@awak-app/simy-cli 0.6.16 → 0.6.18

package/src/orchestrator/loop.js

@@ -28,6 +28,10 @@ async function runCodingLoopOwned({
   shouldStop = () => false,
   consumeHumanGuidance = () => "",
 }) {
+  if (resume && snapshot.attempts.at(-1)?.ci_review_refresh_pending) {
+    return recheckPrReadinessOwned({ snapshot, collectEvidence, checkSqm, executeIndependentAudit,
+      shouldStop, onUpdate, retryCiReview: true });
+  }
   if (!resume && snapshot.attempts.length > 0 && !snapshot.metadata?.completed_worker_result) {
     return recheckPrReadinessOwned({ snapshot, collectEvidence, checkSqm, onUpdate });
   }
@@ -263,39 +267,7 @@ async function runCodingLoopOwned({
     });
     await publish(snapshot, "independent_auditing", onUpdate);
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
-    const auditInstruction = buildIndependentAuditInstruction(snapshot.charter, attempt);
-    const reviewedMatrix = attempt.observed_evidence?.minimum_completion?.matrix_sha256;
-    const reviewedEvidenceIdentity = independentAuditEvidenceIdentity(attempt);
-    const reviewedObjectiveDigest = snapshot.charter.thread_state?.objective_contract?.current_digest;
-    const reviewedObjectiveVersion = snapshot.charter.thread_state?.objective_contract?.version;
-    const auditExecution = await safeExecution(() =>
-      executeIndependentAudit({
-        attemptNumber,
-        backend: snapshot.charter.audit_backend,
-        instruction: auditInstruction,
-        charter: snapshot.charter,
-        attempt,
-      }),
-    );
-    if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
-    attempt.independent_audit = buildIndependentAudit(
-      auditExecution,
-      snapshot.charter,
-      attempt,
-    );
-    attempt.token_usage = mergeTokenUsage(attempt.token_usage, auditExecution.tokenUsage);
-    attempt.budget = refreshBudgetState(snapshot);
-    recordBudgetWarnings(snapshot, attempt);
-    if (attempt.budget.token_exhausted) {
-      await stopForBudget({ snapshot, attempt, reason: "token_budget_exhausted", onUpdate });
-      return snapshot;
-    }
-
-    attempt.independent_audit.result_parse = normalizeResultParseDiagnostic(auditExecution.result_parse);
-    attempt.independent_audit.minimum_matrix_sha256 = reviewedMatrix;
-    attempt.independent_audit.evidence_identity_sha256 = reviewedEvidenceIdentity;
-    attempt.independent_audit.objective_digest = reviewedObjectiveDigest;
-    attempt.independent_audit.objective_version = reviewedObjectiveVersion;
+    if (await reviewAttempt({ snapshot, attempt, executeIndependentAudit, shouldStop, onUpdate })) return snapshot;
 
     // Re-collect after the read-only auditor to catch any mutated HEAD or working tree.
     attempt.observed_evidence = await safeEvidence(collectEvidence, attempt, { retries: snapshot.metadata?.completed_worker_result ? 2 : 0, shouldStop });
@@ -369,7 +341,63 @@ async function stopCodingLoop(snapshot, onUpdate) {
   return snapshot;
 }
 
