@awak-app/simy-cli 0.6.16 → 0.6.18

package/src/desktop-host.js

@@ -1,3 +1,5 @@
+import { PROVIDER_LINKS, readProviderLinks, writeProviderLink, requireProviderLink } from "./provider-links.js";
+import { randomUUID } from "node:crypto";
 import { readCodexStatistics, unavailableStatistics } from './session-supervision/statistics.js';
 import { readClaudeStatistics } from './session-supervision/claude-sessions.js';
 import { inspectProviderPlugins, unavailablePluginStatus } from './sqm/provider-plugin-status.js';
@@ -8,11 +10,11 @@ import { stopDesktopWorkForUpdate } from './desktop-update-stop.js';
 import { desktopAccessReady, desktopActionAllowed, requireDesktopAccess, validDesktopAccessPath } from './desktop-access.js';
 import { createActionDeadlineService } from './session-supervision/action-deadline.js';
 import { deliveryHookStatus, openHookSetup } from "./delivery-hooks/desktop.js";
-import { controlDelivery, verifyDelivery, createRecordReader, TERMINAL } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
+import { controlDelivery, verifyDelivery, createRecordReader, updateRecord, TERMINAL } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
 import { createManagedSupervisor } from "./delivery-hooks/supervisor.js";
 import { createActionAssociationHost } from "./session-supervision/action-association-host.js";
 import { createStopNotifier } from "./session-supervision/stop-notifications.js";
-import { answerSession, continueSession, discoverSessions, enrollSession, monitorSession, trackSession, setSessionAutoContinue } from "./session-supervision/index.js";
+import { AutoContinueUnavailableError, answerSession, continueSession, discoverSessions, enrollSession, monitorSession, trackSession, setSessionAutoContinue } from "./session-supervision/index.js";
 import { createContinuationAnalysisManager } from "./session-supervision/analysis-manager.js";
 import { analyzeContinuation, readContinuationContext } from "./session-supervision/continuation-analysis.js";
 import { continueAnalyzedSession, createAutomaticContinuation } from "./session-supervision/automatic-continuation.js";
@@ -35,6 +37,8 @@ import { openAuthorizationUrl } from "./browser.js";
 import { inspectBackendExecutable } from "./backend-executable.js";
 import { inspectSqmAgentSkill } from "./sqm/agent-skill.js";
 import { startWorkflowUpdates, syncInstalledWorkflows } from "./sqm/workflow-update.js";
+import { createNativeDevelopmentReportsApi, normalizeNativeDevelopmentReportSave } from "./native-development-reports.js";
+import { projectNativeDevelopmentReportCompletion, sendNativeDevelopmentReportCompletion } from "./native-development-report-completion.js";
 import {
   acquireDesktopProcessLock,
   assertNoLegacyCliDaemon,
@@ -48,9 +52,37 @@ const silentLogger = { log() {}, error() {} };
 // exceed 128 KiB, including after a signed runtime handoff.
 const MAX_DESKTOP_FRAME_BYTES = 8 * 1024 * 1024;
 
+async function withReadCancellation(signal, work) {
+  signal.throwIfAborted();
+  let cancelled;
+  const cancellation = new Promise((_, reject) => {
+    cancelled = () => reject(Object.assign(new Error('Conversation activity request cancelled.'), { code: 'cancelled' }));
+    signal.addEventListener('abort', cancelled, { once: true });
+  });
+  try { return await Promise.race([Promise.resolve().then(work), cancellation]); }
+  finally { signal.removeEventListener('abort', cancelled); }
+}
+
 function desktopActionError(action, error) {
+  if (error?.code === "provider_link_changed") return "SIMY connection changed. Refresh and select the conversation again.";
+  if (error?.code === "provider_link_disconnected") return "Reconnect this provider to SIMY before using it.";
+  if (["provider_connect", "provider_disconnect"].includes(action)) return "Could not finish changing the SIMY connection. Refresh its status and try again.";
+  if (action === "session_set_auto_continue") {
+    const messages = {
+      session_workspace_changed: "The conversation workspace changed. Refresh and select it again.",
+      session_metadata_unavailable: "Conversation details are unavailable. Refresh this provider and select the conversation again.",
+      session_model_unavailable: "This provider did not expose the conversation model; automatic continuation is unavailable.",
+      existing_loop: "This conversation already has a Delivery Loop. Open its existing supervision instead.",
+      task_settled: "This task has finished. Start a new conversation before enabling automatic continuation.",
+    };
+    if (messages[error?.code]) return messages[error.code];
+  }
   if (action === 'authorization_open' || error?.code === 'desktop_browser_unavailable') return "Could not open your browser. Open the verification link again, or check your default browser.";
   if (error?.code === "desktop_access_required") return "Sign in to an organization with SQM and Developer access before using SIMY.";
+  if (action === "codex_hooks" || action === "claude_hooks") return "Could not open the setup guide. Check your default browser, or use /hooks inside the provider.";
+  if (action === "install_plugins") return error?.code === "plugin_setup_busy"
+    ? "Another SIMY process is preparing plugins. Wait, then refresh to check the files."
+    : "Plugin setup could not finish. Refresh its status or retry setup.";
   if (action === "session_deadline_decide") return error?.code === "conflict"
     ? "Deadline changed; refresh before deciding." : "The deadline is unavailable. Refresh this conversation before deciding.";
   if (typeof action === "string" && action.startsWith("session_")) {
@@ -65,6 +97,10 @@ function desktopActionError(action, error) {
     return "Could not save SQM settings. Check your SIMY connection and try again.";
   }
   if (action === 'update') return 'Update could not finish. Restart SIMY and retry; stopped tasks stay stopped.';
+  if (/^(codex|claude)_login$/.test(action || "")) {
+    if (error?.code === "provider_not_installed") return "Provider CLI is not installed. Install it, then refresh connections.";
+    return "Could not open the sign-in terminal. Check your Terminal / PowerShell app, then try again.";
+  }
   return "Action could not finish. Refresh the status and try again.";
 }
 
@@ -74,8 +110,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
   // A heartbeat remains a complete native frame. Only its observation time is
   // volatile; reuse the encoded body after comparing freshly authorized data.
   // Detach the comparison value because registries may mutate nested objects.
-  let encodedStatus = null, lastStatus = null;
+  let encodedStatus = null, lastStatus = null, updateProgress = null;
   const emitStatus = status => {
+    if (updateProgress) status = { ...status, update: { ...status.update, ...updateProgress } };
     const { sampledAt, ...content } = status;
     if (!lastStatus || !isDeepStrictEqual(content, lastStatus)) {
       encodedStatus = JSON.stringify(content).slice(1, -1);
@@ -95,18 +132,51 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const supervisorToken = lock?.nonce || env.SIMY_DESKTOP_SUPERVISOR_TOKEN;
   const deliveryRoot = join(root, "delivery-hooks");
   const recordReader = createRecordReader(deliveryRoot);
+  let providerLinks = await readProviderLinks(root);
+  const providerLinkBusy = new Set(), providerLinkFeedback = {}, explicitAnalyses = new Set();
+  const linkedSessions = sessions => sessions.filter(item => providerLinks[item.provider]?.connected === true);
+  const analysisSessions = sessions => linkedSessions(sessions).filter(item => !providerLinks[item.provider].requiresConsent ||
+    item.autoContinue === true || item.tracked === true || item.monitor === true || explicitAnalyses.has(`${item.provider}:${item.session}`));
+  const authorizeProvider = async (provider, scope, expectedEpoch) => {
+    await authorizeWork(scope);
+    return requireProviderLink({ root: deliveryRoot, provider, expectedEpoch });
+  };
   let agent, updater, analysisManager, automaticContinuation, stopWorkflows = async () => {}, timer, closed = false, relay = null, publishing = null, publishAgain = false, scheduledPublish = null;
-  const makeActionAssociations = () => (dependencies.createActionAssociationHost || createActionAssociationHost)({ root: join(root, "delivery-hooks"), sessionRoot: root, webOrigin, list: () => recordReader.list(), onChange: () => { if (!closed) setImmediate(() => { void publish().catch(() => {}); }); } });
+  const makeActionAssociations = () => (dependencies.createActionAssociationHost || createActionAssociationHost)({ root: join(root, "delivery-hooks"), sessionRoot: root, webOrigin, list: async () => linkedSessions(await recordReader.list()), onChange: () => { if (!closed) setImmediate(() => { void publish().catch(() => {}); }); } });
   let actionAssociations = makeActionAssociations();
   const statisticsCache = new Map();
+  let activeStatisticsRead = null;
+  let statisticsSelection = { key: null, generation: 0 };
   const stopNotifier = createStopNotifier({ emit: event => { if (!closed && !relay) emit(event); } });
   let currentAccess = { state: 'checking', organizationId: null, organizationName: null };
+  let nativeDevelopmentReports = { state: 'loading', enrollments: [] };
+  let nativeDevelopmentReportsScope = null;
+  let nativeDevelopmentReportsRequest = null;
+  let nativeDevelopmentReportsGeneration = 0;
+  let nativeDevelopmentReportsRetryAt = 0;
+  let nativeDevelopmentReportsMutation = false;
+  const nativeCompletionSuccess = new Set();
+  const nativeCompletionRejected = new Set();
+  const nativeCompletionInFlight = new Map();
+  const nativeCompletionRetryAt = new Map();
   const accessScope = access => JSON.stringify([access?.revision ?? null, access?.organizationId ?? null]);
   const setAccessSnapshot = async access => {
     const previousScope = accessScope(currentAccess);
+    const previouslyReady = desktopAccessReady(currentAccess);
     currentAccess = access || { state: 'unavailable', organizationId: null, organizationName: null };
+    if (previousScope !== accessScope(currentAccess) || previouslyReady && !desktopAccessReady(currentAccess)) {
+      // A privilege loss also invalidates consent reads, even when the
+      // credential/organization revision itself did not change.
