@awak-app/simy-cli 0.6.13 → 0.6.17

package/src/desktop-update-stop.js

@@ -0,0 +1,22 @@
+// Confirmed updates must not wait indefinitely on a provider or remote flush.
+// SIGKILL is ownership checked by the caller; the desktop host itself survives
+// long enough to settle its local checkpoints and perform the signed handoff.
+export async function stopDesktopWorkForUpdate({ stopWork, killOwned, timeoutMs = 12_000 }) {
+  let timer;
+  const stopping = Promise.resolve().then(stopWork);
+  // A kill failure or deadline can win the race before checkpoint cancellation
+  // settles. Observe its eventual rejection as well.
+  void stopping.catch(() => {});
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error('Task shutdown timed out. Restart SIMY and retry the update.')), timeoutMs);
+  });
+  try {
+    await Promise.race([(async () => {
+      // Start cancellation before taking the process snapshot so queued work is
+      // fenced and live workers observe their stop intent before termination.
+      await Promise.resolve();
+      await killOwned();
+      await stopping;
+    })(), deadline]);
+  } finally { clearTimeout(timer); }
+}

package/src/doctor.js

@@ -4,6 +4,7 @@ import { connectionDiscoveryPath } from "./connection-discovery.js";
 import { readSession, isSessionValid, defaultSessionRoot } from "./session-store.js";
 import { inspectProviderStatus } from "./desktop-status.js";
 import { readDiagnosticLog } from "./diagnostic-log.js";
+import { readHostExitDiagnostics } from "./host-exit-diagnostics.js";
 
 export async function collectDiagnostics({ webOrigin, cliVersion, root = defaultSessionRoot(),
   readSessionImpl = readSession, inspectProvider = inspectProviderStatus, fetchImpl = fetch,
@@ -37,7 +38,7 @@ export async function collectDiagnostics({ webOrigin, cliVersion, root = default
   return { schema_version: 1, cli_version: cliVersion, web_origin: webOrigin, daemon,
     session: { state: valid ? "signed_in" : session ? "expired" : "signed_out",
       expires_at: Number.isFinite(Date.parse(session?.expires_at)) ? session.expires_at : null },
-    providers, failures,
+    providers, failures, host_exit: await readHostExitDiagnostics(root),
     purpose_verification: await purposeVerificationCapability(purposeSigningKeyPath(root)).then(value => ({ state: value ? "available" : "not_initialized", key_id: value?.key_id || null, execution: "explicit_frozen_recipes_only" })).catch(() => ({ state: "unavailable", key_id: null, execution: "explicit_frozen_recipes_only" })),
     actions: [
       ...(!valid ? [{ id: "reconnect_cli", command: "simy" }] : []),

package/src/host-exit-diagnostics.js

@@ -0,0 +1,28 @@
+import { open } from "node:fs/promises";
+import { constants } from "node:fs";
+import { join } from "node:path";
+
+// The native launcher retains the latest abnormal exit. Read only its bounded
+// header: stderr may contain private paths, prompts or credentials.
+export async function readHostExitDiagnostics(root) {
+  let file;
+  try {
+    file = await open(join(root, "logs", "desktop-host-exit.log"), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    if (!(await file.stat()).isFile()) return { state: "unavailable" };
+    const buffer = Buffer.alloc(256);
+    const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+    const header = buffer.subarray(0, bytesRead).toString("utf8").split("\n")[0];
+    const match = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z) desktop host exited with status (-?\d{1,10})$/.exec(header);
+    const status = match ? Number(match[2]) : NaN;
+    if (!match || !Number.isFinite(Date.parse(match[1])) ||
+      new Date(match[1]).toISOString() !== match[1].replace("Z", ".000Z") ||
+      !Number.isInteger(status) || status === 0 || status < -2147483648 || status > 2147483647) {
+      return { state: "unavailable" };
+    }
+    return { state: "recorded", at: match[1], exit_status: status, scope: "local_desktop_host", retention: "latest_abnormal_exit" };
+  } catch (error) {
+    return { state: error.code === "ENOENT" ? "not_recorded" : "unavailable" };
+  } finally {
+    await file?.close().catch(() => {});
+  }
+}

package/src/index.js

@@ -138,6 +138,7 @@ async function runCommand(installMode) {
   simy --no-tui   Start the foreground HTTP agent without the interactive console
   simy sqm min-check  Run the fast deterministic SQM diff preflight
   simy sqm check      Run full scenarios, write proof.json, and sign the run
+  simy sqm upload-proof  Recover storage of an original signed SQM proof
   simy sqm lint       Validate module reliability before publication
   simy sqm replay     Replay modules against labelled historical snapshots
   simy update --check Check the installed and latest stable CLI versions