-async function recheckPrReadinessOwned({ snapshot, collectEvidence, checkSqm = null, onUpdate }) {
+async function reviewAttempt({ snapshot, attempt, executeIndependentAudit, shouldStop, onUpdate }) {
+  const auditInstruction = buildIndependentAuditInstruction(snapshot.charter, attempt);
+  const reviewedMatrix = attempt.observed_evidence?.minimum_completion?.matrix_sha256;
+  const reviewedEvidenceIdentity = independentAuditEvidenceIdentity(attempt);
+  const reviewedChecks = structuredClone(attempt.observed_evidence?.github?.checks || []);
+  const reviewedObjectiveDigest = snapshot.charter.thread_state?.objective_contract?.current_digest;
+  const reviewedObjectiveVersion = snapshot.charter.thread_state?.objective_contract?.version;
+  const auditExecution = await safeExecution(() =>
+    executeIndependentAudit({
+      attemptNumber: attempt.attempt_number,
+      backend: snapshot.charter.audit_backend,
+      instruction: auditInstruction,
+      charter: snapshot.charter,
+      attempt,
+    }),
+  );
+  if (shouldStop()) { await stopCodingLoop(snapshot, onUpdate); return true; }
+  attempt.independent_audit = buildIndependentAudit(
+    auditExecution,
+    snapshot.charter,
+    attempt,
+  );
+  attempt.token_usage = mergeTokenUsage(attempt.token_usage, auditExecution.tokenUsage);
+  attempt.budget = refreshBudgetState(snapshot);
+  recordBudgetWarnings(snapshot, attempt);
+  if (attempt.budget.token_exhausted) {
+    await stopForBudget({ snapshot, attempt, reason: "token_budget_exhausted", onUpdate });
+    return true;
+  }
+
+  attempt.independent_audit.result_parse = normalizeResultParseDiagnostic(auditExecution.result_parse);
+  attempt.independent_audit.reviewed_checks = reviewedChecks;
+  attempt.independent_audit.minimum_matrix_sha256 = reviewedMatrix;
+  attempt.independent_audit.evidence_identity_sha256 = reviewedEvidenceIdentity;
+  attempt.independent_audit.objective_digest = reviewedObjectiveDigest;
+  attempt.independent_audit.objective_version = reviewedObjectiveVersion;
+  return false;
+}
+
+// Only a CI-only change to the already reviewed candidate may automatically
+// renew its review. Head/base/preparation/acceptance changes need explicit work.
+function ciReviewRefreshIdentity(attempt, previousEvidence) {
+  const reviewed = attempt.independent_audit;
+  const github = attempt.observed_evidence?.github;
+  if (!reviewed?.passed || !reviewed.evidence_identity_sha256 || !github?.available ||
+      !attempt.observed_evidence?.local?.available || !attempt.observed_evidence.local.working_tree_clean ||
+      attempt.observed_evidence.local.errors?.length || github.error || !github.required_checks_present || !github.checks_passing ||
+      !github.checks?.length || github.checks.some(check => check.state !== 'success' && check.state !== 'skipped')) return null;
+  const identity = independentAuditEvidenceIdentity(attempt);
+  if (identity === reviewed.evidence_identity_sha256) return null;
+  const prior = { ...attempt, observed_evidence: { ...attempt.observed_evidence,
+    github: { ...github, checks: reviewed.reviewed_checks || previousEvidence?.github?.checks } } };
+  return independentAuditEvidenceIdentity(prior) === reviewed.evidence_identity_sha256 ? identity : null;
+}
+
+async function recheckPrReadinessOwned({ snapshot, collectEvidence, checkSqm = null, executeIndependentAudit, shouldStop = () => false, onUpdate, retryCiReview = false }) {
+  if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
   if (!verifyObjective(snapshot.charter).valid) {
     snapshot.implementation_gate_passed = false;
     snapshot.done_gate_passed = false;
@@ -391,6 +419,7 @@ async function recheckPrReadinessOwned({ snapshot, collectEvidence, checkSqm = n
       code: "OBJECTIVE_EVIDENCE_STALE", severity: "blocker", target: "objective_contract",
       explanation: "Make a new attempt and independently review evidence against the current objective.", repairability: "manual",
     }]);
+    if (retryCiReview) attempt.ci_review_refresh_pending = false;
     await publish(snapshot, "waiting_human", onUpdate);
     return snapshot;
   }
@@ -398,16 +427,72 @@ async function recheckPrReadinessOwned({ snapshot, collectEvidence, checkSqm = n
     attempt_number: attempt.attempt_number,
   });
   await publish(snapshot, "checking_pr", onUpdate);
+  const previousEvidence = attempt.observed_evidence;
+  // Recover an old review's CI basis only while the saved full identity still
+  // proves it. Later monitoring observations cannot reconstruct that history.
