@awak-app/simy-cli 0.6.19 → 0.6.20

package/README.md

@@ -107,6 +107,27 @@ run retains the legacy metadata endpoint
 no longer impose local limits and changing them never resets usage or resumes work. Both routes require the original authorized
 account, organization and device throughout the request.
 
+## Provider reconnection and saved consent
+
+Disconnecting an AI provider revokes its conversation monitoring and automatic
+continuation with a durable connection epoch. Reconnecting restores discovery;
+previous work remains paused until explicitly selected again. Old or damaged
+conversation locks do not block this operation and are never deleted by it.
+Individual locked conversations may still require support before they can be
+edited or continued. Provider login is separate: for a signed-out Codex CLI,
+run `codex login` in Terminal and refresh connections.
+
+After the first connection change, the saved settings deliberately appear
+**disconnected to older CLI/plugin versions** that cannot enforce the consent
+epoch. Update the runtime and installed SIMY plugins together and start a fresh
+provider session before using their hooks. Do not edit the saved `connected`
+flag to bypass this fence. A rollback to older code leaves those integrations
+disconnected; pause work and use a compatible version to restore the connection.
+Connection failures write only provider, operation, and a bounded error code to
+the private `logs/desktop-host.log`; they do not include credentials or conversation
+content. Verify reconnect, fresh explicit consent, and that previous work remains
+paused when validating a rollout. This does not prove provider model access.
+
 ## Apple Silicon Mac app
 
 The macOS installer includes a native status window and menu bar app. Open

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.6.19",
+  "version": "0.6.20",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.6.19";
+export const CLI_VERSION = "0.6.20";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -37,11 +37,29 @@ export async function providerLinkState(root, provider) {
     const valid = settings?.schemaVersion === 1 && ['codex', 'claude'].every(key => {
       const value = settings.providers?.[key];
       return value && typeof value.connected === 'boolean' && typeof value.requiresConsent === 'boolean' &&
-        (value.epoch === null || typeof value.epoch === 'string' && value.epoch.length > 0 && value.epoch.length <= 128);
+        (value.epoch === null || typeof value.epoch === 'string' && value.epoch.length > 0 && value.epoch.length <= 128) &&
+        (value.consentEpoch === undefined || value.consentEpoch === value.epoch && Boolean(value.consentEpoch) && value.connected === false && typeof value.enabled === 'boolean');
     });
-    return valid ? settings.providers[provider] ?? { connected: false, epoch: null } : { connected: false, epoch: null };
+    const value = valid ? settings.providers[provider] : null;
+    return value ? { ...value, connected: value.consentEpoch ? value.enabled : value.connected } : { connected: false, epoch: null };
   } catch (error) { return { connected: error.code === 'ENOENT', epoch: null }; }
 }
+// Revocation is durable before touching any conversation lock. Project it on every
+// read (including cached records) and under the write lock, so stale consent never
+// returns after reconnect, restart, or a late writer from the previous epoch.
+function applyProviderConsent(record, link) {
+  if (!record || !link.consentEpoch || record.providerConsentEpoch === link.consentEpoch) return record;
+  return { ...record, providerConsentEpoch: link.consentEpoch,
+    autoContinue: false, autoContinueEpoch: null, tracked: false, monitor: false,
+    ...(record.run && !TERMINAL.has(record.run.state) ? { run: { ...record.run,
+      state: 'paused', reason: 'SIMY connection changed. Select this conversation again before continuing.',
+      revision: (record.run.revision || 0) + 1,
+      ...(record.run.managed ? { managed: { ...record.run.managed, autoRecovery: false } } : {}) } } : {}) };
+}
+async function currentProviderConsent(root, records) {
+  const links = Object.fromEntries(await Promise.all(['codex', 'claude'].map(async provider => [provider, await providerLinkState(root, provider)])));
+  return records.map(record => applyProviderConsent(record, links[record.provider] || {}));
+}
 export async function linkedProvider(root, provider) {
   return (await providerLinkState(root, provider)).connected === true;
 }
@@ -158,8 +176,9 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
   const lockToken = await acquireStateLock(lock, inspectProcess);
   let temporary;
   try {
-    const previous = await read(file);
-    const previousBytes = previous === null ? null : JSON.stringify(previous);
+    const stored = await read(file);
+    const previous = applyProviderConsent(stored, await providerLinkState(root, provider));
+    const previousBytes = stored === null ? null : JSON.stringify(stored);
     const next = await mutate(previous);
     if (next) {
       // Older file_equals drafts used `path`, which an older verifier could
@@ -184,7 +203,7 @@ export async function readRecord(root = rootDirectory(), provider, session) {
   const path = recordPath(root, provider, session);
   try {
     const record = await read(path);
-    return record?.schemaVersion === 1 && record.provider === provider && record.session === session ? record : null;
+    return record?.schemaVersion === 1 && record.provider === provider && record.session === session ? applyProviderConsent(record, await providerLinkState(root, provider)) : null;
   } catch { return null; } // Match listRecords' treatment of unreadable records.
 }
 const RECORD_NAME = /^[a-f0-9]{64}\.json$/;
@@ -209,7 +228,7 @@ async function readNamedRecord(root, name) {
   } catch { return null; }
 }
 export async function listRecords(root = rootDirectory()) {
-  return mapRecordNames(await recordNames(root), name => readNamedRecord(root, name));
+  return currentProviderConsent(root, await mapRecordNames(await recordNames(root), name => readNamedRecord(root, name)));
 }
 
