@awak-app/simy-cli 0.6.11 → 0.6.13

package/README.md

@@ -816,3 +816,55 @@ Only summary metadata is retained, without analysis prompts, source inputs,
 model responses or credentials. Historical summaries are not a replacement for
 signed proof files or delivery acceptance. Records from versions that kept
 analysis only in memory cannot be recovered after that process exits.
+
+The CLI Agentic Loop uses [proportionate retry and review decisions](docs/stop-prevention/proportionate-continuation.md): reasoning notes are advisory, and an independent reviewer may explicitly defer or dismiss minor/warning/info findings with a nonempty explanation while retaining them in the receipt. Required acceptance evidence and major safety findings remain protected.
+
+### Local coding attempt result collection
+
+For `executeProcessAttempt`, native provider JSONL is read only from a successfully finished turn's final
+assistant/result channel. Tool output and intermediate messages are never a
+fallback result. Legacy line-anchored markers still work and may contain formatted
+JSON; missing, ambiguous, truncated, invalid, oversized and failed-turn results
+have distinct `result_parse.code` values. Invalid collection cannot become a
+successful empty result. Plain-text markers are supported only for explicit
+shell command overrides. This does not independently verify executor claims.
+The parser can re-read a saved raw result without rerunning the provider.
+Local Task and direct-task result parsers are separate boundaries and are not
+covered by this coding-attempt guarantee.
+
+### Explicit desktop provider selection
+
+Local coding requests may specify `model` / `reasoning_effort` and independently
+`audit_model` / `audit_reasoning_effort`. Both selections survive recovery.
+Codex receives the exact model and reasoning config; the CLI does not use a
+catalog to reject unknown model names or silently replace a rejected model.
+Claude receives the exact model; explicit reasoning is unsupported by this
+adapter and fails before dispatch. A custom shell override cannot enforce an
+explicit selection and is rejected instead of dropping it. Provider acceptance,
+authentication and actual availability still require the provider's response.
+This changes command construction only; it does not start any workflow.
+
+### Reusing a running service and launch recovery
+
+`simy` and `simy --daemon` first inspect the private discovery record and verify
+its live PID, instance, Web origin, CLI/API version and saved account,
+organization and device. A compatible background service is reused: the entry
+prints its existing address and opens SIMY Web (or its sign-in page). The local
+interactive console is only created when this entry owns a new service.
+SQM authorization also reuses that service and leaves it running when SQM exits.
+Unreachable or incompatible live services produce diagnostics instead of a
+second daemon. A stale record with a dead PID permits normal startup.
+
+Web-led launches can omit their temporary challenge. The daemon requests a
+credential for the existing queued run using its authenticated device. An
+explicitly expired challenge can be renewed once; consumed, invalid or
+cross-scope credentials cannot. Refresh the original run/device before retrying
+a consumed credential because execution may have started before its ledger
+status was uploaded. This recovery requires the companion Web
+`/api/local-cli/challenges/issue` endpoint; existing valid challenges continue
+to work against older Web versions.
+
+Scope mismatch diagnostics identify the changed account, organization, device
+or Web host and tell the caller to restore the original identity. Launch and
+recovery operations do not switch identity automatically. The private
+`/v1/connection` endpoint rejects browser requests and never returns tokens.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.6.11",
+  "version": "0.6.13",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -43,7 +43,7 @@
     "check:workflow-observation-sender": "node --check ./src/workflow-observation-sender.js",
     "check:sqm": "node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/reliability.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./src/sqm/agent-skill.js && node --check ./src/sqm/workflow-onboarding.js && node --check ./src/sqm/workflow-update.js && node --check ./src/sqm/history-store.js && node --check ./src/sqm/review-worker.js && node --check ./scripts/sqm-complete-loop-e2e.js && node --check ./scripts/sqm-local-review-e2e.js",
     "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js",
-    "check:syntax": "node --check ./src/purpose-local-proof.js && node --check ./src/device-signing-identity.js && node --check ./src/index.js && node --check ./src/install-update.js && node --check ./src/agent.js && node --check ./src/connection-discovery.js && node --check ./src/codex-plugins/simy/hooks/connection-reminder.mjs && node --check ./src/codex-plugins/simy/hooks/dev-work.mjs && node --check ./src/dev-work-events.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/login-shell-path.js && node --check ./src/hook-runtime.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/pr-preparation.js && node --check ./src/orchestrator/minimum-completion.js && node --check ./src/orchestrator/delivery/scripts/check-minimum-completion.mjs && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./src/coding-run-store.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js && node --check ./src/codex-plugins/simy/hooks/delivery-loop.mjs && node --check ./src/delivery-hooks/command.js && node --check ./src/delivery-hooks/desktop.js && node --check ./src/delivery-hooks/supervisor.js && node --check ./src/session-supervision/automatic-continuation.js && node --check ./src/session-supervision/stop-notifications.js",
+    "check:syntax": "node --check ./src/purpose-local-proof.js && node --check ./src/device-signing-identity.js && node --check ./src/index.js && node --check ./src/install-update.js && node --check ./src/agent.js && node --check ./src/connection-discovery.js && node --check ./src/connection-diagnostics.js && node --check ./src/launch-authorization.js && node --check ./src/codex-plugins/simy/hooks/connection-reminder.mjs && node --check ./src/codex-plugins/simy/hooks/dev-work.mjs && node --check ./src/dev-work-events.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/login-shell-path.js && node --check ./src/hook-runtime.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/pr-preparation.js && node --check ./src/orchestrator/minimum-completion.js && node --check ./src/orchestrator/delivery/scripts/check-minimum-completion.mjs && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./src/coding-run-store.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js && node --check ./src/codex-plugins/simy/hooks/delivery-loop.mjs && node --check ./src/delivery-hooks/command.js && node --check ./src/delivery-hooks/desktop.js && node --check ./src/delivery-hooks/supervisor.js && node --check ./src/session-supervision/automatic-continuation.js && node --check ./src/session-supervision/stop-notifications.js",
     "check:package": "node ./scripts/check-package-contents.js",
     "build:macos-installer:dev": "bash packaging/build-macos-arm64.sh --unsigned-dev",
     "build:macos-installer": "bash packaging/build-macos-arm64.sh --production",

package/src/agent.js

@@ -1,3 +1,6 @@
+import { normalizeProviderModelSelection } from "./provider-model-selection.js";
+import { assertConnectionScope, connectionScope, connectionDiagnostic } from "./connection-diagnostics.js";
+import { authorizeLaunch } from "./launch-authorization.js";
 import { normalizePurposeVerification, assertPurposeActor, preparePurposeVerification, verifyPurposeLocalTask, purposeSigningKeyPath, purposeVerificationCapability, purposeWorkspaceBusy } from "./purpose-local-proof.js";
 import { startupRequirementChecks, summarizeStartupChecks } from "./startup-preflight.js";
 import { BROWSER_HANDOFF_TRANSPORT, browserHandoffPage, decryptBrowserHandoff } from "./browser-handoff.js";
@@ -540,7 +543,7 @@ export async function startAgent({
     })();
     return organizationRefresh;
   };
-  const requestDesktopLogin = (organizationId = null, { passive = false } = {}) => {
+  const requestDesktopLogin = (organizationId = null, { passive = false, reauthorize = false } = {}) => {
     const authorization = authorizationWindow.snapshot();
     if (authorization.state === "timed_out") {
       if (passive) return null;
@@ -568,7 +571,7 @@ export async function startAgent({
       refreshAvailableCapabilities();
       notifyDesktopStatusChange();
     } else if (isSessionValid(session, Date.now(), apiOrigin)) {
-      if (!enforceDesktopAccess || desktopAccess.snapshot().state !== 'signed_out') return null;
+      if (!reauthorize && (!enforceDesktopAccess || desktopAccess.snapshot().state !== 'signed_out')) return null;
       if (!passive || !loginUrl) {
         authNonce = randomBytes(16).toString("base64url");
         loginUrl = null;
@@ -1027,14 +1030,17 @@ export async function startAgent({
     );
   };
 