+  if (!attempt.independent_audit?.reviewed_checks &&
+      attempt.independent_audit?.evidence_identity_sha256 === independentAuditEvidenceIdentity(attempt) &&
+      Array.isArray(previousEvidence?.github?.checks)) {
+    attempt.independent_audit.reviewed_checks = structuredClone(previousEvidence.github.checks);
+  }
   attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+  if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
   attempt.sqm = await safeSqm(checkSqm, attempt, attempt.sqm, "full");
+  if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
+  if (retryCiReview && attempt.observed_evidence?.local?.available && attempt.observed_evidence?.github?.available &&
+      independentAuditEvidenceIdentity(attempt) !== attempt.ci_review_refresh_identity) {
+    attempt.ci_review_refresh_pending = false;
+    snapshot.final_audit = humanGate("The candidate changed while its CI review was interrupted.", [{
+      code: "CI_REVIEW_CANDIDATE_CHANGED", severity: "blocker", target: "independent_audit",
+      explanation: "Reconcile the changed HEAD, base or evidence, then explicitly continue work; the prior review cannot certify this candidate.", repairability: "manual",
+    }]);
+    await publish(snapshot, "waiting_human", onUpdate);
+    return snapshot;
+  }
+  const retryIdentity = retryCiReview && attempt.ci_review_refresh_pending &&
+    independentAuditEvidenceIdentity(attempt) === attempt.ci_review_refresh_identity &&
+    attempt.observed_evidence?.local?.available && attempt.observed_evidence.local.working_tree_clean &&
+    !attempt.observed_evidence.local.errors?.length && attempt.observed_evidence?.github?.available &&
+    !attempt.observed_evidence.github.error && attempt.observed_evidence.github.checks_passing &&
+    attempt.observed_evidence.github.required_checks_present ? attempt.ci_review_refresh_identity : null;
+  const refreshIdentity = retryIdentity || ciReviewRefreshIdentity(attempt, previousEvidence);
+  if (executeIndependentAudit && refreshIdentity && (retryIdentity || attempt.ci_review_refresh_identity !== refreshIdentity)) {
+    const budget = canStartProvider(snapshot, { attemptNumber: attempt.attempt_number, phase: "reviewer" });
+    if (!budget.allowed) { await stopForBudget({ snapshot, attempt, reason: budget.reason, onUpdate }); return snapshot; }
+    // Persist before dispatch so an interrupted/failed review cannot repeat on
+    // every monitor tick. Explicit resume retries only this bound review.
+    attempt.ci_review_refresh_identity = refreshIdentity;
+    attempt.ci_review_refresh_pending = true;
+    appendEvent(snapshot, "independent_auditing", "CI completed; refreshing independent review of the same candidate.", {
+      attempt_number: attempt.attempt_number, evidence_identity: refreshIdentity,
+    });
+    await publish(snapshot, "independent_auditing", onUpdate);
+    if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
+    if (await reviewAttempt({ snapshot, attempt, executeIndependentAudit, shouldStop, onUpdate })) return snapshot;
+    if (!attempt.independent_audit.passed &&
+        !attempt.independent_audit.findings.some(finding => finding.code === "INDEPENDENT_AUDIT_UNAVAILABLE")) {
+      // A completed adverse review belongs to the normal repair path. Only
+      // unavailable/interrupted reviews need a reviewer-only retry.
+      attempt.ci_review_refresh_pending = false;
+    }
+    attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+    if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
+    attempt.sqm = await safeSqm(checkSqm, attempt, attempt.sqm, "full");
+    if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
+  }
   attempt.audit = await auditAttempt(snapshot.charter, attempt, {
     previousAttempt: snapshot.attempts.at(-2) ?? null,
     sqm: attempt.sqm,
   });
+  if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
   attempt.outcome_progress = assessOutcomeProgress(
     snapshot.charter, attempt, snapshot.attempts.at(-2) ?? null,
     outcomeOptions(snapshot),
   );
+  if (attempt.ci_review_refresh_pending && attempt.audit.passed && attempt.independent_audit?.passed &&
+      attempt.independent_audit.evidence_identity_sha256 === independentAuditEvidenceIdentity(attempt)) {
+    attempt.ci_review_refresh_pending = false;
+  }
   snapshot.implementation_gate_passed = attempt.audit.passed;
   attempt.pr_readiness = evaluatePrReadiness(snapshot.charter, attempt);
   attempt.pr_gate = attempt.pr_readiness;

