@awak-app/simy-cli 0.6.13 → 0.6.17

package/src/session-supervision/index.js

@@ -6,19 +6,64 @@ import { listClaudeSessions, readClaudeSession } from './claude-sessions.js';
 import { originalSessionTarget } from './original-session-target.js';
 import { readCodexTitles, sessionTitle } from './session-titles.js';
 import { RECENT_SESSION_LIMIT, recentSessionWindow, retainedSession } from './discovery-window.js';
+import { requireProviderLink } from '../provider-links.js';
 
-function autoContinueState(record, isRunning, supported) {
+// Only product-authored eligibility messages may pass through the desktop
+// error sanitizer; native provider errors never acquire this type.
+export class AutoContinueUnavailableError extends Error {
+  constructor(availability) {
+    super(availability.reason || 'Automatic continuation is unavailable for this conversation.');
+    this.code = availability.reasonCode;
+  }
+}
+
+// Opt-in is independent of a busy provider turn. Dispatch still requires a
+// settled context and the original provider's execution boundary.
+function autoContinueAvailability(run, channel) {
+  const issue = !channel.ready ? channel : run && !run.managed && !canUpgradeDelivery(run)
+    ? { code: 'existing_loop', reason: 'This conversation already has a Delivery Loop. Use its existing controls.' }
+    : TERMINAL_RUNS.has(run?.state)
+      ? { code: 'task_settled', reason: 'This supervised task has settled. Review its existing status before continuing.' } : null;
+  return { canEnable: !issue, reasonCode: issue?.code || null, reason: issue?.reason || null };
+}
+
+function codexContinuationChannel(source, model, issue = null) {
+  if (issue) return { ready: false, ...issue };
+  if (source !== 'codex_app_server') return { ready: false, code: 'session_metadata_unavailable',
+    reason: 'Exact Codex session metadata is unavailable. Refresh the original conversation.' };
+  if (!model) return { ready: false, code: 'model_metadata_unavailable',
+    reason: 'Exact Codex model metadata is unavailable. Configure the model in the original conversation and refresh.' };
+  return { ready: true, code: 'ready', reason: null };
+}
+
+function autoContinueState(record, isRunning, availability) {
   if (record?.autoContinue !== true) return { autoContinueStatus: 'off', autoContinueReason: null };
   const state = record.run?.state;
   if (state === 'budget_exhausted') return { autoContinueStatus: 'needs_user', autoContinueReason: 'Local execution limits have been removed. Resume this same conversation to continue.' };
   if (['completed', 'reported_done'].includes(state)) return { autoContinueStatus: 'finished', autoContinueReason: 'Continuation finished for this conversation.' };
   const managed = record.run?.managed;
   const recoverableCause = record.run?.recoveryCause === 'process_exit' || managed?.resumeChannel === 'codex_app_server' && ['session_supervision', 'approved_action'].includes(record.run?.recoveryCause);
-  if (state === 'recovery_required' && (!managed?.autoRecovery || !recoverableCause || managed.pendingApproval)) return {
-    autoContinueStatus: 'needs_user', autoContinueReason: 'Existing supervision needs your attention before more work can continue.',
-  };
-  if (['paused', 'blocked', 'stopped', 'failed', 'verification_pending'].includes(state)) return { autoContinueStatus: 'needs_user', autoContinueReason: 'Existing supervision needs your attention before more work can continue.' };
-  if (!supported) return { autoContinueStatus: 'unavailable', autoContinueReason: 'The original provider continuation channel is unavailable.' };
+  if (managed?.pendingApproval) return { autoContinueStatus: 'needs_user', autoContinueReason: 'Existing supervision needs your attention: review the pending approval in the original conversation before continuing.' };
+  if (state === 'recovery_required' && (!managed?.autoRecovery || !recoverableCause)) {
+    const recoveryReason = {
+      process_exit: 'the original provider process exited. Reopen the original conversation and explicitly resume.',
+      session_end: 'the original provider session ended. Reopen it and review why it ended before resuming.',
+      provider_error: 'the provider reported an error. Review the original conversation before resuming.',
+      shutdown_cancelled: 'continuation was interrupted when SIMY shut down. Review the task and explicitly resume.',
+      hook_owner_mismatch: 'the original Claude hook process changed. Refresh the original conversation before resuming.',
+      policy_change: 'the continuation policy changed. Resume the original conversation for the selected action.',
+    }[record.run.recoveryCause] || 'automatic recovery is unavailable. Review the task and explicitly resume through its existing controls.';
+    return { autoContinueStatus: 'needs_user', autoContinueReason: `Existing supervision needs your attention: ${recoveryReason}` };
+  }
+  const intervention = {
+    paused: 'resume the paused task through its existing controls.',
+    blocked: 'resolve the task blocker before continuing.',
+    stopped: 'review the stopped task through its existing controls.',
+    failed: 'review the failed task through its existing controls.',
+    verification_pending: 'complete the pending verification before continuing.',
+  }[state];
+  if (intervention) return { autoContinueStatus: 'needs_user', autoContinueReason: `Existing supervision needs your attention: ${intervention}` };
+  if (!availability.canEnable) return { autoContinueStatus: 'unavailable', autoContinueReason: availability.reason };
   return { autoContinueStatus: record.run ? 'supervising' : isRunning ? 'waiting' : 'watching',
     autoContinueReason: record.run ? 'Continuing the original task with progress and approval checks.' : isRunning ? 'Waiting for the original turn to finish.' : 'Checking settled requests for worthwhile remaining work.' };
 }
@@ -55,25 +100,34 @@ async function requireClaudeChannel(record, metadata, inspectProcess) {
 }
 