package/src/provider-links.js

@@ -0,0 +1,74 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+
+export const PROVIDER_LINKS = Object.freeze(['codex', 'claude']);
+const defaultRoot = () => process.env.SIMY_HOME?.trim() || join(homedir(), '.simy');
+const writeQueues = new Map();
+const defaults = () => Object.fromEntries(PROVIDER_LINKS.map(provider => [provider, { connected: true, epoch: null, requiresConsent: false }]));
+const disconnected = () => Object.fromEntries(PROVIDER_LINKS.map(provider => [provider, { connected: false, epoch: null, requiresConsent: true, settingsError: true }]));
+const validateProvider = provider => { if (!PROVIDER_LINKS.includes(provider)) throw new Error('Unsupported SIMY provider connection.'); };
+
+async function readSettings(root) {
+  let payload;
+  try { payload = JSON.parse(await readFile(join(root, 'provider-links.json'), 'utf8')); }
+  catch (error) { if (error.code === 'ENOENT') return defaults(); throw error; }
+  if (payload?.schemaVersion !== 1 || !payload.providers || PROVIDER_LINKS.some(provider => {
+    const value = payload.providers[provider];
+    return !value || typeof value.connected !== 'boolean' || typeof value.requiresConsent !== 'boolean' ||
+      value.epoch !== null && (typeof value.epoch !== 'string' || !value.epoch || value.epoch.length > 128);
+  })) throw new Error('Invalid SIMY provider connection settings.');
+  return Object.fromEntries(PROVIDER_LINKS.map(provider => [provider, {
+    connected: payload.providers[provider].connected,
+    epoch: payload.providers[provider].epoch,
+    requiresConsent: payload.providers[provider].requiresConsent,
+  }]));
+}
+
+// Existing installations stay linked until the user explicitly disconnects.
+// An unreadable saved preference fails closed instead of restoring revoked consent.
+export async function readProviderLinks(root = defaultRoot()) {
+  try { return await readSettings(root); } catch { return disconnected(); }
+}
+
+export async function providerLinkConnected(root = defaultRoot(), provider) {
+  validateProvider(provider);
+  return (await readProviderLinks(root))[provider].connected;
+}
+
+// Session APIs use a delivery-hooks root, while desktop/agent policy uses SIMY_HOME.
+export async function requireProviderLink({ root = join(defaultRoot(), 'delivery-hooks'), provider, expectedEpoch } = {}) {
+  validateProvider(provider);
+  const link = (await readProviderLinks(dirname(resolve(root))))[provider];
+  if (!link.connected) {
+    throw Object.assign(new Error('Reconnect this provider to SIMY before using it.'), { code: 'provider_link_disconnected' });
+  }
+  if (expectedEpoch !== undefined && expectedEpoch !== link.epoch) {
+    throw Object.assign(new Error('SIMY provider connection changed. Select the conversation again.'), { code: 'provider_link_changed' });
+  }
+  return link;
+}
+
+export function writeProviderLink(root = defaultRoot(), provider, connected) {
+  validateProvider(provider);
+  if (typeof connected !== 'boolean') throw new Error('Choose whether this provider is connected to SIMY.');
+  const key = resolve(root);
+  const previous = writeQueues.get(key) || Promise.resolve();
+  const pending = previous.catch(() => {}).then(async () => {
+    const providers = await readSettings(root);
+    // Reconnection restores discovery only. Session execution consent is cleared
+    // separately and must be selected again, including after a host restart.
+    providers[provider] = { connected, epoch: randomUUID(), requiresConsent: true };
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    const target = join(root, 'provider-links.json'), temporary = `${target}.${randomUUID()}.tmp`;
+    try {
+      await writeFile(temporary, `${JSON.stringify({ schemaVersion: 1, providers })}\n`, { mode: 0o600 });
+      await rename(temporary, target);
+    } finally { await rm(temporary, { force: true }); }
+    return providers;
+  });
+  writeQueues.set(key, pending);
+  void pending.finally(() => { if (writeQueues.get(key) === pending) writeQueues.delete(key); }).catch(() => {});
+  return pending;
+}

package/src/session-supervision/action-association-host.js

@@ -3,6 +3,7 @@ import { listRecords, readRecord, updateRecord, TERMINAL, managedBudgetReason }
 import { createActionAssociationApi, ActionAssociationApiError } from './action-association-api.js';
 import { actionCandidateRequest, prepareActionAssociation, importActionBinding,
   settleActionAssociation, cancelActionAssociation } from './action-association.js';
+import { CANDIDATE_DISPLAY_MS, needsCandidateSearch, hasFreshCandidates } from './association-refresh.js';
 