package/src/provider-links.js

@@ -0,0 +1,74 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+
+export const PROVIDER_LINKS = Object.freeze(['codex', 'claude']);
+const defaultRoot = () => process.env.SIMY_HOME?.trim() || join(homedir(), '.simy');
+const writeQueues = new Map();
+const defaults = () => Object.fromEntries(PROVIDER_LINKS.map(provider => [provider, { connected: true, epoch: null, requiresConsent: false }]));
+const disconnected = () => Object.fromEntries(PROVIDER_LINKS.map(provider => [provider, { connected: false, epoch: null, requiresConsent: true, settingsError: true }]));
+const validateProvider = provider => { if (!PROVIDER_LINKS.includes(provider)) throw new Error('Unsupported SIMY provider connection.'); };
+
+async function readSettings(root) {
+  let payload;
+  try { payload = JSON.parse(await readFile(join(root, 'provider-links.json'), 'utf8')); }
+  catch (error) { if (error.code === 'ENOENT') return defaults(); throw error; }
+  if (payload?.schemaVersion !== 1 || !payload.providers || PROVIDER_LINKS.some(provider => {
+    const value = payload.providers[provider];
+    return !value || typeof value.connected !== 'boolean' || typeof value.requiresConsent !== 'boolean' ||
+      value.epoch !== null && (typeof value.epoch !== 'string' || !value.epoch || value.epoch.length > 128);
+  })) throw new Error('Invalid SIMY provider connection settings.');
+  return Object.fromEntries(PROVIDER_LINKS.map(provider => [provider, {
+    connected: payload.providers[provider].connected,
+    epoch: payload.providers[provider].epoch,
+    requiresConsent: payload.providers[provider].requiresConsent,
+  }]));
+}
+
+// Existing installations stay linked until the user explicitly disconnects.
+// An unreadable saved preference fails closed instead of restoring revoked consent.
+export async function readProviderLinks(root = defaultRoot()) {
+  try { return await readSettings(root); } catch { return disconnected(); }
+}
+
+export async function providerLinkConnected(root = defaultRoot(), provider) {
+  validateProvider(provider);
+  return (await readProviderLinks(root))[provider].connected;
+}
+
+// Session APIs use a delivery-hooks root, while desktop/agent policy uses SIMY_HOME.
+export async function requireProviderLink({ root = join(defaultRoot(), 'delivery-hooks'), provider, expectedEpoch } = {}) {
+  validateProvider(provider);
+  const link = (await readProviderLinks(dirname(resolve(root))))[provider];
+  if (!link.connected) {
+    throw Object.assign(new Error('Reconnect this provider to SIMY before using it.'), { code: 'provider_link_disconnected' });
+  }
+  if (expectedEpoch !== undefined && expectedEpoch !== link.epoch) {
+    throw Object.assign(new Error('SIMY provider connection changed. Select the conversation again.'), { code: 'provider_link_changed' });
+  }
+  return link;
+}
+
+export function writeProviderLink(root = defaultRoot(), provider, connected) {
+  validateProvider(provider);
+  if (typeof connected !== 'boolean') throw new Error('Choose whether this provider is connected to SIMY.');
+  const key = resolve(root);
+  const previous = writeQueues.get(key) || Promise.resolve();
+  const pending = previous.catch(() => {}).then(async () => {
+    const providers = await readSettings(root);
+    // Reconnection restores discovery only. Session execution consent is cleared
+    // separately and must be selected again, including after a host restart.
+    providers[provider] = { connected, epoch: randomUUID(), requiresConsent: true };
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    const target = join(root, 'provider-links.json'), temporary = `${target}.${randomUUID()}.tmp`;
+    try {
+      await writeFile(temporary, `${JSON.stringify({ schemaVersion: 1, providers })}\n`, { mode: 0o600 });
+      await rename(temporary, target);
+    } finally { await rm(temporary, { force: true }); }
+    return providers;
+  });
+  writeQueues.set(key, pending);
+  void pending.finally(() => { if (writeQueues.get(key) === pending) writeQueues.delete(key); }).catch(() => {});
+  return pending;
+}

package/src/runner.js

@@ -51,7 +51,7 @@ import {
   normalizeWorkflowStartIntent,
 } from "./workflow-observation-sender.js";
 import { saveCodingRunSnapshot } from "./coding-run-store.js";
-import { acquireDesktopProcessLock } from "./desktop-process-lock.js";
+import { acquireDesktopProcessLock, PROCESS_CONFLICT_CODE } from "./desktop-process-lock.js";
 import {
   assertRecoveryActor, completedWorkerResult, recoveryActorBinding, refreshRecoveryAudit, refreshRecoveryBudgetAudit,
 } from "./coding-run-recovery.js";
@@ -924,7 +924,24 @@ async function cleanupLocalAttachments(run) {
   }
 }
 
