovery),
       canResume: ['blocked', 'recovery_required', 'paused'].includes(r.run.state) && r.run.managed?.phase !== 'needs_clarification' &&
         !r.run.managed?.pendingApproval && !r.run.managed?.dependencyWait && !['pending', 'pending_received', 'transferred'].includes(r.run.managed?.handoff?.status) &&
-        !managedBudgetReason(r.run, now) && now < r.run.deadline && r.run.continuations < r.run.maxContinuations,
+        !managedBudgetReason(r.run, now),
       canApprove: r.run.state === 'blocked' && Boolean(r.run.managed?.pendingApproval) && !r.run.managed.pendingApproval.denied,
       canReject: r.run.state === 'blocked' && Boolean(r.run.managed?.pendingApproval) && !r.run.managed.pendingApproval.denied,
       canReplan: canReplanDelivery(r.run, r.provider, now),
       canAnswer: r.run.managed?.phase === 'needs_clarification' && r.run.state === 'blocked' && Boolean(r.run.managed.understandingQuestion?.id) &&
-        now < r.run.deadline && r.run.continuations < r.run.maxContinuations && r.run.failures < r.run.maxFailures,
+        !managedBudgetReason(r.run, now),
       canResolveDependency: r.run.state === 'blocked' && r.run.blocker === 'external_dependency' && Boolean(r.run.managed?.dependencyWait?.id) &&
         !managedBudgetReason(r.run, now) && !['pending', 'pending_received', 'transferred'].includes(r.run.managed?.handoff?.status),
       canSetPolicy: Boolean(r.run.managed?.autonomyPolicy) && !['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted'].includes(r.run.state),

