@awak-app/simy-cli 0.7.10 → 0.7.12

package/src/local-task.js

@@ -1,3 +1,5 @@
+import { captureDispatchProvenance } from './update-detachment/provenance.js';
+import { captureDispatchOwner, assertTaskAdmission, dispatchWithFence, observeDispatchEvent, queueDispatchReceipt } from './update-detachment/dispatch-gate.js';
 import { normalizePurposeVerification } from "./purpose-local-proof.js";
 import { buildWorkflowReportingInstruction } from "./workflow-reporting.js";
 import { execFile } from "node:child_process";
@@ -449,12 +451,17 @@ export async function startLocalTask(
     beforeSpawn = null,
     session = null,
     apiOrigin = null,
+    sessionRoot,
     observationFetch = globalThis.fetch,
     deliverableUploadSleep = undefined,
   } = {},
 ) {
   if (!task || task.status !== "queued") throw new Error("Local Task must be queued.");
   if (task.invocation_count >= 1) throw new Error("Local Tasks allow only one Provider invocation.");
+  const dispatchOwner = captureDispatchOwner(sessionRoot);
+  const dispatchAttemptId = `${task.id}:provider:1`;
+  const provenance = captureDispatchProvenance({ root: dispatchOwner.root, provider: task.backend, worktree: task.workspace_path, accountSession: session || undefined, origin: apiOrigin || undefined, taskId: task.id, recordRef: path.join(task.task_root, 'task.json') });
+  assertTaskAdmission(dispatchOwner, { taskId: provenance.taskId, provenance });
   updateTask(task, {
     control_state: "starting",
     invocation_count: 1,
@@ -573,7 +580,7 @@ export async function startLocalTask(
     const tokenRecords = [];
     let child;
     try {
-      child = command.spawn(command.bin, command.args, {
+      child = dispatchWithFence(dispatchOwner, { taskId: task.id, attemptId: dispatchAttemptId, provenance }, () => command.spawn(command.bin, command.args, {
         cwd: task.workspace_path,
         env: {
           ...process.env,
@@ -586,7 +593,7 @@ export async function startLocalTask(
         },
         stdio: ["ignore", "pipe", "pipe"],
         detached: process.platform !== "win32",
-      });
+      }));
     } catch (error) {
       void rm(runtimeTempRoot, { recursive: true, force: true }).then(
         () => reject(error),
@@ -631,7 +638,7 @@ export async function startLocalTask(
       stream: "stdout",
       onLine,
       onUsage,
-      onEvent: (event) => observationSender?.observe(event),
+      onEvent: (event) => { const identity = observeDispatchEvent({ root: dispatchOwner.root, attemptId: dispatchAttemptId, provider: task.backend, event, onError: error => { task.dispatch_recovery_required = error.code || 'provenance_persistence_failed'; } }); if (identity) task.dispatch_identity = identity; observationSender?.observe(event); },
       onTerminalError: (message) => {
         task.error ||= message;
         task.reason_code ||= "provider_execution_failed";
@@ -786,6 +793,8 @@ export async function startLocalTask(
               : task.error || "Local Task failed.",
       });
       await persist(task);
+      try { queueDispatchReceipt({ root: dispatchOwner.root, attemptId: dispatchAttemptId, receiptId: `result:${dispatchAttemptId}`, resultRef: provenance.recordRef }); }
+      catch (error) { task.dispatch_recovery_required = error.code || 'provenance_persistence_failed'; try { await persist(task); } catch {} }
       resolve(task);
     };
     child.on("error", (spawnError) => void finish({ error: spawnError.message }));
@@ -831,6 +840,8 @@ export async function stopLocalTask(task, { persist = persistLocalTask } = {}) {
 export function localTaskSnapshot(task, { includeEvents = true, includeLocalPaths = false } = {}) {
   return {
     id: task.id,
+    ...(task.dispatch_recovery_required ? { dispatch_recovery_required: task.dispatch_recovery_required } : {}),
+    ...(includeLocalPaths && task.dispatch_identity ? { dispatch_identity: task.dispatch_identity } : {}),
     kind: "local_task",
     status: task.status,
     control_state: task.control_state,