+  let connectionDiscovery = null;
+  const launchingRuns = new Set();
   const server = createServer(async (req, res) => {
+    let reservedLaunch = null;
     try {
       const url = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
       const localHandoff = url.pathname === "/v1/auth/browser-complete";
       const localOrigin = `http://127.0.0.1:${port}`;
       if (localHandoff ? (req.headers.origin !== localOrigin || req.headers.host !== `127.0.0.1:${port}`)
           : !isRequestOriginAllowed(req.headers.origin, apiOrigin)) {
-        json(res, 403, { error: "request origin does not match the configured SIMY Web host" });
+        json(res, 403, connectionDiagnostic("connection_scope_changed", "web_origin"));
         return;
       }
       applyCors(req, res, apiOrigin);
@@ -1050,7 +1056,7 @@ export async function startAgent({
         return;
       }
       const agenticLoopPath = canonicalAgenticLoopPath(url.pathname);
-      const desktopRecoveryRoute = ['/v1/health', '/v1/capabilities', '/v1/auth/complete', '/v1/auth/browser-complete'].includes(url.pathname) ||
+      const desktopRecoveryRoute = ['/v1/health', '/v1/connection', '/v1/capabilities', '/v1/auth/complete', '/v1/auth/browser-complete'].includes(url.pathname) ||
         req.method === 'POST' && (/^\/v1\/local-tasks\/[^/]+\/control$/.test(url.pathname) || /^\/v1\/agentic-loop\/[^/]+\/control$/.test(agenticLoopPath));
       let requestAccessScope;
       if (enforceDesktopAccess && !desktopRecoveryRoute) {
@@ -1075,6 +1081,28 @@ export async function startAgent({
         res.once("finish", releaseUpdateWork);
         res.once("close", releaseUpdateWork);
       }
+      if (["GET", "POST"].includes(req.method) && url.pathname === "/v1/connection") {
+        // Private local entry points only. Browser origins must not read account
+        // bindings, instance identifiers or the pending authorization nonce.
+        if (req.headers.origin !== undefined || req.headers.host !== `127.0.0.1:${port}`) {
+          json(res, 403, { error: "Local connection discovery only.", code: "local_connection_only" }); return;
+        }
+        let authorizationUrl;
+        if (req.method === "POST") {
+          const body = await readJson(req);
+          if (!connectionDiscovery?.instanceId || body.instance_id !== connectionDiscovery.instanceId) {
+            json(res, 409, connectionDiagnostic("connection_service_mismatch")); return;
+          }
+          try { assertConnectionScope(body.scope, connectionScope(session || reclaimableSession, apiOrigin)); }
+          catch (error) { json(res, 409, { error: error.message, code: error.code, field: error.field, recovery: error.recovery }); return; }
+          authorizationUrl = requestDesktopLogin(null, { reauthorize: body.reauthorize === true });
+        } else authorizationUrl = requestDesktopLogin(null, { passive: true });
+        json(res, 200, { ok: true, cli_version: CLI_VERSION, api_contract_version: CLI_API_CONTRACT_VERSION,
+          daemon, web_origin: apiOrigin, instance_id: connectionDiscovery?.instanceId || null, pid: process.pid,
+          scope: connectionScope(session || reclaimableSession, apiOrigin), session_valid: isSessionValid(session, Date.now(), apiOrigin),
+          login_url: authorizationUrl });
+        return;
+      }
       if (req.method === "GET" && url.pathname === "/v1/health") {
         const sessionValid = isSessionValid(session, Date.now(), apiOrigin);
         const connection = connectionStatus.snapshot({ authenticated: sessionValid });
@@ -1971,6 +1999,13 @@ export async function startAgent({
           return;
         }
         const { body, attachments } = await readCodingLoopStart(req);
+        let providerSelection;
+        try {
+          providerSelection = normalizeProviderModelSelection(body);
+        } catch (error) {
+          json(res, 400, { error: error.message, code: "invalid_provider_selection" });
+          return;
+        }
         const guardrailSource = String(body.source_message || "").trim();
         if (guardrailSource) {
           const guardrail = classifyExecutionRequirement(guardrailSource);
@@ -1987,25 +2022,23 @@ export async function startAgent({
             return;
           }
         }
-        const verified = await verifyLaunchChallenge({
-          apiOrigin,
-          apiBaseUrl: session.api_base_url,
-          token: session.token,
-          runId: String(body.run_id || ""),
-          challenge: String(body.challenge || ""),
-        });
-        if (!verified.ok) {
-          json(res, 403, { error: verified.error || "launch challenge rejected" });
-          return;
-        }
         const runId = String(body.run_id || "");
-        if (!runId) {
-          json(res, 400, { error: "run_id is required" });
-          return;
-        }
+        if (!runId) { json(res, 400, { error: "run_id is required" }); return; }
+        const launchSession = session;
+        try { assertConnectionScope(body.connection_scope, connectionScope(launchSession, apiOrigin)); }
+        catch (error) { json(res, 409, { error: error.message, code: error.code, field: error.field, recovery: error.recovery }); return; }
+        if (launchingRuns.has(runId)) { json(res, 409, { error: "This launch is still being checked. Refresh its status before retrying.", code: "launch_in_progress" }); return; }
+        launchingRuns.add(runId);
+        reservedLaunch = runId;
+        const verified = await authorizeLaunch({ apiOrigin, apiBaseUrl: launchSession.api_base_url,
+          token: launchSession.token, runId, challenge: String(body.challenge || ""),
+          fetchImpl: dependencies.fetch || globalThis.fetch });
+        if (session !== launchSession || !isSessionValid(session, Date.now(), apiOrigin)) {
+          json(res, 409, changedLaunchSession(launchSession, session, apiOrigin)); return;
+        }
+        if (!verified.ok) { json(res, verified.status, connectionDiagnostic(verified.code)); return; }
         if (registry.has(runId)) {
-          json(res, 409, { error: "agentic loop run already exists" });
-          return;
+          json(res, 409, { error: "agentic loop run already exists" }); return;
         }
         let executionTarget;
         try {
@@ -2069,9 +2102,14 @@ export async function startAgent({
           });
           return;
         }
+        if (session !== launchSession || !isSessionValid(session, Date.now(), apiOrigin)) {
+          await cleanupRunAttachments(stagedAttachments);
+          json(res, 409, changedLaunchSession(launchSession, session, apiOrigin)); return;
+        }
         const run = createRun({
           runId,
           request: {
+            ...providerSelection,
             backend: body.backend === "claude" ? "claude" : "codex",
             execution_target: executionTarget,
             execution_device_id: session?.device_id || null,
@@ -2136,6 +2174,9 @@ export async function startAgent({
           throw error;
         }
         await authorizeDesktopWork(requestAccessScope);
+        if (session !== launchSession || !isSessionValid(session, Date.now(), apiOrigin)) {
+          json(res, 409, changedLaunchSession(launchSession, session, apiOrigin)); return;
+        }
         void startLocalCodingRun(run, dependencies.runOptions);
         json(res, 202, { ok: true, run_id: run.id });
         return;
@@ -2216,7 +2257,7 @@ export async function startAgent({
             json(res, 200, { recovery, run_id: run.id, resumed: false });
           }
         } catch (error) {
-          json(res, 409, { error: error instanceof Error ? error.message : "Recovery could not be verified.", code: error.code || "recovery_rejected" });
+          json(res, 409, { error: error instanceof Error ? error.message : "Recovery could not be verified.", code: error.code || "recovery_rejected", ...(error.field ? { field: error.field, recovery: error.recovery } : {}) });
         }
         return;
       }
@@ -2449,13 +2490,16 @@ export async function startAgent({
       }
       if (String(err?.code || "").startsWith("purpose_verification_")) { json(res, err.status || 409, { error: err.message, code: err.code }); return; }
       json(res, 500, { error: err instanceof Error ? err.message : "internal error" });
+    } finally {
+      // An aborted HTTP response must not leave a permanent launch reservation.
+      // Keep the reservation until all asynchronous preparation has settled.
+      if (reservedLaunch) launchingRuns.delete(reservedLaunch);
     }
   });
 
