@awak-app/simy-cli 0.5.81 → 0.5.83

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.5.81",
+  "version": "0.5.83",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.5.81";
+export const CLI_VERSION = "0.5.83";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -294,7 +294,7 @@ export function assessedCheckpointContract(decision) {
   return `Return ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened",evidence:["concrete observation"]} for THIS selected action. This is provider-reported, not independent verification. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. Missing facts are unknown. Completed requires evidence, and SIMY independently checks frozen acceptance. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. missing_information requires a specific question. external_dependency requires waitCondition:{condition,owner,nextCheck} with the observable resumption condition, dependency owner, and bounded recheck instruction, plus nextStep.`;
 }
 export function understandingCheckpointContract(decision) {
-  return `This is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; do not edit files, call external services, or start the proposed next action. Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require review. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. For semantic conditions use manual. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. If material context is missing, set exactly one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification. Optionally include sessionUnderstanding.matchingContext:{deliverables:["concrete requested output"],projectHints:["project name"],repositoryUrls:[],relatedUrls:[],actionIds:[],sourceRefs:[{platform:"slack",externalThreadId:"exact thread",channelExternalId:"exact channel"}]}. Extract only explicit conversation evidence; IDs and sources are retrieval signals, never authenticated identity. Do not infer URLs or identifiers.`;
+  return `This is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; do not edit files, call external services, or start the proposed next action. Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require review. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. For semantic conditions use manual. If the complete expected file contents are not yet known from the original user request or observed evidence in this understanding turn, use manual for that criterion and choose a read as the next action to learn them. Never emit file_equals with null, omitted, guessed, or placeholder text; an exact file check requires a bounded concrete UTF-8 string now. Do not perform the proposed next action merely to fill the check, and do not claim that a later read or model report has independently verified a manual criterion. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. If material context is missing, set exactly one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification. Optionally include sessionUnderstanding.matchingContext:{deliverables:["concrete requested output"],projectHints:["project name"],repositoryUrls:[],relatedUrls:[],actionIds:[],sourceRefs:[{platform:"slack",externalThreadId:"exact thread",channelExternalId:"exact channel"}]}. Extract only explicit conversation evidence; IDs and sources are retrieval signals, never authenticated identity. Do not infer URLs or identifiers.`;
 }
 function boundedContextList(value, maxItems = 8, maxLength = 300) {
   if (!Array.isArray(value) || value.length > maxItems) throw new Error('Session understanding has too many items.');
@@ -444,7 +444,7 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     if (liveHookAdmission) {
       const process = previous?.process;
       if (provider !== 'claude' || previous?.hookStartedAt !== liveHookAdmission.hookStartedAt ||
-          !(['SessionStart', 'Stop'].includes(previous.lastEvent) || previous.lastEvent === 'Notification' && previous.lastNotificationType === 'idle_prompt') || process?.pid !== liveHookAdmission.pid ||
+          !(await claudeHookChannel(previous, { session, cwd, inspectProcess })).ready || process?.pid !== liveHookAdmission.pid ||
           process?.identity !== liveHookAdmission.identity || !process.identity ||
           await inspectProcess(process.pid) !== process.identity) throw new Error('Claude live hook changed before enrollment; refresh the session.');
     }
@@ -928,6 +928,29 @@ export async function processIdentity(pid) {
   try { const { stdout } = await promisify(execFile)('/bin/ps', ['-p', String(pid), '-o', 'lstart=,comm='], { timeout: 500, maxBuffer: 2048 }); return text(stdout, 1000) || null; }
   catch (e) { return e.code === 1 ? '' : null; }
 }
+// Channel availability lasts for the verified provider session, independently
+// of turn/permission events. Permission and dispatch decisions remain in the loop.
+export async function claudeHookChannel(record, { session, cwd, inspectProcess = processIdentity, platform = process.platform } = {}) {
+  const unavailable = (code, reason) => ({ ready: false, code, reason });
