@awak-app/simy-cli 0.6.16 → 0.6.18

package/README.md

@@ -15,12 +15,26 @@ cached in memory, so restarting the host may retrieve live contexts again.
 checking for updates. `simy doctor` performs read-only local connection and
 provider login checks and prints a JSON diagnostic report: installed/running
 versions, stale discovery records, session expiry, provider readiness, and recent
-structured SQM failures. It does not run a model, renew login, or restart tasks.
+structured SQM failures, plus `host_exit` with the latest native desktop host's
+abnormal exit time and status. `failures.total_failures` counts scoped SQM
+failures only; zero does not mean the desktop has never crashed. `host_exit` is
+local machine history, independent of account/organization and current daemon
+reachability. A recorded exit remains visible after restart; `not_recorded` means
+no retained exit record, and `unavailable` means it could not be verified. It is
+not a lifetime crash count. Only the fixed header is read; stderr is never
+included. Doctor does not run a model, renew login, or restart tasks.
 Provider login is separate from model access; unverified model access remains
 `unknown`. Diagnostic journals retain stage/code/HTTP status only, use private
 files scoped to the Web/account/organization, rotate each writer's four 64 KiB
 segments, and keep lifetime failure counts after event rotation.
 
+The desktop host continues sampling connection and access while optional
+conversation metadata is pending. It retains the last completed conversation
+metadata only within the same verified scope, clears it after access or account
+changes, and merges completed metadata with the newer connection observation.
+This prevents a slow metadata read from making a live service appear disconnected;
+it does not conceal actual host exits, failed connections, or revoked access.
+
 The organization menu's **Allow Codex / Claude fallback** setting defaults to
 off and grants only read-only SQM analysis permission to use the other signed-in
 local provider. It is saved per Web/account/organization. Switching requires an
@@ -72,6 +86,18 @@ and an already consumed remote result prevent automatic recovery. An unfinished
 worker or a missing, invalid or redacted structured result still requires
 reconciliation; no unknown external operation is automatically replayed.
 
+After CI finishes successfully, the authenticated daemon refreshes the independent
+review of the same saved candidate without dispatching its implementation worker.
+The reviewed HEAD, fetched base, objective, preparation evidence and minimum
+completion matrix must still match; changed candidates require explicit work.
+Pending/failing checks, a dirty checkout and missing required checks do not trigger
+this review. Human peer approval remains required when the charter requires it.
+The refreshed review is checked against newly collected evidence before readiness
+can pass. Stop cancels review continuation. A failed or interrupted refresh is not
+repeated on every monitor tick; explicitly continue the same run to recover.
+Older reviews without a saved CI basis can refresh only when their prior evidence
+still establishes the complete reviewed identity; otherwise explicitly continue.
+
 For interrupted Agentic work, `GET /v1/agentic-loop/:id/recovery` provides a
 read-only objective and checkout fingerprint. Reconcile an uncertain side effect
 with `POST` to that endpoint (`action: reconcile`, authoritative
@@ -124,6 +150,12 @@ a fresh Codex or Claude login probe succeeds, including after an app restart.
 An unchanged ready status cannot repeatedly re-run a failed check. Manual retry
 remains available; continuing the conversation still requires **Auto-continue**.
 
