@awak-app/simy-cli 0.6.16 → 0.6.17

package/README.md

@@ -15,12 +15,26 @@ cached in memory, so restarting the host may retrieve live contexts again.
 checking for updates. `simy doctor` performs read-only local connection and
 provider login checks and prints a JSON diagnostic report: installed/running
 versions, stale discovery records, session expiry, provider readiness, and recent
-structured SQM failures. It does not run a model, renew login, or restart tasks.
+structured SQM failures, plus `host_exit` with the latest native desktop host's
+abnormal exit time and status. `failures.total_failures` counts scoped SQM
+failures only; zero does not mean the desktop has never crashed. `host_exit` is
+local machine history, independent of account/organization and current daemon
+reachability. A recorded exit remains visible after restart; `not_recorded` means
+no retained exit record, and `unavailable` means it could not be verified. It is
+not a lifetime crash count. Only the fixed header is read; stderr is never
+included. Doctor does not run a model, renew login, or restart tasks.
 Provider login is separate from model access; unverified model access remains
 `unknown`. Diagnostic journals retain stage/code/HTTP status only, use private
 files scoped to the Web/account/organization, rotate each writer's four 64 KiB
 segments, and keep lifetime failure counts after event rotation.
 
+The desktop host continues sampling connection and access while optional
+conversation metadata is pending. It retains the last completed conversation
+metadata only within the same verified scope, clears it after access or account
+changes, and merges completed metadata with the newer connection observation.
+This prevents a slow metadata read from making a live service appear disconnected;
+it does not conceal actual host exits, failed connections, or revoked access.
+
 The organization menu's **Allow Codex / Claude fallback** setting defaults to
 off and grants only read-only SQM analysis permission to use the other signed-in
 local provider. It is saved per Web/account/organization. Switching requires an
@@ -124,6 +138,12 @@ a fresh Codex or Claude login probe succeeds, including after an app restart.
 An unchanged ready status cannot repeatedly re-run a failed check. Manual retry
 remains available; continuing the conversation still requires **Auto-continue**.
 
+You can enable **Auto-continue** while a conversation is running when its original
+provider configuration is verified. SIMY saves the preference and waits for the
+current turn to finish before checking remaining work. Configuration and runtime
+blockers appear in the conversation view with recovery guidance; turning the
+setting off does not interrupt the current turn.
+
 Claude read-only structured reviews retry once when the provider explicitly
 reports exhausted turns or structured-output repair attempts, within the original
 timeout. Other failures retain distinct codes and recovery hints. Safe native
@@ -211,9 +231,31 @@ marketplace still points to SIMY’s generated local source. Plugin versions inc
 receive a fresh cache. Use a new Codex task to pick up updated skills; running
 tasks are not restarted. Missing or disabled plugins are not enabled automatically.
 Failed refreshes retry on the next check without blocking daemon startup.
+Auto-continue ON saves consent for the selected original conversation; it does not
+immediately launch a second turn. A verified desktop discovery admission or an
+existing exact admission saves this preference without another provider RPC.
+After the current turn settles, continuation separately rechecks context, the
+live provider channel, approvals and the opt-in epoch. Required human decisions
+remain pending, and OFF prevents future continuation without interrupting the
+current turn. The macOS switch and label explain these boundaries through their
+tooltips and accessibility help.
+
+Conversation statistics estimate work time from activity events within the last
+seven days. Usage counters alone leave work time, idle time and utilization
+unavailable; a single observed activity event is a measured zero-duration sample.
+Missing usage records remain distinct from recorded zero tokens.
+
 The desktop Sessions page loads a recent window of up to 200 conversations,
-ranked by last activity. Explicitly tracked, monitored, auto-continue and unsettled
-supervision records remain visible even outside that window. Claude discovery
+ranked by last activity. Codex candidates come from CLI, VS Code and app-server
+conversation sources; non-interactive exec, unknown sources and delegated agents
+are excluded. A hook observation alone cannot restore a filtered conversation.
+Explicitly tracked, monitored, auto-continue and unsettled supervision records
+remain visible even outside that window. When a retained Codex conversation is
+omitted from the recent provider page, SIMY reads its exact metadata without
+loading turns or taking writer ownership. The same interactive source filter and
+a matching active rollout path are required before restoring provider capabilities
+and probing its latest turn. Exact reads and turn probes share a bounded
+observation deadline. Claude discovery
 ranks file metadata before opening selected transcripts. A conflicting saved
 workspace leaves only that conversation's Action association unavailable; it
 does not stop discovery or change the saved identity. The page lets users
@@ -586,6 +628,26 @@ execution. Keep concrete regression and delivery acceptance evidence separately.
 If knowledge is unavailable, the command returns exit 2 with the service cause
 and writes no new proof; any older artifact is not evidence for that attempt.
 