-export async function recheckLocalCodingRun(run, { collectEvidence } = {}) {
+export async function recheckLocalCodingRun(run, options = {}) {
+  if (!run?.snapshot?.attempts?.length) return run?.snapshot || null;
+  if (!["pr_ready_for_review", "merge_ready"].includes(run.status)) return run.snapshot;
+  if (run.operation || run.child || run.stopRequested) return run.snapshot;
+  const operation = (async () => {
+    assertRecoveryActor(run);
+    const lease = run.localStateRoot ? await acquireDesktopProcessLock(
+      path.join(run.localStateRoot, ".controllers", executionTextSha256(run.id)),
+    ) : null;
+    try { return await recheckLocalCodingRunOwned(run, options); }
+    finally { await lease?.release(); }
+  })();
+  run.operation = operation;
+  try { return await operation; }
+  finally { if (run.operation === operation) run.operation = null; }
+}
+
+async function recheckLocalCodingRunOwned(run, { collectEvidence, executeIndependentAudit, authorizeReview } = {}) {
   if (!run?.snapshot?.attempts?.length) return run?.snapshot || null;
   if (!["pr_ready_for_review", "merge_ready"].includes(run.status)) return run.snapshot;
   const repositoryPath = await resolveRepositoryPath(run.request);
@@ -956,6 +973,15 @@ export async function recheckLocalCodingRun(run, { collectEvidence } = {}) {
   await recheckPrReadiness({
     snapshot: run.snapshot,
     collectEvidence: evidenceCollector,
+    executeIndependentAudit: async context => {
+      await authorizeReview?.();
+      assertRecoveryActor(run);
+      if (run.stopRequested) throw new Error("Review cancelled by the local operator.");
+      return executeIndependentAudit ? executeIndependentAudit(context) : executeProcessAttempt({
+        ...context, repositoryPath, run, marker: "SIMY_AUDIT_JSON:",
+      });
+    },
+    shouldStop: () => run.stopRequested,
     checkSqm: sqmChecker,
     onUpdate: async (snapshot) => {
       run.snapshot = snapshot;
@@ -966,6 +992,8 @@ export async function recheckLocalCodingRun(run, { collectEvidence } = {}) {
 }
 
 export async function markCodingRunMonitorFailure(run, error) {
+  // A losing controller never owns the right to persist its stale snapshot.
+  if (run.stopRequested || run.status === "stopped" || error?.code === PROCESS_CONFLICT_CODE) return run.snapshot;
   const message = error instanceof Error ? error.message : String(error);
   run.snapshot.done_gate_passed = false;
   run.snapshot.final_audit = {
@@ -1026,6 +1054,7 @@ export async function executeProcessAttempt({
     model: phase === "reviewer" ? charter?.audit_model : charter?.model,
     reasoningEffort: phase === "reviewer" ? charter?.audit_reasoning_effort : charter?.reasoning_effort,
   });
+  if (run.stopRequested) throw new Error("Execution cancelled by the local operator.");
   const startedAt = new Date().toISOString();
   const stdout = [];
   const stderr = [];

package/src/session-supervision/automatic-continuation.js

@@ -1,10 +1,27 @@
 import { continueSession, readSessionAutoContinue } from './index.js';
 import { readContinuationContext } from './continuation-analysis.js';
+import { requireProviderLink } from '../provider-links.js';
+
+function continuationFailureReason(error) {
+  // Provider exceptions can contain private paths/output. Only known codes
+  // select actionable UI copy; unrecognized failures retain a safe fallback.
+  const reasons = {
+    desktop_access_required: 'Sign in to an organization with SQM and Developer access before auto-continue can run.',
+    provider_sign_in_required: 'Sign in to the original AI provider, then retry auto-continue.',
+    unavailable: 'The local provider is unavailable. Open or configure it, then retry auto-continue.',
+    unsupported: 'Update the original AI provider to a compatible version, then retry auto-continue.',
+    process_exited: 'The original Claude process has exited. Return to the original conversation, then refresh.',
+    session_ended: 'This Claude session has ended. Return to the original conversation, then refresh.',
+    hook_missing: 'SIMY has not observed the original Claude session-start hook. Check the plugin and hook execution, then refresh.',
+  };
+  return Object.hasOwn(reasons, error?.code) ? reasons[error.code] : 'Could not start auto-continue. Check the original conversation and retry.';
+}
 
 // Shared by explicit Continue and automatic enrollment. Analysis alone never
 // dispatches work: the exact current provider context is checked again here.
 export async function continueAnalyzedSession({ candidate, manager, root, settings = {}, signal,
   readContext = readContinuationContext, enroll = continueSession, beforeEnroll = () => {} }) {
+  const link = await requireProviderLink({ root, provider: candidate.provider, expectedEpoch: settings.expectedProviderEpoch });
   const recommendation = manager.requireRecommendation(candidate);
   if (candidate.isRunning || candidate.capabilities?.canContinue !== true) throw new Error('Automatic continuation is unavailable for this conversation.');
   const context = await readContext(candidate, { signal });
@@ -14,8 +31,10 @@ export async function continueAnalyzedSession({ candidate, manager, root, settin
   }
   manager.requireRecommendation(candidate);
   await beforeEnroll(candidate);
+  await requireProviderLink({ root, provider: candidate.provider, expectedEpoch: link.epoch });
+  manager.requireRecommendation(candidate);
   if (signal?.aborted) throw new Error('Automatic continuation was cancelled before enrollment.');
-  return enroll({ root, provider: candidate.provider, session: candidate.session, ...settings });
+  return enroll({ root, provider: candidate.provider, session: candidate.session, ...settings, expectedProviderEpoch: link.epoch });
 }
 