+You can enable **Auto-continue** while a conversation is running when its original
+provider configuration is verified. SIMY saves the preference and waits for the
+current turn to finish before checking remaining work. Configuration and runtime
+blockers appear in the conversation view with recovery guidance; turning the
+setting off does not interrupt the current turn.
+
 Claude read-only structured reviews retry once when the provider explicitly
 reports exhausted turns or structured-output repair attempts, within the original
 timeout. Other failures retain distinct codes and recovery hints. Safe native
@@ -211,9 +243,31 @@ marketplace still points to SIMY’s generated local source. Plugin versions inc
 receive a fresh cache. Use a new Codex task to pick up updated skills; running
 tasks are not restarted. Missing or disabled plugins are not enabled automatically.
 Failed refreshes retry on the next check without blocking daemon startup.
+Auto-continue ON saves consent for the selected original conversation; it does not
+immediately launch a second turn. A verified desktop discovery admission or an
+existing exact admission saves this preference without another provider RPC.
+After the current turn settles, continuation separately rechecks context, the
+live provider channel, approvals and the opt-in epoch. Required human decisions
+remain pending, and OFF prevents future continuation without interrupting the
+current turn. The macOS switch and label explain these boundaries through their
+tooltips and accessibility help.
+
+Conversation statistics estimate work time from activity events within the last
+seven days. Usage counters alone leave work time, idle time and utilization
+unavailable; a single observed activity event is a measured zero-duration sample.
+Missing usage records remain distinct from recorded zero tokens.
+
 The desktop Sessions page loads a recent window of up to 200 conversations,
-ranked by last activity. Explicitly tracked, monitored, auto-continue and unsettled
-supervision records remain visible even outside that window. Claude discovery
+ranked by last activity. Codex candidates come from CLI, VS Code and app-server
+conversation sources; non-interactive exec, unknown sources and delegated agents
+are excluded. A hook observation alone cannot restore a filtered conversation.
+Explicitly tracked, monitored, auto-continue and unsettled supervision records
+remain visible even outside that window. When a retained Codex conversation is
+omitted from the recent provider page, SIMY reads its exact metadata without
+loading turns or taking writer ownership. The same interactive source filter and
+a matching active rollout path are required before restoring provider capabilities
+and probing its latest turn. Exact reads and turn probes share a bounded
+observation deadline. Claude discovery
 ranks file metadata before opening selected transcripts. A conflicting saved
 workspace leaves only that conversation's Action association unavailable; it
 does not stop discovery or change the saved identity. The page lets users
@@ -586,6 +640,26 @@ execution. Keep concrete regression and delivery acceptance evidence separately.
 If knowledge is unavailable, the command returns exit 2 with the service cause
 and writes no new proof; any older artifact is not evidence for that attempt.
 
+Cloud storage is separate from the check outcome. `check` retains the completed
+proof and local check history if its evidence POST fails, returns exit 2 when
+storage is unconfirmed (exit 1 still takes precedence for a failed check), and
+writes a redacted storage receipt to `<proof-path>.upload.json`. Only a server
+acknowledgement matching the proof ID, evidence ID and proof digest counts as
+stored. `--no-upload` intentionally keeps evidence local and does not return
+exit 2 for storage. A successful upload is not evidence of applicable coverage.
+
+After resolving a storage/authentication failure, explicitly recover the original
+run with `simy sqm upload-proof --proof /path/to/proof.json` (add
+`--signed-evidence /path/to/signature.json` if using a custom signature path, and
+`--host <original-origin>` for its SIMY environment). This verifies the original
+signature and current organization/account/device before sending the same proof;
+it never reruns checks, resigns evidence or automatically replays an ambiguous
+POST. The backend reconciles repeated proof IDs against their exact digest and
+evidence ID. The receipt includes the saved record ID and evidence ID on success.
+This recovers a historical run, not acceptance of the current working tree.
+Dev/production record visibility, deployed gateway/schema and UI destination
+permissions still require validation in the corresponding environment.
+
 Normal runs do not require a separate sync command: the CLI
 uses a verified local cache and revalidates it with TTL and ETag semantics.
 The Agentic Loop runs min-check after each code modification and the full check
@@ -697,7 +771,7 @@ from an empty CLI chat, types repository, branch, executor, attachment, and task
 input through a pseudoterminal, creates the Web ledger, spawns real child
 processes, and exercises HIL plus lifecycle controls. It regenerates the
 screenshots, terminal frames, raw transcript, and SHA-256 manifest under
-`docs/pr-evidence/cli-agentic-loop-console/`.
+`.artifacts/e2e/cli-agentic-loop-console/`.
 
 ## Delivery Loop design proposals
 
@@ -759,6 +833,11 @@ not a GitHub hook that mechanically intercepts every external close command.
 