package/src/provider-stream.js

@@ -206,6 +206,9 @@ function formatClaudeToolResults(prefix, content) {
 }
 
 function contentLines(prefix, label, value) {
+  // Native providers wrap machine results in assistant events too. Keep the
+  // result available to the parser without flooding the user transcript.
+  if (label === "assistant" && STRUCTURED_MARKERS.some(marker => String(value || "").trimStart().startsWith(marker))) return [];
   return String(value || "")
     .split(/\r?\n/)
     .map((line) => cleanLine(line))

package/src/runner.js

@@ -1,3 +1,5 @@
+import { captureDispatchProvenance } from './update-detachment/provenance.js';
+import { captureDispatchOwner, assertTaskAdmission, dispatchWithFence, observeDispatchEvent, queueDispatchReceipt } from './update-detachment/dispatch-gate.js';
 import { execFile, execFileSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { EventEmitter, once } from "node:events";
@@ -1060,7 +1062,11 @@ export async function executeProcessAttempt({
   onExecutionComplete = null,
   readOnly = false,
 }) {
+  const dispatchOwner = captureDispatchOwner(run.sqmHistoryRoot || (run.localStateRoot ? path.dirname(run.localStateRoot) : undefined));
   const phase = marker === "SIMY_AUDIT_JSON:" ? "reviewer" : "executor";
+  const dispatchAttemptId = `${run.snapshot.id}:${phase}:${attemptNumber ?? run.snapshot.attempts?.length ?? 0}`;
+  const provenance = captureDispatchProvenance({ root: dispatchOwner.root, provider: backend, worktree: repositoryPath, accountSession: run.session, origin: run.apiOrigin || undefined, taskId: run.snapshot.id, recordRef: run.localStateRoot ? path.join(run.localStateRoot, `${run.snapshot.id}.json`) : `coding-run:${run.snapshot.id}` });
+  assertTaskAdmission(dispatchOwner, { taskId: provenance.taskId, provenance });
   const command = await resolveCommandImpl({
     backend,
     instruction,
@@ -1094,7 +1100,7 @@ export async function executeProcessAttempt({
     let terminalError = null;
     let terminalErrorCode = null;
     const checkpointWrites = [];
-    const child = command.spawn(command.bin, command.args, {
+    const child = dispatchWithFence(dispatchOwner, { taskId: run.snapshot.id, attemptId: dispatchAttemptId, provenance }, () => command.spawn(command.bin, command.args, {
       cwd: repositoryPath,
       env: {
         ...process.env,
@@ -1104,14 +1110,14 @@ export async function executeProcessAttempt({
       },
       stdio: ["ignore", "pipe", "pipe"],
       detached: process.platform !== "win32",
-    });
+    }));
     run.child = child;
 
     const stdoutDecoder = createProviderStreamDecoder({
       backend,
       stream: "stdout",
       onLine: (line) => emitOutput(run, line, { backend }),
-      onEvent: (event) => observationSender?.observe(event),
+      onEvent: (event) => { const identity = observeDispatchEvent({ root: dispatchOwner.root, attemptId: dispatchAttemptId, provider: backend, event, onError: error => { run.snapshot.metadata.dispatch_recovery_required = error.code || 'provenance_persistence_failed'; } }); if (identity) { run.snapshot.metadata.dispatch_identities ||= {}; run.snapshot.metadata.dispatch_identities[dispatchAttemptId] = identity; } observationSender?.observe(event); },
       onTerminalError: (message) => { terminalError ||= message; },
       onUsage: (usage) => {
         tokenUsageRecords.push({
@@ -1183,7 +1189,16 @@ export async function executeProcessAttempt({
         startedAt,
         finishedAt: new Date().toISOString(),
       };
-      try { await onExecutionComplete?.(execution); }
+      try {
+        if (run.localStateRoot) {
+          run.snapshot.metadata.dispatch_results ||= {};
+          run.snapshot.metadata.dispatch_results[dispatchAttemptId] = execution;
+          await saveCodingRunSnapshot(run.localStateRoot, run.snapshot);
+          try { queueDispatchReceipt({ root: dispatchOwner.root, attemptId: dispatchAttemptId, receiptId: `result:${dispatchAttemptId}`, resultRef: provenance.recordRef }); }
+          catch (error) { run.snapshot.metadata.dispatch_recovery_required = error.code || 'provenance_persistence_failed'; await saveCodingRunSnapshot(run.localStateRoot, run.snapshot); }
+        }
+        await onExecutionComplete?.(execution);
+      }
       catch (error) { reject(error); return; }
       // The run must always resolve: a WorkFlow observation failure (or a
       // sender bug) never changes or blocks the Provider result. flush() is