 export async function discoverSessions({ root, openClient = openCodexAppServer, listClaude = listClaudeSessions,
-  inspectProcess = processIdentity, now = Date.now(), signal, listCodexTitles = readCodexTitles, codexHome } = {}) {
+  inspectProcess = processIdentity, now = Date.now(), signal, listCodexTitles = readCodexTitles, codexHome, connectedProviders = ['codex', 'claude'] } = {}) {
   const assertActive = () => { if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation discovery was cancelled.'); };
   assertActive();
-  const records = await listRecords(root);
+  const connected = new Set(connectedProviders);
+  const records = (await listRecords(root)).filter(record => connected.has(record.provider));
   const priorities = records.filter(retainedSession);
-  let discovered = [], codexError = null, claude = [], claudeError = null;
+  let discovered = [], codexError = null, codexReasonCode = null, claude = [], claudeError = null;
   let archiveStates = new Map();
-  try { discovered = await withClient(openClient, async client => {
-    const active = await listCodexSessions({ client, inspectState: true, maxSessions: RECENT_SESSION_LIMIT,
-      prioritySessions: priorities.filter(record => record.provider === 'codex').map(record => record.session) });
-    const ids = new Set(active.map(item => item.session));
-    archiveStates = await readCodexArchiveStates(client, records.filter(record => record.provider === 'codex' && !ids.has(record.session)), { codexHome });
-    return active;
-  }, signal); }
-  catch (error) { codexError = error?.code === 'unavailable' ? 'Codex executable unavailable.' : error?.code === 'unsupported' ? 'This Codex version lacks a verified app-server writer lock; update before enrollment.' : 'Codex conversation discovery unavailable.'; }
-  assertActive();
-  try { claude = await listClaude({ signal, limit: RECENT_SESSION_LIMIT,
-    prioritySessions: priorities.filter(record => record.provider === 'claude').map(record => record.session) }); }
-  catch { claudeError = 'Claude conversation discovery unavailable.'; }
+  await Promise.all([
+    (async () => {
+      try { if (connected.has('codex')) discovered = await withClient(openClient, async client => {
+        const active = await listCodexSessions({ client, inspectState: true, maxSessions: RECENT_SESSION_LIMIT, codexHome,
+          prioritySessions: priorities.filter(record => record.provider === 'codex').map(record => record.session) });
+        const ids = new Set(active.map(item => item.session));
+        archiveStates = await readCodexArchiveStates(client, records.filter(record => record.provider === 'codex' && !ids.has(record.session)), { codexHome });
+        return active;
+      }, signal); }
+      catch (error) {
+        codexReasonCode = error?.code === 'unavailable' ? 'provider_unavailable' : error?.code === 'unsupported' ? 'provider_unsupported' : 'session_metadata_unavailable';
+        codexError = error?.code === 'unavailable' ? 'Codex executable unavailable. Configure a compatible Codex installation and refresh.' : error?.code === 'unsupported' ? 'This Codex version lacks a verified app-server writer lock; update before enrollment.' : 'Codex conversation discovery unavailable. Refresh the conversation list.';
+      }
+    })(),
+    (async () => {
+      try { if (connected.has('claude')) claude = await listClaude({ signal, limit: RECENT_SESSION_LIMIT,
+        prioritySessions: priorities.filter(record => record.provider === 'claude').map(record => record.session) }); }
+      catch { claudeError = 'Claude conversation discovery unavailable.'; }
+    })(),
+  ]);
   assertActive();
   const activeCodex = new Set(discovered.map(item => item.session));
   for (let index = 0; index < records.length; index++) {
@@ -106,7 +160,9 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   for (const record of records) {
     if (record.providerArchived === true) continue;
     const key = `${record.provider}:${record.session}`;
-    if (!byKey.has(key) && (record.observedAt || record.admission || retainedSession(record))) byKey.set(key, {
+    // A hook observation can belong to an AI-created worker. Only explicit
+    // supervision may restore a conversation absent from provider discovery.
+    if (!byKey.has(key) && retainedSession(record)) byKey.set(key, {
       provider: record.provider, session: record.session, cwd: record.cwd, title: '', source: record.admission?.source || 'hook',
       lastActivityAt: record.observedAt || record.admission?.validatedAt || record.run?.updatedAt || null,
       observation: { source: record.admission?.source || `${record.provider}_hook`, observedAt: record.observedAt || record.admission?.validatedAt || null },
@@ -125,11 +181,20 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
     const record = recordsByKey.get(`${item.provider}:${item.session}`);
     const run = record?.run;
     const mode = run?.managed ? run.state === 'recovery_required' && run.recoveryCause === 'session_supervision' ? 'pending_takeover' : 'managed' : run ? 'standard_loop' : record?.monitor ? 'monitor' : 'unmanaged';
-    const supported = item.provider === 'codex' && item.observation.source === 'codex_app_server' && Boolean(item.model) && !codexError;
+    const codexChannel = codexContinuationChannel(item.observation.source, item.model, codexError ? { code: codexReasonCode, reason: codexError } : null);
+    const supported = item.provider === 'codex' && codexChannel.ready;
     const claudeChannel = item.provider === 'claude' ? claudeError
       ? { ready: false, code: 'session_metadata_unavailable', reason: claudeError }
       : await liveClaudeChannel(record, item, inspectProcess) : null;
     const liveHook = claudeChannel?.ready === true;
+    let continuationAdmission;
+    if (supported || liveHook) {
+      try {
+        continuationAdmission = { provider: item.provider, session: item.session,
+          cwd: await realpath(item.cwd), source: item.observation.source, model: item.model, validatedAt: now };
+      } catch { /* Missing workspaces cannot grant an admission. */ }
+    }
+    const availability = autoContinueAvailability(run, claudeChannel || codexChannel);
     const upgradeable = canUpgradeDelivery(run);
     const continuationIssue = liveHook && run ? !run.managed && !upgradeable
       ? { code: 'existing_loop', reason: 'This conversation already has a Delivery Loop. Use its existing controls.' }
@@ -154,13 +219,15 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       tracked: typeof record?.tracked === 'boolean' ? record.tracked : record?.monitor === true,
       autoContinue: record?.autoContinue === true,
       autoContinueEpoch: record?.autoContinue === true ? record.autoContinueEpoch : null,
-      ...autoContinueState(record, isRunning, supported || liveHook),
+      autoContinueAvailability: availability,
+      ...autoContinueState(record, isRunning, availability),
       lastActivityAt: item.lastActivityAt, observation: item.observation, availability: item.availability,
       taskId: run?.managed?.taskId || record?.associationTaskId || null,
       binding: { mode, taskId: run?.managed?.taskId || record?.associationTaskId || null },
       originalSessionTarget: originalSessionTarget(item.provider, item.session),
       continuationMode: item.provider === 'claude' ? liveHook ? 'live_hook' : 'manual' : supported ? 'codex_app_server' : 'manual',
-      ...(claudeChannel ? { continuationReasonCode: continuationIssue?.code || claudeChannel.code } : {}),
+      ...(continuationAdmission ? { continuationAdmission } : {}),
+      continuationReasonCode: availability.reasonCode || claudeChannel?.code || 'ready',
       capabilities: { canMonitor: item.capabilities?.canMonitor ?? true,
         canAnalyze: !run && (item.provider === 'codex' ? item.observation.source === 'codex_app_server' && !codexError : item.observation.source === 'claude_local_index' && !claudeError),
         canEnroll: (supported || liveHook) && !run, canContinue: (supported || liveHook) && !run,
@@ -178,21 +245,69 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   }));
   assertActive();
   projected.sort((a, b) => (b.lastActivityAt || 0) - (a.lastActivityAt || 0));
-  return { sessions: projected, providers: { codex: { discovery: codexError ? 'unavailable' : 'ready', reason: codexError }, claude: { discovery: claudeError ? 'unavailable' : 'local_index', reason: claudeError } }, refreshedAt: now };
+  return { sessions: projected, providers: { codex: { discovery: !connected.has('codex') ? 'disconnected' : codexError ? 'unavailable' : 'ready', reason: codexError }, claude: { discovery: !connected.has('claude') ? 'disconnected' : claudeError ? 'unavailable' : 'local_index', reason: claudeError } }, refreshedAt: now };
+}
+
+// Saving consent needs an exact admitted identity, not another provider RPC.
+// Execution separately rechecks the settled context, live channel and approvals.
+function hasAutoContinueAdmission(record, provider, session) {
+  const admission = record?.admission;
+  return record?.provider === provider && record.session === session && typeof record.cwd === 'string' && record.cwd &&
+    admission?.provider === provider && admission.session === session && admission.cwd === record.cwd &&
+    admission.source === (provider === 'codex' ? 'codex_app_server' : 'claude_local_index') &&
+    (provider !== 'codex' || typeof admission.model === 'string' && admission.model.trim());
+}
+function requireAutoContinueTask(record) {
+  if (record?.run && !record.run.managed && !canUpgradeDelivery(record.run)) throw Object.assign(new Error('This conversation already has a Delivery Loop. Use its existing controls.'), { code: 'existing_loop' });
+  if (TERMINAL_RUNS.has(record?.run?.state)) throw new AutoContinueUnavailableError({ reason: 'This supervised task has settled. Review its existing status before continuing.', reasonCode: 'task_settled' });
 }
 