+Cloud storage is separate from the check outcome. `check` retains the completed
+proof and local check history if its evidence POST fails, returns exit 2 when
+storage is unconfirmed (exit 1 still takes precedence for a failed check), and
+writes a redacted storage receipt to `<proof-path>.upload.json`. Only a server
+acknowledgement matching the proof ID, evidence ID and proof digest counts as
+stored. `--no-upload` intentionally keeps evidence local and does not return
+exit 2 for storage. A successful upload is not evidence of applicable coverage.
+
+After resolving a storage/authentication failure, explicitly recover the original
+run with `simy sqm upload-proof --proof /path/to/proof.json` (add
+`--signed-evidence /path/to/signature.json` if using a custom signature path, and
+`--host <original-origin>` for its SIMY environment). This verifies the original
+signature and current organization/account/device before sending the same proof;
+it never reruns checks, resigns evidence or automatically replays an ambiguous
+POST. The backend reconciles repeated proof IDs against their exact digest and
+evidence ID. The receipt includes the saved record ID and evidence ID on success.
+This recovers a historical run, not acceptance of the current working tree.
+Dev/production record visibility, deployed gateway/schema and UI destination
+permissions still require validation in the corresponding environment.
+
 Normal runs do not require a separate sync command: the CLI
 uses a verified local cache and revalidates it with TTL and ETag semantics.
 The Agentic Loop runs min-check after each code modification and the full check
@@ -697,7 +759,7 @@ from an empty CLI chat, types repository, branch, executor, attachment, and task
 input through a pseudoterminal, creates the Web ledger, spawns real child
 processes, and exercises HIL plus lifecycle controls. It regenerates the
 screenshots, terminal frames, raw transcript, and SHA-256 manifest under
-`docs/pr-evidence/cli-agentic-loop-console/`.
+`.artifacts/e2e/cli-agentic-loop-console/`.
 
 ## Delivery Loop design proposals
 
@@ -815,11 +877,25 @@ explains baseline updates, historical regression coverage and evidence limits.
 SQM Tasks has separate **Analysis** and **Checks** lists on macOS and Windows.
 Analysis retains local review summaries; Checks retains both `simy sqm min-check`
 and `simy sqm check` outcomes, including checks run by the Delivery Loop.
-Each list keeps the latest 100 runs under `SIMY_HOME/sqm-history` (default
-`~/.simy/sqm-history`), isolated by web origin, account and organization.
+Each desktop list displays the latest 100 runs. Durable summary files under
+`SIMY_HOME/sqm-history` (default `~/.simy/sqm-history`) are retained without
+a count or age cutoff, isolated by web origin, account and organization. Adding
+a run never deletes older history. Old job keys remain available through the
+local task-detail lookup, including failure stage/code, HTTP status, provider
+diagnostics and the matching web task link. The separate rotating diagnostic
+log is a recent-event view; retained job summaries provide longer-term correlation.
+Operators should include this directory in their disk usage and backup policy.
+Deleting a scope directory explicitly removes its history; previously pruned
+records cannot be recovered.
 History remains visible with local analysis off and after restarting. A saved
 in-flight analysis is shown as Interrupted until this client claims it again;
 it does not contribute to the running count. The web workspace owns retry status.
+Model/provider execution failures permit one recovery claim after a five-minute
+cooldown, even when the app/account identity is unchanged. If that attempt fails
+again, the pause survives reconnects and host restarts until a newer SIMY version
+is installed. Sign-in, local installation, SIMY access, schema and persistence
+errors do not open this automatic provider recovery path. The existing six-failure
+circuit still protects other analysis failures.
 