   await new Promise((resolve) => server.listen(requestedPort, "127.0.0.1", resolve));
   const address = server.address();
   port = typeof address === "object" && address ? address.port : requestedPort;
-  let connectionDiscovery = null;
   try {
     connectionDiscovery = await (
       dependencies.publishConnectionDiscovery || publishConnectionDiscovery
@@ -2717,6 +2761,7 @@ export async function startAgent({
       scanRepositories,
       selectRepository,
       create: (input) => withUpdateWork(updateManager, async () => {
+        const providerSelection = normalizeProviderModelSelection(input);
         const scope = await authorizeDesktopWork();
         if (!isSessionValid(session, Date.now(), apiOrigin)) {
           throw new Error("Sign in to SIMY before starting a coding task.");
@@ -2732,6 +2777,8 @@ export async function startAgent({
         }
         const indexedRepository = await ensureRepositoryIndexed(repository);
         const request = {
+          ...providerSelection,
+          audit_backend: input.audit_backend === "claude" || input.audit_backend === "codex" ? input.audit_backend : null,
           requirement,
           repository,
           local_path: indexedRepository?.local_path || input.localPath || workspace.localPath,
@@ -3292,26 +3339,6 @@ function backendPreflightSummary(backend, inspection) {
   return `${label} is not available. Install or update it: ${inspection.update_command}`;
 }
 
-async function verifyLaunchChallenge({ apiOrigin, apiBaseUrl, token, runId, challenge }) {
-  try {
-    const response = await fetch(
-      webApiUrl("challenges/verify", { webOrigin: apiOrigin, apiBaseUrl }),
-      {
-        method: "POST",
-        headers: webApiHeaders(
-          { token },
-          { "Content-Type": "application/json" },
-        ),
-        body: JSON.stringify({ run_id: runId, challenge }),
-      },
-    );
-    if (response.ok) return { ok: true };
-    const payload = await response.json().catch(() => null);
-    return { ok: false, error: webApiErrorMessage(payload, response.status) };
-  } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : "challenge check failed" };
-  }
-}
 
 function canonicalAgenticLoopPath(pathname) {
   return pathname.replace(/^\/v1\/coding-loop(?=\/|$)/, "/v1/agentic-loop");
@@ -3573,3 +3600,9 @@ function providerAuthenticationFailure(provider, status) {
     }),
   };
 }
+
+function changedLaunchSession(previous, current, origin) {
+  try { assertConnectionScope(connectionScope(previous, origin), connectionScope(current, origin)); }
+  catch (error) { return { error: error.message, code: error.code, field: error.field, recovery: error.recovery }; }
+  return connectionDiagnostic("connection_session_changed");
+}

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.6.11";
+export const CLI_VERSION = "0.6.13";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/coding-run-recovery.js

@@ -91,6 +91,11 @@ export function assertRecoveryActor(run) {
     if (saved[field] && saved[field] !== current[field]) {
       const error = new Error(`The saved run belongs to another ${field}; restore its original authorized session.`);
       error.code = "recovery_actor_mismatch";
+      error.field = field;
+      error.recovery = { action: "reconnect_cli", steps: [
+        "Select the original SIMY Web host, account and organization.",
+        "Reconnect the original device, refresh the saved run and retry recovery.",
+      ] };
       throw error;
     }
   }

package/src/connection-diagnostics.js

@@ -0,0 +1,77 @@
+export function connectionScope(session, webOrigin) {
+  return {
+    web_origin: webOrigin,
+    account_id: session?.account_id || session?.auth_user_id || null,
+    organization_id: session?.organization_id || session?.org_id || null,
+    device_id: session?.device_id || null,
+  };
+}
+
+export function connectionDiagnostic(code, field = null) {
+  const scopeChanged = code === "connection_scope_changed";
+  const error = scopeChanged
+    ? `SIMY ${field.replaceAll("_", " ")} changed. Restore the account, organization, device and Web host that authorized this run before reconnecting.`
+    : {
+        connection_service_mismatch:
+          "The discovered port belongs to a different service. Run simy doctor, then reconnect to the original SIMY Web host.",
+        connection_service_unavailable:
+          "A SIMY service is recorded but cannot be reached. Run simy doctor; reopen SIMY or restart the confirmed daemon before reconnecting.",
+        connection_service_not_background:
+          "The existing SIMY service runs in a foreground terminal. Keep that terminal open, or stop it when idle and start simy --daemon before reconnecting.",
+        connection_port_mismatch:
+          "The existing SIMY service uses a different port. Reconnect without --port to reuse it, or select its recorded port.",
+        connection_session_changed:
+          "SIMY sign-in changed while the launch was being authorized. Refresh this run on the original device before retrying.",
+        connection_service_incompatible:
+          "The existing SIMY service has an incompatible version or API. Run simy update --check; update or restart that service when its tasks are idle.",
+        connection_session_expired:
+          "SIMY sign-in expired. Open the verification link for the existing service and sign in to the original account and organization.",
+        launch_challenge_expired:
+          "The launch credential expired. Retry this same run to obtain a fresh credential.",
+        launch_challenge_consumed:
+          "This launch credential was already used. Refresh the run status on its original device before retrying; execution may already have started.",
+        launch_scope_mismatch:
+          "This run or credential is unavailable for the current account, organization or device. Reconnect to the service and identity that authorized the run.",
+        launch_challenge_invalid:
+          "The launch credential is invalid. Refresh this run in SIMY Web and reconnect to its original device.",
+        launch_service_incompatible:
+          "SIMY Web does not support launch-credential recovery yet. Update the Web service, refresh this run and retry on its original device.",
+        launch_service_unavailable:
+          "The SIMY launch service could not be reached. Check the connection and retry this same run.",
+        launch_run_not_queued:
+          "This run has already progressed or stopped. Refresh its status on the original device before starting anything again.",
+      }[code] ||
+      "SIMY could not authorize this launch. Refresh the run in SIMY Web and reconnect to its original device.";
+  return {
+    error,
+    code,
+    ...(field ? { field } : {}),
+    recovery: {
+      action: "reconnect_cli",
+      steps:
+        scopeChanged || code === "launch_scope_mismatch"
+          ? [
+              "Select the original SIMY Web host, account and organization.",
+              "Reconnect the original device, refresh the run and retry.",
+            ]
+          : [error],
+    },
+  };
+}
+
+export function assertConnectionScope(expected, current) {
+  for (const field of [
+    "web_origin",
+    "account_id",
+    "organization_id",
+    "device_id",
+  ]) {
+    if (expected?.[field] && expected[field] !== current?.[field]) {
+      const diagnostic = connectionDiagnostic(
+        "connection_scope_changed",
+        field,
+      );
+      throw Object.assign(new Error(diagnostic.error), diagnostic);
+    }
+  }
+}