package/src/session-supervision/claude-desktop-lineage.js

@@ -1,3 +1,4 @@
+import { normalizePullRequests } from './pull-requests.js';
 import { constants } from 'node:fs';
 import { lstat, open, readdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
@@ -70,12 +71,14 @@ async function metadata(path, desktopId, sessions) {
     let value = null;
     if (item.sessionId === desktopId && UUID.test(item.cliSessionId || '') && typeof item.cwd === 'string' && isAbsolute(item.cwd)) {
       value = { desktopId, session: item.cliSessionId, cwd: resolve(item.cwd),
+        ...(complete ? { providerArchived: typeof item.isArchived === 'boolean' ? item.isArchived : typeof item.archived === 'boolean' ? item.archived : undefined,
+          pullRequests: normalizePullRequests(item.pullRequests || item.gitHubPullRequests || item.githubPullRequests || item.githubPRs || item.gitHubPRs || item.gitHubPR || item.pullRequest || (item.prUrl ? { url: item.prUrl, state: item.prStatus } : null)) } : {}),
         parentDesktopId: complete && LOCAL.test(item.spawnedFrom?.sessionId || '') ? item.spawnedFrom.sessionId : null };
     }
     const after = await lstat(path, { bigint: true });
     if (fingerprint(after) !== key || fingerprint(await handle.stat({ bigint: true })) !== key || after.isSymbolicLink()) return null;
     if (!complete && !value) return null;
-    // Cache only identity/lineage. Desktop files also contain private settings;
+    // Cache only identity, lineage, archive and PR summaries. Desktop files also contain private settings;
     // none of those fields or conversation text leave this bounded reader.
     cache.delete(path); cache.set(path, { key, value, complete });
     while (cache.size > MAX_FILES) cache.delete(cache.keys().next().value);
@@ -86,7 +89,7 @@ async function metadata(path, desktopId, sessions) {
 