 // A shared candidate/display index, never mutation authority. Every list checks
@@ -244,7 +263,7 @@ export function createRecordReader(root = rootDirectory()) {
       if (!inFlight) inFlight = scan().finally(() => { inFlight = null; });
       // Consumers can decorate/mutate their own snapshots without corrupting the
       // cached records or a simultaneous caller's view.
-      return structuredClone(await inFlight);
+      return currentProviderConsent(root, structuredClone(await inFlight));
     },
     async close() { closed = true; await inFlight?.catch(() => {}); cache.clear(); },
   };

package/src/desktop-host.js

@@ -66,7 +66,12 @@ async function withReadCancellation(signal, work) {
 function desktopActionError(action, error) {
   if (error?.code === "provider_link_changed") return "SIMY connection changed. Refresh and select the conversation again.";
   if (error?.code === "provider_link_disconnected") return "Reconnect this provider to SIMY before using it.";
-  if (["provider_connect", "provider_disconnect"].includes(action)) return "Could not finish changing the SIMY connection. Refresh its status and try again.";
+  if (["provider_connect", "provider_disconnect"].includes(action)) {
+    if (error?.code === 'desktop_access_required') return "Sign in to your SIMY workspace, then try connecting again.";
+    if (['EACCES', 'EPERM', 'EROFS'].includes(error?.code)) return "SIMY could not save the connection settings. Check access to its local settings folder, then retry.";
+    if (error?.code === 'ENOSPC') return "SIMY could not save the connection settings. Free disk space, then retry.";
+    return "SIMY could not change the connection. Reopen SIMY and retry. If this continues, share its diagnostic log with support.";
+  }
   if (action === "session_set_auto_continue") {
     const messages = {
       session_workspace_changed: "The conversation workspace changed. Refresh and select it again.",
@@ -297,10 +302,10 @@ export async function startDesktopHost({ input = process.stdin, output = process
   let organizationAnalysisDrain = Promise.resolve();
   let organizationAnalysisEpoch = 0;
   const authorizeWork = async expectedScope => {
-    if (closed || stoppingForUpdate || updater?.acceptsNewWork?.() === false || organizationAnalysesSuspended) throw new Error("SIMY is stopping. Reopen SIMY before starting new work.");
+    if (closed || stoppingForUpdate || updater?.acceptsNewWork?.() === false || organizationAnalysesSuspended) throw Object.assign(new Error("SIMY is stopping. Reopen SIMY before starting new work."), { code: "desktop_stopping" });
     if (agent?.requireDesktopAccess) await agent.requireDesktopAccess();
     const access = await accessSnapshot();
-    if (closed || stoppingForUpdate || updater?.acceptsNewWork?.() === false || organizationAnalysesSuspended) throw new Error("SIMY is stopping. Reopen SIMY before starting new work.");
+    if (closed || stoppingForUpdate || updater?.acceptsNewWork?.() === false || organizationAnalysesSuspended) throw Object.assign(new Error("SIMY is stopping. Reopen SIMY before starting new work."), { code: "desktop_stopping" });
     requireDesktopAccess(access);
     const scope = accessScope(access);
     if (expectedScope !== undefined && expectedScope !== scope) throw Object.assign(new Error("Desktop account or organization changed."), { code: "desktop_access_required" });
@@ -406,29 +411,15 @@ export async function startDesktopHost({ input = process.stdin, output = process
     selectedLinkEpochs.set(selected, link.epoch);
     return selected;
   };
-  const revokeProviderConsent = async provider => {
-    const records = (await recordReader.list()).filter(record => record.provider === provider);
-    for (const record of records) {
-      automaticContinuation?.revoke(provider, record.session);
-      await updateRecord(deliveryRoot, provider, record.session, previous => {
-        if (!previous) return previous;
-        const next = { ...previous, autoContinue: false, autoContinueEpoch: randomUUID(), tracked: false, monitor: false };
-        if (previous.run && !TERMINAL.has(previous.run.state)) {
-          next.run = { ...previous.run, state: "paused", reason: "Provider disconnected from SIMY.",
-            revision: (previous.run.revision || 0) + 1, updatedAt: Date.now(),