 // Explicit execution authority: legacy monitor/tracked records stay read-only.
 export async function setSessionAutoContinue({ root, provider, session, enabled, continuationPolicy, ...options }) {
   if (!['codex', 'claude'].includes(provider) || typeof enabled !== 'boolean') throw new Error('Unsupported automatic continuation request.');
-  if (enabled) await trackSession({ root, provider, session, tracked: true, ...options });
+  const link = enabled ? await requireProviderLink({ root, provider, expectedEpoch: options.expectedProviderEpoch }) : null;
+  let discoveredAdmission;
+  if (enabled) {
+    const record = await readRecord(root, provider, session);
+    if (record?.providerArchived === true) throw Object.assign(new Error('Restore the original provider conversation before enabling automatic continuation.'), { code: 'session_archived' });
+    requireAutoContinueTask(record);
+    if (!hasAutoContinueAdmission(record, provider, session)) {
+      // Only the host's verified discovery catalog supplies this option; command
+      // payloads must never provide admission. First opt-in needs no remote RPC.
+      const supplied = options.admission;
+      if (!record?.admission && hasAutoContinueAdmission({ provider, session, cwd: supplied?.cwd, admission: supplied }, provider, session)) {
+        try {
+          const cwd = await realpath(supplied.cwd);
+          if (cwd === supplied.cwd) discoveredAdmission = { provider, session, cwd, source: supplied.source,
+            model: supplied.model, validatedAt: supplied.validatedAt };
+        } catch { /* Fall back to exact provider metadata if the catalog is stale. */ }
+      }
+      try { if (!discoveredAdmission) await trackSession({ root, provider, session, tracked: true, ...options, expectedProviderEpoch: link.epoch }); }
+      catch (error) {
+        if (['session_archived', 'session_workspace_changed', 'provider_link_disconnected', 'provider_link_changed'].includes(error?.code)) throw error;
+        throw Object.assign(new Error('SIMY could not verify this conversation. Refresh its provider and conversation list, then try again.'), { code: 'session_metadata_unavailable' });
+      }
+    }
+  }
   const updated = await updateRecord(root, provider, session, async previous => {
+    if (enabled) await requireProviderLink({ root, provider, expectedEpoch: link.epoch });
+    if (enabled && discoveredAdmission) {
+      if (previous && previous.cwd !== discoveredAdmission.cwd) throw Object.assign(new Error('Session workspace changed; refresh its metadata.'), { code: 'session_workspace_changed' });
+      // An admission written while saving is authoritative. Never overwrite its
+      // identity with the earlier catalog snapshot, including a mismatch.
+      previous = previous?.admission ? previous : { ...(previous || { schemaVersion: 1, provider, session, cwd: discoveredAdmission.cwd, run: null }), admission: discoveredAdmission };
+    }
     if (!previous) throw new Error('Refresh this conversation before changing automatic continuation.');
     if (enabled && previous.providerArchived === true) throw new Error('Restore the original provider conversation before enabling automatic continuation.');
-    if (enabled && previous.run && !previous.run.managed && !canUpgradeDelivery(previous.run)) throw new Error('Resolve the existing loop blocker before enabling automatic continuation.');
-    if (enabled && TERMINAL_RUNS.has(previous.run?.state)) throw new Error('This conversation is settled. Resume an eligible existing task after refreshing its status.');
-    if (enabled && provider === 'codex' && !previous.admission?.model) throw new Error('Automatic continuation is unavailable for this conversation.');
-    if (enabled && provider === 'claude') await requireClaudeChannel(previous,
-      { session, cwd: previous.cwd, observation: { source: previous.admission?.source } }, options.inspectProcess || processIdentity);
+    if (enabled) {
+      const channel = provider === 'claude' ? await liveClaudeChannel(previous,
+        { session, cwd: previous.cwd, observation: { source: previous.admission?.source } }, options.inspectProcess || processIdentity)
+        : codexContinuationChannel(previous.admission?.source, previous.admission?.model);
+      const availability = autoContinueAvailability(previous.run, channel);
+      if (!availability.canEnable) throw new AutoContinueUnavailableError(availability);
+      if (!hasAutoContinueAdmission(previous, provider, session)) throw Object.assign(new Error('SIMY could not verify this conversation. Refresh its provider and conversation list, then try again.'), { code: 'session_metadata_unavailable' });
+    }
+    if (enabled) await requireProviderLink({ root, provider, expectedEpoch: link.epoch });
     const epoch = previous.autoContinue === enabled && previous.autoContinueEpoch ? previous.autoContinueEpoch : randomUUID();
     // Settings persisted by older versions may carry removed time, turn and
     // token caps; only the fields that still govern a task are forwarded.
@@ -211,7 +326,7 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
     // Enrollment checks this exact opt-in epoch under its state lock, so an
     // overlapping Off action prevents the promotion from dispatching work.
     await continueSession({ ...options, root, provider, session,
-      ...updated.autoContinueSettings, autoContinueEpoch: updated.autoContinueEpoch });
+      ...updated.autoContinueSettings, autoContinueEpoch: updated.autoContinueEpoch, expectedProviderEpoch: link.epoch });
     return readRecord(root, provider, session);
   }
   return updated;
@@ -225,7 +340,7 @@ export async function readSessionAutoContinue({ root, provider, session }) {
 