+      nativeDevelopmentReports = { state: 'loading', enrollments: [] };
+      nativeDevelopmentReportsScope = null;
+      nativeDevelopmentReportsGeneration++;
+      nativeDevelopmentReportsRetryAt = 0;
+      nativeCompletionInFlight.clear();
+    }
     if (previousScope !== accessScope(currentAccess)) {
       statisticsCache.clear();
+      activeStatisticsRead?.controller.abort();
+      explicitAnalyses.clear();
       discoveryController?.abort();
       sessionRefreshAgain = Boolean(sessionRefresh) && desktopAccessReady(currentAccess);
       for (const item of sessionStatus.sessions) automaticContinuation?.revoke(item.provider, item.session);
@@ -115,9 +185,114 @@ export async function startDesktopHost({ input = process.stdin, output = process
     }
     return currentAccess;
   };
-  const accessSnapshot = async () => setAccessSnapshot((await agent?.getDesktopStatus?.())?.access);
-  let stoppingForUpdate = false;
+  const sameAccess = (left, right) => accessScope(left) === accessScope(right) && left?.state === right?.state;
+  const readAccess = async () => agent?.getDesktopAccess
+    ? agent.getDesktopAccess() : (await agent?.getDesktopStatus?.())?.access;
+  const accessSnapshot = async () => {
+    await setAccessSnapshot(agent?.getDesktopAccess ? agent.getDesktopAccess() : await readAccess());
+    // Cleanup can yield while the account changes. Never return that obsolete
+    // access, or reapply it after another caller installed the new scope.
+    if (agent?.getDesktopAccess && !sameAccess(currentAccess, agent.getDesktopAccess())) return accessSnapshot();
+    return currentAccess;
+  };
+  const acceptStatusAccess = async sampledAccess => {
+    // Validate before setAccessSnapshot: it clears the catalog/statistics and
+    // revokes continuations, so rejecting only the emitted frame is too late.
+    const before = agent?.getDesktopAccess ? agent.getDesktopAccess() : await readAccess();
+    if (!sameAccess(sampledAccess, before)) return false;
+    await setAccessSnapshot(sampledAccess);
+    const latestAccess = agent?.getDesktopAccess ? agent.getDesktopAccess() : await readAccess();
+    if (!sameAccess(sampledAccess, latestAccess)) {
+      await accessSnapshot();
+      return false;
+    }
+    return sameAccess(currentAccess, sampledAccess);
+  };
+  let stoppingForUpdate = false, updateOperation = null, updateOperationKind = null, updateDrain = null, releaseUpdateHold = null;
   let unfinishedDesktopWork = true;
+  const runningUpdateDeliveryTask = record => record.run && ['active', 'auto_resuming', 'recovery_required'].includes(record.run.state);
+  const stopUpdateDeliveryTasks = async () => {
+    const records = await recordReader.list();
+    const results = await Promise.allSettled(records.map(async record => {
+      if (record.autoContinue === true) await (dependencies.setSessionAutoContinue || setSessionAutoContinue)({ root: deliveryRoot, provider: record.provider, session: record.session, enabled: false });
+      if (record.run && !TERMINAL.has(record.run.state)) await controlDelivery({
+        root: deliveryRoot, provider: record.provider, session: record.session,
+        taskId: record.run.managed?.taskId, action: 'stop',
+      });
+    }));
+    const failure = results.find(result => result.status === 'rejected');
+    if (failure) throw failure.reason;
+  };
+  const localCliApiSession = () => dependencies.getLocalCliApiSession?.() || agent?.getLocalCliApiSession?.() || null;
+  const nativeReportsApi = (fixedSession = null) => (dependencies.createNativeDevelopmentReportsApi || createNativeDevelopmentReportsApi)({
+    webOrigin,
+    readSession: async () => fixedSession || localCliApiSession(),
+    fetchImpl: dependencies.fetch || globalThis.fetch,
+  });
+  const refreshNativeDevelopmentReports = async ({ force = false } = {}) => {
+    if (!desktopAccessReady(currentAccess)) return nativeDevelopmentReports;
+    if (nativeDevelopmentReportsMutation) return nativeDevelopmentReports;
+    const requestedScope = accessScope(currentAccess);
+    if (!force && nativeDevelopmentReportsScope === requestedScope && nativeDevelopmentReports.state === 'ready') return nativeDevelopmentReports;
+    if (!force && Date.now() < nativeDevelopmentReportsRetryAt) return nativeDevelopmentReports;
+    if (nativeDevelopmentReportsRequest?.scope === requestedScope) return nativeDevelopmentReportsRequest.promise;
+    nativeDevelopmentReports = { state: 'loading', enrollments: nativeDevelopmentReportsScope === requestedScope ? nativeDevelopmentReports.enrollments : [] };
+    nativeDevelopmentReportsScope = requestedScope;
+    const generation = nativeDevelopmentReportsGeneration;
+    const job = { scope: requestedScope, generation, promise: null };
+    job.promise = nativeReportsApi().list().then(enrollments => {
+      if (accessScope(currentAccess) === requestedScope && nativeDevelopmentReportsGeneration === generation) {
+        nativeDevelopmentReports = { state: 'ready', enrollments };
+        nativeDevelopmentReportsRetryAt = 0;
+      }
+      return nativeDevelopmentReports;
+    }).catch(() => {
+      if (accessScope(currentAccess) === requestedScope && nativeDevelopmentReportsGeneration === generation) {
+        nativeDevelopmentReports = { state: 'unavailable', enrollments: [] };
+        nativeDevelopmentReportsRetryAt = Date.now() + 30_000;
+      }
+      return nativeDevelopmentReports;
+    }).finally(() => {
+      if (nativeDevelopmentReportsRequest === job) nativeDevelopmentReportsRequest = null;
+      if (!closed && !relay) void publish().catch(() => {});
+    });
+    nativeDevelopmentReportsRequest = job;
+    return job.promise;
+  };
+  const submitNativeDevelopmentReportCompletions = ({ records, scope, deviceSession }) => {
+    if (!deviceSession?.token || !deviceSession?.api_base_url || nativeDevelopmentReports.state !== "ready" || nativeDevelopmentReportsScope !== scope) return;
+    const generation = nativeDevelopmentReportsGeneration;
+    for (const enrollment of nativeDevelopmentReports.enrollments) {
+      if (enrollment.provider !== "codex" || enrollment.enabled !== true) continue;
+      const record = records.find(item => item.provider === enrollment.provider && item.session?.toLowerCase() === enrollment.provider_session_id?.toLowerCase());
+      const completion = projectNativeDevelopmentReportCompletion({ enrollment, record });
+      if (!completion) continue;
+      const key = [scope, completion.provider, completion.provider_session_id, completion.task_id, completion.enrollment_revision, completion.managed_revision, completion.acceptance_digest].join(":");
+      // A terminal response is tied to the consent identity, rather than a
+      // particular proof revision: a new consent revision is required before
+      // the desktop may offer that server a different attestation.
+      const rejectionKey = [scope, completion.provider, completion.provider_session_id, completion.task_id, completion.enrollment_revision].join(":");
+      if (nativeCompletionSuccess.has(key) || nativeCompletionRejected.has(rejectionKey) || nativeCompletionInFlight.has(key) || Date.now() < (nativeCompletionRetryAt.get(key) || 0)) continue;
+      const job = Promise.resolve().then(async () => {
+        if (closed || relay || nativeDevelopmentReportsGeneration !== generation || accessScope(currentAccess) !== scope) return null;
+        const receipt = await sendNativeDevelopmentReportCompletion({ api: nativeReportsApi(deviceSession), enrollment, record });
+        if (receipt && nativeDevelopmentReportsGeneration === generation && accessScope(currentAccess) === scope) {
+          nativeCompletionSuccess.add(key);
+          nativeCompletionRetryAt.delete(key);
+        }
+        return receipt;
+      }).catch(error => {
+        if (nativeDevelopmentReportsGeneration === generation && accessScope(currentAccess) === scope) {
+          // These are immutable authorization/contract rejections. A new
+          // enrollment revision or scope produces a fresh rejection identity.