 // One pending enrollment per identity. A failed attempt is retried only after
@@ -54,6 +73,7 @@ export function createAutomaticContinuation({ root, getManager, selectCandidate,
       errors.delete(key);
       const controller = new AbortController();
       const guard = async () => {
+        await requireProviderLink({ root, provider: candidate.provider });
         const setting = await readSetting({ root, provider: candidate.provider, session: candidate.session });
         if (closed || controller.signal.aborted || !setting.enabled || setting.epoch !== candidate.autoContinueEpoch || setting.hasRun) throw new Error('Automatic continuation was disabled or already enrolled.');
         return setting;
@@ -67,7 +87,7 @@ export function createAutomaticContinuation({ root, getManager, selectCandidate,
           settings: { ...setting.settings, autoContinueEpoch: candidate.autoContinueEpoch } });
       }).catch(error => {
         if (!closed && !controller.signal.aborted && !/disabled|already enrolled|setting changed|conversation changed; wait|needs a current recommendation/i.test(error?.message || '')) {
-          errors.set(key, { epoch: candidate.autoContinueEpoch, reason: 'Could not start auto-continue. Check the original conversation and retry.' });
+          errors.set(key, { epoch: candidate.autoContinueEpoch, reason: continuationFailureReason(error) });
         }
       }).finally(() => { pending.delete(key); if (!closed) onChange(); });
       pending.set(key, { job, controller });
@@ -79,11 +99,20 @@ export function createAutomaticContinuation({ root, getManager, selectCandidate,
       if (!closed && !pending.has(key)) { attempted.delete(key); errors.delete(key); }
     },
     project(candidate) {
+      if (candidate.autoContinue === true && candidate.isRunning !== true &&
+          ['unmanaged', 'monitor'].includes(candidate.binding?.mode || 'unmanaged') && candidate.analysis?.state === 'needs_user') return {
+        ...candidate, autoContinueStatus: 'needs_user', autoContinueReason: candidate.analysis.reason || 'Your decision is needed before automatic continuation can proceed.',
+      };
       const error = errors.get(`${candidate.provider}:${candidate.session}`);
       if (candidate.autoContinue === true && candidate.autoContinueEpoch === error?.epoch && candidate.capabilities?.canContinue === true &&
           !['no_action', 'needs_user', 'waiting', 'uncertain'].includes(candidate.analysis?.state)) return {
         ...candidate, autoContinueStatus: 'error', autoContinueReason: error.reason,
       };
+      if (candidate.autoContinue === true && !candidate.isRunning && candidate.capabilities?.canContinue === true) {
+        const statuses = { no_action: 'finished', needs_user: 'needs_user', waiting: 'waiting', uncertain: 'error', failed: 'error' };
+        const status = statuses[candidate.analysis?.state];
+        if (status && candidate.analysis?.reason) return { ...candidate, autoContinueStatus: status, autoContinueReason: candidate.analysis.reason };
+      }
       return candidate;
     },
     revoke(provider, session) { pending.get(`${provider}:${session}`)?.controller.abort(); },

package/src/session-supervision/claude-sessions.js

@@ -12,7 +12,6 @@ const MAX_PROJECTS = 256;
 const MAX_TRANSCRIPTS = 4096;
 const MAX_PREFIX_BYTES = 256 * 1024;
 const MAX_LINES = 256;
-const MAX_FILE_BYTES = 64 * 1024 * 1024;
 // Metadata is observation only. Exact-session/context readers always open the
 // transcript again; cached values contain no conversation message bodies.
 const metadataCache = new Map();
@@ -99,7 +98,8 @@ async function latestCustomTitle(handle, size, id) {
   return title;
 }
 