 // Tracking is local observation metadata. It neither starts nor stops the
 // original provider task and never grants automatic continuation authority.
-export async function trackSession({ root, provider, session, tracked = true, openClient = openCodexAppServer, readClaude = readClaudeSession, now = Date.now() }) {
+export async function trackSession({ root, provider, session, tracked = true, openClient = openCodexAppServer, readClaude = readClaudeSession, expectedProviderEpoch, now = Date.now() }) {
   if (!['codex', 'claude'].includes(provider) || typeof tracked !== 'boolean') throw new Error('Unsupported tracking request.');
   if (!tracked) {
     await updateRecord(root, provider, session, previous => {
@@ -234,18 +349,20 @@ export async function trackSession({ root, provider, session, tracked = true, op
     });
     return;
   }
+  const link = await requireProviderLink({ root, provider, expectedEpoch: expectedProviderEpoch });
   const metadata = provider === 'codex' ? await withClient(openClient, client => readCodexSession(client, session)) : await readClaude(session);
   if (!metadata) throw new Error('Exact provider session metadata is unavailable.');
   const cwd = await realpath(metadata.cwd);
-  await updateRecord(root, provider, session, previous => {
-    if (previous?.providerArchived === true) throw new Error('Restore the original provider conversation before enabling automatic continuation or tracking.');
+  await updateRecord(root, provider, session, async previous => {
+    await requireProviderLink({ root, provider, expectedEpoch: link.epoch });
+    if (previous?.providerArchived === true) throw Object.assign(new Error('Restore the original provider conversation before enabling automatic continuation or tracking.'), { code: 'session_archived' });
     if (previous && previous.cwd !== cwd) throw new Error('Session workspace changed; refresh its metadata.');
     return { ...(previous || { schemaVersion: 1, provider, session, cwd, run: null }), tracked: true, monitor: true,
       admission: { ...(previous?.admission || {}), source: metadata.observation.source, provider, session, cwd, model: metadata.model, validatedAt: now } };
   });
 }
 