package/src/connection-discovery.js

@@ -3,6 +3,8 @@ import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 
+import { assertConnectionScope, connectionDiagnostic } from "./connection-diagnostics.js";
+
 import { normalizeWebOrigin } from "./web-origin.js";
 
 export function connectionDiscoveryPath(webOrigin, sessionRoot) {
@@ -47,3 +49,162 @@ export async function removeConnectionDiscovery(discovery) {
     if (error?.code !== "ENOENT" && !(error instanceof SyntaxError)) throw error;
   }
 }
+
+// A private discovery file identifies a candidate; the live instance must prove
+// it owns that record before an entry point can reuse it. Never send a token.
+export async function findReusableConnection({
+  webOrigin,
+  sessionRoot,
+  cliVersion,
+  apiContractVersion,
+  expectedScope,
+  requestedPort = 0,
+  authorize = false,
+  reauthorize = false,
+  fetchImpl = fetch,
+  alive = (pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+}) {
+  const origin = normalizeWebOrigin(webOrigin);
+  let record;
+  try {
+    record = JSON.parse(
+      await readFile(connectionDiscoveryPath(origin, sessionRoot), "utf8"),
+    );
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw connectionError("connection_service_mismatch");
+  }
+  if (
+    record?.schema_version !== 1 ||
+    record.web_origin !== origin ||
+    !Number.isInteger(record.port) ||
+    record.port < 1 ||
+    record.port > 65535 ||
+    !Number.isInteger(record.pid) ||
+    record.pid <= 0 ||
+    typeof record.instance_id !== "string" ||
+    !record.instance_id
+  ) {
+    throw connectionError("connection_service_mismatch");
+  }
+  if (!alive(record.pid)) return null;
+  let response, health;
+  try {
+    response = await fetchImpl(
+      `http://127.0.0.1:${record.port}/v1/connection`,
+      {
+        signal: AbortSignal.timeout(1500),
+        redirect: "error",
+        cache: "no-store",
+      },
+    );
+    health = response.ok ? await response.json() : null;
+  } catch {
+    throw connectionError("connection_service_unavailable");
+  }
+  if (response.status === 404)
+    throw connectionError("connection_service_incompatible");
+  if (
+    !health?.ok ||
+    health.instance_id !== record.instance_id ||
+    health.pid !== record.pid ||
+    health.web_origin !== origin
+  ) {
+    throw connectionError("connection_service_mismatch");
+  }
+  if (health.daemon !== true)
+    throw connectionError("connection_service_not_background");
+  if (requestedPort && requestedPort !== record.port)
+    throw connectionError("connection_port_mismatch");
+  if (
+    !compatibleServiceVersion(health.cli_version, cliVersion) ||
+    health.api_contract_version !== apiContractVersion
+  )
+    throw connectionError("connection_service_incompatible");
+  assertConnectionScope(expectedScope, health.scope);
+  if (authorize && (reauthorize || !health.session_valid)) {
+    try {
+      response = await fetchImpl(
+        `http://127.0.0.1:${record.port}/v1/connection`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            instance_id: record.instance_id,
+            scope: health.scope,
+            reauthorize,
+          }),
+          signal: AbortSignal.timeout(1500),
+          redirect: "error",
+          cache: "no-store",
+        },
+      );
+      health = await response.json().catch(() => null);
+    } catch {
+      throw connectionError("connection_service_unavailable");
+    }
+    if (!response.ok && health?.code === "connection_scope_changed" &&
+        ["web_origin", "account_id", "organization_id", "device_id"].includes(health.field)) {
+      const diagnostic = connectionDiagnostic(health.code, health.field);
+      throw Object.assign(new Error(diagnostic.error), diagnostic);
+    }
+    if (!response.ok) throw connectionError("connection_service_mismatch");
+    if (
+      !health?.ok ||
+      health.instance_id !== record.instance_id ||
+      health.pid !== record.pid ||
+      health.web_origin !== origin
+    ) {
+      throw connectionError("connection_service_mismatch");
+    }
+    assertConnectionScope(expectedScope, health.scope);
+  }
+  if (health.login_url !== null) {
+    let url;
+    try {
+      url = new URL(health.login_url);
+    } catch {
+      throw connectionError("connection_service_mismatch");
+    }
+    if (
+      url.origin !== origin ||
+      url.pathname !== "/local-cli/connect" ||
+      url.searchParams.get("port") !== String(record.port)
+    ) {
+      throw connectionError("connection_service_mismatch");
+    }
+  }
+  return {
+    port: record.port,
+    webOrigin: origin,
+    loginUrl: health.login_url,
+    sessionValid: health.session_valid === true,
+  };
+}
+
+function connectionError(code) {
+  const diagnostic = connectionDiagnostic(code);
+  return Object.assign(new Error(diagnostic.error), diagnostic);
+}
+
+function compatibleServiceVersion(running, requested) {
+  const version = (value) =>
+    typeof value === "string"
+      ? /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.exec(value)
+      : null;
+  const existing = version(running),
+    target = version(requested);
+  return Boolean(
+    existing &&
+    target &&
+    existing[1] === target[1] &&
+    (existing[1] !== "0" || existing[2] === target[2]),
+  );
+}

package/src/desktop-executor.js

@@ -1,4 +1,5 @@
 import spawn from "cross-spawn";
+import { normalizeProviderModelSelection } from "./provider-model-selection.js";
 
 import {
   BACKEND_VERSION_POLICIES,
@@ -48,6 +49,7 @@ export function desktopExecutorCapability(inspection) {
 export async function resolveDesktopExecutorCommand({
   backend,
   model = null,
+  reasoningEffort = null,
   instruction,
   repositoryPath,
   executionKind = "agentic_loop",
@@ -62,17 +64,26 @@ export async function resolveDesktopExecutorCommand({
     throw new Error("Desktop execution kind must be agentic_loop or direct.");
   }
   const normalizedPermissionMode = normalizePermissionMode(permissionMode);
-  const normalizedModel =
-    model === null || model === undefined
-      ? null
-      : String(model).trim();
-  if (normalizedModel !== null && !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$/.test(normalizedModel)) {
-    throw new Error("Desktop executor model is invalid.");
+  const { model: normalizedModel, reasoning_effort: effort } =
+    normalizeProviderModelSelection({ model, reasoning_effort: reasoningEffort });
+  if (provider !== "codex" && effort !== null) {
+    const error = new Error("Explicit reasoning effort is not supported by this Claude command adapter.");
+    error.code = "desktop_executor_selection_unsupported";
+    throw error;
   }
+  const selectionArgs = [
+    ...(normalizedModel ? ["--model", normalizedModel] : []),
+    ...(effort ? ["--config", `model_reasoning_effort=${JSON.stringify(effort)}`] : []),
+  ];
   const target = normalizeDesktopExecutionTarget(DESKTOP_EXECUTION_TARGET);
   const override =
     provider === "claude" ? environment.SIMY_CLAUDE_COMMAND : environment.SIMY_CODEX_COMMAND;
   if (override) {
+    if (normalizedModel || effort) {
+      const error = new Error("Explicit provider selection cannot be enforced by a shell command override.");
+      error.code = "desktop_executor_selection_unsupported";
+      throw error;
+    }
     return {
       ...shellCommand(override, repositoryPath, instruction, spawnImpl),
       backend: provider,
@@ -100,7 +111,7 @@ export async function resolveDesktopExecutorCommand({
               normalizedPermissionMode,
               normalizedModel,
             )
-          : claudeBackendArgs(instruction)
+          : claudeBackendArgs(instruction, normalizedModel)
         : directExecution
           ? [
               "exec",
@@ -108,22 +119,24 @@ export async function resolveDesktopExecutorCommand({
               "--skip-git-repo-check",
               "--sandbox",
               normalizedPermissionMode === "read_only" ? "read-only" : "workspace-write",
-              ...(normalizedModel ? ["--model", normalizedModel] : []),
+              ...selectionArgs,
               instruction,
             ]
-          : ["exec", "--json", instruction],
+          : ["exec", "--json", ...selectionArgs, instruction],
     env: {},
     spawn: spawnImpl,
     backend: provider,
     execution_target: target,
     execution_kind: executionKind,
     permission_mode: normalizedPermissionMode,
+    requested_model: normalizedModel,
+    requested_reasoning_effort: effort,
     verification: "compatible_version",
     installed_version: inspection.installed_version,
   };
 }
 