+          if ([400, 403, 409].includes(error?.status)) nativeCompletionRejected.add(rejectionKey);
+          else nativeCompletionRetryAt.set(key, Date.now() + 30_000);
+        }
+        return null;
+      }).finally(() => nativeCompletionInFlight.delete(key));
+      nativeCompletionInFlight.set(key, job);
+    }
+  };
   let organizationAnalysesSuspended = false;
   let organizationAnalysisDrain = Promise.resolve();
   let organizationAnalysisEpoch = 0;
@@ -131,15 +306,19 @@ export async function startDesktopHost({ input = process.stdin, output = process
     if (expectedScope !== undefined && expectedScope !== scope) throw Object.assign(new Error("Desktop account or organization changed."), { code: "desktop_access_required" });
     return scope;
   };
-  const selectedScopes = new WeakMap();
+  const selectedScopes = new WeakMap(), selectedLinkEpochs = new WeakMap();
   const guardedEnroll = async options => {
-    await authorizeWork();
+    await authorizeProvider(options.provider);
     return (dependencies.continueSession || continueSession)(options);
   };
 
   const deadlines = createActionDeadlineService({ root: join(root, "action-deadlines") });
   const managedSupervisor = (dependencies.createManagedSupervisor || createManagedSupervisor)({ root: join(root, "delivery-hooks"),
-    authorizeDispatch: authorizeWork, readRecords: () => recordReader.list(),
+    authorizeDispatch: async record => {
+      const scope = await authorizeWork();
+      const link = await requireProviderLink({ root: deliveryRoot, provider: record.provider });
+      return JSON.stringify([scope, link.epoch]);
+    }, readRecords: () => recordReader.list(),
     beforeClaim: record => actionAssociations.prepareCached?.(record) || record });
   let shuttingDown = null;
   let commands;
@@ -155,6 +334,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   let confirmedUpdateStop;
   const stopWorkForUpdate = () => confirmedUpdateStop ||= (async () => {
     stoppingForUpdate = true; discoveryStopped = true;
+    activeStatisticsRead?.controller.abort();
     void stopDiscovery();
     await stopDesktopWorkForUpdate({
       stopWork: () => Promise.all([
@@ -183,7 +363,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     if (!sessionRefresh && (force || Date.now() - sessionRefreshedAt >= 15_000)) {
       const requestedScope = accessScope(currentAccess);
       const controller = discoveryController = new AbortController();
-      sessionRefresh = Promise.resolve().then(() => { if (controller.signal.aborted) return null; return (dependencies.discoverSessions || discoverSessions)({ root: deliveryRoot, signal: controller.signal }); })
+      sessionRefresh = Promise.resolve().then(() => { if (controller.signal.aborted) return null; return (dependencies.discoverSessions || discoverSessions)({ root: deliveryRoot, signal: controller.signal, connectedProviders: PROVIDER_LINKS.filter(provider => providerLinks[provider].connected) }); })
         .then(async value => {
           if (closed || relay || controller.signal.aborted) return;
           const latestAccess = await accessSnapshot();
@@ -193,7 +373,10 @@ export async function startDesktopHost({ input = process.stdin, output = process
             sessionRefreshAgain = desktopAccessReady(latestAccess);
             return;
           }
-          await analysisManager.update(value.sessions); sessionStatus = { ...value, initialLoading: false }; sessionRefreshedAt = Date.now(); })
+          const sessions = linkedSessions(value.sessions);
+          await analysisManager.update(analysisSessions(sessions));
+          if (controller.signal.aborted) return;
+          sessionStatus = { ...value, sessions, initialLoading: false }; sessionRefreshedAt = Date.now(); })
         .catch(() => { if (closed || relay || controller.signal.aborted) return; sessionStatus = { ...sessionStatus, initialLoading: false, providers: { codex: { discovery: "unavailable", reason: "Conversation discovery unavailable." }, claude: { discovery: "unavailable", reason: "Conversation discovery unavailable." } } }; sessionRefreshedAt = Date.now(); })
         .finally(() => { if (discoveryController === controller) discoveryController = null; sessionRefresh = null; if (sessionRefreshAgain && !closed && !relay) { sessionRefreshAgain = false; refreshSessions(true); }
           if (!closed) setImmediate(() => { void publish().catch(() => {}); }); });
@@ -202,6 +385,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   };
   const selectedSession = async (command, { reuseDiscovery = false, preferObserved = false } = {}) => {
     const scope = await authorizeWork();
+    const link = await requireProviderLink({ root: deliveryRoot, provider: command.provider });
     // Preference changes may use the observation already displayed by the UI.
     // Execution still takes the fresh-discovery path and rechecks opt-in epochs.
     const matches = item => item.provider === command.provider && item.session === command.session;
@@ -216,21 +400,72 @@ export async function startDesktopHost({ input = process.stdin, output = process
       candidate = sessionStatus.sessions.find(matches);
     }
     if (!candidate) throw new Error('This conversation is unavailable; refresh its provider.');
-    await authorizeWork(scope);
+    await authorizeProvider(command.provider, scope, link.epoch);
     const selected = { ...candidate };
     selectedScopes.set(selected, scope);
+    selectedLinkEpochs.set(selected, link.epoch);
     return selected;
   };
+  const revokeProviderConsent = async provider => {
+    const records = (await recordReader.list()).filter(record => record.provider === provider);
+    for (const record of records) {
+      automaticContinuation?.revoke(provider, record.session);
+      await updateRecord(deliveryRoot, provider, record.session, previous => {
+        if (!previous) return previous;
+        const next = { ...previous, autoContinue: false, autoContinueEpoch: randomUUID(), tracked: false, monitor: false };
+        if (previous.run && !TERMINAL.has(previous.run.state)) {
+          next.run = { ...previous.run, state: "paused", reason: "Provider disconnected from SIMY.",
+            revision: (previous.run.revision || 0) + 1, updatedAt: Date.now(),
+            ...(previous.run.managed ? { managed: { ...previous.run.managed, autoRecovery: false } } : {}) };
+        }
+        return next;
+      });
+    }
+  };
+  const changeProviderLink = async (provider, connected) => {
+    if (!PROVIDER_LINKS.includes(provider)) throw new Error("Unsupported SIMY provider connection.");
+    if (providerLinkBusy.has(provider)) throw new Error("SIMY connection is already changing.");
+    providerLinkBusy.add(provider);
+    providerLinkFeedback[provider] = { state: connected ? "connecting" : "disconnecting" };
+    try {
+      providerLinks = await readProviderLinks(root);
+      if (!connected) providerLinks = await writeProviderLink(root, provider, false);
+      if (activeStatisticsRead?.key.startsWith(`${provider}:`)) activeStatisticsRead.controller.abort();
+      discoveryController?.abort();
+      sessionRefreshAgain = false;
+      for (const item of sessionStatus.sessions.filter(item => item.provider === provider)) automaticContinuation?.revoke(provider, item.session);
+      for (const key of explicitAnalyses) if (key.startsWith(`${provider}:`)) explicitAnalyses.delete(key);
+      statisticsCache.clear();
+      if (!connected) sessionStatus = { ...sessionStatus, sessions: linkedSessions(sessionStatus.sessions) };
+      await analysisManager.update(analysisSessions(sessionStatus.sessions));
+      await publish();
+      // A crash after saving disconnected must not restore old session consent
+      // when the user reconnects. Revoke before persisting connected again.