-            ...(previous.run.managed ? { managed: { ...previous.run.managed, autoRecovery: false } } : {}) };
-        }
-        return next;
-      });
-    }
-  };
   const changeProviderLink = async (provider, connected) => {
     if (!PROVIDER_LINKS.includes(provider)) throw new Error("Unsupported SIMY provider connection.");
     if (providerLinkBusy.has(provider)) throw new Error("SIMY connection is already changing.");
     providerLinkBusy.add(provider);
     providerLinkFeedback[provider] = { state: connected ? "connecting" : "disconnecting" };
+    let phase = "read_settings";
     try {
       providerLinks = await readProviderLinks(root);
+      phase = "save_disconnect";
       if (!connected) providerLinks = await writeProviderLink(root, provider, false);
       if (activeStatisticsRead?.key.startsWith(`${provider}:`)) activeStatisticsRead.controller.abort();
       discoveryController?.abort();
@@ -437,13 +428,16 @@ export async function startDesktopHost({ input = process.stdin, output = process
       for (const key of explicitAnalyses) if (key.startsWith(`${provider}:`)) explicitAnalyses.delete(key);
       statisticsCache.clear();
       if (!connected) sessionStatus = { ...sessionStatus, sessions: linkedSessions(sessionStatus.sessions) };
+      phase = "cancel_analysis";
       await analysisManager.update(analysisSessions(sessionStatus.sessions));
+      phase = "publish_status";
       await publish();
-      // A crash after saving disconnected must not restore old session consent
-      // when the user reconnects. Revoke before persisting connected again.
-      if (!connected || !providerLinks[provider].connected) await revokeProviderConsent(provider);
+      // The provider epoch revokes old consent atomically, independent of stale
+      // conversation locks. Record readers and writers enforce that boundary.
       if (connected && !providerLinks[provider].connected) {
+        phase = "authorize_connect";
         await authorizeWork();
+        phase = "save_connect";
         providerLinks = await writeProviderLink(root, provider, true);
       }
       delete providerLinkFeedback[provider];
@@ -451,6 +445,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       catch { providerLinkFeedback[provider] = { message: "SIMY connection saved. Provider status could not be verified; refresh connections to check it." }; }
       refreshSessions(true);
     } catch (error) {
+      diagnostics.write(`provider connection phase provider=${provider} phase=${phase}`);
       providerLinkFeedback[provider] = { state: "error", message: desktopActionError(connected ? "provider_connect" : "provider_disconnect", error) };
       throw error;
     } finally { providerLinkBusy.delete(provider); await publish(); }
@@ -1327,6 +1322,13 @@ export async function startDesktopHost({ input = process.stdin, output = process
         emit({ type: "result", id: command.id, ok: true });
         await publish();
       } catch (error) {
+        if (["provider_connect", "provider_disconnect"].includes(command.action)) {
+          const code = ['desktop_access_required', 'desktop_stopping', 'EACCES', 'EPERM', 'ENOSPC', 'EROFS', 'EBUSY', 'ENOENT', 'ERR_INVALID_ARG_TYPE'].includes(error?.code) ? error.code : 'provider_connection_failed';
+          const provider = PROVIDER_LINKS.includes(command.provider) ? command.provider : 'unsupported';
+          const kind = ['Error', 'TypeError', 'RangeError', 'SyntaxError'].includes(error?.name) ? error.name : 'Error';
+          const locations = [...String(error?.stack || '').matchAll(/(?:desktop-host|agent|provider-links|delivery-loop|analysis-manager)\.m?js:\d{1,6}:\d{1,6}/g)].slice(0, 3).map(match => match[0]).join(',') || 'unknown';
+          diagnostics.write(`provider connection failed provider=${provider} operation=${command.action} code=${code} kind=${kind} locations=${locations}`);
+        }
         emit({ type: "result", id: command.id, ok: false, ...(error?.code === 'cancelled' || statisticsRequest?.controller.signal.aborted ? { code: 'cancelled' } : {}), message: ["update", "prepare_update_restart"].includes(command.action) && updateProgress ? updateProgress.message : desktopActionError(command.action, error) });
       } finally {
         // Access rejection can happen before the shared reader is constructed.