-export async function monitorSession({ root, provider, session, monitor = true, openClient = openCodexAppServer, readClaude = readClaudeSession, now = Date.now() }) {
+export async function monitorSession({ root, provider, session, monitor = true, openClient = openCodexAppServer, readClaude = readClaudeSession, expectedProviderEpoch, now = Date.now() }) {
   if (!['codex', 'claude'].includes(provider)) throw new Error('Unsupported provider.');
   if (!monitor) {
     await updateRecord(root, provider, session, previous => {
@@ -255,10 +372,12 @@ export async function monitorSession({ root, provider, session, monitor = true,
     });
     return null;
   }
+  const link = await requireProviderLink({ root, provider, expectedEpoch: expectedProviderEpoch });
   const metadata = provider === 'codex' ? await withClient(openClient, client => readCodexSession(client, session)) : await readClaude(session);
   if (!metadata) throw new Error('Exact provider session metadata is unavailable.');
   const cwd = await realpath(metadata.cwd);
-  await updateRecord(root, provider, session, previous => {
+  await updateRecord(root, provider, session, async previous => {
+    await requireProviderLink({ root, provider, expectedEpoch: link.epoch });
     if (previous?.providerArchived === true) throw new Error('Restore the original provider conversation before enabling supervision.');
     if (previous && previous.cwd !== cwd) throw new Error('Session workspace changed; refresh its metadata.');
     return { ...(previous || { schemaVersion: 1, provider, session, cwd, run: null }), monitor,
@@ -268,9 +387,10 @@ export async function monitorSession({ root, provider, session, monitor = true,
 }
 