+      if (!connected || !providerLinks[provider].connected) await revokeProviderConsent(provider);
+      if (connected && !providerLinks[provider].connected) {
+        await authorizeWork();
+        providerLinks = await writeProviderLink(root, provider, true);
+      }
+      delete providerLinkFeedback[provider];
+      try { await agent.refreshProviderStatus?.(); }
+      catch { providerLinkFeedback[provider] = { message: "SIMY connection saved. Provider status could not be verified; refresh connections to check it." }; }
+      refreshSessions(true);
+    } catch (error) {
+      providerLinkFeedback[provider] = { state: "error", message: desktopActionError(connected ? "provider_connect" : "provider_disconnect", error) };
+      throw error;
+    } finally { providerLinkBusy.delete(provider); await publish(); }
+  };
   const makeAutomaticContinuation = () => createAutomaticContinuation({ root: join(root, 'delivery-hooks'),
     getManager: () => analysisManager, selectCandidate: selectedSession,
     readSetting: dependencies.readSessionAutoContinue,
     readContext: dependencies.readContinuationContext || readContinuationContext,
-    enroll: guardedEnroll, beforeEnroll: candidate => authorizeWork(selectedScopes.get(candidate)),
+    enroll: guardedEnroll, beforeEnroll: candidate => authorizeProvider(candidate.provider, selectedScopes.get(candidate), selectedLinkEpochs.get(candidate)),
     onChange: () => { if (!closed && !relay) refreshSessions(true); },
   });
   const suspendOrganizationAnalyses = () => {
     organizationAnalysisEpoch++;
     organizationAnalysesSuspended = true;
+    activeStatisticsRead?.controller.abort();
     discoveryStopped = true;
     organizationAnalysisDrain = Promise.all([
       stopDiscovery({ drain: true }), automaticContinuation?.close(), analysisManager?.suspend?.(),
@@ -252,6 +487,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
     refreshSessions(true);
   };
   let pluginSetup = { state: "unknown" };
+  const providerAuth = {};
+  const providerAuthBusy = new Set();
+  let pluginInstallationActive = false, pluginSetupEpoch = 0;
   let providerPlugins = { codex: { state: 'checking' }, claude: { state: 'checking' } };
   let pluginInspection = null, lastPluginInspectionAt = -Infinity;
   let pluginInspectionAbort = new AbortController();
@@ -267,20 +505,40 @@ export async function startDesktopHost({ input = process.stdin, output = process
     return pluginInspection;
   };
   const inspectPlugins = dependencies.inspectPlugins || inspectSqmAgentSkill;
-  const refreshPlugins = async () => {
+  const refreshPlugins = async ({ settleInstall = false } = {}) => {
+    const epoch = pluginSetupEpoch;
+    const canApply = () => epoch === pluginSetupEpoch && (!pluginInstallationActive || settleInstall);
     try {
       const status = await inspectPlugins();
-      pluginSetup = { state: status.installed ? "ready" : "missing", refreshPending: status.installed && pluginSetup.refreshPending === true };
-    } catch { pluginSetup = { state: "error" }; }
+      if (canApply()) pluginSetup = { state: status.installed ? "ready" : "missing", refreshPending: status.installed && pluginSetup.refreshPending === true };
+    } catch { if (canApply()) pluginSetup = { state: "error" }; }
     void refreshProviderPlugins();
   };
+  const decorateProviderSettings = async status => {
+    providerLinks = await readProviderLinks(root);
+    sessionStatus = { ...sessionStatus, sessions: linkedSessions(sessionStatus.sessions) };
+    status.providerLinks = Object.fromEntries(PROVIDER_LINKS.map(provider => [provider, {
+      ...providerLinks[provider], state: providerLinks[provider].connected ? "connected" : "disconnected",
+      ...(providerLinks[provider].settingsError ? { state: "error", message: "SIMY connection settings could not be read. Restore the settings before reconnecting." } : {}),
+      ...providerLinkFeedback[provider], busy: providerLinkBusy.has(provider),
+    }]));
+    status.pluginSetup = { ...pluginSetup };
+    status.providerPlugins = structuredClone(providerPlugins);
+    for (const provider of ["codex", "claude"]) {
+      if (providerAuth[provider]?.state === "awaiting_sign_in" && !providerAuthBusy.has(provider) && status.providers?.[provider]?.state === "ready") delete providerAuth[provider];
+    }
+    status.providerAuth = Object.fromEntries(Object.entries(providerAuth).map(([provider, value]) => [provider, { ...value, busy: providerAuthBusy.has(provider) }]));
+    return JSON.stringify(providerLinks);
+  };
   const packageInfo = dependencies.packageInfo || await readCliPackageInfo();
   diagnostics.write(`desktop starting version=${packageInfo.version} pid=${process.pid} role=${candidate ? "update-candidate" : "supervisor"}`);
   const makeAnalysisManager = () => (dependencies.createAnalysisManager || createContinuationAnalysisManager)({
     root: join(root, 'session-analysis'), analyze: async (...args) => {
       const scope = await authorizeWork();
       const [candidate, options] = args;
-      return (dependencies.analyzeContinuation || analyzeContinuation)(candidate, { ...options, beforeProviderDispatch: () => authorizeWork(scope) });
+      const link = await requireProviderLink({ root: deliveryRoot, provider: candidate.provider });
+      return (dependencies.analyzeContinuation || analyzeContinuation)(candidate, { ...options,
+        beforeProviderDispatch: () => authorizeProvider(candidate.provider, scope, link.epoch) });
     },
     onChange: () => { if (!closed && !relay) setImmediate(() => { void publish().catch(() => {}); }); },
   });
@@ -296,21 +554,76 @@ export async function startDesktopHost({ input = process.stdin, output = process
     return scheduledPublish.promise;
   };
   let lastDeadlineFailureAt = -Infinity;
+  let connectionPublishing = null;
+  let connectionRevision = 0;
+  let latestConnectionStatus = null;
+  // Optional conversation enrichment can wait on local records or remote
+  // metadata. Keep sampling the real connection while that projection waits;
+  // replaying an old frame alone would hide sign-out or organization changes.
+  const publishConnectionStatus = () => {
+    if (connectionPublishing) return connectionPublishing;
+    connectionPublishing = Promise.resolve().then(() => agent.getDesktopStatus()).then(async status => {
+      if (closed || relay) return;
+      const sampledAccess = structuredClone(status.access || { state: 'unavailable', organizationId: null, organizationName: null });
+      if (!await acceptStatusAccess(sampledAccess)) { publishAgain = true; return; }
+      status.access = sampledAccess;
+      const requestedLinks = await decorateProviderSettings(status);
+      const sameScope = desktopAccessReady(currentAccess) &&
+        accessScope(lastStatus?.access) === accessScope(currentAccess);
+      status.deliveryHooks = sameScope && lastStatus?.deliveryHooks
+        ? structuredClone(lastStatus.deliveryHooks) : { runs: [], providers: {} };
+      status.sessionSupervision = sameScope && lastStatus?.sessionSupervision
+        ? structuredClone(lastStatus.sessionSupervision) : { sessions: [], providers: {}, refreshedAt: null, initialLoading: desktopAccessReady(currentAccess) };
+      // Complete fast frames must retain the current saved preference so OFF
+      // remains available while unrelated conversation enrichment is waiting.
+      status.nativeDevelopmentReports = sameScope && nativeDevelopmentReportsScope === accessScope(currentAccess)
+        ? structuredClone(nativeDevelopmentReports) : { state: 'loading', enrollments: [] };
+      // Cached enrichment must follow the current connection preference even
+      // while a full projection is waiting on records or remote metadata.
+      status.deliveryHooks.runs = linkedSessions(status.deliveryHooks.runs || []);
+      status.sessionSupervision.sessions = linkedSessions(status.sessionSupervision.sessions || []);
+      status.sessionSupervision.providers ||= {};
+      for (const provider of PROVIDER_LINKS) {
+        if (!providerLinks[provider].connected) status.sessionSupervision.providers[provider] = { discovery: 'disconnected', reason: null };
+      }
+      const update = status.update || updater.snapshot?.() || {};
+      status.update = { ...update, requires_task_stop: update.requires_task_stop === true || unfinishedDesktopWork ||
+        (status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) > 0 };
+      status.updateActiveTaskCount = Math.max(lastStatus?.updateActiveTaskCount || 0,
+        (status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0));
+      if (!desktopAccessReady(currentAccess)) {
+        status.tasks = { activeCount: status.tasks?.activeCount || 0, items: [] };
+        status.sqmChecks = { activeCount: 0, items: [] };
+        status.sqmTasks = { activeCount: status.sqmTasks?.activeCount || 0, items: [] };
+      }
+      if (JSON.stringify(await readProviderLinks(root)) !== requestedLinks) { publishAgain = true; return; }
+      const latestAccess = agent.getDesktopAccess ? agent.getDesktopAccess() : await accessSnapshot();
+      if (accessScope(latestAccess) !== accessScope(status.access) || latestAccess?.state !== status.access?.state) {
+        publishAgain = true;
+        return;
+      }
+      if (!closed && !relay) { connectionRevision += 1; latestConnectionStatus = structuredClone(status); emitStatus(status); }
+    }).finally(() => { connectionPublishing = null; });
+    return connectionPublishing;
+  };
   const projectStatus = () => {
     if (closed || relay || !agent) return Promise.resolve();
-    if (publishing) { publishAgain = true; return publishing; }
+    if (publishing) { publishAgain = true; return publishConnectionStatus(); }
+    const requestedConnectionRevision = connectionRevision;
     publishing = Promise.resolve(agent.getDesktopStatus()).then(async (status) => {
       if (closed || relay) return;
-      await setAccessSnapshot(status.access);
-      status.access = currentAccess;
+      const sampledAccess = structuredClone(status.access || { state: 'unavailable', organizationId: null, organizationName: null });
+      if (!await acceptStatusAccess(sampledAccess)) { publishAgain = true; return; }
+      status.access = sampledAccess;
       const requestedScope = accessScope(currentAccess);
-      status.pluginSetup = { ...pluginSetup };
-      status.providerPlugins = structuredClone(providerPlugins);
-      const records = await recordReader.list();
+      const requestedLinks = await decorateProviderSettings(status);
+      const allRecords = await recordReader.list();
+      const records = linkedSessions(allRecords);
       const update = status.update || updater.snapshot?.() || {};
-      if (!stoppingForUpdate) unfinishedDesktopWork = hasUnfinishedSessions(records);
+      if (!stoppingForUpdate) unfinishedDesktopWork = hasUnfinishedSessions(allRecords);
       status.update = { ...update, requires_task_stop: update.requires_task_stop === true ||
-        (status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) > 0 || hasUnfinishedSessions(records) };
+        (status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) > 0 || hasUnfinishedSessions(allRecords) };
+      status.updateActiveTaskCount = (status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) + allRecords.filter(runningUpdateDeliveryTask).length;
       if (!desktopAccessReady(currentAccess)) {
         for (const item of sessionStatus.sessions) automaticContinuation?.revoke(item.provider, item.session);
         if (currentAccess.state !== 'checking') await analysisManager.update([]);
@@ -319,10 +632,26 @@ export async function startDesktopHost({ input = process.stdin, output = process
         status.sqmTasks = { activeCount: status.sqmTasks?.activeCount || 0, items: [] };
         status.deliveryHooks = { runs: [], providers: {} };
         status.sessionSupervision = { sessions: [], providers: {}, refreshedAt: null };
+        if (JSON.stringify(await readProviderLinks(root)) !== requestedLinks) { publishAgain = true; return; }
+        if (connectionRevision !== requestedConnectionRevision || !sameAccess(sampledAccess, agent?.getDesktopAccess ? agent.getDesktopAccess() : await readAccess())) { publishAgain = true; return; }
+        status.nativeDevelopmentReports = { state: 'loading', enrollments: [] };
         if (!closed && !relay) emitStatus(status);
         return;
       }
       await analysisManager.updateProviderStatuses?.(status.providers);
+      // Listing only reads rows previously registered by this device/account/org;
+      // it never passes the locally discovered catalog to Web.