package/src/provider-links.js

@@ -17,10 +17,12 @@ async function readSettings(root) {
   if (payload?.schemaVersion !== 1 || !payload.providers || PROVIDER_LINKS.some(provider => {
     const value = payload.providers[provider];
     return !value || typeof value.connected !== 'boolean' || typeof value.requiresConsent !== 'boolean' ||
-      value.epoch !== null && (typeof value.epoch !== 'string' || !value.epoch || value.epoch.length > 128);
+      value.epoch !== null && (typeof value.epoch !== 'string' || !value.epoch || value.epoch.length > 128) ||
+      value.consentEpoch !== undefined && (value.consentEpoch !== value.epoch || !value.consentEpoch || value.connected !== false || typeof value.enabled !== 'boolean');
   })) throw new Error('Invalid SIMY provider connection settings.');
   return Object.fromEntries(PROVIDER_LINKS.map(provider => [provider, {
-    connected: payload.providers[provider].connected,
+    connected: payload.providers[provider].consentEpoch ? payload.providers[provider].enabled : payload.providers[provider].connected,
+    ...(payload.providers[provider].consentEpoch ? { consentEpoch: payload.providers[provider].consentEpoch } : {}),
     epoch: payload.providers[provider].epoch,
     requiresConsent: payload.providers[provider].requiresConsent,
   }]));
@@ -59,11 +61,15 @@ export function writeProviderLink(root = defaultRoot(), provider, connected) {
     const providers = await readSettings(root);
     // Reconnection restores discovery only. Session execution consent is cleared
     // separately and must be selected again, including after a host restart.
-    providers[provider] = { connected, epoch: randomUUID(), requiresConsent: true };
+    const epoch = randomUUID();
+    providers[provider] = { connected, epoch, consentEpoch: epoch, requiresConsent: true };
+    // Old plugins must remain disconnected: they cannot enforce epoch revocation.
+    const saved = Object.fromEntries(Object.entries(providers).map(([key, value]) => [key,
+      value.consentEpoch ? { ...value, connected: false, enabled: value.connected } : value]));
     await mkdir(root, { recursive: true, mode: 0o700 });
     const target = join(root, 'provider-links.json'), temporary = `${target}.${randomUUID()}.tmp`;
     try {
-      await writeFile(temporary, `${JSON.stringify({ schemaVersion: 1, providers })}\n`, { mode: 0o600 });
+      await writeFile(temporary, `${JSON.stringify({ schemaVersion: 1, providers: saved })}\n`, { mode: 0o600 });
       await rename(temporary, target);
     } finally { await rm(temporary, { force: true }); }
     return providers;