package/src/delivery-hooks/supervisor.js

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { dirname } from 'node:path';
-import { automaticContinuationAllowed, assessedCheckpointContract, checkpointDelivery, decideStop, listRecords, readRecord, managedBudgetReason, notifyState, processIdentity, reconcileRecords, updateRecord, verifyAutomaticCriteria } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { automaticContinuationAllowed, assessedCheckpointContract, checkpointDelivery, decideStop, deliveryBudgetState, listRecords, readRecord, managedBudgetReason, managedDispatchDeadline, notifyState, processIdentity, reconcileRecords, updateRecord, verifyAutomaticCriteria } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { resolveBackendExecutable } from '../backend-executable.js';
 import { executeCodexAppServer } from '../session-supervision/codex-app-server.js';
 import { acquireWorkspaceLease, leaseOwnerDead } from '../session-supervision/workspace-lease.js';
@@ -38,7 +38,7 @@ async function assertActiveLease(root, provider, session, leaseId, signal, curre
   if (signal?.aborted || current?.run?.state !== 'auto_resuming' || current.run.managed?.resumeLease?.id !== leaseId) {
     throw new Error('Managed recovery lease changed before provider dispatch.');
   }
-  if (currentTime() >= current.run.deadline) throw new Error('Managed recovery deadline expired before provider dispatch.');
+  if (currentTime() >= managedDispatchDeadline(current.run)) throw new Error('Managed recovery deadline expired before provider dispatch.');
   if (!automaticContinuationAllowed(current)) throw new Error('Automatic continuation was disabled before provider dispatch.');
   if (managedBudgetReason(current.run, currentTime())) throw new Error('Managed progress budget expired before provider dispatch.');
   const managed = current.run.managed;
@@ -78,12 +78,13 @@ export async function executeCodexResume(record, { signal, root, leaseId, execut
     lastDependencyResolution: run.managed.lastDependencyResolution,
     remainingWork: run.managed.remainingWork, acceptanceCriteria: run.managed.acceptanceCriteria, proposedAction: run.managed.proposedAction,
     currentDecision: run.managed.autonomyPolicy ? run.managed.decision : undefined, diagnosis: run.managed.plan?.diagnosis,
-    budgets: { continuations: run.continuations, maxContinuations: run.maxContinuations, failures: run.failures, maxFailures: run.maxFailures, deadline: run.deadline } };
+    budgets: { ...deliveryBudgetState(run), continuations: run.continuations, failures: run.failures, maxFailures: run.maxFailures,
+      softDeadline: run.deadline, softMaxContinuations: run.maxContinuations } };
   const prompt = run.managed.autonomyPolicy ? `Continue the existing SIMY managed task in this exact session. Context: ${JSON.stringify(context)}\nExecute ONLY currentDecision.action. Its expectedVerification and rollback apply to this turn. Stay within provider permissions. End with ONLY one JSON checkpoint. ${assessedCheckpointContract(run.managed.decision)} Do not write SIMY state directly.` : `Continue the existing SIMY managed task in this exact session. Context: ${JSON.stringify(context)}\nStay within the original task and provider permissions. End with ONLY one JSON object: {"status":"in_progress|completed|blocked|error","summary":"...","nextStep":"...","remainingWork":"...","proposedAction":{"kind":"read|local_edit|local_test|external|destructive|scope_change|unknown","scope":"...","summary":"..."},"evidence":[],"acceptanceMet":false}. For blocked include blocker (authorization, missing_information, external_dependency), and for authorization include approval {kind,scope,summary}. Do not claim completion without checking frozen acceptance. SIMY independently verifies supported criteria. Do not write SIMY state directly. If approval or input is needed, return blocked and stop.`;
   const sandbox = run.managed.autonomyPolicy && run.managed.decision?.action.kind === 'read' ? 'read-only' : run.managed.autoRecoverySandbox;
   const args = ['exec', '--json', '--skip-git-repo-check', '-s', sandbox, '-m', run.managed.resumeModel, 'resume', record.session, prompt];
   if (signal?.aborted) throw new Error('Managed recovery cancelled before provider dispatch.');