 ### Submit repaired local delivery evidence to SQM
 
+The [integrated delivery state model](src/orchestrator/delivery/references/state-model.md)
+connects delivery milestones, repair/wait/resume branches and actual controller
+states. Both executor and auditor receive its path. It documents existing control
+and evidence duties; it adds no scheduler or transition-enforcement mechanism.
+
 The bundled Delivery Loop maintains an external acceptance checklist with separate
 user-journey and technical-invariant results. It refreshes the table after each
 evaluated action and marks evidence pending when the code or runtime context
@@ -815,11 +894,25 @@ explains baseline updates, historical regression coverage and evidence limits.
 SQM Tasks has separate **Analysis** and **Checks** lists on macOS and Windows.
 Analysis retains local review summaries; Checks retains both `simy sqm min-check`
 and `simy sqm check` outcomes, including checks run by the Delivery Loop.
-Each list keeps the latest 100 runs under `SIMY_HOME/sqm-history` (default
-`~/.simy/sqm-history`), isolated by web origin, account and organization.
+Each desktop list displays the latest 100 runs. Durable summary files under
+`SIMY_HOME/sqm-history` (default `~/.simy/sqm-history`) are retained without
+a count or age cutoff, isolated by web origin, account and organization. Adding
+a run never deletes older history. Old job keys remain available through the
+local task-detail lookup, including failure stage/code, HTTP status, provider
+diagnostics and the matching web task link. The separate rotating diagnostic
+log is a recent-event view; retained job summaries provide longer-term correlation.
+Operators should include this directory in their disk usage and backup policy.
+Deleting a scope directory explicitly removes its history; previously pruned
+records cannot be recovered.
 History remains visible with local analysis off and after restarting. A saved
 in-flight analysis is shown as Interrupted until this client claims it again;
 it does not contribute to the running count. The web workspace owns retry status.
+Model/provider execution failures permit one recovery claim after a five-minute
+cooldown, even when the app/account identity is unchanged. If that attempt fails
+again, the pause survives reconnects and host restarts until a newer SIMY version
+is installed. Sign-in, local installation, SIMY access, schema and persistence
+errors do not open this automatic provider recovery path. The existing six-failure
+circuit still protects other analysis failures.
 
 Only summary metadata is retained, without analysis prompts, source inputs,
 model responses or credentials. Historical summaries are not a replacement for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.6.16",
+  "version": "0.6.18",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -1,12 +1,14 @@
 import { normalizeProviderModelSelection } from "./provider-model-selection.js";
 import { assertConnectionScope, connectionScope, connectionDiagnostic } from "./connection-diagnostics.js";
 import { authorizeLaunch } from "./launch-authorization.js";
+import { resolveDesktopExecutorCommand } from "./desktop-executor.js";
 import { normalizePurposeVerification, assertPurposeActor, preparePurposeVerification, verifyPurposeLocalTask, purposeSigningKeyPath, purposeVerificationCapability, purposeWorkspaceBusy } from "./purpose-local-proof.js";
 import { startupRequirementChecks, summarizeStartupChecks } from "./startup-preflight.js";
 import { BROWSER_HANDOFF_TRANSPORT, browserHandoffPage, decryptBrowserHandoff } from "./browser-handoff.js";
 import { createAuthorizationWindow } from "./browser-authorization.js";
 import { createSqmHistoryStore, projectSqmHistory, sqmHistoryScope } from "./sqm/history-store.js";
 import { createSqmFailureCircuit, createSqmFailureCircuitStore } from "./sqm/failure-circuit.js";
+import { readProviderLinks } from './provider-links.js';
 import { createDesktopAccessPolicy, desktopAccessReady, requireDesktopAccess } from './desktop-access.js';
 import { readSqmEnabled, writeSqmEnabled, readSqmSettings, writeSqmEngineFallback } from "./desktop-sqm-settings.js";
 import { createServer } from "node:http";
@@ -35,6 +37,7 @@ import {
   restoreRun,
   resumeLocalCodingRun,
   startLocalCodingRun,
+  executeProcessAttempt,
   syncLocalCodingRun,
   stopLocalCodingRun,
   toCompatibleCodingLoopState,
@@ -269,6 +272,13 @@ export async function startAgent({
     daemon,
   );
   let availableCapabilities;
+  const inspectedLinks = new WeakMap(), runAuthorizations = new WeakMap();
+  let providerLinks = await readProviderLinks(sessionRoot);
+  const requireLinkedProvider = async (provider, expected) => {
+    const link = (await readProviderLinks(sessionRoot))[provider];
+    if (!link?.connected || expected && link.epoch !== expected.epoch) throw Object.assign(new Error("Reconnect this provider to SIMY before using it."), { code: "provider_link_disconnected" });
+    return link;
+  };
   let providerStatuses = { codex: { state: "unknown" }, claude: { state: "unknown" } };
   const providerRecoveryRevisions = { codex: 0, claude: 0 };
   const refreshAvailableCapabilities = () => {
@@ -390,6 +400,7 @@ export async function startAgent({
         token: session.token,
         deviceId: session.device_id,
         accountId: session.account_id,
+        connectedProviders: ["codex", "claude"].filter(provider => providerLinks[provider]?.connected),
       });
     } catch (error) {
       reportCodexWorkPatternSyncError(error, quiet);
@@ -449,7 +460,7 @@ export async function startAgent({
     providerReadForced = force;
     providerReadInFlight = (async () => {
       const previous = providerStatuses;
-      await Promise.all(["codex", "claude"].map(async (provider) => {
+      await Promise.all([readProviderLinks(sessionRoot).then(links => { providerLinks = links; }), ...["codex", "claude"].map(async (provider) => {
         const next = await (provider === "codex" ? codexStatus : claudeStatus)({ force });
         // Publish each verified result independently. A slow Claude probe must
         // not keep a completed Codex result hidden (or vice versa).
@@ -459,7 +470,7 @@ export async function startAgent({
           providerRecoveryRevisions[provider] += 1;
           notifyDesktopStatusChange();
         }
-      }));
+      })]);
       const binaryStateChanged = ["codex", "claude"].some((provider) =>
         previous[provider]?.version !== providerStatuses[provider]?.version ||
         previous[provider]?.state !== providerStatuses[provider]?.state);
@@ -473,25 +484,85 @@ export async function startAgent({
   };
 