-export function claudeBackendArgs(instruction) {
+export function claudeBackendArgs(instruction, model = null) {
   return [
     "-p",
     instruction,
@@ -134,6 +147,7 @@ export function claudeBackendArgs(instruction) {
     // by the user. Print mode cannot display permission prompts, so edits would
     // otherwise be silently unavailable to the desktop executor.
     "--dangerously-skip-permissions",
+    ...(model ? ["--model", model] : []),
   ];
 }
 

package/src/index.js

@@ -6,6 +6,10 @@ import { createInterface } from "node:readline/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { findReusableConnection } from "./connection-discovery.js";
+import { connectionScope } from "./connection-diagnostics.js";
+import { readSession } from "./session-store.js";
+import { CLI_API_CONTRACT_VERSION } from "./cli-contract.js";
 import { startAgent } from "./agent.js";
 import { createRuntimeDiagnostics, captureRuntimeOutput } from "./runtime-diagnostics.js";
 import {
@@ -165,6 +169,23 @@ async function runLocalAgent() {
   const webOrigin = configuredWebOrigin;
   const sessionRoot = process.env.SIMY_HOME?.trim() || join(homedir(), ".simy");
 
+  try {
+    const existing = await findReusableConnection({ webOrigin, sessionRoot, cliVersion: packageInfo.version,
+      apiContractVersion: CLI_API_CONTRACT_VERSION, requestedPort: port, authorize: true,
+      expectedScope: connectionScope(await readSession(webOrigin, sessionRoot), webOrigin) });
+    if (existing) {
+      console.log(`Connected to existing SIMY service at http://127.0.0.1:${existing.port}`);
+      const url = existing.loginUrl || webOrigin;
+      console.log(`Continue in SIMY Web: ${url}`);
+      if (!args.has('--no-open') && process.env.SIMY_DAEMON_CHILD !== '1') await openAuthorizationUrl(url);
+      return;
+    }
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 2;
+    return;
+  }
+
   try {
     await prepareDaemonWorkflows({ argv, daemon });
   } catch (error) {

package/src/launch-authorization.js

@@ -0,0 +1,80 @@
+import { webApiHeaders, webApiUrl } from "./web-api.js";
+
+// Only an explicitly expired credential is renewable. A consumed or rejected
+// credential may represent an execution that already started; never replay it.
+export async function authorizeLaunch({
+  apiOrigin,
+  apiBaseUrl,
+  token,
+  runId,
+  challenge,
+  fetchImpl = fetch,
+}) {
+  const post = async (path, body) => {
+    const response = await fetchImpl(
+      webApiUrl(path, { webOrigin: apiOrigin, apiBaseUrl }),
+      {
+        method: "POST",
+        headers: webApiHeaders(
+          { token },
+          { "Content-Type": "application/json" },
+        ),
+        body: JSON.stringify(body),
+        redirect: "error",
+        signal: AbortSignal.timeout(10_000),
+      },
+    );
+    return { response, payload: await response.json().catch(() => null) };
+  };
+  const rejected = ({ response, payload }) => ({
+    ok: false,
+    status: response.status >= 500 ? 502 : response.status === 401 ? 401 : 403,
+    code:
+      typeof payload?.code === "string"
+        ? payload.code
+        : response.status >= 500
+          ? "launch_service_unavailable"
+          : response.status === 401
+            ? "connection_session_expired"
+            : response.status === 404
+              ? "launch_service_incompatible"
+              : "launch_challenge_invalid",
+  });
+  const verificationOutcome = (result) => {
+    if (!result.response.ok) return rejected(result);
+    return result.payload?.ok === true
+      ? { ok: true }
+      : { ok: false, status: 502, code: "launch_service_unavailable" };
+  };
+  try {
+    if (challenge) {
+      const verified = await post("challenges/verify", {
+        run_id: runId,
+        challenge,
+      });
+      if (verified.response.ok) return verificationOutcome(verified);
+      if (verified.payload?.code !== "launch_challenge_expired")
+        return rejected(verified);
+    }
+    const issued = await post("challenges/issue", {
+      run_id: runId,
+      ...(challenge ? { previous_challenge: challenge } : {}),
+    });
+    if (!issued.response.ok) return rejected(issued);
+    if (
+      typeof issued.payload?.challenge !== "string" ||
+      !issued.payload.challenge ||
+      !Number.isFinite(Date.parse(issued.payload.expires_at)) ||
+      Date.parse(issued.payload.expires_at) <= Date.now()
+    ) {
+      return { ok: false, status: 502, code: "launch_service_unavailable" };
+    }
+    const verified = await post("challenges/verify", {
+      run_id: runId,
+      challenge: issued.payload.challenge,
+    });
+    return verificationOutcome(verified);
+  } catch {
+    return { ok: false, status: 502, code: "launch_service_unavailable" };
+  }
+}

package/src/orchestrator/audit.js

@@ -134,7 +134,7 @@ export async function auditAttempt(charter, attempt, { previousAttempt = null, s
 
   const retryProblemSolving = evaluateRetryProblemSolving(attempt, previousAttempt);
   for (const check of retryProblemSolving.checks) {
-    addCheck(check.id, check.label, check.passed, check.detail);
+    addCheck(check.id, check.label, check.passed, check.detail, check.severity);
   }
   attempt.retry_problem_solving = retryProblemSolving;
 