+      if (agent.getLocalCliApiSession || dependencies.getLocalCliApiSession) {
+        void refreshNativeDevelopmentReports();
+      }
+      status.nativeDevelopmentReports = structuredClone(nativeDevelopmentReports);
+      // This is an asynchronous local attestation. It neither changes a
+      // Delivery Loop nor places receipt or device data in status frames.
+      submitNativeDevelopmentReportCompletions({
+        records: allRecords,
+        scope: requestedScope,
+        deviceSession: localCliApiSession(),
+      });
       stopNotifier.observe(records);
       const projection = await actionAssociations.beginProjection?.({ records });
       status.deliveryHooks = await (dependencies.deliveryHookStatus || deliveryHookStatus)({ root: deliveryRoot, records: projection?.records || records }).catch(() => ({ error: "Delivery hook status unavailable", providers: {}, runs: [] }));
@@ -333,7 +662,10 @@ export async function startDesktopHost({ input = process.stdin, output = process
       await actionAssociations.decorateSessions?.(sessions, projection);
       const runsBySession = new Map((status.deliveryHooks.runs || []).map(run => [`${run.provider}:${run.session}`, run]));
       for (const session of sessions) {
-        session.statistics = statisticsCache.get(`${session.provider}:${session.session}`) || unavailableStatistics();
+        const key = `${session.provider}:${session.session}`;
+        session.statistics = activeStatisticsRead?.key === key && !activeStatisticsRead.controller.signal.aborted
+          ? { state: 'loading', hours: [], activity: [] }
+          : statisticsCache.get(key) || unavailableStatistics();
         session.sqmActivity = conversationSqmChecks(session, [...(status.sqmChecks?.items || []), ...(status.sqmTasks?.items || [])]);
         session.actionDeadline = { status: 'unavailable', online: false, reminder: null };
         try {
@@ -350,10 +682,22 @@ export async function startDesktopHost({ input = process.stdin, output = process
         const run = runsBySession.get(`${session.provider}:${session.session}`);
         if (run) run.actionDeadline = session.actionDeadline;
       }
-      status.sessionSupervision = { ...discovery, sessions };
+      status.sessionSupervision = { ...discovery, refreshing: Boolean(sessionRefresh), sessions };
       const latestAccess = await accessSnapshot();
-      if (!desktopAccessReady(latestAccess) || accessScope(latestAccess) !== requestedScope ||
+      if (JSON.stringify(await readProviderLinks(root)) !== requestedLinks ||
+        !desktopAccessReady(latestAccess) || accessScope(latestAccess) !== requestedScope ||
         actionAssociations.validateProjection && !await actionAssociations.validateProjection(projection)) { publishAgain = true; return; }
+      if (JSON.stringify(await readProviderLinks(root)) !== requestedLinks) { publishAgain = true; return; }
+      // Validation may wait for synchronization. Recheck access after that
+      // await so a sign-out or scope change cannot publish the old projection.
+      const validatedAccess = agent?.getDesktopAccess ? agent.getDesktopAccess() : await readAccess();
+      if (!sameAccess(sampledAccess, validatedAccess)) { publishAgain = true; return; }
+      if (connectionRevision !== requestedConnectionRevision) {
+        // Keep successfully enriched metadata, but never roll fresh connection
+        // observations back to the status captured before that work began.
+        if (accessScope(latestConnectionStatus?.access) !== requestedScope || !desktopAccessReady(latestConnectionStatus?.access)) { publishAgain = true; return; }
+        status = { ...structuredClone(latestConnectionStatus), deliveryHooks: status.deliveryHooks, sessionSupervision: status.sessionSupervision };
+      }
       if (!closed && !relay) emitStatus(status);
     }).finally(() => { publishing = null; if (publishAgain && !closed) { publishAgain = false; setImmediate(() => { void publish().catch(() => {}); }); } });
     return publishing;
@@ -361,12 +705,13 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const stopAgent = async () => {
     clearInterval(timer);
     pluginInspectionAbort.abort();
+    activeStatisticsRead?.controller.abort();
     discoveryStopped = true;
     encodedStatus = null; lastStatus = null;
     if (scheduledPublish) { clearTimeout(scheduledPublish.timer); scheduledPublish.resolve(); scheduledPublish = null; }
     // Start every cancellation before draining discovery/network work. A hung
     // reader must never postpone cancellation of an owned Provider process.
-    const results = await Promise.allSettled([stopDiscovery({ drain: true }), publishing,
+    const results = await Promise.allSettled([stopDiscovery({ drain: true }), publishing, connectionPublishing,
       pluginInspection,
       actionAssociations.close(), automaticContinuation?.close(), analysisManager?.close(),
       managedSupervisor.close(), recordReader.close(), stopWorkflows(),
@@ -505,6 +850,73 @@ export async function startDesktopHost({ input = process.stdin, output = process
     }, 3_000);
   } catch (error) { await close(); throw error; }
 
+  const drainForUpdate = async ({ releaseHold = true } = {}) => {
+    // Acquire the hold before suspending dispatch: an automatic update may
+    // already have started since the last native status frame.
+    releaseUpdateHold ||= updater.holdApply?.() || (() => {});
+    stoppingForUpdate = true; discoveryStopped = true;
+    activeStatisticsRead?.controller.abort();
+    updateProgress = { state: 'stopping_tasks', available: true, message: 'Stopping running tasks before updating…' };
+    void publish().catch(() => {});
+    // Start every cancellation immediately. A blocked stop/detail command or
+    // discovery request must not postpone cancellation in another worker.
+    updateDrain ||= (async () => {
+      const results = await Promise.allSettled([stopDiscovery(), sessionRefresh,
+        stopUpdateDeliveryTasks(), agent.stopDesktopTasks(), managedSupervisor.close(),
+        automaticContinuation?.close(), analysisManager?.close()]);
+      const failure = results.find(result => result.status === 'rejected');
+      if (failure) throw failure.reason;
+      const status = await agent.getDesktopStatus();
+      if ((status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) > 0 ||
+        (await recordReader.list()).some(record => record.autoContinue === true || record.run && !TERMINAL.has(record.run.state))) throw new Error('Tasks are still running.');
+    })();
+    const draining = updateDrain;
+    void draining.finally(() => { if (updateDrain === draining) updateDrain = null; }).catch(() => {});
+    let timeout, timedOut = false;
+    try {
+      await Promise.race([updateDrain, new Promise((_, reject) => {
+        timeout = setTimeout(() => { timedOut = true; reject(new Error('Task shutdown timed out.')); }, dependencies.updateDrainTimeoutMs ?? dependencies.updateStopTimeoutMs ?? 20_000);
+      })]);
+    } catch {
+      if (timedOut) await (dependencies.stopOwnedHost || stopOwnedDesktopHost)(process.pid, { parentPid: process.ppid, includeRoot: false });
+      // Keep the hold after a timeout: a late lease release must never start
+      // installation after the native UI has reported that shutdown failed.