   const inspectReadyBackend = async (backend, options) => {
+    const link = await requireLinkedProvider(backend);
     await readProviderStatuses(options);
+    await requireLinkedProvider(backend, link);
     const inspection = normalizeBackendInspection(backend, availableCapabilities);
     if (inspection.compatible) {
       const failure = providerAuthenticationFailure(backend, providerStatuses[backend]);
       if (failure) throw Object.assign(new Error(failure.summary), failure);
     }
+    inspectedLinks.set(inspection, link);
     return inspection;
   };
 
-  const requireRunProvider = async (run) => {
+  const requireRunProvider = async (run, { backend = run.request.backend } = {}) => {
     const scope = await authorizeDesktopWork();
-    const backend = run.request.backend;
     const inspection = await inspectReadyBackend(backend, { force: true });
     await authorizeDesktopWork(scope);
+    await requireLinkedProvider(backend, inspectedLinks.get(inspection));
     if (!inspection.compatible) {
       throw Object.assign(new Error(backendPreflightSummary(backend, inspection)), {
         code: `desktop_executor_${inspection.status}`,
       });
     }
+    await bindRunAuthorization(run, scope, inspection, backend);
+  };
+
+  const authorizeProviderDispatch = async (backend, scope, link) => {
+    await authorizeDesktopWork(scope);
+    await requireLinkedProvider(backend, link);
+  };
+  const bindRunAuthorization = async (run, scope, inspection, backend = run.request.backend) => {
+    const links = await readProviderLinks(sessionRoot);
+    links[backend] = inspectedLinks.get(inspection);
+    await authorizeProviderDispatch(backend, scope, links[backend]);
+    runAuthorizations.set(run, { scope, links });
+  };
+  const providerRuntimeOptions = (task, options = {}, scope, link) => {
+    const guard = () => authorizeProviderDispatch(task.backend, scope, link);
+    const wrap = callback => async (...args) => {
+      await guard();
+      await callback?.(...args);
+      await guard();
+    };
+    return { ...options, beforeProviderInvocation: wrap(options.beforeProviderInvocation), beforeSpawn: wrap(options.beforeSpawn) };
+  };
+  const codingRuntimeOptions = run => {
+    const wrap = (custom, marker) => async context => {
+      // Explicit resume may reauthorize the retained run callbacks. Freeze this
+      // invocation's scope so reconnection during command resolution cannot do so.
+      const authorization = runAuthorizations.get(run);
+      const guard = backend => authorizeProviderDispatch(backend, authorization?.scope, authorization?.links[backend]);
+      await guard(context.backend);
+      if (custom) return custom(context);
+      const repositoryPath = await resolveRepositoryPath(run.request);
+      return executeProcessAttempt({ ...context, run, repositoryPath, ...(marker ? { marker } : {}),
+        resolveCommandImpl: async input => {
+          const command = await (dependencies.resolveDesktopExecutorCommand || resolveDesktopExecutorCommand)(input);
+          await guard(input.backend);
+          return command;
+        },
+      });
+    };
+    return { ...runOptions, executeAttempt: wrap(runOptions.executeAttempt),
+      executeIndependentAudit: wrap(runOptions.executeIndependentAudit, "SIMY_AUDIT_JSON:") };
+  };
+
+  const recheckAuthorizedCodingRun = (run, options = {}) => {
+    const scope = desktopScopeRevision();
+    return recheckLocalCodingRun(run, { collectEvidence: runOptions.collectEvidence, ...options,
+      executeIndependentAudit: context => withUpdateWork(updateManager,
+        () => codingRuntimeOptions(run).executeIndependentAudit(context)),
+      authorizeReview: async () => {
+        await authorizeDesktopWork(scope);
+        if (!isSessionValid(session, Date.now(), apiOrigin) || !sameRunScope(run.session, session)) {
+          throw new Error("The original authorized coding run session changed.");
+        }
+        await requireRunProvider(run, { backend: run.snapshot.charter.audit_backend });
+        await authorizeDesktopWork(scope);
+      },
+    });
   };
 