 const namespaceFor = (origin, scope) => JSON.stringify([new URL(origin).origin, scope.organizationId, scope.userId]);
 const identity = record => ({ provider: record.provider, session: record.session, taskId: record.run.managed.taskId });
@@ -90,22 +91,34 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
     let view = views.get(target.taskId);
     const request = actionCandidateRequest(record);
     const contextRevision = request?.context.revision || null;
-    if (!force && view?.auth === expected && view.contextRevision === contextRevision && now() < view.nextRefresh && (!association?.outbox || view.error)) {
-      if (queue && !view.error && view.snapshot && !association?.manualOverride && !association?.job && !association?.outbox && !TERMINAL.has(record.run.state)) await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now(), validate: validateScope(expected) });
+    const active = !TERMINAL.has(record.run.state);
+    if (!force && view?.auth === expected && view.active === active && view.contextRevision === contextRevision && now() < view.nextRefresh && (!association?.outbox || view.error)) {
+      if (queue && !view.error && hasFreshCandidates(view, now()) && !association?.manualOverride && !association?.job && !association?.outbox && !TERMINAL.has(record.run.state)) await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now(), validate: validateScope(expected) });
       return;
     }
-    view = { ...view, auth: expected, contextRevision, nextRefresh: now() + refreshMs };
+    const search = request && (needsCandidateSearch(view, expected, contextRevision, active, force) ||
+      association?.outbox && !view?.snapshot);
+    view = { ...view, auth: expected, active, contextRevision, nextRefresh: now() + refreshMs };
     views.delete(target.taskId); views.set(target.taskId, view);
     while (views.size > 500) views.delete(views.keys().next().value);
     try {
       // Never publish an outbox from an earlier organization or login before a
       // scoped server response confirms who owns the current request.
-      const snapshot = request ? await api.candidates(request, { signal: abort.signal }) : await api.readBinding(target.taskId, { signal: abort.signal });
-      const namespace = await importEnvelope(record, snapshot, expected);
+      const envelope = search ? await api.candidates(request, { signal: abort.signal }) : await api.readBinding(target.taskId, { signal: abort.signal });
+      const namespace = await importEnvelope(record, envelope, expected);
+      const reusable = view.auth === expected && view.namespace === namespace && view.snapshot?.contextRevision === contextRevision;
+      const snapshot = search ? envelope : { ...(reusable ? view.snapshot : {}), ...envelope };
       view.namespace = namespace; view.error = null;
-      view.candidates = (snapshot.candidates || []).map(publicCandidate);
+      if (search) {
+        view.candidateAuth = expected; view.candidateContextRevision = contextRevision;
+        view.candidatesExpireAt = now() + CANDIDATE_DISPLAY_MS;
+      } else if (!reusable) {
+        view.candidateAuth = null; view.candidateContextRevision = null;
+      }
+      view.candidates = (search || hasFreshCandidates(view, now()) ? snapshot.candidates || [] : []).map(publicCandidate);
       view.candidateTruncated = snapshot.retrieval?.truncated === true || view.candidates.length > 5;
-      view.snapshot = request ? snapshot : null;
+      view.snapshot = snapshot.candidateRevision ? snapshot : null;
+      if (!active && !snapshot.binding?.action && !association?.outbox) view.nextRefresh = Infinity;
       let latest = await fresh(target);
       if (!latest || !await valid(expected)) return;
       const pending = latest.run.managed.actionAssociation?.outbox;
@@ -123,7 +136,7 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
         await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: saved.binding, now: now(), validate: validateScope(expected) });
         return;
       }
-      if (queue && request && !latest.run.managed.actionAssociation?.manualOverride && !TERMINAL.has(latest.run.state)) {
+      if (queue && request && hasFreshCandidates(view, now()) && !latest.run.managed.actionAssociation?.manualOverride && !TERMINAL.has(latest.run.state)) {
         // A read turn is queued only at the original session's safe boundary.
         // Blocked tasks retain candidates for auxiliary correction in the UI.
         await prepareActionAssociation({ root, record: latest, snapshot, webOrigin, now: now(), validate: validateScope(expected) });
@@ -245,7 +258,7 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
     async prepareCached(record) {
       const expected = await current();
       const view = views.get(record?.run?.managed?.taskId), request = actionCandidateRequest(record);
-      if (closed || !auth || !view || view.auth !== auth || view.error || !view.snapshot || !request || view.contextRevision !== request.context.revision || view.snapshot.contextRevision !== request.context.revision || view.namespace !== namespaceFor(webOrigin, view.snapshot.scope)) return record;
+      if (closed || !auth || !view || view.auth !== auth || view.error || !hasFreshCandidates(view, now()) || !request || view.contextRevision !== request.context.revision || view.snapshot.contextRevision !== request.context.revision || view.namespace !== namespaceFor(webOrigin, view.snapshot.scope)) return record;
       try {
         const prepared = await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now(), validate: validateScope(expected) });
         return prepared || record;
@@ -268,7 +281,7 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
           !view || view.auth !== expected ? { status: 'loading', binding: null, candidates: [], canCorrect: false } : {
             status: view.error || local?.status || 'waiting_boundary',
             binding: view.namespace && local?.namespace === view.namespace ? publicBinding(local.binding) : null,
-            candidates: (view.candidates || []).slice(0,5), canCorrect: !view.error,
+            candidates: (hasFreshCandidates(view, now()) ? view.candidates || [] : []).slice(0,5), canCorrect: !view.error,
             contextRevision: view.contextRevision, candidateRevision: view.snapshot?.candidateRevision || null, retryOn: local?.retryOn || null, truncated: view.candidateTruncated || false,
           };
         let bytes = Buffer.byteLength(JSON.stringify(run.actionAssociation));