+  if (platform === 'win32') return unavailable('platform_unsupported', 'Claude process verification is unavailable on Windows; monitoring remains available.');
+  if (!record) return unavailable('hook_missing', 'SIMY has not observed a session-start event for this conversation. Check the SIMY plugin and hook execution in the original Claude window.');
+  if (record.provider !== 'claude' || record.session !== session) return unavailable('session_mismatch', 'The observed hook belongs to a different Claude conversation. Refresh this conversation.');
+  try { if (record.cwd !== await realpath(cwd)) return unavailable('workspace_mismatch', 'The observed Claude hook belongs to a different folder. Refresh this conversation.'); }
+  catch { return unavailable('workspace_unavailable', 'The Claude conversation folder could not be verified. Check the folder and refresh.'); }
+  if (record.hookEndedAt || record.lastEvent === 'SessionEnd') return unavailable('session_ended', 'This Claude session has ended. Return to the original conversation to continue.');
+  if (!record.hookStartedAt) return unavailable(record.hookObservedAt ? 'process_unverified' : 'hook_missing', record.hookObservedAt
+    ? 'The session-start hook ran, but SIMY could not identify its Claude process. Check the hook diagnostics.'
+    : 'SIMY has not observed a session-start event for this conversation. Check the SIMY plugin and hook execution in the original Claude window.');
+  const owner = record.hookSessionProcess || record.process; // Existing verified records remain compatible.
+  if (!owner?.identity || !Number.isSafeInteger(owner.pid) || owner.pid < 2) return unavailable('process_unverified', 'The session-start hook ran, but SIMY could not identify its Claude process. Check the hook diagnostics.');
+  if (record.process?.pid !== owner.pid || record.process?.identity !== owner.identity) return unavailable('process_changed', 'A different Claude process reported this conversation. Refresh the original conversation.');
+  let identity;
+  try { identity = await inspectProcess(owner.pid); } catch { identity = null; }
+  if (identity == null) return unavailable('process_check_unavailable', 'SIMY could not check whether the original Claude process is still running. Refresh and check the local process diagnostics.');
+  if (!identity) return unavailable('process_exited', 'The original Claude process has exited. Return to the original conversation to continue.');
+  if (identity !== owner.identity) return unavailable('process_changed', 'The original Claude process identity changed. Refresh the original conversation.');
+  return { ready: true, code: 'ready', reason: 'The SIMY hook channel is available. Continuation waits for this turn to finish and respects the original permissions.' };
+}
 async function providerProcess(provider) {
   if (process.platform === 'win32') return null;
   let pid = process.ppid;
@@ -960,12 +983,22 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
     }
     record.observedAt = now; record.lastEvent = event;
     record.lastNotificationType = event === 'Notification' ? text(input.notification_type, 80) : null;
-    if (identity) record.process = identity;
+    if (identity) {
+      // Legacy records have no frozen hook owner; a new process must not inherit
+      // an old SessionStart admission through a later prompt or stop event.
+      if (event !== 'SessionStart' && record.process && !record.hookSessionProcess &&
+          (identity.pid !== record.process.pid || identity.identity !== record.process.identity)) delete record.hookStartedAt;
+      record.process = identity;
+    }
     if (event === 'SessionStart') {
-      if (identity) record.hookStartedAt = now;
+      record.hookObservedAt = now;
+      delete record.hookEndedAt;
+      if (identity) { record.hookStartedAt = now; record.hookSessionProcess = { ...identity }; }
+      else { delete record.hookStartedAt; delete record.hookSessionProcess; delete record.process; }
       const approved = record.run?.managed?.approvedAction;
       output = { hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: `SIMY hooks observed this ${provider} session: ${input.session_id}. Only if the user requests SIMY Delivery Loop, use simy delivery start --provider ${provider} --session ${input.session_id} with the agreed objective and next step. Existing loop: ${record.run?.state || 'not started'}.${approved ? ` User approved exactly one ${approved.action.kind} action in scope ${approved.action.scope}: ${approved.action.summary}. Next step: ${approved.nextStep}. ${approved.dispatchedAt ? 'That approval was already dispatched; any repeated action needs a new approval.' : 'Resume the original conversation to dispatch this one action.'}` : ''} Never enable, trust, resume, or reset a loop on the user's behalf without their request.` } };
     }
+    if (event === 'SessionEnd') record.hookEndedAt = now;
     const run = record.run;
     if (run && event === 'Stop' && input.turn_id && run.lastStopKey === `${input.turn_id}:${Boolean(input.stop_hook_active)}:${run.revision}`) return record;
     // Observation only: human prompts mark work in progress, and real provider