   let organizationCancellation = Promise.resolve();
@@ -740,7 +811,7 @@ export async function startAgent({
       for (const run of registry.list()) {
         if (!["pr_ready_for_review", "merge_ready"].includes(run.status) || run.operation || run.child) continue;
         try {
-          await (dependencies.recheckCodingRun || recheckLocalCodingRun)(run);
+          await (dependencies.recheckCodingRun || recheckAuthorizedCodingRun)(run);
         } catch (error) {
           await markCodingRunMonitorFailure(run, error);
         }
@@ -933,7 +1004,9 @@ export async function startAgent({
           });
         }
         await authorizeDesktopWork(scope);
-        return (dependencies.runLocalTask || startLocalTask)(task, options);
+        const link = inspectedLinks.get(inspection);
+        await requireLinkedProvider(task.backend, link);
+        return (dependencies.runLocalTask || startLocalTask)(task, providerRuntimeOptions(task, options, scope, link));
       },
       attachmentStore: localTaskAttachmentStore,
       getDeviceId: () => session?.device_id || null,
@@ -964,7 +1037,9 @@ export async function startAgent({
         const actor = JSON.stringify([apiOrigin, session?.account_id, session?.organization_id, session?.device_id]);
         const settings = await readSqmSettings(sessionRoot, apiOrigin, session);
         const engineSettings = JSON.stringify([settings.enable_engine_fallback, settings.allowed_fallback_providers]);
-        const beforeDispatch = async () => {
+        const reviewLinks = await readProviderLinks(sessionRoot);
+        const beforeDispatch = async (selectedProvider = provider) => {
+          await requireLinkedProvider(selectedProvider, reviewLinks[selectedProvider]);
           await authorizeDesktopWork(scope);
           const current = await readSqmSettings(sessionRoot, apiOrigin, session);
           if (actor !== JSON.stringify([apiOrigin, session?.account_id, session?.organization_id, session?.device_id]) ||
@@ -973,19 +1048,22 @@ export async function startAgent({
           }
           await context.beforeLeaseDispatch?.();
           await authorizeDesktopWork(scope);
+          await requireLinkedProvider(selectedProvider, reviewLinks[selectedProvider]);
           const finalSettings = await readSqmSettings(sessionRoot, apiOrigin, session);
           if (actor !== JSON.stringify([apiOrigin, session?.account_id, session?.organization_id, session?.device_id]) ||
             engineSettings !== JSON.stringify([finalSettings.enable_engine_fallback, finalSettings.allowed_fallback_providers])) {
             throw Object.assign(new Error("SQM actor or fallback settings changed."), { code: "desktop_access_required" });
           }
+          await requireLinkedProvider(selectedProvider, reviewLinks[selectedProvider]);
         };
         return (dependencies.runSqmLocalReview || ((value, selected, options) => runStructuredProviderReview(selected, value, options)))(request, provider, {
           signal: context.signal, beforeDispatch, readOnlyAnalysis: true, enableEngineFallback: settings.enable_engine_fallback,
+          allowAutomaticRetry: context.allowAutomaticRetry, beforeAutomaticRetry: context.beforeAutomaticRetry,
           allowedFallbackProviders: settings.allowed_fallback_providers, providerReportingSupported: context.providerReportingSupported === true,
         });
       },
       getEnvironmentKey: () => JSON.stringify([apiOrigin, session?.account_id, session?.organization_id, session?.device_id,
-        session?.expires_at, sqmEnabled, sqmEngineSettings, ["codex", "claude"].map(provider => [providerStatuses[provider]?.state, providerStatuses[provider]?.version])]),
+        session?.expires_at, sqmEnabled, sqmEngineSettings, providerLinks, ["codex", "claude"].map(provider => [providerStatuses[provider]?.state, providerStatuses[provider]?.version])]),
       onChange: notifyDesktopStatusChange,
       getWorkspaceUrl: () => {
         const slug = desktopAccess.snapshot().organizationSlug;
@@ -996,7 +1074,7 @@ export async function startAgent({
       recordHistory: (scope, item) => sqmHistory.record(scope, item),
       onHistoryError: () => { if (!quiet) console.error("Could not save the local SQM analysis history."); },
       getProvider: () => !desktopWorkAllowed() || availableCapabilities?.features?.sqm_local_review !== true ? null : ["codex", "claude"].find(
-        (provider) => availableCapabilities?.backends?.[provider] === true &&
+        (provider) => providerLinks[provider]?.connected === true && availableCapabilities?.backends?.[provider] === true &&
           providerStatuses[provider]?.state === "ready",
       ) || null,
       onError: (error) => reportSqmLocalReviewError(error, quiet),
@@ -1025,7 +1103,7 @@ export async function startAgent({
         continueLocalCodingRunAfterRepositoryApproval(
           run,
           { repository: selected.repository, localPath: selected.local_path },
-          runOptions,
+          codingRuntimeOptions(run),
         ),
     );
   };
@@ -1156,6 +1234,7 @@ export async function startAgent({
           return;
         }
         try {
+          await requireLinkedProvider(event.source === "claude_code" ? "claude" : "codex");
           json(
             res,
             200,
@@ -1167,7 +1246,8 @@ export async function startAgent({