-  if (currentTime() >= run.deadline) throw new Error('Managed recovery deadline expired before provider dispatch.');
+  if (currentTime() >= managedDispatchDeadline(run)) throw new Error('Managed recovery deadline expired before provider dispatch.');
   await beforeDispatch();
   if (signal?.aborted) throw new Error('Managed recovery cancelled before provider dispatch.');
   if (currentTime() >= run.deadline) throw new Error('Managed recovery deadline expired before provider dispatch.');
@@ -221,10 +222,10 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
     const abort = () => controller.abort();
     if (signal?.aborted) controller.abort();
     else signal?.addEventListener('abort', abort, { once: true });
-    const timeout = setTimeout(abort, Math.max(1, claimed.run.deadline - currentTime()));
+    const timeout = setTimeout(abort, Math.max(1, managedDispatchDeadline(claimed.run) - currentTime()));
     const stopWatch = watchLease(root, record.provider, record.session, current => {
       if (current?.run?.state !== 'auto_resuming' || current.run.managed?.resumeLease?.id !== leaseId ||
-        managedBudgetReason(current.run, currentTime()) || !waitingForTool && currentTime() - lastActivityAt >= 5 * 60_000) controller.abort();
+        managedBudgetReason(current.run, currentTime(), { checkProgress: false }) || !waitingForTool && currentTime() - lastActivityAt >= 5 * 60_000) controller.abort();
     }, () => controller.abort());
     try {
       if (!controller.signal.aborted) await assertActiveLease(root, record.provider, record.session, leaseId, controller.signal, currentTime);
@@ -263,7 +264,8 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
           onActivity: observation => { lastActivityAt = currentTime(); waitingForTool = observation?.waitingForTool === true; },
           onUsage: observed => {
             usage = observed;
-            if (claimed.run.managed.maxTokens && (claimed.run.managed.tokensUsed || 0) + observed.tokens >= claimed.run.managed.maxTokens) {
+            const tokenCeiling = deliveryBudgetState(claimed.run).tokenCeiling;
+            if (tokenCeiling && (claimed.run.managed.tokensUsed || 0) + observed.tokens >= tokenCeiling) {
               tokenBudgetExceeded = true; controller.abort();
             }
           },
@@ -299,7 +301,7 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
         errorCode: error?.code || 'provider_error', restorationUnverified: error?.restorationUnverified === true }; }
     finally { clearTimeout(timeout); stopWatch(); signal?.removeEventListener('abort', abort); }
     if (controller.signal.aborted) result = { ...result, code: -2, cancelled: true };
-    if (claimed.run.managed.maxTokens && !usage && !result.busy && dispatched) {
+    if (deliveryBudgetState(claimed.run).tokenCeiling && !usage && !result.busy && dispatched) {
       result = { ...result, usageUnavailable: true };
     }
     if (result.code === 0) {
@@ -332,7 +334,7 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
         live.managed.tokensUsed = (live.managed.tokensUsed || 0) + usage.tokens;
         live.managed.usageAvailable = true;
         live.managed.lastUsage = { ...usage, attemptId: leaseId };
-      } else if (!result.busy && live.managed.maxTokens && dispatched) {
+      } else if (!result.busy && deliveryBudgetState(live).tokenCeiling && dispatched) {
         live.managed.usageAvailable = false; live.managed.usageBlocked = true;
       }
       const attempt = live.managed.executionAttempt;
@@ -357,7 +359,9 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
         }
         live.updatedAt = Date.now(); notifyState(live, live.updatedAt); return current;
       }
-      if (tokenBudgetExceeded || live.managed.maxTokens && live.managed.tokensUsed >= live.managed.maxTokens) {
+      live.budgetWarnings = deliveryBudgetState(live).warnings;
+      const tokenCeiling = deliveryBudgetState(live).tokenCeiling;
+      if (tokenBudgetExceeded || tokenCeiling && live.managed.tokensUsed >= tokenCeiling) {
         live.state = 'budget_exhausted'; live.managed.autoRecovery = false;
         live.reason = 'Observed provider token budget exhausted; inspect any interrupted action in the original conversation.';
       } else if (live.managed.usageBlocked) {