 export async function enrollSession({ root, provider, session, objective, acceptanceCriteria, contextBootstrap = false, autonomyPolicy = 'balanced',
-  maxFailures = 3, maxNoProgressMinutes, continuationPolicy, autoContinueEpoch, executionCwd, upgradeRunId, openClient = openCodexAppServer,
+  maxFailures = 3, maxNoProgressMinutes, continuationPolicy, autoContinueEpoch, executionCwd, upgradeRunId, expectedProviderEpoch, openClient = openCodexAppServer,
   readClaude = readClaudeSession, inspectProcess = processIdentity, now = Date.now() }) {
   if (!['codex', 'claude'].includes(provider)) throw new Error('This provider does not have a verified exact-session enrollment channel.');
+  const link = await requireProviderLink({ root, provider, expectedEpoch: expectedProviderEpoch });
   if (typeof objective !== 'string' || !objective.trim() || objective.length > 4000) throw new Error('A concrete objective is required.');
   if (!['autonomous', 'balanced', 'strict'].includes(autonomyPolicy)) throw new Error('Choose an autonomy policy.');
   let metadata;
@@ -279,20 +399,21 @@ export async function enrollSession({ root, provider, session, objective, accept
     const record = await readRecord(root, provider, session);
     await requireClaudeChannel(record, metadata, inspectProcess);
     if (record.run && !upgradeRunId) throw new Error('This session already has a Delivery Loop.');
-    await monitorSession({ root, provider, session, monitor: true, readClaude: async () => metadata, now });
+    await monitorSession({ root, provider, session, monitor: true, readClaude: async () => metadata, expectedProviderEpoch: link.epoch, now });
     // A second check narrows the time between metadata admission and the
     // original provider's next Stop boundary. Process exit still remains a
     // manual recovery condition; SIMY never starts claude -r.
     await requireClaudeChannel(await readRecord(root, provider, session), metadata, inspectProcess);
   } else {
-    metadata = await monitorSession({ root, provider, session, monitor: true, openClient, now });
+    metadata = await monitorSession({ root, provider, session, monitor: true, openClient, expectedProviderEpoch: link.epoch, now });
     if (!metadata.model) throw new Error('Codex did not expose this conversation’s model; automatic continuation is unavailable.');
   }
   const cwd = await realpath(metadata.cwd);
   const initialPlan = initialDiagnosisPlan(objective.trim(), contextBootstrap);
   const admission = provider === 'codex' ? { source: 'codex_app_server', provider, session, cwd, model: metadata.model } : undefined;
   const liveRecord = provider === 'claude' ? await readRecord(root, provider, session) : null;
-  const run = await startDelivery({ root, provider, session, cwd, executionCwd, upgradeRunId, objective: objective.trim(), nextStep: 'Inspect current evidence and propose the next assessed action.',
+  await requireProviderLink({ root, provider, expectedEpoch: link.epoch });
+  const run = await startDelivery({ root, provider, session, cwd, executionCwd, upgradeRunId, providerLinkEpoch: link.epoch, objective: objective.trim(), nextStep: 'Inspect current evidence and propose the next assessed action.',
     maxFailures, continuationPolicy, now, admission, inspectProcess, autoContinueEpoch,
     liveHookAdmission: liveRecord ? { hookStartedAt: liveRecord.hookStartedAt, pid: liveRecord.process.pid, identity: liveRecord.process.identity } : undefined,
     managed: { acceptanceCriteria, contextBootstrap, autonomyPolicy, maxNoProgressMinutes, approvalScopes: ['task'], approvalPolicy: 'wait',

package/src/session-supervision/statistics.js

@@ -2,6 +2,7 @@ import { constants } from 'node:fs';
 import { lstat, open, realpath } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, relative, isAbsolute, sep } from 'node:path';
+import { setImmediate as yieldToHost } from 'node:timers/promises';
 
 const HOUR = 3_600_000;
 export const unavailableStatistics = () => ({ state: 'unavailable', hours: [], activity: [] });
@@ -14,6 +15,32 @@ const WINDOW_MS = 7 * 24 * HOUR;
 let cachedTranscript;
 const fingerprint = info => [info.dev, info.ino, info.size, info.mtimeMs, info.ctimeMs].join(':');
 