             }),
           );
         } catch (error) {
-          json(res, error instanceof DevWorkEventError ? error.status : 502, {
+          json(res, error?.code === "provider_link_disconnected" ? 409 : error instanceof DevWorkEventError ? error.status : 502, {
+            ...(error?.code === "provider_link_disconnected" ? { code: error.code } : {}),
             error: error instanceof DevWorkEventError ? error.message : "dev-work event failed",
           });
         }
@@ -1836,19 +1916,18 @@ export async function startAgent({
           localTaskRegistry.create(task);
           requestClaim.complete(task);
           requestClaimCompleted = true;
-          const runLocalTask =
-            dependencies.runLocalTask ||
-            ((localTask) => startLocalTask(localTask, { session, apiOrigin, beforeSpawn: async () => {
+          const runLocalTask = dependencies.runLocalTask || startLocalTask;
+          const runtimeOptions = providerRuntimeOptions(task, { session, apiOrigin, beforeSpawn: async localTask => {
               if (purposeWorkspaceBusy(localTask.workspace_path)) throw Object.assign(new Error("Independent verification owns this workspace."), { code: "purpose_verification_workspace_busy" });
               if (purposeVerification) {
                 await authorizeDesktopWork(requestAccessScope);
                 assertPurposeActor(purposeVerification, session, apiOrigin, localTask, idempotencyKey);
                 if (purposeStartScope !== desktopScopeRevision() || !isSessionValid(session, Date.now(), apiOrigin)) throw Object.assign(new Error("Purpose verification actor changed."), { code: "purpose_verification_scope_changed" });
               }
-            } }));
-          await authorizeDesktopWork(requestAccessScope);
+            } }, requestAccessScope, inspectedLinks.get(inspection));
+          await authorizeProviderDispatch(body.backend, requestAccessScope, inspectedLinks.get(inspection));
           if (purposeVerification && (purposeStartScope !== desktopScopeRevision() || !isSessionValid(session, Date.now(), apiOrigin))) throw Object.assign(new Error("Purpose verification actor changed."), { code: "purpose_verification_scope_changed", status: 403 });
-          task.operation_promise = Promise.resolve(runLocalTask(task))
+          task.operation_promise = Promise.resolve(runLocalTask(task, runtimeOptions))
             .catch(async (error) => {
               task.status = "failed";
               task.control_state = "complete";
@@ -1973,13 +2052,20 @@ export async function startAgent({
           repositoryPath,
         });
         directRegistry.create(task);
+        const link = inspectedLinks.get(inspection);
+        await authorizeProviderDispatch(body.backend, requestAccessScope, link);
         const runDirectTask = dependencies.runDirectTask || startDirectTask;
+        const directOptions = { resolveCommand: async input => {
+          const command = await (dependencies.resolveDesktopExecutorCommand || resolveDesktopExecutorCommand)(input);
+          await authorizeProviderDispatch(body.backend, requestAccessScope, link);
+          return command;
+        } };
         const releaseUpdateWork = acquireUpdateWork(updateManager);
         if (!releaseUpdateWork) {
           json(res, 503, updateInProgressResponse(updateManager));
           return;
         }
-        void Promise.resolve(runDirectTask(task))
+        void Promise.resolve(runDirectTask(task, directOptions))
           .catch((error) => {
             task.status = "failed";
             task.error = error instanceof Error ? error.message : String(error);
@@ -2177,7 +2263,8 @@ export async function startAgent({
         if (session !== launchSession || !isSessionValid(session, Date.now(), apiOrigin)) {
           json(res, 409, changedLaunchSession(launchSession, session, apiOrigin)); return;
         }
-        void startLocalCodingRun(run, dependencies.runOptions);
+        await bindRunAuthorization(run, requestAccessScope, inspection);
+        void startLocalCodingRun(run, codingRuntimeOptions(run));
         json(res, 202, { ok: true, run_id: run.id });
         return;
       }
@@ -2321,7 +2408,7 @@ export async function startAgent({
         const continuation = continueLocalCodingRun(
           run,
           String(body.message || "Continue after increasing the Provider token budget."),
-          runOptions,
+          codingRuntimeOptions(run),
         );
         json(res, 202, {
           ok: true,
@@ -2434,7 +2521,7 @@ export async function startAgent({
           const continuation = continueLocalCodingRunAfterRepositoryApproval(
             run,
             { repository: selected.repository, localPath: selected.local_path },
-            runOptions,
+            codingRuntimeOptions(run),
           );
           json(res, 202, {
             ok: true,
@@ -2466,7 +2553,7 @@ export async function startAgent({
           json(res, 409, { error: "run is not ready for PR evidence recheck" });
           return;
         }
-        const snapshot = await recheckLocalCodingRun(run);
+        const snapshot = await recheckAuthorizedCodingRun(run);
         json(res, 200, { ok: true, run_id: run.id, state: snapshot.state });
         return;
       }
@@ -2479,7 +2566,7 @@ export async function startAgent({
 