package/src/desktop-host.js

@@ -52,7 +52,7 @@ function desktopActionError(action, error) {
       ? "Wait for running tasks to finish before switching organizations."
       : "Could not switch organization. Refresh organizations and try again.";
   }
-  if (action === "sqm_set_enabled") {
+  if (["sqm_set_enabled", "sqm_set_engine_fallback", "sqm_retry_environment"].includes(action)) {
     return "Could not save SQM settings. Check your SIMY connection and try again.";
   }
   return "Action could not finish. Refresh the status and try again; active tasks must finish before quitting.";
@@ -452,6 +452,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
         }
         else if (action === "organizations_refresh") await agent.refreshOrganizations();
         else if (action === "sqm_set_enabled") await agent.setSqmEnabled(command.enabled);
+        else if (action === "sqm_set_engine_fallback") await agent.setSqmEngineFallback({ enabled: command.enabled, allowedProviders: command.allowedProviders });
+        else if (action === "sqm_retry_environment") await agent.retrySqmEnvironment();
         else if (action === "organization_cancel") agent.cancelOrganizationSelection();
         else if (action === "login" || action === "organization_select" || action === "authorization_open") {
           if (action === "organization_select" && (typeof command.organizationId !== "string" || !command.organizationId)) throw new Error("Select an organization first.");
@@ -498,9 +500,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
         else if (action === "codex_hooks" || action === "claude_hooks") {
           const provider = action === "codex_hooks" ? "codex" : "claude";
           await (dependencies.openHookSettings || openHookSetup)(provider);
-        } else if (["delivery_stop", "delivery_resume", "delivery_pause", "delivery_approve", "delivery_reject", "delivery_replan", "delivery_set_policy", "delivery_dependency_ready"].includes(action)) {
+        } else if (["delivery_stop", "delivery_resume", "delivery_pause", "delivery_approve", "delivery_reject", "delivery_replan", "delivery_set_policy", "delivery_dependency_ready", "delivery_extend", "delivery_continuation_policy"].includes(action)) {
           await controlDelivery({ root: join(root, "delivery-hooks"), provider: command.provider, session: command.session,
-            taskId: command.taskId, approvalId: command.approvalId, autonomyPolicy: command.autonomyPolicy, waitId: command.waitId, answer: command.answer, action: action.slice("delivery_".length) });
+            taskId: command.taskId, approvalId: command.approvalId, autonomyPolicy: command.autonomyPolicy, limits: command.limits, continuationPolicy: command.continuationPolicy, waitId: command.waitId, answer: command.answer, action: action.slice("delivery_".length) });
         } else if (action === "delivery_verify") {
           await verifyDelivery({ root: join(root, "delivery-hooks"), provider: command.provider, session: command.session,
             taskId: command.taskId, criterionId: command.criterionId });
@@ -516,7 +518,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           }
           if (command.enabled) await authorizeWork(commandScope);
           await (dependencies.setSessionAutoContinue || setSessionAutoContinue)({ root: join(root, 'delivery-hooks'),
-            provider: command.provider, session: command.session, enabled: command.enabled });
+            provider: command.provider, session: command.session, enabled: command.enabled, continuationPolicy: command.continuationPolicy, hardMaxMinutes: command.hardMaxMinutes, hardMaxContinuations: command.hardMaxContinuations, providerTokenCeiling: command.providerTokenCeiling });
           if (!command.enabled) automaticContinuation.revoke(command.provider, command.session);
           // Acknowledge the durable preference before discovery or analysis.
           emit({ type: "result", id: command.id, ok: true });
@@ -552,7 +554,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await (dependencies.enrollSession || enrollSession)({ root: join(root, "delivery-hooks"), provider: command.provider,
             session: command.session, objective: command.objective, acceptanceCriteria: command.acceptanceCriteria,
             autonomyPolicy: command.autonomyPolicy, maxMinutes: command.maxMinutes,
-            maxContinuations: command.maxContinuations, maxFailures: command.maxFailures, maxNoProgressMinutes: command.maxNoProgressMinutes, maxTokens: command.maxTokens });
+            maxContinuations: command.maxContinuations, maxFailures: command.maxFailures, maxNoProgressMinutes: command.maxNoProgressMinutes, maxTokens: command.maxTokens, continuationPolicy: command.continuationPolicy, hardMaxMinutes: command.hardMaxMinutes, hardMaxContinuations: command.hardMaxContinuations, providerTokenCeiling: command.providerTokenCeiling });
           await refreshSessions(true);
         } else if (action === "session_analyze") {
           const candidate = await selectedSession(command, { reuseDiscovery: true });
@@ -566,7 +568,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
             enroll: async options => { await authorizeWork(commandScope); return guardedEnroll(options); }, beforeEnroll: () => authorizeWork(commandScope),
             settings: { autonomyPolicy: command.autonomyPolicy, maxMinutes: command.maxMinutes,
               maxContinuations: command.maxContinuations, maxFailures: command.maxFailures,
-              maxNoProgressMinutes: command.maxNoProgressMinutes, maxTokens: command.maxTokens } });
+              maxNoProgressMinutes: command.maxNoProgressMinutes, maxTokens: command.maxTokens, continuationPolicy: command.continuationPolicy, hardMaxMinutes: command.hardMaxMinutes, hardMaxContinuations: command.hardMaxContinuations, providerTokenCeiling: command.providerTokenCeiling } });
           await refreshSessions(true);
         } else if (action === "session_answer") {
           await (dependencies.answerSession || answerSession)({ root: join(root, "delivery-hooks"), provider: command.provider,