@@ -220,7 +220,7 @@ export async function auditAttempt(charter, attempt, { previousAttempt = null, s
   }
 
   const findings = checks
-    .filter((check) => !check.passed)
+    .filter((check) => !check.passed && check.severity !== "advisory")
     .map((check) => ({
       code: check.id.toUpperCase(),
       title: check.label,

package/src/orchestrator/contract.js

@@ -1,3 +1,4 @@
+import { normalizeProviderModelSelection } from "../provider-model-selection.js";
 import { randomUUID } from "node:crypto";
 
 import {
@@ -103,6 +104,7 @@ export function createCodingLoopSnapshot({ runId, request, metadata = {} }) {
     charter: {
       id: `${runId}_charter`,
       requirement: cleanString(request.requirement),
+      ...normalizeProviderModelSelection(request),
       repository: cleanString(request.repository),
       backend: request.backend === "claude" ? "claude" : "codex",
       execution_target: executionTarget,

package/src/orchestrator/independent-audit.js

@@ -112,7 +112,7 @@ export function buildIndependentAuditInstruction(charter, attempt) {
         "criterion_results must contain one entry per stable criterion ID with criterion_id, passed, verification_method, evidence_refs, and observed_result.",
         "visual_review must contain inspected, artifacts, and acceptance_observations.",
         "Only passed=false entries are findings. Omit passing checks, and never report passed=true evidence as a finding.",
-        "Use passed=false when a blocker or major finding remains, or when evidence is unavailable.",
+        "Use passed=false when a blocker or major finding remains, or when required evidence is unavailable. For minor/warning/info findings, choose disposition=fix, defer, or dismiss based on impact and reversibility. Include the reason in explanation. Deferring or dismissing a non-major finding does not require human input and must not hide it. Major/blocker findings cannot be deferred by this field.",
       ].join("\n"),
     ),
   ].join("\n\n");
@@ -165,6 +165,8 @@ export function buildIndependentAudit(execution, charter = null, attempt = null)
       target: cleanString(item.target) || "pull_request",
       explanation: cleanString(item.explanation) || "Independent audit finding.",
       repairability: item.repairability === "manual" ? "manual" : "auto",
+      disposition: ["defer", "dismiss"].includes(item.disposition) && cleanString(item.explanation)
+        ? item.disposition : "fix",
       blocker_kind: ["machine", "human", "external"].includes(item.blocker_kind)
         ? item.blocker_kind : item.repairability === "manual" ? "human" : "machine",
       auto_fix_hint: cleanString(item.auto_fix_hint) || null,
@@ -249,10 +251,16 @@ export function buildIndependentAudit(execution, charter = null, attempt = null)
     findings.push({ passed: false, code: "USER_OUTCOME_UNPROVEN", severity: "blocker",
       target: "user_outcome", explanation: "The original user goal lacks independently observed operation and postcondition evidence.", repairability: "auto" });
   }
-  const requiresHuman = findings.some((item) => item.repairability === "manual");
+  // Only the independent reviewer can defer/dismiss a non-major finding.
+  // Unknown severities, generated evidence failures and major findings remain blocking.
+  const followUps = findings.filter(item => ["minor", "warning", "info"].includes(item.severity) &&
+    ["defer", "dismiss"].includes(item.disposition));
+  const blockingFindings = findings.filter(item => !followUps.includes(item));
+  const requiresHuman = blockingFindings.some((item) => item.repairability === "manual");
   return {
     ...objectiveBinding,
-    passed: result.passed === true && findings.length === 0,
+    passed: blockingFindings.length === 0 && (result.passed === true || followUps.length > 0),
+    follow_ups: followUps,
     summary: cleanString(result.summary) || "Independent audit completed.",
     findings,
     criterion_results: criterionResults,

package/src/orchestrator/instruction.js

@@ -171,8 +171,8 @@ export function buildCodingInstruction(
       [
         "Treat implementation as hypothesis testing: state assumptions, list plausible causes or approaches, inspect discriminating evidence, then choose the smallest strategy supported by that evidence.",
         attemptNumber > 1
-          ? "This is a retry. Before editing, generate at least eight distinct MECE hypotheses, select a different primary hypothesis or approach, and do not repeat the previous strategy."
-          : "For the first attempt, identify the single highest uncertainty and run the smallest discriminating verification before editing.",
+          ? "This is a retry. Repair clear failures directly; compare plausible causes when needed. Reasoning notes are advisory, not a prerequisite to editing."
+          : "For the first attempt, investigate material uncertainty before a risky operation; use a reasonable assumption for low-impact reversible choices and verify as you proceed.",
         attemptNumber > 1
           ? "Explain exactly what changed from the previous attempt and why the new evidence supports this strategy."
           : "Record the uncertainty, first verification, concrete evidence checked, observed result, selected hypothesis, and strategy in the structured result.",
@@ -244,7 +244,7 @@ export function buildPromptInterventions(
       trigger: "repair_focus",
       title: "Repair focus",
       prompt:
-        "Diagnose the reported gate failures with at least eight distinct hypotheses, select a new strategy supported by evidence, and do not repeat the previous approach.",
+        "Repair clear failures directly and verify the change. Investigate competing causes only when uncertainty warrants it; do not invent eight hypotheses or change strategy merely to satisfy a form.",
       evidence_required: [
         "hypotheses",
         "selected_hypothesis_id",

package/src/orchestrator/loop.js

@@ -10,7 +10,7 @@ import {
 } from "./independent-audit.js";
 import { buildCodingInstruction, buildPromptInterventions } from "./instruction.js";
 import { canStartProvider, codingAttemptCeiling, refreshBudgetState } from "./budget.js";
-import { buildAttempt, mergeTokenUsage } from "./result.js";
+import { buildAttempt, mergeTokenUsage, normalizeResultParseDiagnostic } from "./result.js";
 import { evaluateRetryCircuit } from "./retry.js";
 import { assessOutcomeProgress, verifyObjective } from "./outcome-monitor.js";
 import { appendEvent, publish } from "./shared.js";
@@ -291,6 +291,7 @@ async function runCodingLoopOwned({
       return snapshot;
     }
 
+    attempt.independent_audit.result_parse = normalizeResultParseDiagnostic(auditExecution.result_parse);
     attempt.independent_audit.minimum_matrix_sha256 = reviewedMatrix;
     attempt.independent_audit.evidence_identity_sha256 = reviewedEvidenceIdentity;
     attempt.independent_audit.objective_digest = reviewedObjectiveDigest;

package/src/orchestrator/problem-solving.js

@@ -1,6 +1,6 @@
 import { cleanString, stringArray } from "./shared.js";
 
-const MIN_RETRY_HYPOTHESES = 8;
+const MIN_RETRY_HYPOTHESES = 1;
 
 export function normalizeProblemSolving(value) {
   const record = value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -49,7 +49,7 @@ export function evaluateRetryProblemSolving(attempt, previousAttempt) {
   const checks = [
     {
       id: "retry_hypotheses_expanded",
-      label: "Retry considers at least eight distinct hypotheses",
+      label: "Retry considers a plausible explanation",
       passed: distinctHypotheses >= MIN_RETRY_HYPOTHESES,
       detail: `Expected at least ${MIN_RETRY_HYPOTHESES} distinct hypotheses; recorded ${distinctHypotheses}.`,
     },
@@ -78,9 +78,10 @@ export function evaluateRetryProblemSolving(attempt, previousAttempt) {
     },
   ];
   return {
-    required: true,
-    passed: checks.every((check) => check.passed),
-    checks,
+    required: false,
+    passed: true,
+    assessment_complete: checks.every((check) => check.passed),
+    checks: checks.map(check => ({ ...check, severity: "advisory" })),
     current,
     previous,
   };
@@ -91,7 +92,7 @@ export function problemSolvingResultContract() {
     "problem_solving must be an object with hypotheses, selected_hypothesis_id, evidence_checked, strategy, and changed_from_previous.",
     "Each hypothesis must use {id, statement}; evidence_checked must list concrete observations or commands.",
     "On attempt 1, record the assumptions, hypotheses considered, selected hypothesis, and implementation strategy; changed_from_previous may be null.",
-    `On every retry, record at least ${MIN_RETRY_HYPOTHESES} distinct MECE hypotheses, select one of them, check discriminating evidence, use a strategy different from the previous attempt, and explain the change in changed_from_previous.`,
+    "On retry, use reasoning proportional to the uncertainty. If the repair is clear, make it and verify it; do not invent a fixed number of hypotheses or change a working strategy merely to satisfy a form. For persistent unexplained failures, compare plausible causes and inspect discriminating evidence. These reasoning notes are advisory; unchanged failures are still subject to the retry circuit.",
   ].join("\n");
 }
 