package/src/session-supervision/association-refresh.js

@@ -0,0 +1,12 @@
+// Candidate search is event-driven; binding reads remain independently renewable.
+// Retain only the search identity after expiry, so a timer cannot restart search
+// or keep displaying candidate text after its authorization window has elapsed.
+export const CANDIDATE_DISPLAY_MS = 60_000;
+
+export function needsCandidateSearch(view, auth, contextRevision, active, force = false) {
+  return force || active && (view?.candidateAuth !== auth || view.candidateContextRevision !== contextRevision);
+}
+
+export function hasFreshCandidates(view, now) {
+  return Boolean(view?.snapshot?.candidateRevision && now < view.candidatesExpireAt);
+}

package/src/session-supervision/association-store.js

@@ -3,9 +3,14 @@ import {
   listRecords,
   readRecord,
   updateRecord,
+  TERMINAL,
 } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { associationRevision } from './action-association.js';
 import { ActionAssociationApiError } from './action-association-api.js';
+import { CANDIDATE_DISPLAY_MS, needsCandidateSearch, hasFreshCandidates } from './association-refresh.js';
+
+const activeConversation = (candidate, record) => !TERMINAL.has(record.run?.state) &&
+  (candidate.isRunning !== false || candidate.autoContinue === true || candidate.analysis?.state === 'continue');
 