package/src/desktop-sqm-settings.js

@@ -1,4 +1,4 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
@@ -8,16 +8,33 @@ export function sqmSettingsPath(root, origin, session) {
   return join(root, 'sqm-settings', `${key}.json`);
 }
 export async function readSqmEnabled(root, origin, session) {
+  return (await readSqmSettings(root, origin, session)).enabled;
+}
+export async function readSqmSettings(root, origin, session) {
   const path = sqmSettingsPath(root, origin, session);
-  if (!path) return false;
-  try { return JSON.parse(await readFile(path, 'utf8')).enabled === true; }
-  catch (error) { if (error.code === 'ENOENT' || error instanceof SyntaxError) return false; throw error; }
+  if (!path) return { enabled: false, enable_engine_fallback: false, allowed_fallback_providers: [] };
+  try {
+    const settings = JSON.parse(await readFile(path, 'utf8'));
+    return { enabled: settings.enabled === true, enable_engine_fallback: settings.enable_engine_fallback === true,
+      allowed_fallback_providers: Array.isArray(settings.allowed_fallback_providers)
+        ? [...new Set(settings.allowed_fallback_providers.filter(provider => ['codex', 'claude'].includes(provider)))] : [] };
+  } catch (error) { if (error.code === 'ENOENT' || error instanceof SyntaxError) return { enabled: false, enable_engine_fallback: false, allowed_fallback_providers: [] }; throw error; }
 }
 export async function writeSqmEnabled(root, origin, session, enabled) {
+  return writeSqmSettings(root, origin, session, { enabled });
+}
+export async function writeSqmEngineFallback(root, origin, session, { enabled, allowedProviders } = {}) {
+  if (typeof enabled !== 'boolean' || !Array.isArray(allowedProviders) || allowedProviders.some(provider => !['codex', 'claude'].includes(provider))) {
+    throw new Error('Select allowed local SQM fallback providers explicitly.');
+  }
+  return writeSqmSettings(root, origin, session, { enable_engine_fallback: enabled, allowed_fallback_providers: [...new Set(allowedProviders)] });
+}
+async function writeSqmSettings(root, origin, session, update) {
   const path = sqmSettingsPath(root, origin, session);
-  if (!path || typeof enabled !== 'boolean') throw new Error('Sign in to an organization before enabling SQM.');
+  if (!path || ('enabled' in update && typeof update.enabled !== 'boolean')) throw new Error('Sign in to an organization before enabling SQM.');
+  const current = await readSqmSettings(root, origin, session);
   await mkdir(join(root, 'sqm-settings'), { recursive: true, mode: 0o700 });
-  const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile(temporary, JSON.stringify({ enabled }), { mode: 0o600 });
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  await writeFile(temporary, JSON.stringify({ ...current, ...update }), { mode: 0o600 });
   await rename(temporary, path);
 }

package/src/device-signing-identity.js

@@ -0,0 +1,65 @@
+import { constants } from "node:fs";
+import { mkdir, open, lstat } from "node:fs/promises";
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync } from "node:crypto";
+import path from "node:path";
+
+// Shared SQM/Purpose identity. Inspection never creates or repairs a key.
+export async function loadDeviceSigningIdentity(location, { create = false } = {}) {