       json(res, 404, { error: "not found" });
     } catch (err) {
-      if (err?.code === "provider_login_required" || err?.code === "provider_status_unknown" ||
+      if (err?.code === "provider_link_disconnected" || err?.code === "provider_login_required" || err?.code === "provider_status_unknown" ||
           (typeof err?.code === "string" && err.code.startsWith("desktop_executor_"))) {
         json(res, 409, { error: err.message, code: err.code, recovery: err.recovery });
         return;
@@ -2720,6 +2807,12 @@ export async function startAgent({
           !Number.isFinite(ticket.expiresAt) || ticket.expiresAt <= Date.now() || ticket.expiresAt > Date.now() + 60_000) throw new Error("Desktop sign-in changed");
       return { code: ticket.code, expiresAt: ticket.expiresAt, userId: ticket.userId, orgSlug: ticket.orgSlug };
     },
+    // This is an in-process capability for the native host. It is deliberately
+    // absent from status frames and never written to disk by the host.
+    getLocalCliApiSession() {
+      if (!isSessionValid(session, Date.now(), apiOrigin) || pendingOrganization) return null;
+      return { token: session.token, api_base_url: session.api_base_url };
+    },
     getDesktopStatus,
     stopDesktopTask,
     stopDesktopTasks,
@@ -2772,7 +2865,8 @@ export async function startAgent({
         const executionTarget = normalizeDesktopExecutionTarget(input.executionTarget);
         if (!requirement) throw new Error("Describe the coding task first.");
         if (!repository) throw new Error("Set a repository with /repo owner/name.");
-        if (!(await inspectReadyBackend(backend)).compatible) {
+        const inspection = await inspectReadyBackend(backend);
+        if (!inspection.compatible) {
           throw new Error(`${backend === "claude" ? "Claude Code" : "Codex"} is not available on PATH.`);
         }
         const indexedRepository = await ensureRepositoryIndexed(repository);
@@ -2812,18 +2906,19 @@ export async function startAgent({
         await saveCodingRunSnapshot(codingRunStateRoot, run.snapshot);
         registry.create(run);
         await authorizeDesktopWork(scope);
-        void startLocalCodingRun(run, runOptions);
+        await bindRunAuthorization(run, scope, inspection);
+        void startLocalCodingRun(run, codingRuntimeOptions(run));
         return run;
       }),
       continue: (run, guidance) =>
         withUpdateWork(updateManager, async () => {
           await requireRunProvider(run);
-          return continueLocalCodingRun(run, guidance, runOptions);
+          return continueLocalCodingRun(run, guidance, codingRuntimeOptions(run));
         }),
       applyDecision: (run, decision) =>
         withUpdateWork(updateManager, async () => {
           await requireRunProvider(run);
-          return applyLocalHumanDecision(run, decision, runOptions);
+          return applyLocalHumanDecision(run, decision, codingRuntimeOptions(run));
         }),
       queueGuidance: (run, guidance) => {
         if (enforceDesktopAccess) requireDesktopAccess(desktopAccess.snapshot());
@@ -2838,7 +2933,7 @@ export async function startAgent({
       recheck: (run) =>
         withUpdateWork(updateManager, async () => {
           await authorizeDesktopWork();
-          return recheckLocalCodingRun(run, { collectEvidence: runOptions.collectEvidence });
+          return recheckAuthorizedCodingRun(run, { collectEvidence: runOptions.collectEvidence });
         }),
     },
   };