package/src/orchestrator/result.js

@@ -56,6 +56,7 @@ export function buildAttempt({ attemptNumber, charter, instruction, promptInterv
     visual_qa_result: null,
     release_gate: null,
     executor_logs: stringArray(execution.logs).slice(-100),
+    result_parse: normalizeResultParseDiagnostic(execution.result_parse),
     token_usage:
       execution.tokenUsage && typeof execution.tokenUsage === "object"
         ? execution.tokenUsage
@@ -79,16 +80,104 @@ export function parseStructuredResult(text) {
 }
 
 export function parseStructuredMarker(text, marker) {
-  const index = String(text || "").lastIndexOf(marker);
-  if (index < 0) return {};
-  const afterMarker = String(text).slice(index + marker.length).trim();
-  const firstLine = afterMarker.split(/\r?\n/, 1)[0].trim();
+  return diagnoseStructuredMarker(text, marker).value;
+}
+
+// Parse only a line-anchored result channel. Braces in JSON strings are not
+// boundaries; JSON.parse remains responsible for syntax and object validation.
+export function diagnoseStructuredMarker(text, marker, { maxBytes = 1024 * 1024 } = {}) {
+  const failure = code => ({ code, value: {} });
+  if (typeof text !== "string") return failure("missing_marker");
+  if (Buffer.byteLength(text, "utf8") > maxBytes) return failure("result_too_large");
+  const escaped = marker.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const matches = [...text.matchAll(new RegExp(`(?:^|\\n)[ \t]*${escaped}`, "g"))];
+  if (!matches.length) return failure("missing_marker");
+  if (matches.length !== 1) return failure("ambiguous_marker");
+  const payload = text.slice(matches[0].index + matches[0][0].length).trim();
+  if (!payload) return failure("truncated_json");
+  if (!payload.startsWith("{")) return failure("result_root_not_object");
+  let depth = 0, quoted = false, escapedChar = false, end = -1;
+  for (let index = 0; index < payload.length; index += 1) {
+    const char = payload[index];
+    if (quoted) {
+      if (escapedChar) escapedChar = false;
+      else if (char === "\\") escapedChar = true;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === "{" || char === "[") depth += 1;
+    else if (char === "}" || char === "]") {
+      depth -= 1;
+      if (depth === 0) { end = index + 1; break; }
+    }
+  }
+  if (end < 0) return failure("truncated_json");
+  if (payload.slice(end).trim()) return failure("trailing_result_content");
   try {
-    const value = JSON.parse(firstLine);
-    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-  } catch {
-    return {};
+    const value = JSON.parse(payload.slice(0, end));
+    if (!value || Array.isArray(value) || typeof value !== "object") return failure("result_root_not_object");
+    if (!Object.keys(value).length) return failure("empty_result");
+    return { code: "parsed", value };
+  } catch { return failure("invalid_json"); }
+}
+
+// Native JSONL admits results only from a successfully finished provider turn.
+// Command output, echoed prompts and intermediate assistant items cannot be a
+// fallback channel. Explicit shell overrides retain the documented legacy text.
+export function parseProviderStructuredResult(raw, { backend, marker = "SIMY_RESULT_JSON:", allowPlainText = false,
+  maxBytes = 1024 * 1024, maxStreamBytes = 64 * 1024 * 1024 } = {}) {
+  const failure = code => ({ code, value: {} });
+  if (typeof raw !== "string") return failure("missing_provider_final");
+  if (Buffer.byteLength(raw, "utf8") > maxStreamBytes) return failure("provider_stream_too_large");
+  const events = [];
+  let malformedStream = false;
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try {
+      const event = JSON.parse(line);
+      if (event && typeof event === "object" && !Array.isArray(event) && typeof event.type === "string") {
+        // Tool payload size is independent of the bounded final result. Retain
+        // event identity/order, not arbitrary command output, during selection.
+        events.push(event.type === "result" || event.item?.type === "agent_message"
+          ? event : { type: event.type, item: { type: event.item?.type } });
+      } else malformedStream = true;
+    }
+    catch { malformedStream = true; }
   }
+  const nativeTypes = new Set(backend === "claude"
+    ? ["system", "assistant", "user", "result", "stream_event", "tool_progress", "tool_use_summary", "rate_limit_event", "auth_status"]
+    : ["thread.started", "turn.started", "turn.completed", "turn.failed", "item.started", "item.updated", "item.completed", "error"]);
+  const native = events.some(e => nativeTypes.has(e.type));
+  // A discarded line could be a later error or unfinished turn. Native streams
+  // must stay intact; only an explicit non-native override admits plain text.
+  if (malformedStream && (native || !allowPlainText)) return failure("malformed_provider_stream");
+  if (!native) return allowPlainText ? diagnoseStructuredMarker(raw, marker, {maxBytes}) : failure("missing_provider_final");
+  if (backend === "claude") {
+    const results = events.filter(e => e.type === "result");
+    if (results.length > 1) return failure("contradictory_provider_terminal");
+    const final = results[0];
+    if (!final) return failure("missing_provider_final");
+    if (events.slice(events.indexOf(final) + 1).some(e => typeof e.type === "string")) return failure("unsettled_provider_turn");
+    if (final.is_error === true || String(final.subtype || "").startsWith("error")) return failure("provider_failed");
+    return diagnoseStructuredMarker(final.result, marker, {maxBytes});
+  }
+  const end = events.findLastIndex(e => e.type === "turn.completed" || e.type === "turn.failed");
+  if (end < 0) return failure("missing_provider_final");
+  if (events[end].type === "turn.failed") return failure("provider_failed");
+  const start = events.slice(0, end).findLastIndex(e => e.type === "turn.started");
+  const turn = events.slice(start + 1, end);
+  if (turn.some(e => e.type === "turn.failed" || e.type === "turn.completed")) {
+    return failure("contradictory_provider_terminal");
+  }
+  const finalIndex = turn.findLastIndex(e => e.type === "item.completed" &&
+    e.item?.type === "agent_message" && (!e.item.phase || e.item.phase === "final_answer"));
+  if (finalIndex < 0) return failure("missing_provider_final");
+  if (turn.slice(finalIndex + 1).some(e => typeof e.type === "string")) {
+    return failure("nonterminal_agent_message");
+  }
+  const final = turn[finalIndex].item;
+  // A later unsettled turn must not replay an earlier completed result.
+  if (events.slice(end + 1).some(e => typeof e.type === "string")) return failure("unsettled_provider_turn");
+  return diagnoseStructuredMarker(final.text, marker, {maxBytes});
 }
 
 function buildArtifactPreviews(result) {
@@ -125,3 +214,10 @@ function isUsageRecord(value) {
 }
 
 function safeDigest(compute) { try { return compute(); } catch { return null; } }
+
+export function normalizeResultParseDiagnostic(value) {
+  if (!value) return null;
+  const codes = ["parsed", "missing_marker", "result_too_large", "ambiguous_marker", "truncated_json", "result_root_not_object", "trailing_result_content", "empty_result", "invalid_json", "missing_provider_final", "provider_failed", "unsettled_provider_turn", "nonterminal_agent_message", "contradictory_provider_terminal", "provider_stream_too_large", "malformed_provider_stream"];
+  return { code: codes.includes(value.code) ? value.code : "unknown_parse_diagnostic",
+    channel: ["override_or_native", "provider_final"].includes(value.channel) ? value.channel : "unknown" };
+}