+  const parent = path.dirname(location);
+  if (create) await mkdir(parent, { recursive: true, mode: 0o700 });
+  try {
+    const directory = await lstat(parent);
+    if (!directory.isDirectory() || directory.isSymbolicLink() || (process.platform !== "win32" && (directory.mode & 0o022) !== 0)) throw new Error("Unsafe signing key directory.");
+    const details = await lstat(location);
+    assertPrivateFile(details);
+    const handle = await open(location, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    try {
+      const opened = await handle.stat();
+      assertPrivateFile(opened);
+      if (opened.ino !== details.ino || opened.dev !== details.dev || opened.size > 4096) throw new Error("Signing key changed while opening.");
+      const raw = await handle.readFile("utf8");
+      const after = await handle.stat();
+      if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs) throw new Error("Signing key changed while reading.");
+      const parsed = JSON.parse(raw);
+      const privateKey = createPrivateKey({ key: decode(parsed.private_key), format: "der", type: "pkcs8" });
+      const publicKeyDer = createPublicKey(privateKey).export({ format: "der", type: "spki" });
+      const keyId = `sha256:${createHash("sha256").update(publicKeyDer).digest("hex")}`;
+      if (privateKey.asymmetricKeyType !== "ed25519" || parsed.algorithm !== "ed25519" ||
+          parsed.key_id !== keyId || !decode(parsed.public_key).equals(publicKeyDer)) throw new Error("Signing key pair does not match.");
+      return { privateKey, publicKeyDer, keyId };
+    } finally { await handle.close(); }
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    if (!create) return null;
+  }
+  const pair = generateKeyPairSync("ed25519");
+  const publicKeyDer = pair.publicKey.export({ format: "der", type: "spki" });
+  const keyId = `sha256:${createHash("sha256").update(publicKeyDer).digest("hex")}`;
+  let handle;
+  try {
+    handle = await open(location, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+  } catch (error) {
+    if (error.code === "EEXIST") return loadDeviceSigningIdentity(location);
+    throw error;
+  }
+  try {
+    await handle.writeFile(`${JSON.stringify({ algorithm: "ed25519", key_id: keyId,
+      private_key: pair.privateKey.export({ format: "der", type: "pkcs8" }).toString("base64"),
+      public_key: publicKeyDer.toString("base64"), created_at: new Date().toISOString() })}\n`);
+    await handle.sync();
+  } finally { await handle.close(); }
+  return { privateKey: pair.privateKey, publicKeyDer, keyId };
+}
+
+function assertPrivateFile(details) {
+  if (!details.isFile() || details.isSymbolicLink() || details.nlink !== 1 ||
+      (process.platform !== "win32" && ((details.mode & 0o077) !== 0 ||
+        (typeof process.getuid === "function" && details.uid !== process.getuid())))) throw new Error("Signing key must be a private regular file.");
+}
+
+function decode(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)) throw new Error("Invalid signing key encoding.");
+  const bytes = Buffer.from(value, "base64");
+  if (bytes.toString("base64") !== value) throw new Error("Invalid signing key encoding.");
+  return bytes;
+}