package/src/auto-update.js

@@ -72,6 +72,7 @@ export class CliAutoUpdater extends EventEmitter {
   #confirmedUpdate = null;
   #confirmedReady = false;
   #desktopIdle = () => true;
+  #applyHolds = 0;
 
   constructor(options) {
     super();
@@ -136,7 +137,9 @@ export class CliAutoUpdater extends EventEmitter {
   async performAction() {
     const action = this.#snapshot.action;
     if (action?.id === "download_macos_installer" && action.url) {
-      return this.#options.openUrl(action.url);
+      const result = await this.#options.openUrl(action.url);
+      if (result?.opened === false) throw new Error("Could not open the update installer download.");
+      return result;
     }
     if (action?.command) {
       throw new Error(`Run this command after leaving SIMY: ${action.command}`);
@@ -144,8 +147,17 @@ export class CliAutoUpdater extends EventEmitter {
     throw new Error("No SIMY CLI update action is currently available.");
   }
 
+  // Hold installation across a multi-worker cancellation, even when the last
+  // registry event or work lease is released before every worker has drained.
+  holdApply() {
+    if (["updating", "restarting"].includes(this.#snapshot.state)) throw new Error("SIMY is already updating.");
+    this.#applyHolds++;
+    let released = false;
+    return () => { if (!released) { released = true; this.#applyHolds--; } };
+  }
+
   acceptsNewWork() {
-    return !this.#confirmedUpdate && !["stopping_tasks", "updating", "restarting"].includes(this.#snapshot.state);
+    return this.#applyHolds === 0 && !this.#confirmedUpdate && !["stopping_tasks", "updating", "restarting"].includes(this.#snapshot.state);
   }
 
   beginWork() {
@@ -370,7 +382,7 @@ export class CliAutoUpdater extends EventEmitter {
   }
 
   #isIdle() {
-    return this.#activeWork === 0 && isRegistryIdle(this.#registry) && this.#desktopIdle();
+    return this.#applyHolds === 0 && this.#activeWork === 0 && isRegistryIdle(this.#registry) && this.#desktopIdle();
   }
 
   #clearIdleTimer() {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.6.16";
+export const CLI_VERSION = "0.6.18";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/codex-plugins/simy/hooks/connection-reminder.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import { linkedProvider } from "./delivery-loop.mjs";
 import { createHash } from "node:crypto";
 import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -13,12 +14,14 @@ const MAX_DISCOVERY_RECORDS = 16;
 
 export async function runConnectionReminder({
   env = process.env,
+  provider = env.CLAUDE_PLUGIN_ROOT ? "claude" : "codex",
   input = {},
   fetchImpl = globalThis.fetch,
   now = () => Date.now(),
 } = {}) {
   const explicitWebOrigin = resolveExplicitWebOrigin(env);
   const sessionRoot = env.SIMY_HOME?.trim() || join(homedir(), ".simy");
+  if (!await linkedProvider(join(sessionRoot, "delivery-hooks"), provider)) return { continue: true };
   const pluginData = env.PLUGIN_DATA?.trim() || env.CLAUDE_PLUGIN_DATA?.trim() || join(sessionRoot, "plugin-data", "simy");
   const sessionId = String(input.session_id || input.sessionId || env.CODEX_THREAD_ID || "unknown");
   const statePath = reminderStatePath(pluginData, explicitWebOrigin || "any-origin", sessionId);
@@ -172,9 +175,9 @@ async function readHookInput(stream = process.stdin) {
   }
 }
 
-export async function main() {
+export async function main(provider) {
   try {
-    const result = await runConnectionReminder({ input: await readHookInput() });
+    const result = await runConnectionReminder({ provider, input: await readHookInput() });
     process.stdout.write(`${JSON.stringify(result)}\n`);
   } catch {
     process.stdout.write(`${JSON.stringify({ continue: true })}\n`);