 // Desktop spawn parents use local_* IDs, whereas transcripts and SIMY use CLI
 // UUIDs. Resolve them within the same account AND organization partition.
-export async function readClaudeDesktopLineage({ home = homedir(), root = claudeDesktopSessionRoot(home), signal, sessions = null } = {}) {
+export async function readClaudeDesktopLineage({ home = homedir(), root = claudeDesktopSessionRoot(home), signal, sessions = null, includeState = false } = {}) {
   if (signal?.aborted) return new Map();
   const files = [];
   for (const account of await directories(root)) {
@@ -122,12 +125,23 @@ export async function readClaudeDesktopLineage({ home = homedir(), root = claude
       parentSession: { provider: 'claude', session: parent.session },
       source: 'claude_desktop_spawned_from' });
   }
+  if (includeState) for (const partition of partitions.values()) for (const item of partition.values()) {
+    if (claims.get(item.session) !== 1 || sessions && !sessions.has(item.session)) continue;
+    lineage.set(item.session, { cwd: item.cwd, ...lineage.get(item.session),
+      providerArchived: item.providerArchived, pullRequests: item.pullRequests || [], observedAt: Date.now() });
+  }
   // Reject cyclic Desktop metadata rather than inventing a root or parent.
   for (const session of [...lineage.keys()]) {
     const seen = new Set(); let cursor = session;
     while (lineage.has(cursor)) {
-      if (seen.has(cursor)) { for (const id of seen) lineage.delete(id); break; }
-      seen.add(cursor); cursor = lineage.get(cursor).parentSession.session;
+      if (seen.has(cursor)) {
+        for (const id of seen) {
+          if (!includeState) lineage.delete(id);
+          else { const { parentSession, parentCwd, source, ...state } = lineage.get(id); lineage.set(id, state); }
+        }
+        break;
+      }
+      seen.add(cursor); cursor = lineage.get(cursor).parentSession?.session;
     }
   }
   return lineage;
@@ -138,7 +152,7 @@ export async function readClaudeDesktopLineage({ home = homedir(), root = claude
 // discovery and unrelated provider controls must not wait for the entire scan.
 export async function observeClaudeDesktopLineage(options = {}, { read = readClaudeDesktopLineage, budgetMs = 1500 } = {}) {
   if (options.signal?.aborted) return new Map();
-  const root = options.root || claudeDesktopSessionRoot(options.home);
+  const root = (options.root || claudeDesktopSessionRoot(options.home)) + (options.includeState ? ':state' : ':lineage');
   let entry = observations.get(root);
   if (!entry) {
     entry = { value: new Map(), pending: null };

package/src/session-supervision/claude-sessions.js

@@ -2,11 +2,12 @@ import { statisticsFromHandle, unavailableStatistics } from './statistics.js';
 import { constants } from 'node:fs';
 import { lstat, open, readdir, realpath } from 'node:fs/promises';
 import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { boundConversation, CONVERSATION_LIMITS, textContent } from './conversation-context.js';
 import { sessionTitle } from './session-titles.js';
 import { RECENT_SESSION_LIMIT, recentSessionWindow } from './discovery-window.js';
-import { observeClaudeDesktopLineage } from './claude-desktop-lineage.js';
+import { observeClaudeDesktopLineage, readClaudeDesktopLineage } from './claude-desktop-lineage.js';
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const MAX_PROJECTS = 256;
@@ -101,7 +102,7 @@ async function latestCustomTitle(handle, size, id) {
   return title;
 }
 
-async function inspectTranscript(root, projectName, fileName, observedAt, includeContext = false, cacheMetadata = false, includeStatistics = false, signal) {
+async function inspectTranscript(root, projectName, fileName, observedAt, includeContext = false, cacheMetadata = false, includeStatistics = false, signal, includeBoundary = false) {
   signal?.throwIfAborted();
   const id = fileName.slice(0, -'.jsonl'.length);
   if (!UUID.test(id)) return null;
@@ -147,12 +148,17 @@ async function inspectTranscript(root, projectName, fileName, observedAt, includ
     signal?.throwIfAborted();
     if (includeStatistics) candidate.statistics = await statisticsFromHandle(handle, opened, 'claude', id, { signal });
     if (includeContext) candidate.context = await conversationFromHandle(handle, opened, id, metadata.cwd);
+    if (includeBoundary) {
+      candidate.boundary = await boundaryFromHandle(handle, opened, id, metadata.cwd, signal);
+      const after = await lstat(path);
+      if (!after.isFile() || after.isSymbolicLink() || after.dev !== opened.dev || after.ino !== opened.ino || after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs) return null;
+    }
     return candidate;
   } catch (error) { metadataCache.delete(path); if (signal?.aborted) throw error; return null; }
   finally { await handle?.close(); }
 }
 