package/src/diagnostic-log.js

@@ -0,0 +1,68 @@
+import { randomUUID, createHash } from "node:crypto";
+import { mkdir, appendFile, rename, writeFile, readdir, readFile, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { defaultSessionRoot } from "./session-store.js";
+
+const writers = new Map();
+const scopeDir = (root, scope) => join(root, "diagnostics", createHash("sha256").update(JSON.stringify([
+  scope?.webOrigin, scope?.accountId, scope?.organizationId,
+])).digest("hex"));
+const safeIdentifier = value => typeof value === "string" && /^[a-z][a-z0-9_.-]{0,79}$/i.test(value) ? value : null;
+
+// Only structured diagnostics are durable. Never retain prompts, arbitrary error
+// messages, tokens, source paths, or provider stdout/stderr.
+export function safeDiagnosticEvent(value, now = () => Date.now()) {
+  return { at: Number.isFinite(Date.parse(value?.at)) ? value.at : new Date(now()).toISOString(),
+    kind: ["analysis", "check", "preflight"].includes(value?.kind) ? value.kind : "check",
+    stage: safeIdentifier(value?.stage) || "unknown",
+    code: safeIdentifier(value?.code) || "failure_unclassified",
+    provider: ["codex", "claude"].includes(value?.provider) ? value.provider : null,
+    http_status: Number.isInteger(value?.http_status) && value.http_status >= 400 && value.http_status <= 599 ? value.http_status : null };
+}
+
+export function diagnosticLogger({ root = defaultSessionRoot(), scope, maxBytes = 64 * 1024, segments = 4, now } = {}) {
+  if (!scope?.webOrigin || !scope?.accountId || !scope?.organizationId) return { record: async () => false };
+  const dir = scopeDir(root, scope), cacheKey = `${dir}:${maxBytes}:${segments}`;
+  if (writers.has(cacheKey)) return writers.get(cacheKey);
+  const id = randomUUID();
+  let queue = Promise.resolve(), total = 0, bytes = 0, segment = 0, firstAt = null;
+  const writer = { record(value) {
+    const task = queue.catch(() => {}).then(async () => {
+      const event = safeDiagnosticEvent(value, now), line = `${JSON.stringify(event)}\n`;
+      await mkdir(dir, { recursive: true, mode: 0o700 });
+      if (bytes + Buffer.byteLength(line) > maxBytes && bytes > 0) {
+        segment += 1; bytes = 0;
+        if (segment >= segments) await rm(join(dir, `${id}.${segment - segments}.jsonl`), { force: true });
+      }
+      await appendFile(join(dir, `${id}.${segment}.jsonl`), line, { mode: 0o600 });
+      bytes += Buffer.byteLength(line); total += 1; firstAt ||= event.at;
+      const meta = join(dir, `${id}.json`), temp = `${meta}.tmp`;
+      await writeFile(temp, JSON.stringify({ schema_version: 1, total_failures: total, first_failure_at: firstAt, last_failure_at: event.at }), { mode: 0o600 });
+      await rename(temp, meta);
+      return true;
+    });
+    queue = task; return task;
+  } };
+  writers.set(cacheKey, writer); return writer;
+}
+
+export async function readDiagnosticLog({ root = defaultSessionRoot(), scope, limit = 20 } = {}) {
+  if (!scope?.webOrigin || !scope?.accountId || !scope?.organizationId) return { total_failures: 0, first_failure_at: null, recent: [] };
+  const dir = scopeDir(root, scope);
+  let names;
+  try { names = await readdir(dir); } catch (error) { if (error.code === "ENOENT") return { total_failures: 0, first_failure_at: null, recent: [] }; throw error; }
+  let total = 0, first = null; const events = [];
+  for (const name of names.filter(name => /^[a-f0-9-]{36}(?:\.\d+\.jsonl|\.json)$/.test(name))) {
+    const content = await readFile(join(dir, name), "utf8").catch(() => "");
+    if (name.endsWith(".json")) {
+      try { const meta = JSON.parse(content); if (Number.isSafeInteger(meta.total_failures) && meta.total_failures >= 0) total += meta.total_failures;
+        if (Number.isFinite(Date.parse(meta.first_failure_at)) && (!first || meta.first_failure_at < first)) first = meta.first_failure_at; } catch {}
+    } else {
+      for (const line of content.slice(0, 128 * 1024).split("\n")) {
+        try { const event = JSON.parse(line); if (Number.isFinite(Date.parse(event.at))) events.push(safeDiagnosticEvent(event)); } catch {}
+      }
+    }
+  }
+  return { total_failures: total, first_failure_at: first,
+    recent: events.sort((a, b) => b.at.localeCompare(a.at)).slice(0, Math.max(0, Math.min(100, limit))) };
+}