+      updateProgress = { state: 'update_stop_failed', available: true,
+        message: 'Tasks could not stop. The update has not started. Retry, or reopen SIMY.' };
+      void publish().catch(() => {});
+      throw new Error(updateProgress.message);
+    } finally { clearTimeout(timeout); }
+    unfinishedDesktopWork = false;
+    if (releaseHold) { releaseUpdateHold(); releaseUpdateHold = null; }
+  };
+  const runUpdate = async force => {
+    try {
+      if ((force || stoppingForUpdate) && updater.applyConfirmed) {
+        await updater.applyConfirmed(async () => { await drainForUpdate(); updateProgress = null; });
+        if (updateProgress?.state === 'update_stop_failed') throw new Error(updateProgress.message);
+      } else {
+        if (force || stoppingForUpdate) await drainForUpdate();
+        updateProgress = null;
+        if (updater.snapshot().state === 'waiting_for_idle') await updater.maybeApply();
+        else await updater.performAction();
+      }
+      if (stoppingForUpdate && ['failed', 'error', 'waiting_for_idle'].includes(updater.snapshot().state)) throw new Error('Update did not finish.');
+    } catch (error) {
+      if (!stoppingForUpdate || updateProgress?.state === 'update_stop_failed') throw error;
+      updateProgress = { state: 'update_failed', available: true,
+        message: 'The update could not finish. Tasks remain stopped. Retry, or reopen SIMY.' };
+      throw new Error(updateProgress.message);
+    }
+  };
+  const executeUpdate = (prepareRestart = false) => {
+    const kind = prepareRestart ? 'restart' : 'install';
+    if (updateOperation && updateOperationKind !== kind) throw new Error('Another update operation is in progress. Retry after it finishes.');
+    if (updateOperation) return updateOperation;
+    updateOperationKind = kind;
+    return updateOperation = (prepareRestart ? drainForUpdate({ releaseHold: false }) : runUpdate(true))
+      .finally(() => { updateOperation = null; updateOperationKind = null; });
+  };
+
   let queue = Promise.resolve();
   // Authorization must not wait behind remote refresh/detail/provider work.
   // Keep these commands ordered with each other; the agent still owns all
@@ -528,6 +940,17 @@ export async function startDesktopHost({ input = process.stdin, output = process
       if (!relay.stdin.destroyed && relay.exitCode === null) relay.stdin.write(`${JSON.stringify(command)}\n`);
       return;
     }
+    // Read-only activity must never hold the ordered control queue. Share an
+    // identical pending selection and cancel superseded selections immediately.
+    let statisticsRequest, requestedStatisticsSelection;
+    if (command.action === 'session_statistics') {
+      const key = `${command.provider}:${command.session}`;
+      if (statisticsSelection.key !== key) {
+        statisticsSelection = { key, generation: statisticsSelection.generation + 1 };
+        activeStatisticsRead?.controller.abort();
+      }
+      requestedStatisticsSelection = statisticsSelection;
+    }
     const execute = async () => {
       if (closed) return;
       try {
@@ -559,23 +982,67 @@ export async function startDesktopHost({ input = process.stdin, output = process
           emit({ type: "result", id: command.id, ok: true });
           void publish().catch(() => emit({ type: "error", message: "SIMY status could not be refreshed." })); return;
         }
+        if (action === 'prepare_update_restart' || action === 'update' && (command.force === true || stoppingForUpdate)) {
+          if (action === 'prepare_update_restart' && command.force !== true) {
+            const status = await agent.getDesktopStatus();
+            if ((status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) > 0 ||
+              hasUnfinishedSessions(await recordReader.list())) throw new Error('Confirm before stopping tasks to restart.');
+          }
+          await executeUpdate(action === 'prepare_update_restart');
+          emit({ type: 'result', id: command.id, ok: true });
+          void publish().catch(() => {}); return;
+        }
         const access = await accessSnapshot();
         const commandScope = accessScope(access);
         if (!desktopActionAllowed(access, command)) throw Object.assign(new Error('Desktop access is required.'), { code: 'desktop_access_required' });
         if (desktopAccessReady(access) && !desktopActionAllowed({ state: 'unavailable' }, command)) await authorizeWork();
 
+        let commandProviderLink;
+        if (command.provider && !["provider_connect", "provider_disconnect", "delivery_stop", "delivery_pause", "delivery_reject", "session_untrack", "session_unmonitor"].includes(action) &&
+          !(action === "session_set_auto_continue" && command.enabled === false)) {
+          commandProviderLink = await requireProviderLink({ root: deliveryRoot, provider: command.provider });
+        }
+        if (action === "provider_connect" || action === "provider_disconnect") {
+          await changeProviderLink(command.provider, action === "provider_connect");
+          emit({ type: "result", id: command.id, ok: true });
+          return;
+        }
         if (action === "session_statistics") {
-          const candidate = await selectedSession(command, { preferObserved: true });
-          let statistics;
-          if (dependencies.readSessionStatistics) statistics = await dependencies.readSessionStatistics(candidate);
-          else if (candidate.provider === 'claude') statistics = await readClaudeStatistics(candidate);
-          else {
-            const client = await openCodexAppServer();
-            try { statistics = await readCodexStatistics(client, candidate); } finally { await client.close(); }
-          }
           await authorizeWork(commandScope);
-          statisticsCache.clear(); // Only the selected conversation needs chart data.
-          statisticsCache.set(`${candidate.provider}:${candidate.session}`, statistics);
+          // Authorization can wait for scope cleanup. Only the latest selection
+          // generation may register a reader; an old A cannot revive after A-B-A.
+          if (requestedStatisticsSelection.generation !== statisticsSelection.generation) {
+            throw Object.assign(new Error('Conversation activity request cancelled.'), { code: 'cancelled' });
+          }
+          if (activeStatisticsRead?.key !== requestedStatisticsSelection.key ||
+            activeStatisticsRead.scope !== commandScope || activeStatisticsRead.controller.signal.aborted) {
+            activeStatisticsRead?.controller.abort();
+            activeStatisticsRead = { ...requestedStatisticsSelection, scope: commandScope, controller: new AbortController(), promise: null };
+          }
+          statisticsRequest = activeStatisticsRead;
+          const request = statisticsRequest, signal = request.controller.signal;
+          request.promise ||= withReadCancellation(signal, async () => {
+            const candidate = await selectedSession(command, { preferObserved: true });
+            signal.throwIfAborted();
+            void publish().catch(() => {});
+            let statistics;
+            if (dependencies.readSessionStatistics) statistics = await dependencies.readSessionStatistics(candidate, { signal });
+            else if (candidate.provider === 'claude') statistics = await readClaudeStatistics(candidate, { signal });
+            else {
+              const client = await openCodexAppServer({ signal, cancelOnAbort: true });
+              try { statistics = await readCodexStatistics(client, candidate, { signal }); } finally { await client.close(); }
+            }
+            signal.throwIfAborted();
+            await authorizeProvider(candidate.provider, commandScope, selectedLinkEpochs.get(candidate));
+            signal.throwIfAborted();
+            if (activeStatisticsRead !== request) throw Object.assign(new Error('Conversation activity request cancelled.'), { code: 'cancelled' });
+            statisticsCache.clear(); // Only the selected conversation needs chart data.
+            statisticsCache.set(request.key, statistics);
+          }).finally(() => {
+            if (activeStatisticsRead === request) activeStatisticsRead = null;
+            if (!closed) void publish().catch(() => {});
+          });
+          await request.promise;
           emit({ type: "result", id: command.id, ok: true });
           void publish().catch(() => emit({ type: "error", message: "SIMY status could not be refreshed." })); return;
         }
@@ -633,35 +1100,57 @@ export async function startDesktopHost({ input = process.stdin, output = process
           }
         } else if (action === "check_update") await updater.checkNow();
         else if (action === "update") {
-          if (command.force === true && updater.applyConfirmed) await updater.applyConfirmed(stopWorkForUpdate);
-          else if (command.force === true) { await stopWorkForUpdate(); await updater.performAction(); }
-          else {
-            const status = await agent.getDesktopStatus();
-            if ((status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) > 0 ||
-              updater.snapshot().requires_task_stop === true || hasUnfinishedSessions(await recordReader.list())) throw new Error('Confirm before stopping unfinished tasks.');
-            if (updater.snapshot().state === "waiting_for_idle") await updater.maybeApply();
-            else await updater.performAction();
-          }
-          if (command.force === true && ["failed", "error"].includes(updater.snapshot().state)) throw new Error("Update failed after stopping tasks.");
-        } else if (action === "codex_login" || action === "claude_login") {
-          const provider = action === "claude_login" ? "claude" : "codex";
-          const login = dependencies[`${provider}Login`];
-          if (login) await login(root);
-          else await openProviderLogin(provider, root);
+          const status = await agent.getDesktopStatus();
+          if ((status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) > 0 || updater.snapshot().requires_task_stop === true || hasUnfinishedSessions(await recordReader.list())) throw new Error('Confirm before stopping unfinished tasks.');
+          await runUpdate(false);
+        } else if (/^(codex|claude)_login$/.test(action)) {
+          const [provider] = action.split("_");
+          if (providerAuthBusy.has(provider)) throw new Error("Provider authentication is already running.");
+          providerAuthBusy.add(provider);
+          providerAuth[provider] = { state: "opening" };
+          try {
+            await publish();
+            const custom = dependencies[`${provider}Login`];
+            if (custom) await custom(root);
+            else await openProviderLogin(provider, root);
+            providerAuth[provider] = { state: "awaiting_sign_in" };
+            await publish();
+            // Terminal launch is not authentication success. The existing CLI
+            // probes remain the authority for readiness after the handoff.