-async function inspectTranscript(root, projectName, fileName, observedAt, includeContext = false, cacheMetadata = false, includeStatistics = false) {
+async function inspectTranscript(root, projectName, fileName, observedAt, includeContext = false, cacheMetadata = false, includeStatistics = false, signal) {
+  signal?.throwIfAborted();
   const id = fileName.slice(0, -'.jsonl'.length);
   if (!UUID.test(id)) return null;
   const project = join(root, projectName);
@@ -108,7 +108,7 @@ async function inspectTranscript(root, projectName, fileName, observedAt, includ
   let handle;
   try {
     const before = await lstat(path);
-    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_FILE_BYTES) { metadataCache.delete(path); return null; }
+    if (!before.isFile() || before.isSymbolicLink()) { metadataCache.delete(path); return null; }
     if (!within(root, await realpath(path))) { metadataCache.delete(path); return null; }
     let key;
     if (cacheMetadata) {
@@ -141,10 +141,11 @@ async function inspectTranscript(root, projectName, fileName, observedAt, includ
     }
     if (!metadata) return null;
     const candidate = candidateMetadata(id, metadata, opened.mtimeMs, observedAt);
-    if (includeStatistics) candidate.statistics = await statisticsFromHandle(handle, opened, 'claude', id);
+    signal?.throwIfAborted();
+    if (includeStatistics) candidate.statistics = await statisticsFromHandle(handle, opened, 'claude', id, { signal });
     if (includeContext) candidate.context = await conversationFromHandle(handle, opened, id, metadata.cwd);
     return candidate;
-  } catch { metadataCache.delete(path); return null; }
+  } catch (error) { metadataCache.delete(path); if (signal?.aborted) throw error; return null; }
   finally { await handle?.close(); }
 }
 
@@ -174,7 +175,7 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
         const file = candidates[next++];
         try {
           const info = await lstat(join(project, file.name));
-          if (info.isFile() && !info.isSymbolicLink() && info.size <= MAX_FILE_BYTES)
+          if (info.isFile() && !info.isSymbolicLink())
             descriptors.push({ projectName: entry.name, fileName: file.name,
               session: file.name.slice(0, -'.jsonl'.length), lastActivityAt: info.mtimeMs });
         } catch { /* A disappearing transcript does not stop discovery. */ }
@@ -185,13 +186,20 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
   const selected = session ? descriptors : recentSessionWindow(descriptors, {
     limit: maximum, priority: item => priorities.has(item.session),
   });
-  for (const file of selected.slice(0, MAX_TRANSCRIPTS)) {
-    if (signal?.aborted) return [];
-    const candidate = await inspectTranscript(root, file.projectName, file.fileName, observedAt, includeContext, cacheMetadata, includeStatistics);
-    if (!candidate) continue;
-    const key = `${candidate.session}\0${candidate.cwd}${includeContext || includeStatistics ? `\0${file.projectName}\0${file.fileName}` : ''}`;
-    if (!result.has(key) || candidate.lastActivityAt > result.get(key).lastActivityAt) result.set(key, candidate);
-  }
+  const filesToInspect = selected.slice(0, MAX_TRANSCRIPTS);
+  let nextFile = 0;
+  // Catalog prefixes are bounded independently of full transcript size. Use a
+  // small I/O pool; exact-context/statistics reads stay serial and identity-safe.
+  await Promise.all(Array.from({ length: Math.min(includeContext || includeStatistics ? 1 : 8, filesToInspect.length) }, async () => {
+    while (nextFile < filesToInspect.length && !signal?.aborted) {
+      const file = filesToInspect[nextFile++];
+      const candidate = await inspectTranscript(root, file.projectName, file.fileName, observedAt, includeContext, cacheMetadata, includeStatistics, signal);
+      if (!candidate) continue;
+      const key = `${candidate.session}\0${candidate.cwd}${includeContext || includeStatistics ? `\0${file.projectName}\0${file.fileName}` : ''}`;
+      if (!result.has(key) || candidate.lastActivityAt > result.get(key).lastActivityAt) result.set(key, candidate);
+    }
+  }));
+  if (signal?.aborted) return [];
   const sorted = [...result.values()].sort((a, b) => b.lastActivityAt - a.lastActivityAt || a.session.localeCompare(b.session));
   return session ? sorted : recentSessionWindow(sorted, { limit: maximum, priority: item => priorities.has(item.session) });
 }
@@ -249,8 +257,10 @@ export async function readClaudeConversation(candidate, { home, signal } = {}) {
   return { ...selected[0].context, awaitingTurn: candidate.isRunning === true };
 }
 