+// One global Array.sort can freeze the host after the asynchronous file scan.
+// Sort bounded runs and merge cooperatively without discarding any timestamps.
+function* sortedActivityEvents(events, start, end) {
+  const batchSize = 2048;
+  let runs = [];
+  for (let index = 0; index < events.length; index += batchSize) {
+    runs.push(events.slice(index, index + batchSize).filter(at => at >= start && at <= end).sort((a, b) => a - b));
+    yield;
+  }
+  while (runs.length > 1) {
+    const mergedRuns = [];
+    for (let index = 0; index < runs.length; index += 2) {
+      if (!runs[index + 1]) { mergedRuns.push(runs[index]); continue; }
+      const left = runs[index], right = runs[index + 1], merged = [];
+      let a = 0, b = 0;
+      while (a < left.length || b < right.length) {
+        merged.push(b >= right.length || a < left.length && left[a] <= right[b] ? left[a++] : right[b++]);
+        if (merged.length % batchSize === 0) yield;
+      }
+      mergedRuns.push(merged);
+    }
+    runs = mergedRuns;
+  }
+  return runs[0] || [];
+}
+
 // Only usage envelopes and timestamps survive parsing, never message text.
 // The reverse reducer attributes each cumulative difference to the newer row,
 // retaining an older baseline even when it lies outside the displayed week.
@@ -76,34 +103,57 @@ class StatisticsAccumulator {
       if (!previous || tokens > previous.tokens || tokens === previous.tokens && at < previous.at) this.usage.set(row.message.id, { at, tokens });
     }
   }
-  finish(now, incomplete = false, coverage = {}) {
+  *finishSteps(now, incomplete = false, coverage = {}) {
     if (!this.matched || this.wrongSession || this.earliest > now) return unavailableStatistics();
     const missing = this.missing || incomplete;
     const start = Math.max(this.earliest, now - WINDOW_MS), end = now;
     const hours = new Map();
     for (let at = Math.floor(start / HOUR) * HOUR; at <= end; at += HOUR) hours.set(at, { at, tokens: null });
-    const usage = [...this.usage.values()];
-    if (this.reverse && this.pending) usage.push({ at: this.pending.at, tokens: this.pending.total });
-    for (const item of usage) {
-      if (item.at < start || item.at > end) continue;
+    let batch = 0;
+    const addUsage = item => {
+      if (item.at < start || item.at > end) return;
       const bucket = hours.get(Math.floor(item.at / HOUR) * HOUR);
       bucket.tokens = (bucket.tokens ?? 0) + item.tokens;
+    };
+    for (const item of this.usage.values()) {
+      addUsage(item);
+      if (++batch % 2048 === 0) yield;
     }
+    if (this.reverse && this.pending) addUsage({ at: this.pending.at, tokens: this.pending.total });
     const activity = [];
-    for (const at of this.events.filter(x => x >= start && x <= end).sort((a, b) => a - b)) {
+    let observedActiveMs = 0;
+    for (const at of (yield* sortedActivityEvents(this.events, start, end))) {
       const previous = activity.at(-1);
-      if (previous && at - previous.end <= 5 * 60_000) previous.end = at;
+      if (previous && at - previous.end <= 5 * 60_000) { observedActiveMs += at - previous.end; previous.end = at; }
       else activity.push({ start: at, end: at });
+      if (++batch % 2048 === 0) yield;
     }
-    const activeMs = activity.reduce((total, x) => total + x.end - x.start, 0);
+    // Usage counters alone cannot establish time spent working. A newly
+    // observed single event is a real zero-duration sample; no events is unknown.
+    const activeMs = activity.length ? observedActiveMs : null;
     const elapsedMs = end - start;
     return { state: missing ? 'partial' : 'ready', start, end, observedAt: now, hours: [...hours.values()], activity,
       tokens: [...hours.values()].some(h => h.tokens !== null) ? [...hours.values()].reduce((sum, h) => sum + (h.tokens || 0), 0) : null,
-      activeMs, idleMs: missing ? null : Math.max(0, elapsedMs - activeMs),
-      utilization: missing || !elapsedMs ? null : activeMs / elapsedMs,
+      activeMs, idleMs: missing || activeMs === null ? null : Math.max(0, elapsedMs - activeMs),
+      utilization: missing || activeMs === null || !elapsedMs ? null : activeMs / elapsedMs,
       coverage: { ...coverage, complete: !missing, scope: 'rolling_7_days' },
       activityMethod: 'recorded_events_5m_gap', includesCachedInput: true };
   }
+  finish(...args) {
+    const steps = this.finishSteps(...args);
+    let step;
+    do { step = steps.next(); } while (!step.done);
+    return step.value;
+  }
+  async finishAsync(now, incomplete, coverage, signal) {
+    const steps = this.finishSteps(now, incomplete, coverage);
+    for (;;) {
+      signal?.throwIfAborted();
+      const step = steps.next();
+      if (step.done) return step.value;
+      await yieldToHost();
+    }
+  }
 }
 