package/src/session-supervision/analysis-manager.js

@@ -307,7 +307,7 @@ export async function createContinuationAnalysisManager({ root, analyze = analyz
       candidate = observedCandidate(candidate);
       const revision = continuationAnalysisRevision(candidate), entry = entries.get(keyOf(candidate));
       let analysis = entry?.revision === revision ? { ...entry.result, revision, requestId: entry.requestId } : { state: 'unanalysed', revision };
-      const previous = entry?.cwd === candidate.cwd ? entry.settledResult : null;
+      const previous = entry && entry.cwd === candidate.cwd ? entry.settledResult : null;
       if (candidate.isRunning === true || analysis.awaitingTurn === true) {
         analysis = { state: 'waiting', awaitingTurn: true, revision,
           reason: 'This turn is still running. SIMY analyzes only finished turns and will update automatically when it ends.',

package/src/session-supervision/index.js

@@ -316,7 +316,7 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
       ...(continuationPolicy ?? savedPolicy) === undefined ? {} : { continuationPolicy: continuationPolicy ?? savedPolicy } };
     if (settings.continuationPolicy !== undefined && !['bounded', 'progress'].includes(settings.continuationPolicy)) throw new Error('Choose a continuation policy.');
     if (previous.run && continuationPolicy !== undefined) throw new Error('Change an existing task through its explicit continuation controls.');
-    const next = { ...previous, autoContinue: enabled, autoContinueEpoch: epoch,
+    const next = { ...previous, ...(enabled && link.consentEpoch ? { providerConsentEpoch: link.consentEpoch } : {}), autoContinue: enabled, autoContinueEpoch: epoch,
       ...(enabled ? { tracked: true, monitor: true, autoContinueSettings: settings } : { tracked: false, monitor: false }) };
     // Adopt existing supervision without restarting it or renewing its budgets.
     if (next.run?.managed) next.run.managed.autoContinueEpoch = epoch;
@@ -357,7 +357,8 @@ export async function trackSession({ root, provider, session, tracked = true, op
     await requireProviderLink({ root, provider, expectedEpoch: link.epoch });
     if (previous?.providerArchived === true) throw Object.assign(new Error('Restore the original provider conversation before enabling automatic continuation or tracking.'), { code: 'session_archived' });
     if (previous && previous.cwd !== cwd) throw new Error('Session workspace changed; refresh its metadata.');
-    return { ...(previous || { schemaVersion: 1, provider, session, cwd, run: null }), tracked: true, monitor: true,
+    return { ...(previous || { schemaVersion: 1, provider, session, cwd, run: null }),
+      ...(link.consentEpoch ? { providerConsentEpoch: link.consentEpoch } : {}), tracked: true, monitor: true,
       admission: { ...(previous?.admission || {}), source: metadata.observation.source, provider, session, cwd, model: metadata.model, validatedAt: now } };
   });
 }
@@ -380,7 +381,8 @@ export async function monitorSession({ root, provider, session, monitor = true,
     await requireProviderLink({ root, provider, expectedEpoch: link.epoch });
     if (previous?.providerArchived === true) throw new Error('Restore the original provider conversation before enabling supervision.');
     if (previous && previous.cwd !== cwd) throw new Error('Session workspace changed; refresh its metadata.');
-    return { ...(previous || { schemaVersion: 1, provider, session, cwd, run: null }), monitor,
+    return { ...(previous || { schemaVersion: 1, provider, session, cwd, run: null }),
+      ...(link.consentEpoch ? { providerConsentEpoch: link.consentEpoch } : {}), monitor,
       admission: { source: metadata.observation.source, provider, session, cwd, model: metadata.model, validatedAt: now } };
   });
   return metadata;