 Only summary metadata is retained, without analysis prompts, source inputs,
 model responses or credentials. Historical summaries are not a replacement for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.6.16",
+  "version": "0.6.17",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -1,12 +1,14 @@
 import { normalizeProviderModelSelection } from "./provider-model-selection.js";
 import { assertConnectionScope, connectionScope, connectionDiagnostic } from "./connection-diagnostics.js";
 import { authorizeLaunch } from "./launch-authorization.js";
+import { resolveDesktopExecutorCommand } from "./desktop-executor.js";
 import { normalizePurposeVerification, assertPurposeActor, preparePurposeVerification, verifyPurposeLocalTask, purposeSigningKeyPath, purposeVerificationCapability, purposeWorkspaceBusy } from "./purpose-local-proof.js";
 import { startupRequirementChecks, summarizeStartupChecks } from "./startup-preflight.js";
 import { BROWSER_HANDOFF_TRANSPORT, browserHandoffPage, decryptBrowserHandoff } from "./browser-handoff.js";
 import { createAuthorizationWindow } from "./browser-authorization.js";
 import { createSqmHistoryStore, projectSqmHistory, sqmHistoryScope } from "./sqm/history-store.js";
 import { createSqmFailureCircuit, createSqmFailureCircuitStore } from "./sqm/failure-circuit.js";
+import { readProviderLinks } from './provider-links.js';
 import { createDesktopAccessPolicy, desktopAccessReady, requireDesktopAccess } from './desktop-access.js';
 import { readSqmEnabled, writeSqmEnabled, readSqmSettings, writeSqmEngineFallback } from "./desktop-sqm-settings.js";
 import { createServer } from "node:http";
@@ -35,6 +37,7 @@ import {
   restoreRun,
   resumeLocalCodingRun,
   startLocalCodingRun,
+  executeProcessAttempt,
   syncLocalCodingRun,
   stopLocalCodingRun,
   toCompatibleCodingLoopState,
@@ -269,6 +272,13 @@ export async function startAgent({
     daemon,
   );
   let availableCapabilities;
+  const inspectedLinks = new WeakMap(), runAuthorizations = new WeakMap();
+  let providerLinks = await readProviderLinks(sessionRoot);
+  const requireLinkedProvider = async (provider, expected) => {
+    const link = (await readProviderLinks(sessionRoot))[provider];
+    if (!link?.connected || expected && link.epoch !== expected.epoch) throw Object.assign(new Error("Reconnect this provider to SIMY before using it."), { code: "provider_link_disconnected" });
+    return link;
+  };
   let providerStatuses = { codex: { state: "unknown" }, claude: { state: "unknown" } };
   const providerRecoveryRevisions = { codex: 0, claude: 0 };
   const refreshAvailableCapabilities = () => {
@@ -390,6 +400,7 @@ export async function startAgent({
         token: session.token,
         deviceId: session.device_id,
         accountId: session.account_id,
+        connectedProviders: ["codex", "claude"].filter(provider => providerLinks[provider]?.connected),
       });
     } catch (error) {
       reportCodexWorkPatternSyncError(error, quiet);
@@ -449,7 +460,7 @@ export async function startAgent({
     providerReadForced = force;
     providerReadInFlight = (async () => {
       const previous = providerStatuses;
-      await Promise.all(["codex", "claude"].map(async (provider) => {
+      await Promise.all([readProviderLinks(sessionRoot).then(links => { providerLinks = links; }), ...["codex", "claude"].map(async (provider) => {
         const next = await (provider === "codex" ? codexStatus : claudeStatus)({ force });
         // Publish each verified result independently. A slow Claude probe must
         // not keep a completed Codex result hidden (or vice versa).
@@ -459,7 +470,7 @@ export async function startAgent({
           providerRecoveryRevisions[provider] += 1;
           notifyDesktopStatusChange();
         }
-      }));
+      })]);
       const binaryStateChanged = ["codex", "claude"].some((provider) =>
         previous[provider]?.version !== providerStatuses[provider]?.version ||
         previous[provider]?.state !== providerStatuses[provider]?.state);
@@ -473,12 +484,15 @@ export async function startAgent({
   };
 
   const inspectReadyBackend = async (backend, options) => {
+    const link = await requireLinkedProvider(backend);
     await readProviderStatuses(options);
+    await requireLinkedProvider(backend, link);
     const inspection = normalizeBackendInspection(backend, availableCapabilities);
     if (inspection.compatible) {
       const failure = providerAuthenticationFailure(backend, providerStatuses[backend]);
       if (failure) throw Object.assign(new Error(failure.summary), failure);
     }
+    inspectedLinks.set(inspection, link);
     return inspection;
   };
 