package/src/provider-model-selection.js

@@ -0,0 +1,24 @@
+const SELECTION_FIELDS = ["model", "reasoning_effort", "audit_model", "audit_reasoning_effort"];
+const REASONING_EFFORTS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"]);
+
+// Preserve explicit selections at request boundaries; do not infer a model catalog.
+export function normalizeProviderModelSelection(input = {}) {
+  const result = {};
+  for (const field of SELECTION_FIELDS) {
+    const value = input[field];
+    if (value == null) {
+      result[field] = null;
+      continue;
+    }
+    if (typeof value !== "string" || !value.trim()) {
+      throw new Error(`${field} must be a non-empty string.`);
+    }
+    const normalized = value.trim();
+    const valid = field.endsWith("reasoning_effort")
+      ? REASONING_EFFORTS.has(normalized)
+      : /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,159}(?:\[1m\])?$/.test(normalized);
+    if (!valid) throw new Error(`${field} is invalid.`);
+    result[field] = normalized;
+  }
+  return result;
+}

package/src/runner.js

@@ -8,11 +8,10 @@ import { promisify } from "node:util";
 import {
   collectPrEvidence,
   createCodingLoopSnapshot,
-  parseStructuredMarker,
-  parseStructuredResult,
   recheckPrReadiness,
   runCodingLoop,
 } from "./orchestrator/index.js";
+import { parseProviderStructuredResult } from "./orchestrator/result.js";
 import {
   EXECUTION_IO_POLICY_VERSION,
   executionTextSha256,
@@ -180,6 +179,10 @@ export function restoreRun({ snapshot, session, apiOrigin, localPath = null, loc
     sqmHistoryRoot,
     request: {
       backend: charter.backend === "claude" ? "claude" : "codex",
+      model: charter.model || null,
+      reasoning_effort: charter.reasoning_effort || null,
+      audit_model: charter.audit_model || null,
+      audit_reasoning_effort: charter.audit_reasoning_effort || null,
       execution_target: normalizeDesktopExecutionTarget(charter.execution_target),
       execution_device_id:
         String(snapshot.metadata?.execution_device_id || session?.device_id || "").trim() || null,
@@ -1012,18 +1015,21 @@ export async function executeProcessAttempt({
   marker = "SIMY_RESULT_JSON:",
   attemptNumber = null,
   resolveCommandImpl = resolveDesktopExecutorCommand,
+  charter = run?.snapshot?.charter,
   onExecutionComplete = null,
 }) {
+  const phase = marker === "SIMY_AUDIT_JSON:" ? "reviewer" : "executor";
   const command = await resolveCommandImpl({
     backend,
     instruction,
     repositoryPath,
+    model: phase === "reviewer" ? charter?.audit_model : charter?.model,
+    reasoningEffort: phase === "reviewer" ? charter?.audit_reasoning_effort : charter?.reasoning_effort,
   });
   const startedAt = new Date().toISOString();
   const stdout = [];
   const stderr = [];
   const tokenUsageRecords = [];
-  const phase = marker === "SIMY_AUDIT_JSON:" ? "reviewer" : "executor";
   const initialBudget = budgetState(run.snapshot);
   const invocationId = randomUUID();
   const observationSender =
@@ -1106,18 +1112,17 @@ export async function executeProcessAttempt({
       run.child = null;
       await Promise.all(checkpointWrites);
       const rawStdout = stdout.join("");
-      const assistantText = extractAssistantText(rawStdout);
-      const parse =
-        marker === "SIMY_RESULT_JSON:"
-          ? parseStructuredResult
-          : (value) => parseStructuredMarker(value, marker);
-      const result = parse(assistantText);
+      const parsed = parseProviderStructuredResult(rawStdout, {
+        backend, marker, allowPlainText: command.verification === "explicit_command_override",
+      });
+      const parseError = parsed.code === "parsed" ? null : `Provider result unavailable: ${parsed.code}.`;
       const execution = {
         invocationId,
         exitCode: terminalError && exitCode === 0 ? 1 : exitCode,
-        error: error || terminalError,
+        error: error || terminalError || parseError,
         ...(terminalErrorCode ? { errorCode: terminalErrorCode } : {}),
-        result: Object.keys(result).length > 0 ? result : parse(rawStdout),
+        result: parsed.value,
+        result_parse: { code: parsed.code, channel: command.verification === "explicit_command_override" ? "override_or_native" : "provider_final" },
         tokenUsage:
           tokenUsageRecords.length > 0 ? { records: tokenUsageRecords } : {},
         logs: [...stdout, ...stderr]
@@ -1212,25 +1217,6 @@ async function pathExists(value) {
   }
 }
 
-function extractAssistantText(raw) {
-  const messages = [];
-  for (const line of String(raw || "").split(/\r?\n/)) {
-    if (!line.trim().startsWith("{")) continue;
-    try {
-      const item = JSON.parse(line);
-      if (item.type === "result" && typeof item.result === "string") messages.push(item.result);
-      if (item.type === "item.completed" && item.item?.type === "agent_message") {
-        if (typeof item.item.text === "string") messages.push(item.item.text);
-      }
-      if (item.type === "assistant" && typeof item.message?.content === "string") {
-        messages.push(item.message.content);
-      }
-    } catch {
-      // Non-JSON executor output is still available to the fallback parser.
-    }
-  }
-  return messages.join("\n");
-}
 
 function emitOutput(run, text, { backend = run.request.backend, promote = true } = {}) {
   for (const line of String(text).split(/\r?\n/)) {

package/src/sqm/session.js

@@ -1,3 +1,6 @@
+import { findReusableConnection } from "../connection-discovery.js";
+import { connectionScope } from "../connection-diagnostics.js";
+import { CLI_VERSION, CLI_API_CONTRACT_VERSION } from "../cli-contract.js";
 import { startAgent } from "../agent.js";
 import { openAuthorizationUrl } from "../browser.js";
 import { isSessionValid, readSession } from "../session-store.js";
@@ -16,6 +19,7 @@ export async function ensureSqmSession(
     readSessionImpl = readSession,
     isSessionValidImpl = isSessionValid,
     startAgentImpl = startAgent,
+    findConnectionImpl = findReusableConnection,
     openAuthorizationUrlImpl = openAuthorizationUrl,
     createAgentShutdownImpl = createAgentShutdown,
     expectedScope,
@@ -31,8 +35,11 @@ export async function ensureSqmSession(
     return session;
   }
 
-  const agent = await startAgentImpl({ requestedPort: 0, webOrigin, quiet: true });
-  const shutdown = createAgentShutdownImpl(agent);
+  const existing = await findConnectionImpl({ webOrigin, cliVersion: CLI_VERSION,
+    apiContractVersion: CLI_API_CONTRACT_VERSION, expectedScope: connectionScope(session, webOrigin),
+    authorize: true, reauthorize: session?.token === rejectedToken && Boolean(rejectedToken) });
+  const agent = existing || await startAgentImpl({ requestedPort: 0, webOrigin, quiet: true });
+  const shutdown = existing ? async () => {} : createAgentShutdownImpl(agent);
   try {
     const loginUrl = agent.loginUrl;
     if (!loginUrl) throw new Error("SIMY could not create an SQM authorization session.");