+            try { await agent.refreshProviderStatus?.(); }
+            catch {
+              // The Terminal launch already finished. A failed verification
+              // probe must not turn a real Terminal handoff into failure.
+              providerAuth[provider] = { ...providerAuth[provider], statusRefreshFailed: true,
+                message: "Provider sign-in status could not be verified. Refresh connections to check it." };
+            }
+            refreshSessions(true);
+          } catch (error) {
+            providerAuth[provider] = { state: "error", message: desktopActionError(action, error) };
+            await publish();
+            throw error;
+          } finally { providerAuthBusy.delete(provider); await publish(); }
         }
         else if (action === "install_plugins") {
+          pluginInstallationActive = true; pluginSetupEpoch++;
           pluginSetup = { state: "installing" };
-          await publish();
           try {
-            const result = await (dependencies.installPlugins || syncInstalledWorkflows)({ installMissing: true });
-            if (result.outcome === "busy") throw new Error("Plugin installation is busy.");
-            await refreshPlugins();
+            await publish();
+            const result = await (dependencies.installPlugins || syncInstalledWorkflows)({ installMissing: true, lockWaitMs: 30_000 });
+            if (result.outcome === "busy") throw Object.assign(new Error("Plugin installation is busy."), { code: "plugin_setup_busy" });
+            await refreshPlugins({ settleInstall: true });
             if (pluginSetup.state !== "ready") throw new Error("Plugin files could not be verified.");
             pluginSetup.refreshPending = result.refreshPending === true;
-          } catch {
-            pluginSetup = { state: "error" };
+          } catch (error) {
+            // A cache refresh or lock conflict does not undo prepared files.
+            // Keep the result aligned with the source verification shown to users.
+            await refreshPlugins({ settleInstall: true });
+            if (pluginSetup.state === "ready") pluginSetup.refreshPending = true;
+            else pluginSetup = { state: error?.code === "plugin_setup_busy" ? "waiting" : "error" };
             await publish();
-            throw new Error("Plugin setup failed.");
+            if (pluginSetup.state !== "ready") throw error;
+          } finally {
+            pluginInstallationActive = false; pluginSetupEpoch++;
           }
         }
         else if (action === "codex_hooks" || action === "claude_hooks") {
@@ -679,13 +1168,20 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await actionAssociations.correct(command, analysisManager.project(candidate));
         } else if (action === "session_set_auto_continue") {
           if (typeof command.enabled !== 'boolean') throw new Error('Choose whether automatic continuation is enabled.');
+          let admission, providerEpoch;
           if (command.enabled) {
             const candidate = await selectedSession(command, { preferObserved: true });
-            if (candidate.capabilities?.canAutoContinue !== true) throw new Error('Automatic continuation is unavailable for this conversation.');
+            const canEnable = candidate.autoContinueAvailability?.canEnable ?? candidate.capabilities?.canAutoContinue;
+            if (canEnable !== true) {
+              throw new AutoContinueUnavailableError({ reason: candidate.autoContinueAvailability?.reason || candidate.reason,
+                reasonCode: candidate.autoContinueAvailability?.reasonCode || candidate.continuationReasonCode });
+            }
+            admission = candidate.continuationAdmission;
+            providerEpoch = selectedLinkEpochs.get(candidate);
           }
           if (command.enabled) await authorizeWork(commandScope);
           await (dependencies.setSessionAutoContinue || setSessionAutoContinue)({ root: join(root, 'delivery-hooks'),
-            provider: command.provider, session: command.session, enabled: command.enabled, continuationPolicy: command.continuationPolicy });
+            provider: command.provider, session: command.session, enabled: command.enabled, continuationPolicy: command.continuationPolicy, admission, expectedProviderEpoch: providerEpoch });
           if (!command.enabled) automaticContinuation.revoke(command.provider, command.session);
           // Acknowledge the durable preference before discovery or analysis.
           emit({ type: "result", id: command.id, ok: true });
@@ -694,6 +1190,92 @@ export async function startDesktopHost({ input = process.stdin, output = process
           // forced request could invalidate a concurrent manual recommendation.
           void publish().catch(() => {});
           return;
+        } else if (action === "session_set_email_reports") {
+          if (typeof command.enabled !== 'boolean') throw new Error('Choose whether development report emails are enabled.');
+          if (command.enabled) {
+            if (command.provider !== 'codex') throw new Error('Development report email is not available for this provider yet.');
+            // Initial consent binds only to a currently observed local session.
+            // The title remains caller-provided; the host never reads transcript
+            // content to populate it.
+            await selectedSession(command, { preferObserved: true });
+          }
+          if (command.enabled) await authorizeWork(commandScope);
+          // Validate before the recovery path: an invalid local command is not
+          // an ambiguous remote write and must never be accepted from a list.
+          const request = normalizeNativeDevelopmentReportSave({
+            provider: command.provider,
+            provider_session_id: command.session,
+            request_title: command.requestTitle,
+            enabled: command.enabled,
+            expected_revision: command.expectedRevision,
+          });
+          const deviceSession = localCliApiSession();
+          if (!deviceSession) throw new Error('SIMY desktop sign-in is required.');
+          // Keep the credential tuple fixed across PUT and its readback. A
+          // changed account/device scope must fail instead of confirming one
+          // user’s write with another user’s registry.
+          const reportsApi = nativeReportsApi(deviceSession);
+          const sameIdentity = enrollment => enrollment.provider === request.provider &&
+            enrollment.provider_session_id === String(request.provider_session_id || '').toLowerCase();
+          const matchesSaved = enrollment => sameIdentity(enrollment) && enrollment.enabled === request.enabled &&
+            (!request.enabled || enrollment.request_title === String(request.request_title || '').trim());
+          const confirmed = enrollments => request.enabled
+            ? enrollments.some(matchesSaved)
+            : !enrollments.some(sameIdentity) || enrollments.some(matchesSaved);
+          const mutationGeneration = ++nativeDevelopmentReportsGeneration;
+          nativeDevelopmentReportsMutation = true;
+          let recoveredCurrent = false;
+          const invalidateMutation = () => {
+            if (nativeDevelopmentReportsGeneration !== mutationGeneration || accessScope(currentAccess) !== commandScope) return;
+            nativeDevelopmentReports = { state: 'unavailable', enrollments: [] };
+            nativeDevelopmentReportsRetryAt = Date.now() + 30_000;
+          };
+          try {
+            try {
+              await reportsApi.save(request);
+            } catch (error) {
+            // The server may have committed before a connection failure. Read
+            // back the device-scoped registry before reporting an error.
+            const recovered = await reportsApi.list().catch(() => null);
+            if (!recovered) {
+              invalidateMutation();
+              throw error;
+            }
+            // A conflict contains useful current revision state. Publish it so
+            // the next explicit choice starts from the server's revision.
+            if (nativeDevelopmentReportsGeneration === mutationGeneration && accessScope(currentAccess) === commandScope) {
+              nativeDevelopmentReports = { state: 'ready', enrollments: recovered };
+              nativeDevelopmentReportsRetryAt = 0;
+              recoveredCurrent = true;
+            }
+              if (!confirmed(recovered)) throw error;
+            }
+            const enrollments = await reportsApi.list();
+            if (!confirmed(enrollments)) throw new Error('Development report email settings could not be confirmed.');
+            if (command.enabled) await authorizeWork(commandScope);
+            const currentDeviceSession = localCliApiSession();
+            if (!currentDeviceSession || currentDeviceSession.token !== deviceSession.token || currentDeviceSession.api_base_url !== deviceSession.api_base_url) {
+              throw Object.assign(new Error('Desktop account or organization changed.'), { code: 'desktop_access_required' });
+            }
+            if (nativeDevelopmentReportsGeneration !== mutationGeneration) throw new Error('Development report email settings changed; refresh and try again.');
+            nativeDevelopmentReportsScope = accessScope(currentAccess);
+            nativeDevelopmentReports = { state: 'ready', enrollments };
+            nativeDevelopmentReportsRetryAt = 0;
+            // Fence a GET that was in flight before this completed mutation.