package/src/session-supervision/claude-sessions.js

@@ -30,6 +30,10 @@ function candidateMetadata(id, metadata, lastActivityAt, observedAt) {
   };
 }
 
+// Desktop writes this bookkeeping outside the session envelope. It is neither
+// conversation identity nor message content in either bounded reader.
+const unscopedFileHistory = item => item.type === 'file-history-snapshot' && item.sessionId === undefined;
+
 function within(parent, child) {
   const path = relative(parent, child);
   return path === '' || (path !== '..' && !path.startsWith(`..${sep}`) && !isAbsolute(path));
@@ -60,6 +64,7 @@ function metadataFromPrefix(bytes, id) {
     if (!line) continue;
     let item;
     try { item = JSON.parse(line); } catch { return null; }
+    if (unscopedFileHistory(item)) continue;
     if (item.sessionId !== id) return null;
     if (item.type === 'custom-title' && item.isSidechain !== true) { customTitle = sessionTitle(item.customTitle); continue; }
     if (item.type !== 'user' && item.type !== 'assistant') continue;
@@ -199,6 +204,7 @@ async function conversationFromHandle(handle, opened, session, cwd) {
     if (!line.trim()) continue;
     let item;
     try { item = JSON.parse(line); } catch { incomplete = true; continue; }
+    if (unscopedFileHistory(item)) continue;
     if (item.sessionId !== session || item.isSidechain === true) { incomplete = true; continue; }
     if (!['user', 'assistant'].includes(item.type) || item.isMeta === true) continue;
     if (typeof item.cwd !== 'string' || resolve(item.cwd) !== cwd) { incomplete = true; continue; }

package/src/session-supervision/index.js

@@ -1,6 +1,6 @@
 import { realpath } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
-import { TERMINAL as TERMINAL_RUNS, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { TERMINAL as TERMINAL_RUNS, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { listCodexSessions, openCodexAppServer, readCodexSession, CodexAppServerError } from './codex-app-server.js';
 import { listClaudeSessions, readClaudeSession } from './claude-sessions.js';
 import { originalSessionTarget } from './original-session-target.js';
@@ -44,15 +44,13 @@ async function withClient(openClient, work, signal) {
   } finally { signal?.removeEventListener('abort', cancelled); await client.close(); }
 }
 
-async function liveClaudeHook(record, metadata, inspectProcess) {
-  if (!record || record.provider !== 'claude' || record.session !== metadata?.session ||
-      metadata.observation?.source !== 'claude_local_index' || !record.hookStartedAt ||
-      !(['SessionStart', 'Stop'].includes(record.lastEvent) || record.lastEvent === 'Notification' && record.lastNotificationType === 'idle_prompt') ||
-      !record.process?.identity) return false;
-  try {
-    if (record.cwd !== await realpath(metadata.cwd)) return false;
-    return await inspectProcess(record.process.pid) === record.process.identity;
-  } catch { return false; }
+async function liveClaudeChannel(record, metadata, inspectProcess) {
+  if (metadata?.observation?.source !== 'claude_local_index') return { ready: false, code: 'session_metadata_unavailable', reason: 'SIMY could not match this hook to the Claude conversation index. Refresh the conversation list.' };
+  return claudeHookChannel(record, { session: metadata.session, cwd: metadata.cwd, inspectProcess });
+}
+async function requireClaudeChannel(record, metadata, inspectProcess) {
+  const channel = await liveClaudeChannel(record, metadata, inspectProcess);
+  if (!channel.ready) throw Object.assign(new Error(channel.reason), { code: channel.code });
 }
 