@@ -487,11 +501,53 @@ export async function startAgent({
     const backend = run.request.backend;
     const inspection = await inspectReadyBackend(backend, { force: true });
     await authorizeDesktopWork(scope);
+    await requireLinkedProvider(backend, inspectedLinks.get(inspection));
     if (!inspection.compatible) {
       throw Object.assign(new Error(backendPreflightSummary(backend, inspection)), {
         code: `desktop_executor_${inspection.status}`,
       });
     }
+    await bindRunAuthorization(run, scope, inspection);
+  };
+
+  const authorizeProviderDispatch = async (backend, scope, link) => {
+    await authorizeDesktopWork(scope);
+    await requireLinkedProvider(backend, link);
+  };
+  const bindRunAuthorization = async (run, scope, inspection) => {
+    const links = await readProviderLinks(sessionRoot);
+    links[run.request.backend] = inspectedLinks.get(inspection);
+    await authorizeProviderDispatch(run.request.backend, scope, links[run.request.backend]);
+    runAuthorizations.set(run, { scope, links });
+  };
+  const providerRuntimeOptions = (task, options = {}, scope, link) => {
+    const guard = () => authorizeProviderDispatch(task.backend, scope, link);
+    const wrap = callback => async (...args) => {
+      await guard();
+      await callback?.(...args);
+      await guard();
+    };
+    return { ...options, beforeProviderInvocation: wrap(options.beforeProviderInvocation), beforeSpawn: wrap(options.beforeSpawn) };
+  };
+  const codingRuntimeOptions = run => {
+    const wrap = (custom, marker) => async context => {
+      // Explicit resume may reauthorize the retained run callbacks. Freeze this
+      // invocation's scope so reconnection during command resolution cannot do so.
+      const authorization = runAuthorizations.get(run);
+      const guard = backend => authorizeProviderDispatch(backend, authorization?.scope, authorization?.links[backend]);
+      await guard(context.backend);
+      if (custom) return custom(context);
+      const repositoryPath = await resolveRepositoryPath(run.request);
+      return executeProcessAttempt({ ...context, run, repositoryPath, ...(marker ? { marker } : {}),
+        resolveCommandImpl: async input => {
+          const command = await (dependencies.resolveDesktopExecutorCommand || resolveDesktopExecutorCommand)(input);
+          await guard(input.backend);
+          return command;
+        },
+      });
+    };
+    return { ...runOptions, executeAttempt: wrap(runOptions.executeAttempt),
+      executeIndependentAudit: wrap(runOptions.executeIndependentAudit, "SIMY_AUDIT_JSON:") };
   };
 