package/src/doctor.js

@@ -0,0 +1,55 @@
+import { purposeSigningKeyPath, purposeVerificationCapability } from "./purpose-local-proof.js";
+import { readFile } from "node:fs/promises";
+import { connectionDiscoveryPath } from "./connection-discovery.js";
+import { readSession, isSessionValid, defaultSessionRoot } from "./session-store.js";
+import { inspectProviderStatus } from "./desktop-status.js";
+import { readDiagnosticLog } from "./diagnostic-log.js";
+
+export async function collectDiagnostics({ webOrigin, cliVersion, root = defaultSessionRoot(),
+  readSessionImpl = readSession, inspectProvider = inspectProviderStatus, fetchImpl = fetch,
+  readFileImpl = readFile, alive = pid => { try { process.kill(pid, 0); return true; } catch { return false; } }, now = Date.now() } = {}) {
+  const session = await readSessionImpl(webOrigin, root).catch(() => null);
+  const valid = isSessionValid(session, now, webOrigin);
+  let daemon = { state: "not_found", cli_version: null, version_matches: null };
+  try {
+    const record = JSON.parse(await readFileImpl(connectionDiscoveryPath(webOrigin, root), "utf8"));
+    if (record.web_origin !== webOrigin || !Number.isInteger(record.port) || record.port < 1 || record.port > 65535 ||
+      !Number.isInteger(record.pid) || record.pid <= 0) throw new Error("Invalid discovery");
+    if (!alive(record.pid)) daemon.state = "stale_record";
+    else {
+      const response = await fetchImpl(`http://127.0.0.1:${record.port}/v1/health`, {
+        headers: { Origin: webOrigin }, signal: AbortSignal.timeout(1500), redirect: "error" });
+      const health = response.ok ? await response.json() : null;
+      if (health?.web_origin !== webOrigin || health?.ok !== true) throw new Error("Unverified daemon");
+      const version = typeof health.cli_version === "string" && /^\d+\.\d+\.\d+$/.test(health.cli_version) ? health.cli_version : null;
+      daemon = { state: "reachable", cli_version: version, version_matches: version ? version === cliVersion : null,
+        background: health.daemon === true };
+    }
+  } catch (error) { if (error.code !== "ENOENT") daemon.state = "unverified"; }
+  const providers = Object.fromEntries(await Promise.all(["codex", "claude"].map(async provider => {
+    const result = await inspectProvider(provider).catch(() => ({ state: "unknown" }));
+    return [provider, { state: ["ready", "signed_out", "missing", "outdated", "unknown"].includes(result?.state) ? result.state : "unknown",
+      version: typeof result?.version === "string" && /^\d+\.\d+\.\d+(?:-[a-z0-9.-]+)?$/i.test(result.version) ? result.version : null,
+      model_access: "unknown" }];
+  })));
+  const scope = session?.account_id && session?.organization_id ? { webOrigin, accountId: session.account_id, organizationId: session.organization_id } : null;
+  const failures = await readDiagnosticLog({ root, scope }).catch(() => ({ status: "unavailable", recent: [] }));
+  return { schema_version: 1, cli_version: cliVersion, web_origin: webOrigin, daemon,
+    session: { state: valid ? "signed_in" : session ? "expired" : "signed_out",
+      expires_at: Number.isFinite(Date.parse(session?.expires_at)) ? session.expires_at : null },
+    providers, failures,
+    purpose_verification: await purposeVerificationCapability(purposeSigningKeyPath(root)).then(value => ({ state: value ? "available" : "not_initialized", key_id: value?.key_id || null, execution: "explicit_frozen_recipes_only" })).catch(() => ({ state: "unavailable", key_id: null, execution: "explicit_frozen_recipes_only" })),
+    actions: [
+      ...(!valid ? [{ id: "reconnect_cli", command: "simy" }] : []),
+      ...(["stale_record", "not_found", "unverified"].includes(daemon.state) ? [{ id: "inspect_daemon", command: "simy doctor" }] : []),
+      ...(daemon.version_matches === false ? [{ id: "update_when_idle", command: "simy update --check" }] : []),
+      ...Object.entries(providers).filter(([, provider]) => provider.state === "signed_out")
+        .map(([provider]) => ({ id: `login_${provider}`, command: provider === "codex" ? "codex login" : "claude auth login" })),
+    ] };
+}
+
+export async function runDoctor(options) {
+  const diagnostics = await collectDiagnostics(options);
+  console.log(JSON.stringify(diagnostics, null, 2));
+  return 0;
+}

package/src/index.js

@@ -52,6 +52,11 @@ try {
 
 if (!configuredWebOrigin) {
   // Invalid host input is reported above before update discovery or startup.
+} else if (args.has("--version") || args.has("-v")) {
+  console.log(packageInfo.version);
+} else if (dispatchArgv[0] === "doctor") {
+  const { runDoctor } = await import("./doctor.js");
+  process.exitCode = await runDoctor({ webOrigin: configuredWebOrigin, cliVersion: packageInfo.version });
 } else if (dispatchArgv[0] === "update") {
   const checkOnly = args.has("--check");
   const result = await runCliUpdateGate({
@@ -120,6 +125,8 @@ async function runCommand(installMode) {
   if (args.has("--help") || args.has("-h")) {
     console.log(`Usage:
   simy            Start the local SIMY agent
+  simy --version  Print the installed version without starting or updating
+  simy doctor     Read-only version, connection, provider and failure diagnostics
   simy --daemon   Start it in the background
   simy --no-tui   Start the foreground HTTP agent without the interactive console
   simy sqm min-check  Run the fast deterministic SQM diff preflight