-export async function readClaudeStatistics(candidate, { home } = {}) {
+export async function readClaudeStatistics(candidate, { home, signal } = {}) {
+  signal?.throwIfAborted();
   if (!UUID.test(candidate?.session || '')) return unavailableStatistics();
-  const matches = (await collect({ home, session: candidate.session, includeStatistics: true })).filter(item => item.cwd === candidate.cwd);
+  const matches = (await collect({ home, session: candidate.session, includeStatistics: true, signal })).filter(item => item.cwd === candidate.cwd);
+  signal?.throwIfAborted();
   return matches.length === 1 ? matches[0].statistics : unavailableStatistics();
 }

package/src/session-supervision/codex-app-server.js

@@ -15,7 +15,9 @@ const ANALYSIS_MAX_LINE = 1024 * 1024;
 const ANALYSIS_MAX_TURNS = 16;
 const ANALYSIS_PAGE_SIZE = 6;
 const ANALYSIS_MAX_WIRE_LINE = 8 * 1024 * 1024;
-const SOURCE_KINDS = ['cli', 'vscode', 'exec', 'appServer', 'unknown'];
+// Non-interactive exec and unknown origins are not evidence of a human-created
+// conversation. Explicit bindings remain visible through discoverSessions.
+const SOURCE_KINDS = ['cli', 'vscode', 'appServer'];
 
 export class CodexAppServerError extends Error {
   constructor(code, message) {
@@ -190,7 +192,7 @@ export function codexThreadMetadata(thread) {
   };
 }
 
-export async function listCodexSessions({ client, maxPages = 40, pageSize = 25, maxSessions = RECENT_SESSION_LIMIT, archived = false, inspectState = false, prioritySessions = [], observationBudgetMs = 3000 } = {}) {
+export async function listCodexSessions({ client, maxPages = 40, pageSize = 25, maxSessions = RECENT_SESSION_LIMIT, archived = false, inspectState = false, prioritySessions = [], observationBudgetMs = 3000, codexHome } = {}) {
   const sessions = [];
   const windowSize = Math.min(maxSessions, maxPages * pageSize);
   let cursor = null, listed = 0, pages = 0, batchSize = pageSize;
@@ -210,18 +212,39 @@ export async function listCodexSessions({ client, maxPages = 40, pageSize = 25,
     listed += threads.length; pages++;
     for (const thread of threads) {
       const metadata = codexThreadMetadata(thread);
-      if (metadata) sessions.push(metadata);
+      if (metadata && SOURCE_KINDS.includes(metadata.source)) sessions.push(metadata);
     }
     cursor = response?.nextCursor || null;
     if (!cursor) break;
   }
+  const deadline = Date.now() + Math.max(1, Math.min(observationBudgetMs, 5000));
+  // A recent page can omit an explicitly supervised conversation, including
+  // a newly created desktop chat. Read its exact metadata without loading or
+  // resuming it; only an active rollout path proves that it is not archived.
+  if (!archived && prioritySessions.length) {
+    const recoveryDeadline = Math.min(deadline, Date.now() + Math.max(1, (deadline - Date.now()) / 3));
+    const listedIds = new Set(sessions.map(item => item.session));
+    const missing = [...new Set(prioritySessions)].filter(id => !listedIds.has(id));
+    let next = 0;
+    await Promise.all(Array.from({ length: Math.min(3, missing.length) }, async () => {
+      while (next < missing.length && Date.now() < recoveryDeadline) {
+        const id = missing[next++];
+        try {
+          const response = await client.request('thread/read', { threadId: id, includeTurns: false },
+            Math.max(1, Math.min(1000, recoveryDeadline - Date.now())));
+          const metadata = codexThreadMetadata(response?.thread);
+          if (metadata?.session === id && SOURCE_KINDS.includes(metadata.source) &&
+            codexArchivePathState(response.thread.path, id, codexHome) === false) sessions.push(metadata);
+        } catch { /* Missing or unverifiable metadata remains a retained hook record. */ }
+      }
+    }));
+  }
   if (inspectState) {
     // Status-only pages have no conversation text. A separate app-server often
     // reports notLoaded rather than the original writer's actual turn state.
     // Bound this metadata fan-out independently of the analysis worker pool.
     const priorities = new Set(prioritySessions);
     const ordered = [...sessions].sort((a, b) => Number(priorities.has(b.session)) - Number(priorities.has(a.session)) || (b.lastActivityAt || 0) - (a.lastActivityAt || 0));
-    const deadline = Date.now() + Math.max(1, Math.min(observationBudgetMs, 5000));
     let next = 0, unavailable = false;
     for (const metadata of sessions) metadata.goalReadState = 'unavailable';
     await Promise.all(Array.from({ length: Math.min(3, sessions.length) }, async () => {