   let organizationCancellation = Promise.resolve();
@@ -933,7 +989,9 @@ export async function startAgent({
           });
         }
         await authorizeDesktopWork(scope);
-        return (dependencies.runLocalTask || startLocalTask)(task, options);
+        const link = inspectedLinks.get(inspection);
+        await requireLinkedProvider(task.backend, link);
+        return (dependencies.runLocalTask || startLocalTask)(task, providerRuntimeOptions(task, options, scope, link));
       },
       attachmentStore: localTaskAttachmentStore,
       getDeviceId: () => session?.device_id || null,
@@ -964,7 +1022,9 @@ export async function startAgent({
         const actor = JSON.stringify([apiOrigin, session?.account_id, session?.organization_id, session?.device_id]);
         const settings = await readSqmSettings(sessionRoot, apiOrigin, session);
         const engineSettings = JSON.stringify([settings.enable_engine_fallback, settings.allowed_fallback_providers]);
-        const beforeDispatch = async () => {
+        const reviewLinks = await readProviderLinks(sessionRoot);
+        const beforeDispatch = async (selectedProvider = provider) => {
+          await requireLinkedProvider(selectedProvider, reviewLinks[selectedProvider]);
           await authorizeDesktopWork(scope);
           const current = await readSqmSettings(sessionRoot, apiOrigin, session);
           if (actor !== JSON.stringify([apiOrigin, session?.account_id, session?.organization_id, session?.device_id]) ||
@@ -973,19 +1033,22 @@ export async function startAgent({
           }
           await context.beforeLeaseDispatch?.();
           await authorizeDesktopWork(scope);
+          await requireLinkedProvider(selectedProvider, reviewLinks[selectedProvider]);
           const finalSettings = await readSqmSettings(sessionRoot, apiOrigin, session);
           if (actor !== JSON.stringify([apiOrigin, session?.account_id, session?.organization_id, session?.device_id]) ||
             engineSettings !== JSON.stringify([finalSettings.enable_engine_fallback, finalSettings.allowed_fallback_providers])) {
             throw Object.assign(new Error("SQM actor or fallback settings changed."), { code: "desktop_access_required" });
           }
+          await requireLinkedProvider(selectedProvider, reviewLinks[selectedProvider]);
         };
         return (dependencies.runSqmLocalReview || ((value, selected, options) => runStructuredProviderReview(selected, value, options)))(request, provider, {
           signal: context.signal, beforeDispatch, readOnlyAnalysis: true, enableEngineFallback: settings.enable_engine_fallback,
+          allowAutomaticRetry: context.allowAutomaticRetry, beforeAutomaticRetry: context.beforeAutomaticRetry,
           allowedFallbackProviders: settings.allowed_fallback_providers, providerReportingSupported: context.providerReportingSupported === true,
         });
       },
       getEnvironmentKey: () => JSON.stringify([apiOrigin, session?.account_id, session?.organization_id, session?.device_id,
-        session?.expires_at, sqmEnabled, sqmEngineSettings, ["codex", "claude"].map(provider => [providerStatuses[provider]?.state, providerStatuses[provider]?.version])]),
+        session?.expires_at, sqmEnabled, sqmEngineSettings, providerLinks, ["codex", "claude"].map(provider => [providerStatuses[provider]?.state, providerStatuses[provider]?.version])]),
       onChange: notifyDesktopStatusChange,
       getWorkspaceUrl: () => {
         const slug = desktopAccess.snapshot().organizationSlug;
@@ -996,7 +1059,7 @@ export async function startAgent({
       recordHistory: (scope, item) => sqmHistory.record(scope, item),
       onHistoryError: () => { if (!quiet) console.error("Could not save the local SQM analysis history."); },
       getProvider: () => !desktopWorkAllowed() || availableCapabilities?.features?.sqm_local_review !== true ? null : ["codex", "claude"].find(
-        (provider) => availableCapabilities?.backends?.[provider] === true &&
+        (provider) => providerLinks[provider]?.connected === true && availableCapabilities?.backends?.[provider] === true &&
           providerStatuses[provider]?.state === "ready",
       ) || null,
       onError: (error) => reportSqmLocalReviewError(error, quiet),
@@ -1025,7 +1088,7 @@ export async function startAgent({
         continueLocalCodingRunAfterRepositoryApproval(
           run,
           { repository: selected.repository, localPath: selected.local_path },
-          runOptions,
+          codingRuntimeOptions(run),
         ),
     );
   };
@@ -1156,6 +1219,7 @@ export async function startAgent({
           return;
         }
         try {
+          await requireLinkedProvider(event.source === "claude_code" ? "claude" : "codex");
           json(
             res,
             200,
@@ -1167,7 +1231,8 @@ export async function startAgent({
             }),
           );
         } catch (error) {
-          json(res, error instanceof DevWorkEventError ? error.status : 502, {
+          json(res, error?.code === "provider_link_disconnected" ? 409 : error instanceof DevWorkEventError ? error.status : 502, {
+            ...(error?.code === "provider_link_disconnected" ? { code: error.code } : {}),
             error: error instanceof DevWorkEventError ? error.message : "dev-work event failed",
           });
         }
@@ -1836,19 +1901,18 @@ export async function startAgent({
           localTaskRegistry.create(task);
           requestClaim.complete(task);
           requestClaimCompleted = true;
-          const runLocalTask =
-            dependencies.runLocalTask ||
-            ((localTask) => startLocalTask(localTask, { session, apiOrigin, beforeSpawn: async () => {
+          const runLocalTask = dependencies.runLocalTask || startLocalTask;
+          const runtimeOptions = providerRuntimeOptions(task, { session, apiOrigin, beforeSpawn: async localTask => {
               if (purposeWorkspaceBusy(localTask.workspace_path)) throw Object.assign(new Error("Independent verification owns this workspace."), { code: "purpose_verification_workspace_busy" });
               if (purposeVerification) {
                 await authorizeDesktopWork(requestAccessScope);
                 assertPurposeActor(purposeVerification, session, apiOrigin, localTask, idempotencyKey);
                 if (purposeStartScope !== desktopScopeRevision() || !isSessionValid(session, Date.now(), apiOrigin)) throw Object.assign(new Error("Purpose verification actor changed."), { code: "purpose_verification_scope_changed" });
               }
-            } }));
-          await authorizeDesktopWork(requestAccessScope);
+            } }, requestAccessScope, inspectedLinks.get(inspection));
+          await authorizeProviderDispatch(body.backend, requestAccessScope, inspectedLinks.get(inspection));
           if (purposeVerification && (purposeStartScope !== desktopScopeRevision() || !isSessionValid(session, Date.now(), apiOrigin))) throw Object.assign(new Error("Purpose verification actor changed."), { code: "purpose_verification_scope_changed", status: 403 });
-          task.operation_promise = Promise.resolve(runLocalTask(task))
+          task.operation_promise = Promise.resolve(runLocalTask(task, runtimeOptions))
             .catch(async (error) => {
               task.status = "failed";
               task.control_state = "complete";
@@ -1973,13 +2037,20 @@ export async function startAgent({
           repositoryPath,
         });
         directRegistry.create(task);
+        const link = inspectedLinks.get(inspection);
+        await authorizeProviderDispatch(body.backend, requestAccessScope, link);
         const runDirectTask = dependencies.runDirectTask || startDirectTask;
+        const directOptions = { resolveCommand: async input => {
+          const command = await (dependencies.resolveDesktopExecutorCommand || resolveDesktopExecutorCommand)(input);
+          await authorizeProviderDispatch(body.backend, requestAccessScope, link);
+          return command;
+        } };
         const releaseUpdateWork = acquireUpdateWork(updateManager);
         if (!releaseUpdateWork) {
           json(res, 503, updateInProgressResponse(updateManager));
           return;
         }
-        void Promise.resolve(runDirectTask(task))
+        void Promise.resolve(runDirectTask(task, directOptions))
           .catch((error) => {
             task.status = "failed";
             task.error = error instanceof Error ? error.message : String(error);
@@ -2177,7 +2248,8 @@ export async function startAgent({
         if (session !== launchSession || !isSessionValid(session, Date.now(), apiOrigin)) {
           json(res, 409, changedLaunchSession(launchSession, session, apiOrigin)); return;
         }
-        void startLocalCodingRun(run, dependencies.runOptions);
+        await bindRunAuthorization(run, requestAccessScope, inspection);
+        void startLocalCodingRun(run, codingRuntimeOptions(run));
         json(res, 202, { ok: true, run_id: run.id });
         return;
       }
@@ -2321,7 +2393,7 @@ export async function startAgent({
         const continuation = continueLocalCodingRun(
           run,
           String(body.message || "Continue after increasing the Provider token budget."),
-          runOptions,
+          codingRuntimeOptions(run),
         );
         json(res, 202, {
           ok: true,
@@ -2434,7 +2506,7 @@ export async function startAgent({
           const continuation = continueLocalCodingRunAfterRepositoryApproval(
             run,
             { repository: selected.repository, localPath: selected.local_path },
-            runOptions,
+            codingRuntimeOptions(run),
           );
           json(res, 202, {
             ok: true,
@@ -2479,7 +2551,7 @@ export async function startAgent({
 