+            nativeDevelopmentReportsGeneration++;
+            emit({ type: "result", id: command.id, ok: true });
+            void publish().catch(() => {});
+            return;
+          } catch (error) {
+            // A completed PUT without a confirmable readback must not leave a
+            // prior ready revision cached forever. Preserve a 409 readback,
+            // which is itself the current server state.
+            if (!recoveredCurrent) invalidateMutation();
+            throw error;
+          } finally {
+            nativeDevelopmentReportsMutation = false;
+            if (!closed && !relay) void publish().catch(() => {});
+          }
         } else if (action === "session_deadline_decide") {
           if (command.cancel === true) { emit({ type: "result", id: command.id, ok: true }); return; }
           const candidate = await selectedSession(command);
@@ -711,19 +1293,20 @@ export async function startDesktopHost({ input = process.stdin, output = process
           if (candidate.capabilities?.canMonitor !== true) throw new Error('Tracking is unavailable for this conversation.');
           await authorizeWork(commandScope);
           await (dependencies.trackSession || trackSession)({ root: join(root, "delivery-hooks"), provider: command.provider,
-            session: command.session, tracked: action === "session_track" });
+            session: command.session, tracked: action === "session_track", expectedProviderEpoch: selectedLinkEpochs.get(candidate) });
           await refreshSessions(true);
         } else if (action === "session_monitor" || action === "session_unmonitor") {
           await (dependencies.monitorSession || monitorSession)({ root: join(root, "delivery-hooks"), provider: command.provider,
-            session: command.session, monitor: action === "session_monitor" });
+            session: command.session, monitor: action === "session_monitor", expectedProviderEpoch: commandProviderLink?.epoch });
           await refreshSessions(true);
         } else if (action === "session_enroll") {
           await (dependencies.enrollSession || enrollSession)({ root: join(root, "delivery-hooks"), provider: command.provider,
             session: command.session, objective: command.objective, acceptanceCriteria: command.acceptanceCriteria,
-            autonomyPolicy: command.autonomyPolicy, maxFailures: command.maxFailures, maxNoProgressMinutes: command.maxNoProgressMinutes, continuationPolicy: command.continuationPolicy });
+            autonomyPolicy: command.autonomyPolicy, maxFailures: command.maxFailures, maxNoProgressMinutes: command.maxNoProgressMinutes, continuationPolicy: command.continuationPolicy, expectedProviderEpoch: commandProviderLink?.epoch });
           await refreshSessions(true);
         } else if (action === "session_analyze") {
           const candidate = await selectedSession(command, { reuseDiscovery: true });
+          explicitAnalyses.add(`${candidate.provider}:${candidate.session}`);
           await analysisManager.request(candidate, { requestId: command.analysisRequestId || command.id });
           if (candidate.autoContinue === true && candidate.capabilities?.canContinue === true) automaticContinuation.retry(candidate.provider, candidate.session);
         } else if (action === "session_continue") {
@@ -731,7 +1314,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           const manager = analysisManager;
           await continueAnalyzedSession({ root: join(root, 'delivery-hooks'), candidate, manager,
             readContext: dependencies.readContinuationContext || readContinuationContext,
-            enroll: async options => { await authorizeWork(commandScope); return guardedEnroll(options); }, beforeEnroll: () => authorizeWork(commandScope),
+            enroll: async options => { await authorizeProvider(candidate.provider, commandScope, selectedLinkEpochs.get(candidate)); return guardedEnroll(options); }, beforeEnroll: () => authorizeProvider(candidate.provider, commandScope, selectedLinkEpochs.get(candidate)),
             settings: { autonomyPolicy: command.autonomyPolicy, maxFailures: command.maxFailures,
               maxNoProgressMinutes: command.maxNoProgressMinutes, continuationPolicy: command.continuationPolicy } });
           await refreshSessions(true);
@@ -744,18 +1327,30 @@ export async function startDesktopHost({ input = process.stdin, output = process
         emit({ type: "result", id: command.id, ok: true });
         await publish();
       } catch (error) {
-        emit({ type: "result", id: command.id, ok: false, message: command.action === "update" && stoppingForUpdate ? "Could not finish the update after stopping tasks. Reopen SIMY and retry the update." : desktopActionError(command.action, error) });
+        emit({ type: "result", id: command.id, ok: false, ...(error?.code === 'cancelled' || statisticsRequest?.controller.signal.aborted ? { code: 'cancelled' } : {}), message: ["update", "prepare_update_restart"].includes(command.action) && updateProgress ? updateProgress.message : desktopActionError(command.action, error) });
+      } finally {
+        // Access rejection can happen before the shared reader is constructed.
+        if (statisticsRequest && !statisticsRequest.promise && activeStatisticsRead === statisticsRequest) {
+          activeStatisticsRead = null;
+          if (!closed) void publish().catch(() => {});
+        }
       }
     };
-    if (command.action === "quit" || command.action === "update" && command.force === true) {
+    if (command.action === "quit" || command.action === "prepare_update_restart" || command.action === "update" && (command.force === true || stoppingForUpdate)) {
       void execute();
     } else if (["login", "organization_select", "organization_cancel", "authorization_open"].includes(command.action)) {
       authorizationQueue = authorizationQueue.then(execute).catch(() => {});
+    } else if (/^(codex|claude)_login$/.test(command.action || "") || ["provider_connect", "provider_disconnect"].includes(command.action)) {
+      // Opening an auth terminal must not wait for an unrelated provider turn.
+      // Per-provider busy guards prevent overlapping connection changes.
+      void execute();
     } else if (command.action === "my_ai_session") {
       myAiSessionQueue = myAiSessionQueue.then(execute).catch(() => {});
-    } else if (command.action === "session_set_auto_continue") {
+    } else if (["session_set_auto_continue", "session_set_email_reports"].includes(command.action)) {
       preferenceQueue = preferenceQueue.then(execute).catch(() => {});
-    } else if (["task_stop", "delivery_stop"].includes(command.action) || command.action === "update" && command.force === true) {
+    } else if (command.action === 'session_statistics') {
+      void execute();
+    } else if (["task_stop", "delivery_stop"].includes(command.action)) {
       controlQueue = controlQueue.then(execute).catch(() => {});
     } else {
       queue = queue.then(async () => {
@@ -776,6 +1371,7 @@ function associationActionError(error) {
 }
 
 function sessionActionError(error) {
+  if (error instanceof AutoContinueUnavailableError) return error.message.replace(/[\r\n\x00-\x1f]/g, ' ').slice(0, 600);
   const message = String(error?.message || "");
   if (/already has a Delivery Loop|budgets cannot be reset/i.test(message)) return "This conversation already has a task. Open its existing supervision instead.";
   if (/model.*unavailable|did not expose.*model/i.test(message)) return "This provider did not expose the conversation model; automatic continuation is unavailable.";
@@ -815,7 +1411,7 @@ export async function openProviderLogin(provider, root, {
 } = {}) {
   if (provider !== "codex" && provider !== "claude") throw new Error("Unsupported provider.");
   const executable = await inspectExecutable(provider);
-  if (!executable.available || !executable.executable) throw new Error("Provider is not installed.");
+  if (!executable.available || !executable.executable) throw Object.assign(new Error("Provider is not installed."), { code: "provider_not_installed" });
   const label = provider === "claude" ? "Claude Code" : "Codex";
   const args = provider === "claude" ? ["auth", "login"] : ["login"];
   if (platform === "win32") {
@@ -828,7 +1424,7 @@ export async function openProviderLogin(provider, root, {
   const directory = await mkdtemp(join(root, `${provider}-login-`));
   const script = join(directory, `Sign in to ${label}.command`);
   const quote = (s) => `'${s.replaceAll("'", "'\\''")}'`;
-  await writeFile(script, `#!/bin/bash\nexport PATH=${quote(env.PATH || "/usr/bin:/bin")}\n${quote(executable.executable)} ${args.join(" ")}\nresult=$?\nrm -f -- ${quote(script)}\nrmdir -- ${quote(directory)}\nexit "$result"\n`, { mode: 0o700 });
+  await writeFile(script, `#!/bin/bash\nexport PATH=${quote(env.PATH || "/usr/bin:/bin")}\n${quote(executable.executable)} ${args.join(" ")}\nresult=$?\nif [ "$result" -ne 0 ]; then\n  echo "Sign-in failed. Check the error above, then press Return to close."\n  read -r _\nfi\nrm -f -- ${quote(script)}\nrmdir -- ${quote(directory)}\nexit "$result"\n`, { mode: 0o700 });
   await chmod(script, 0o700);
   try { await execFileImpl("/usr/bin/open", ["-a", "Terminal", script], { timeout: 10_000 }); }
   catch (error) { await rm(directory, { recursive: true, force: true }); throw error; }