 export async function discoverSessions({ root, openClient = openCodexAppServer, listClaude = listClaudeSessions,
@@ -90,7 +88,13 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
     const run = record?.run;
     const mode = run?.managed ? run.state === 'recovery_required' && run.recoveryCause === 'session_supervision' ? 'pending_takeover' : 'managed' : run ? 'standard_loop' : record?.monitor ? 'monitor' : 'unmanaged';
     const supported = item.provider === 'codex' && item.observation.source === 'codex_app_server' && Boolean(item.model) && !codexError;
-    const liveHook = item.provider === 'claude' && !claudeError && await liveClaudeHook(record, item, inspectProcess);
+    const claudeChannel = item.provider === 'claude' ? claudeError
+      ? { ready: false, code: 'session_metadata_unavailable', reason: claudeError }
+      : await liveClaudeChannel(record, item, inspectProcess) : null;
+    const liveHook = claudeChannel?.ready === true;
+    const continuationIssue = liveHook && run ? !run.managed
+      ? { code: 'existing_loop', reason: 'This conversation already has a Delivery Loop. Use its existing controls.' }
+      : TERMINAL_RUNS.has(run.state) ? { code: 'task_settled', reason: 'This supervised task has settled. Review its existing status before continuing.' } : null : null;
     let isRunning = item.isRunning;
     if (record?.runtime?.process?.identity && record.cwd === item.cwd) {
       try {
@@ -114,13 +118,12 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       binding: { mode, taskId: run?.managed?.taskId || record?.associationTaskId || null },
       originalSessionTarget: originalSessionTarget(item.provider, item.session),
       continuationMode: item.provider === 'claude' ? liveHook ? 'live_hook' : 'manual' : supported ? 'codex_app_server' : 'manual',
+      ...(claudeChannel ? { continuationReasonCode: continuationIssue?.code || claudeChannel.code } : {}),
       capabilities: { canMonitor: item.capabilities?.canMonitor ?? true,
         canAnalyze: !run && (item.provider === 'codex' ? item.observation.source === 'codex_app_server' && !codexError : item.observation.source === 'claude_local_index' && !claudeError),
         canEnroll: (supported || liveHook) && !run, canContinue: (supported || liveHook) && !run,
         canAutoContinue: (supported || liveHook) && (!run || Boolean(run.managed) && !TERMINAL_RUNS.has(run.state)) },
-      reason: item.provider === 'claude' ? liveHook ? 'Live SIMY hook can continue this Claude session at its next Stop boundary; cold CLI takeover is unavailable.' :
-        process.platform === 'win32' ? 'Claude live hook enrollment is unavailable on Windows because provider process identity cannot be verified; monitoring remains available.' :
-          'Claude enrollment needs a live matching SIMY SessionStart hook and provider process; cold CLI takeover is unavailable.' :
+      reason: item.provider === 'claude' ? continuationIssue?.reason || claudeChannel.reason :
         codexError || (!supported ? 'Exact model or provider metadata is unavailable.' : null),
     };
   };
@@ -149,8 +152,8 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
     if (enabled && previous.run && !previous.run.managed) throw new Error('Automatic continuation is unavailable for this conversation.');
     if (enabled && TERMINAL_RUNS.has(previous.run?.state)) throw new Error('This conversation is settled. Resume an eligible existing task after refreshing its status.');
     if (enabled && provider === 'codex' && !previous.admission?.model) throw new Error('Automatic continuation is unavailable for this conversation.');
-    if (enabled && provider === 'claude' && !await liveClaudeHook(previous,
-      { session, cwd: previous.cwd, observation: { source: previous.admission?.source } }, options.inspectProcess || processIdentity)) throw new Error('Claude needs a live matching SIMY SessionStart hook; cold CLI takeover is unavailable.');
+    if (enabled && provider === 'claude') await requireClaudeChannel(previous,
+      { session, cwd: previous.cwd, observation: { source: previous.admission?.source } }, options.inspectProcess || processIdentity);
     const epoch = previous.autoContinue === enabled && previous.autoContinueEpoch ? previous.autoContinueEpoch : randomUUID();
     const settings = { autonomyPolicy: 'balanced', maxMinutes: 30, maxContinuations: 6, maxFailures: 3,
       ...previous.autoContinueSettings,
@@ -230,13 +233,13 @@ export async function enrollSession({ root, provider, session, objective, accept
   if (provider === 'claude') {
     metadata = await readClaude(session);
     const record = await readRecord(root, provider, session);
-    if (!await liveClaudeHook(record, metadata, inspectProcess)) throw new Error('Claude needs a live matching SIMY SessionStart hook; cold CLI takeover is unavailable.');
+    await requireClaudeChannel(record, metadata, inspectProcess);
     if (record.run) throw new Error('This session already has a Delivery Loop.');
     await monitorSession({ root, provider, session, monitor: true, readClaude: async () => metadata, now });
     // A second check narrows the time between metadata admission and the
     // original provider's next Stop boundary. Process exit still remains a
     // manual recovery condition; SIMY never starts claude -r.
-    if (!await liveClaudeHook(await readRecord(root, provider, session), metadata, inspectProcess)) throw new Error('Claude provider process exited before enrollment.');
+    await requireClaudeChannel(await readRecord(root, provider, session), metadata, inspectProcess);
   } else {
     metadata = await monitorSession({ root, provider, session, monitor: true, openClient, now });
     if (!metadata.model) throw new Error('Codex did not expose this conversation’s model; automatic continuation is unavailable.');