       json(res, 404, { error: "not found" });
     } catch (err) {
-      if (err?.code === "provider_login_required" || err?.code === "provider_status_unknown" ||
+      if (err?.code === "provider_link_disconnected" || err?.code === "provider_login_required" || err?.code === "provider_status_unknown" ||
           (typeof err?.code === "string" && err.code.startsWith("desktop_executor_"))) {
         json(res, 409, { error: err.message, code: err.code, recovery: err.recovery });
         return;
@@ -2772,7 +2844,8 @@ export async function startAgent({
         const executionTarget = normalizeDesktopExecutionTarget(input.executionTarget);
         if (!requirement) throw new Error("Describe the coding task first.");
         if (!repository) throw new Error("Set a repository with /repo owner/name.");
-        if (!(await inspectReadyBackend(backend)).compatible) {
+        const inspection = await inspectReadyBackend(backend);
+        if (!inspection.compatible) {
           throw new Error(`${backend === "claude" ? "Claude Code" : "Codex"} is not available on PATH.`);
         }
         const indexedRepository = await ensureRepositoryIndexed(repository);
@@ -2812,18 +2885,19 @@ export async function startAgent({
         await saveCodingRunSnapshot(codingRunStateRoot, run.snapshot);
         registry.create(run);
         await authorizeDesktopWork(scope);
-        void startLocalCodingRun(run, runOptions);
+        await bindRunAuthorization(run, scope, inspection);
+        void startLocalCodingRun(run, codingRuntimeOptions(run));
         return run;
       }),
       continue: (run, guidance) =>
         withUpdateWork(updateManager, async () => {
           await requireRunProvider(run);
-          return continueLocalCodingRun(run, guidance, runOptions);
+          return continueLocalCodingRun(run, guidance, codingRuntimeOptions(run));
         }),
       applyDecision: (run, decision) =>
         withUpdateWork(updateManager, async () => {
           await requireRunProvider(run);
-          return applyLocalHumanDecision(run, decision, runOptions);
+          return applyLocalHumanDecision(run, decision, codingRuntimeOptions(run));
         }),
       queueGuidance: (run, guidance) => {
         if (enforceDesktopAccess) requireDesktopAccess(desktopAccess.snapshot());

package/src/auto-update.js

@@ -72,6 +72,7 @@ export class CliAutoUpdater extends EventEmitter {
   #confirmedUpdate = null;
   #confirmedReady = false;
   #desktopIdle = () => true;
+  #applyHolds = 0;
 