 export const sessionAssociationContext = (candidate) => {
   const grounded =
@@ -111,6 +116,7 @@ export function createOrdinaryAssociationStore({
     if (record.run?.managed) return;
     const auth = await api.authRevision(),
       context = sessionAssociationContext(candidate);
+    const active = activeConversation(candidate, record);
     let view = views.get(taskId);
     if (!auth) {
       rememberView(taskId, { auth, status: 'signed_out' });
@@ -120,13 +126,15 @@ export function createOrdinaryAssociationStore({
       !force &&
       view?.auth === auth &&
       view.contextRevision === context.revision &&
+      view.active === active &&
       now() < view.nextRefresh
     )
       return;
     const previous = view?.auth === auth ? view : null;
     const sameContext = previous?.contextRevision === context.revision;
+    const search = needsCandidateSearch(previous, auth, context.revision, active, force);
     view = {
-      ...previous, auth, contextRevision: context.revision,
+      ...previous, auth, active, contextRevision: context.revision,
       // Background renewal retains the last stable presentation. A user refresh
       // can show progress without flashing every cached result back to loading.
       status: force ? 'loading' : previous?.status || 'loading',
@@ -134,19 +142,22 @@ export function createOrdinaryAssociationStore({
     };
     rememberView(taskId, view);
     try {
-      const snapshot = await api.candidates(
+      const envelope = search ? await api.candidates(
         { taskId, context, limit: 10 },
         { signal: abort.signal },
-      );
+      ) : await api.readBinding(taskId, { signal: abort.signal });
       if (closed || (await api.authRevision()) !== auth)
         throw new ActionAssociationApiError('account_changed');
       if (
-        snapshot.taskId !== taskId ||
-        snapshot.contextRevision !== context.revision ||
-        (snapshot.binding && snapshot.binding.taskId !== taskId)
+        search && (envelope.taskId !== taskId || envelope.contextRevision !== context.revision) ||
+        (envelope.binding && envelope.binding.taskId !== taskId)
       )
         throw new ActionAssociationApiError('invalid_response');
-      const namespace = namespaceFor(webOrigin, snapshot.scope);
+      const namespace = namespaceFor(webOrigin, envelope.scope);
+      const reusable = sameContext && previous.namespace === namespace && hasFreshCandidates(previous, now());
+      const snapshot = search ? envelope : {
+        ...(reusable ? previous.snapshot : {}), ...envelope, taskId, contextRevision: context.revision,
+      };
       const persisted = await updateRecord(
         root,
         candidate.provider,
@@ -184,7 +195,10 @@ export function createOrdinaryAssociationStore({
       Object.assign(view, {
         namespace,
         snapshot,
-        nextRefresh: now() + (snapshot.binding?.action ? 15_000 : 60_000),
+        candidateAuth: search ? auth : previous?.namespace === namespace ? previous?.candidateAuth : null,
+        candidateContextRevision: search ? context.revision : previous?.namespace === namespace ? previous?.candidateContextRevision : null,
+        candidatesExpireAt: search ? now() + CANDIDATE_DISPLAY_MS : previous?.candidatesExpireAt,
+        nextRefresh: snapshot.binding?.action ? now() + 15_000 : active ? now() + 60_000 : Infinity,
         failures: 0,
         status: snapshot.binding?.action
           ? 'bound'
@@ -230,7 +244,8 @@ export function createOrdinaryAssociationStore({
         candidate.binding = { ...candidate.binding, taskId };
         if (record.run?.managed) continue;
         const cached = views.get(taskId),
-          context = sessionAssociationContext(candidate);
+          context = sessionAssociationContext(candidate),
+          active = activeConversation(candidate, record);
         if (
           auth &&
           !closed &&
@@ -238,6 +253,7 @@ export function createOrdinaryAssociationStore({
           (!cached ||
             cached.auth !== auth ||
             cached.contextRevision !== context.revision ||
+            cached.active !== active ||
             now() >= cached.nextRefresh)
         ) {
           const scopedBinding = cached?.auth === auth && cached.snapshot && record.actionAssociation?.authRevision === auth && record.actionAssociation.namespace === cached.namespace;
@@ -247,7 +263,7 @@ export function createOrdinaryAssociationStore({
         }
         const view = views.get(taskId);
         const bindingSnapshot = view?.auth === auth && auth ? view.snapshot : null;
-        const snapshot = bindingSnapshot?.contextRevision === context.revision ? bindingSnapshot : null;
+        const snapshot = bindingSnapshot?.contextRevision === context.revision && hasFreshCandidates(view, now()) ? bindingSnapshot : null;
         const local = record.actionAssociation;
         const scoped = Boolean(bindingSnapshot && local?.authRevision === auth && local.namespace === view.namespace);
         const newer = scoped &&

package/src/session-supervision/automatic-continuation.js

@@ -1,10 +1,27 @@
 import { continueSession, readSessionAutoContinue } from './index.js';
 import { readContinuationContext } from './continuation-analysis.js';
+import { requireProviderLink } from '../provider-links.js';
+
+function continuationFailureReason(error) {
+  // Provider exceptions can contain private paths/output. Only known codes
+  // select actionable UI copy; unrecognized failures retain a safe fallback.
+  const reasons = {
+    desktop_access_required: 'Sign in to an organization with SQM and Developer access before auto-continue can run.',
+    provider_sign_in_required: 'Sign in to the original AI provider, then retry auto-continue.',
+    unavailable: 'The local provider is unavailable. Open or configure it, then retry auto-continue.',
+    unsupported: 'Update the original AI provider to a compatible version, then retry auto-continue.',
+    process_exited: 'The original Claude process has exited. Return to the original conversation, then refresh.',
+    session_ended: 'This Claude session has ended. Return to the original conversation, then refresh.',
+    hook_missing: 'SIMY has not observed the original Claude session-start hook. Check the plugin and hook execution, then refresh.',
+  };
+  return Object.hasOwn(reasons, error?.code) ? reasons[error.code] : 'Could not start auto-continue. Check the original conversation and retry.';
+}
 