 export function transcriptStatistics(text, provider, session, { now = Date.now(), truncated = false } = {}) {
@@ -112,9 +162,10 @@ export function transcriptStatistics(text, provider, session, { now = Date.now()
   return accumulator.finish(now, truncated);
 }
 
-async function readReverse(handle, size, accumulator) {
+async function readReverse(handle, size, accumulator, signal) {
   let position = size, carry = Buffer.alloc(0), skipping = false, bytesRead = 0;
   while (position > 0) {
+    signal?.throwIfAborted();
     const length = Math.min(position, READ_BYTES); position -= length;
     const buffer = Buffer.allocUnsafe(length);
     let filled = 0;
@@ -127,11 +178,19 @@ async function readReverse(handle, size, accumulator) {
     if (filled !== length) accumulator.missing = true;
     const data = Buffer.concat([buffer.subarray(0, filled), carry]);
     let end = data.length;
+    let batch = 0, yieldedAt = performance.now();
     for (let index = data.lastIndexOf(10); index >= 0; index = data.lastIndexOf(10, index - 1)) {
       const line = data.subarray(index + 1, end);
       if (!skipping && line.length <= MAX_LINE_BYTES) accumulator.add(line.toString('utf8'));
       else accumulator.missing = true;
       skipping = false; end = index;
+      // Disk I/O alone does not yield while parsing a dense page. Keep status,
+      // selection and cancellation responsive even for huge cached transcripts.
+      if (++batch >= 256 || performance.now() - yieldedAt >= 8) {
+        await yieldToHost();
+        signal?.throwIfAborted();
+        batch = 0; yieldedAt = performance.now();
+      }
       if (index === 0) break;
     }
     if (end > MAX_LINE_BYTES || skipping) { carry = Buffer.alloc(0); skipping = true; accumulator.missing = true; }
@@ -142,6 +201,7 @@ async function readReverse(handle, size, accumulator) {
 }
 
 export async function statisticsFromHandle(handle, info, provider, session, { now = Date.now(), ...options } = {}) {
+  options.signal?.throwIfAborted();
   const key = `${provider}:${session}:${fingerprint(info)}`;
   // Rebuild time-dependent buckets from cached envelopes, never cache wall-clock
   // idle time. A backwards clock or a new file fingerprint requires a new scan.
@@ -149,16 +209,17 @@ export async function statisticsFromHandle(handle, info, provider, session, { no
     const cached = cachedTranscript;
     const changed = fingerprint(await handle.stat()) !== fingerprint(info);
     if (changed) cachedTranscript = undefined;
-    return cached.accumulator.finish(now, changed || options.truncated, cached.coverage);
+    return cached.accumulator.finishAsync(now, changed || options.truncated, cached.coverage, options.signal);
   }
   const accumulator = new StatisticsAccumulator(provider, session, now, true);
-  const bytesRead = await readReverse(handle, info.size, accumulator);
+  const bytesRead = await readReverse(handle, info.size, accumulator, options.signal);
+  options.signal?.throwIfAborted();
   const after = await handle.stat();
   const changed = fingerprint(after) !== fingerprint(info);
   const coverage = { bytesRead, totalBytes: info.size };
   if (!changed && !accumulator.missing && !options.truncated) cachedTranscript = { key, accumulator, coverage };
   else cachedTranscript = undefined;
-  return accumulator.finish(now, changed || options.truncated, coverage);
+  return accumulator.finishAsync(now, changed || options.truncated, coverage, options.signal);
 }
 
 export async function readCodexStatistics(client, candidate, { home = process.env.CODEX_HOME || join(homedir(), '.codex'), ...options } = {}) {
@@ -175,6 +236,6 @@ export async function readCodexStatistics(client, candidate, { home = process.en
     const info = await handle.stat();
     if (info.ino !== before.ino || info.dev !== before.dev || await realpath(thread.path) !== path) return unavailableStatistics();
     return await statisticsFromHandle(handle, info, 'codex', candidate.session, options);
-  } catch { return unavailableStatistics(); }
+  } catch (error) { if (options.signal?.aborted) throw error; return unavailableStatistics(); }
   finally { await handle?.close(); }
 }