   constructor(options) {
     super();
@@ -136,7 +137,9 @@ export class CliAutoUpdater extends EventEmitter {
   async performAction() {
     const action = this.#snapshot.action;
     if (action?.id === "download_macos_installer" && action.url) {
-      return this.#options.openUrl(action.url);
+      const result = await this.#options.openUrl(action.url);
+      if (result?.opened === false) throw new Error("Could not open the update installer download.");
+      return result;
     }
     if (action?.command) {
       throw new Error(`Run this command after leaving SIMY: ${action.command}`);
@@ -144,8 +147,17 @@ export class CliAutoUpdater extends EventEmitter {
     throw new Error("No SIMY CLI update action is currently available.");
   }
 
+  // Hold installation across a multi-worker cancellation, even when the last
+  // registry event or work lease is released before every worker has drained.
+  holdApply() {
+    if (["updating", "restarting"].includes(this.#snapshot.state)) throw new Error("SIMY is already updating.");
+    this.#applyHolds++;
+    let released = false;
+    return () => { if (!released) { released = true; this.#applyHolds--; } };
+  }
+
   acceptsNewWork() {
-    return !this.#confirmedUpdate && !["stopping_tasks", "updating", "restarting"].includes(this.#snapshot.state);
+    return this.#applyHolds === 0 && !this.#confirmedUpdate && !["stopping_tasks", "updating", "restarting"].includes(this.#snapshot.state);
   }
 
   beginWork() {
@@ -370,7 +382,7 @@ export class CliAutoUpdater extends EventEmitter {
   }
 
   #isIdle() {
-    return this.#activeWork === 0 && isRegistryIdle(this.#registry) && this.#desktopIdle();
+    return this.#applyHolds === 0 && this.#activeWork === 0 && isRegistryIdle(this.#registry) && this.#desktopIdle();
   }
 
   #clearIdleTimer() {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.6.16";
+export const CLI_VERSION = "0.6.17";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/codex-plugins/simy/hooks/connection-reminder.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import { linkedProvider } from "./delivery-loop.mjs";
 import { createHash } from "node:crypto";
 import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -13,12 +14,14 @@ const MAX_DISCOVERY_RECORDS = 16;
 
 export async function runConnectionReminder({
   env = process.env,
+  provider = env.CLAUDE_PLUGIN_ROOT ? "claude" : "codex",
   input = {},
   fetchImpl = globalThis.fetch,
   now = () => Date.now(),
 } = {}) {
   const explicitWebOrigin = resolveExplicitWebOrigin(env);
   const sessionRoot = env.SIMY_HOME?.trim() || join(homedir(), ".simy");
+  if (!await linkedProvider(join(sessionRoot, "delivery-hooks"), provider)) return { continue: true };
   const pluginData = env.PLUGIN_DATA?.trim() || env.CLAUDE_PLUGIN_DATA?.trim() || join(sessionRoot, "plugin-data", "simy");
   const sessionId = String(input.session_id || input.sessionId || env.CODEX_THREAD_ID || "unknown");
   const statePath = reminderStatePath(pluginData, explicitWebOrigin || "any-origin", sessionId);
@@ -172,9 +175,9 @@ async function readHookInput(stream = process.stdin) {
   }
 }
 
-export async function main() {
+export async function main(provider) {
   try {
-    const result = await runConnectionReminder({ input: await readHookInput() });
+    const result = await runConnectionReminder({ provider, input: await readHookInput() });
     process.stdout.write(`${JSON.stringify(result)}\n`);
   } catch {
     process.stdout.write(`${JSON.stringify({ continue: true })}\n`);