 // Shared by explicit Continue and automatic enrollment. Analysis alone never
 // dispatches work: the exact current provider context is checked again here.
 export async function continueAnalyzedSession({ candidate, manager, root, settings = {}, signal,
   readContext = readContinuationContext, enroll = continueSession, beforeEnroll = () => {} }) {
+  const link = await requireProviderLink({ root, provider: candidate.provider, expectedEpoch: settings.expectedProviderEpoch });
   const recommendation = manager.requireRecommendation(candidate);
   if (candidate.isRunning || candidate.capabilities?.canContinue !== true) throw new Error('Automatic continuation is unavailable for this conversation.');
   const context = await readContext(candidate, { signal });
@@ -14,8 +31,10 @@ export async function continueAnalyzedSession({ candidate, manager, root, settin
   }
   manager.requireRecommendation(candidate);
   await beforeEnroll(candidate);
+  await requireProviderLink({ root, provider: candidate.provider, expectedEpoch: link.epoch });
+  manager.requireRecommendation(candidate);
   if (signal?.aborted) throw new Error('Automatic continuation was cancelled before enrollment.');
-  return enroll({ root, provider: candidate.provider, session: candidate.session, ...settings });
+  return enroll({ root, provider: candidate.provider, session: candidate.session, ...settings, expectedProviderEpoch: link.epoch });
 }
 
 // One pending enrollment per identity. A failed attempt is retried only after
@@ -54,6 +73,7 @@ export function createAutomaticContinuation({ root, getManager, selectCandidate,
       errors.delete(key);
       const controller = new AbortController();
       const guard = async () => {
+        await requireProviderLink({ root, provider: candidate.provider });
         const setting = await readSetting({ root, provider: candidate.provider, session: candidate.session });
         if (closed || controller.signal.aborted || !setting.enabled || setting.epoch !== candidate.autoContinueEpoch || setting.hasRun) throw new Error('Automatic continuation was disabled or already enrolled.');
         return setting;
@@ -67,7 +87,7 @@ export function createAutomaticContinuation({ root, getManager, selectCandidate,
           settings: { ...setting.settings, autoContinueEpoch: candidate.autoContinueEpoch } });
       }).catch(error => {
         if (!closed && !controller.signal.aborted && !/disabled|already enrolled|setting changed|conversation changed; wait|needs a current recommendation/i.test(error?.message || '')) {
-          errors.set(key, { epoch: candidate.autoContinueEpoch, reason: 'Could not start auto-continue. Check the original conversation and retry.' });
+          errors.set(key, { epoch: candidate.autoContinueEpoch, reason: continuationFailureReason(error) });
         }
       }).finally(() => { pending.delete(key); if (!closed) onChange(); });
       pending.set(key, { job, controller });
@@ -79,11 +99,20 @@ export function createAutomaticContinuation({ root, getManager, selectCandidate,
       if (!closed && !pending.has(key)) { attempted.delete(key); errors.delete(key); }
     },
     project(candidate) {
+      if (candidate.autoContinue === true && candidate.isRunning !== true &&
+          ['unmanaged', 'monitor'].includes(candidate.binding?.mode || 'unmanaged') && candidate.analysis?.state === 'needs_user') return {
+        ...candidate, autoContinueStatus: 'needs_user', autoContinueReason: candidate.analysis.reason || 'Your decision is needed before automatic continuation can proceed.',
+      };
       const error = errors.get(`${candidate.provider}:${candidate.session}`);
       if (candidate.autoContinue === true && candidate.autoContinueEpoch === error?.epoch && candidate.capabilities?.canContinue === true &&
           !['no_action', 'needs_user', 'waiting', 'uncertain'].includes(candidate.analysis?.state)) return {
         ...candidate, autoContinueStatus: 'error', autoContinueReason: error.reason,
       };
+      if (candidate.autoContinue === true && !candidate.isRunning && candidate.capabilities?.canContinue === true) {
+        const statuses = { no_action: 'finished', needs_user: 'needs_user', waiting: 'waiting', uncertain: 'error', failed: 'error' };
+        const status = statuses[candidate.analysis?.state];
+        if (status && candidate.analysis?.reason) return { ...candidate, autoContinueStatus: status, autoContinueReason: candidate.analysis.reason };
+      }
       return candidate;
     },
     revoke(provider, session) { pending.get(`${provider}:${session}`)?.controller.abort(); },

package/src/session-supervision/claude-sessions.js

@@ -12,7 +12,6 @@ const MAX_PROJECTS = 256;
 const MAX_TRANSCRIPTS = 4096;
 const MAX_PREFIX_BYTES = 256 * 1024;
 const MAX_LINES = 256;
-const MAX_FILE_BYTES = 64 * 1024 * 1024;
 // Metadata is observation only. Exact-session/context readers always open the
 // transcript again; cached values contain no conversation message bodies.
 const metadataCache = new Map();
@@ -99,7 +98,8 @@ async function latestCustomTitle(handle, size, id) {
   return title;
 }
 