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -3,7 +3,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { isAbsolute, join, relative, resolve } from 'node:path';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { acquireWorkspaceLease, releaseWorkspaceLease } from './workspace-lease.mjs';
@@ -27,6 +27,23 @@ export const taskDirectory = record => record.run?.executionCwd || record.cwd;
 export const taskWorkspaceDirectories = record => [...new Set([record.cwd, taskDirectory(record)])];
 export const sharesTaskWorkspace = (left, right) => taskWorkspaceDirectories(left).some(cwd => taskWorkspaceDirectories(right).includes(cwd));
 const checkpointDirectoryMatches = (record, cwd) => record.cwd === cwd || taskDirectory(record) === cwd;
+// Plugins ship this standalone file without the CLI's provider-links module.
+// Honor the same durable revocation file before accepting hook work; missing
+// files retain legacy behavior, while malformed saved policy fails closed.
+export async function providerLinkState(root, provider) {
+  try {
+    const settings = JSON.parse(await readFile(join(dirname(resolve(root)), 'provider-links.json'), 'utf8'));
+    const valid = settings?.schemaVersion === 1 && ['codex', 'claude'].every(key => {
+      const value = settings.providers?.[key];
+      return value && typeof value.connected === 'boolean' && typeof value.requiresConsent === 'boolean' &&
+        (value.epoch === null || typeof value.epoch === 'string' && value.epoch.length > 0 && value.epoch.length <= 128);
+    });
+    return valid ? settings.providers[provider] ?? { connected: false, epoch: null } : { connected: false, epoch: null };
+  } catch (error) { return { connected: error.code === 'ENOENT', epoch: null }; }
+}
+export async function linkedProvider(root, provider) {
+  return (await providerLinkState(root, provider)).connected === true;
+}
 const digest = value => createHash('sha256').update(value).digest('hex');
 const text = (value, max = 4000) => typeof value === 'string' ? value.trim().slice(0, max) : '';
 const exactText = value => typeof value === 'string' && Buffer.byteLength(value, 'utf8') <= 1000 ? value : null;
@@ -472,7 +489,10 @@ export function deliveryAcceptanceContext(run) {
     ` Pending acceptance (last recorded checks): ${JSON.stringify(pendingAcceptance(run))}. Continue only within the original request and permissions; manual checks require the user. SQM is optional and 0 applicable checks do not establish quality acceptance.`;
 }
 export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), executionCwd, upgradeRunId, objective, nextStep, maxFailures, continuationPolicy, managed, admission,
-  liveHookAdmission, autoContinueEpoch, inspectProcess = processIdentity, now = Date.now() }) {
+  liveHookAdmission, autoContinueEpoch, providerLinkEpoch, inspectProcess = processIdentity, now = Date.now() }) {
+  const link = await providerLinkState(root, provider);
+  if (providerLinkEpoch !== undefined && providerLinkEpoch !== link.epoch) throw Object.assign(new Error("SIMY provider connection changed before enrollment."), { code: "provider_link_changed" });
+  if (!link.connected) throw Object.assign(new Error("Reconnect this provider to SIMY before using it."), { code: "provider_link_disconnected" });
   cwd = await realpath(cwd);
   if (executionCwd !== undefined) {
     executionCwd = await realpath(executionCwd);
@@ -534,6 +554,8 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     }
     if (managedState && !managedState.contextBootstrap) freezeEnrollment(run, now);
     if (waiting) escalate(run, run.reason);
+    const latest = await providerLinkState(root, provider);
+    if (!latest.connected || latest.epoch !== link.epoch) throw Object.assign(new Error("SIMY connection changed before enrollment."), { code: "provider_link_disconnected" });
     return { ...previous, run };
   });
 }
@@ -1052,12 +1074,16 @@ async function providerProcess(provider) {
   return null;
 }
 export async function handleHook({ input, provider, root = rootDirectory(), now = Date.now(), observedProcess = undefined, inspectProcess = processIdentity }) {
+  const link = await providerLinkState(root, provider);
+  if (!link.connected) return {};
   if (!EVENTS.has(input?.hook_event_name) || !text(input.session_id) || !text(input.cwd)) return {};
   let cwd; try { cwd = await realpath(input.cwd); } catch { return {}; }
   const event = input.hook_event_name;
   const identity = observedProcess === undefined && (['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt'].includes(event)) ? await providerProcess(provider) : observedProcess;
   let output = {}, boundaryLease = null, claimedWorkspace = null;
   try { await updateRecord(root, provider, input.session_id, async old => {
+    const currentLink = await providerLinkState(root, provider);
+    if (!currentLink.connected || currentLink.epoch !== link.epoch) return old;
     if (old && old.cwd !== cwd) return old;
     const record = old || { schemaVersion: 1, provider, session: input.session_id, cwd, run: null };
     const owner = record.run?.managed?.liveHookOwner;
@@ -1139,7 +1165,8 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
     } else if (event === 'Stop') {
       // OFF suppresses future Stop blocking; it never interrupts the provider
       // turn. Lease settlement and runtime observation above still run.
-      if (!automaticContinuationAllowed(record)) return record;
+      const latestLink = await providerLinkState(root, provider);
+      if (!automaticContinuationAllowed(record) || !latestLink.connected || latestLink.epoch !== link.epoch) return record;
       // Codex turn IDs make re-delivered Stop events idempotent. Claude has no
       // stable event ID; never dedupe on text (identical text can be a new turn).
       const key = input.turn_id ? `${input.turn_id}:${Boolean(input.stop_hook_active)}:${run.revision}` : null;