-async function inspectTranscript(root, projectName, fileName, observedAt, includeContext = false, cacheMetadata = false, includeStatistics = false) {
+async function inspectTranscript(root, projectName, fileName, observedAt, includeContext = false, cacheMetadata = false, includeStatistics = false, signal) {
+  signal?.throwIfAborted();
   const id = fileName.slice(0, -'.jsonl'.length);
   if (!UUID.test(id)) return null;
   const project = join(root, projectName);
@@ -108,7 +108,7 @@ async function inspectTranscript(root, projectName, fileName, observedAt, includ
   let handle;
   try {
     const before = await lstat(path);
-    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_FILE_BYTES) { metadataCache.delete(path); return null; }
+    if (!before.isFile() || before.isSymbolicLink()) { metadataCache.delete(path); return null; }
     if (!within(root, await realpath(path))) { metadataCache.delete(path); return null; }
     let key;
     if (cacheMetadata) {
@@ -141,10 +141,11 @@ async function inspectTranscript(root, projectName, fileName, observedAt, includ
     }
     if (!metadata) return null;
     const candidate = candidateMetadata(id, metadata, opened.mtimeMs, observedAt);
-    if (includeStatistics) candidate.statistics = await statisticsFromHandle(handle, opened, 'claude', id);
+    signal?.throwIfAborted();
+    if (includeStatistics) candidate.statistics = await statisticsFromHandle(handle, opened, 'claude', id, { signal });
     if (includeContext) candidate.context = await conversationFromHandle(handle, opened, id, metadata.cwd);
     return candidate;
-  } catch { metadataCache.delete(path); return null; }
+  } catch (error) { metadataCache.delete(path); if (signal?.aborted) throw error; return null; }
   finally { await handle?.close(); }
 }
 
@@ -174,7 +175,7 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
         const file = candidates[next++];
         try {
           const info = await lstat(join(project, file.name));
-          if (info.isFile() && !info.isSymbolicLink() && info.size <= MAX_FILE_BYTES)
+          if (info.isFile() && !info.isSymbolicLink())
             descriptors.push({ projectName: entry.name, fileName: file.name,
               session: file.name.slice(0, -'.jsonl'.length), lastActivityAt: info.mtimeMs });
         } catch { /* A disappearing transcript does not stop discovery. */ }
@@ -185,13 +186,20 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
   const selected = session ? descriptors : recentSessionWindow(descriptors, {
     limit: maximum, priority: item => priorities.has(item.session),
   });
-  for (const file of selected.slice(0, MAX_TRANSCRIPTS)) {
-    if (signal?.aborted) return [];
-    const candidate = await inspectTranscript(root, file.projectName, file.fileName, observedAt, includeContext, cacheMetadata, includeStatistics);
-    if (!candidate) continue;
-    const key = `${candidate.session}\0${candidate.cwd}${includeContext || includeStatistics ? `\0${file.projectName}\0${file.fileName}` : ''}`;
-    if (!result.has(key) || candidate.lastActivityAt > result.get(key).lastActivityAt) result.set(key, candidate);
-  }
+  const filesToInspect = selected.slice(0, MAX_TRANSCRIPTS);
+  let nextFile = 0;
+  // Catalog prefixes are bounded independently of full transcript size. Use a
+  // small I/O pool; exact-context/statistics reads stay serial and identity-safe.
+  await Promise.all(Array.from({ length: Math.min(includeContext || includeStatistics ? 1 : 8, filesToInspect.length) }, async () => {
+    while (nextFile < filesToInspect.length && !signal?.aborted) {
+      const file = filesToInspect[nextFile++];
+      const candidate = await inspectTranscript(root, file.projectName, file.fileName, observedAt, includeContext, cacheMetadata, includeStatistics, signal);
+      if (!candidate) continue;
+      const key = `${candidate.session}\0${candidate.cwd}${includeContext || includeStatistics ? `\0${file.projectName}\0${file.fileName}` : ''}`;
+      if (!result.has(key) || candidate.lastActivityAt > result.get(key).lastActivityAt) result.set(key, candidate);
+    }
+  }));
+  if (signal?.aborted) return [];
   const sorted = [...result.values()].sort((a, b) => b.lastActivityAt - a.lastActivityAt || a.session.localeCompare(b.session));
   return session ? sorted : recentSessionWindow(sorted, { limit: maximum, priority: item => priorities.has(item.session) });
 }
@@ -249,8 +257,10 @@ export async function readClaudeConversation(candidate, { home, signal } = {}) {
   return { ...selected[0].context, awaitingTurn: candidate.isRunning === true };
 }
 
-export async function readClaudeStatistics(candidate, { home } = {}) {
+export async function readClaudeStatistics(candidate, { home, signal } = {}) {
+  signal?.throwIfAborted();
   if (!UUID.test(candidate?.session || '')) return unavailableStatistics();
-  const matches = (await collect({ home, session: candidate.session, includeStatistics: true })).filter(item => item.cwd === candidate.cwd);
+  const matches = (await collect({ home, session: candidate.session, includeStatistics: true, signal })).filter(item => item.cwd === candidate.cwd);
+  signal?.throwIfAborted();
   return matches.length === 1 ? matches[0].statistics : unavailableStatistics();
 }

package/src/session-supervision/codex-app-server.js

@@ -15,7 +15,9 @@ const ANALYSIS_MAX_LINE = 1024 * 1024;
 const ANALYSIS_MAX_TURNS = 16;
 const ANALYSIS_PAGE_SIZE = 6;
 const ANALYSIS_MAX_WIRE_LINE = 8 * 1024 * 1024;
-const SOURCE_KINDS = ['cli', 'vscode', 'exec', 'appServer', 'unknown'];
+// Non-interactive exec and unknown origins are not evidence of a human-created
+// conversation. Explicit bindings remain visible through discoverSessions.
+const SOURCE_KINDS = ['cli', 'vscode', 'appServer'];
 
 export class CodexAppServerError extends Error {
   constructor(code, message) {
@@ -190,7 +192,7 @@ export function codexThreadMetadata(thread) {
   };
 }
 
-export async function listCodexSessions({ client, maxPages = 40, pageSize = 25, maxSessions = RECENT_SESSION_LIMIT, archived = false, inspectState = false, prioritySessions = [], observationBudgetMs = 3000 } = {}) {
+export async function listCodexSessions({ client, maxPages = 40, pageSize = 25, maxSessions = RECENT_SESSION_LIMIT, archived = false, inspectState = false, prioritySessions = [], observationBudgetMs = 3000, codexHome } = {}) {
   const sessions = [];
   const windowSize = Math.min(maxSessions, maxPages * pageSize);
   let cursor = null, listed = 0, pages = 0, batchSize = pageSize;
@@ -210,18 +212,39 @@ export async function listCodexSessions({ client, maxPages = 40, pageSize = 25,
     listed += threads.length; pages++;
     for (const thread of threads) {
       const metadata = codexThreadMetadata(thread);
-      if (metadata) sessions.push(metadata);
+      if (metadata && SOURCE_KINDS.includes(metadata.source)) sessions.push(metadata);
     }
     cursor = response?.nextCursor || null;
     if (!cursor) break;
   }
+  const deadline = Date.now() + Math.max(1, Math.min(observationBudgetMs, 5000));
+  // A recent page can omit an explicitly supervised conversation, including
+  // a newly created desktop chat. Read its exact metadata without loading or
+  // resuming it; only an active rollout path proves that it is not archived.
+  if (!archived && prioritySessions.length) {
+    const recoveryDeadline = Math.min(deadline, Date.now() + Math.max(1, (deadline - Date.now()) / 3));
+    const listedIds = new Set(sessions.map(item => item.session));
+    const missing = [...new Set(prioritySessions)].filter(id => !listedIds.has(id));
+    let next = 0;
+    await Promise.all(Array.from({ length: Math.min(3, missing.length) }, async () => {
+      while (next < missing.length && Date.now() < recoveryDeadline) {
+        const id = missing[next++];
+        try {
+          const response = await client.request('thread/read', { threadId: id, includeTurns: false },
+            Math.max(1, Math.min(1000, recoveryDeadline - Date.now())));
+          const metadata = codexThreadMetadata(response?.thread);
+          if (metadata?.session === id && SOURCE_KINDS.includes(metadata.source) &&
+            codexArchivePathState(response.thread.path, id, codexHome) === false) sessions.push(metadata);
+        } catch { /* Missing or unverifiable metadata remains a retained hook record. */ }
+      }
+    }));
+  }
   if (inspectState) {
     // Status-only pages have no conversation text. A separate app-server often
     // reports notLoaded rather than the original writer's actual turn state.
     // Bound this metadata fan-out independently of the analysis worker pool.
     const priorities = new Set(prioritySessions);
     const ordered = [...sessions].sort((a, b) => Number(priorities.has(b.session)) - Number(priorities.has(a.session)) || (b.lastActivityAt || 0) - (a.lastActivityAt || 0));
-    const deadline = Date.now() + Math.max(1, Math.min(observationBudgetMs, 5000));
     let next = 0, unavailable = false;
     for (const metadata of sessions) metadata.goalReadState = 'unavailable';
     await Promise.all(Array.from({ length: Math.min(3, sessions.length) }, async () => {