-async function collect({ home = homedir(), limit = 100, session = null, prioritySessions = [], includeContext = false, cacheMetadata = false, includeStatistics = false, signal } = {}) {
+async function collect({ home = homedir(), limit = 100, session = null, prioritySessions = [], includeContext = false, cacheMetadata = false, includeStatistics = false, includeBoundary = false, signal } = {}) {
   if (signal?.aborted) return [];
   const root = await projectsRoot(home);
   if (!root) return [];
@@ -186,28 +192,30 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
     }));
   }
   if (signal?.aborted) return [];
-  const desktopLineage = !session && cacheMetadata
-    ? await observeClaudeDesktopLineage({ home, signal, sessions: new Set(descriptors.map(item => item.session)) }) : new Map();
+  const desktopOptions = { home, signal, includeState: true, sessions: new Set(descriptors.map(item => item.session)) };
+  const desktopLineage = await (session ? readClaudeDesktopLineage(desktopOptions) : observeClaudeDesktopLineage(desktopOptions));
   const decorateLineage = candidate => {
     const origin = desktopLineage.get(candidate.session);
-    if (origin?.cwd === candidate.cwd && !candidate.parentSession)
-      return { ...candidate, parentSession: origin.parentSession, parentSessionSource: origin.source };
+    if (origin?.cwd === candidate.cwd)
+      return { ...candidate, ...(typeof origin.providerArchived === 'boolean' ? { archived: origin.providerArchived } : {}), pullRequests: origin.pullRequests || [],
+        ...(!candidate.parentSession && origin.parentSession ? { parentSession: origin.parentSession, parentSessionSource: origin.source } : {}) };
     return candidate;
   };
-  const selected = session ? descriptors : recentSessionWindow(descriptors, {
-    limit: maximum, priority: item => priorities.has(item.session),
-  });
+  const selected = session ? descriptors : [
+    ...recentSessionWindow(descriptors.filter(item => desktopLineage.get(item.session)?.providerArchived !== true), { limit: maximum, priority: item => priorities.has(item.session) }),
+    ...recentSessionWindow(descriptors.filter(item => desktopLineage.get(item.session)?.providerArchived === true), { limit: maximum, priority: item => priorities.has(item.session) }),
+  ];
   const filesToInspect = selected.slice(0, MAX_TRANSCRIPTS);
   let nextFile = 0;
   // Catalog prefixes are bounded independently of full transcript size. Use a
   // small I/O pool; exact-context/statistics reads stay serial and identity-safe.
-  await Promise.all(Array.from({ length: Math.min(includeContext || includeStatistics ? 1 : 8, filesToInspect.length) }, async () => {
+  await Promise.all(Array.from({ length: Math.min(includeContext || includeStatistics || includeBoundary ? 1 : 8, filesToInspect.length) }, async () => {
     while (nextFile < filesToInspect.length && !signal?.aborted) {
       const file = filesToInspect[nextFile++];
-      let candidate = await inspectTranscript(root, file.projectName, file.fileName, observedAt, includeContext, cacheMetadata, includeStatistics, signal);
+      let candidate = await inspectTranscript(root, file.projectName, file.fileName, observedAt, includeContext, cacheMetadata, includeStatistics, signal, includeBoundary);
       if (!candidate) continue;
       candidate = decorateLineage(candidate);
-      const key = `${candidate.session}\0${candidate.cwd}${includeContext || includeStatistics ? `\0${file.projectName}\0${file.fileName}` : ''}`;
+      const key = `${candidate.session}\0${candidate.cwd}${includeContext || includeStatistics || includeBoundary ? `\0${file.projectName}\0${file.fileName}` : ''}`;
       if (!result.has(key) || candidate.lastActivityAt > result.get(key).lastActivityAt) result.set(key, candidate);
     }
   }));
@@ -218,7 +226,7 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
     const attempted = new Set(result.keys());
     for (const child of result.values()) {
       const origin = desktopLineage.get(child.session);
-      if (!origin || child.parentSessionSource !== origin.source || [...result.values()].some(item => item.session === origin.parentSession.session && item.cwd === origin.parentCwd)) continue;
+      if (!origin?.parentSession || child.parentSessionSource !== origin.source || [...result.values()].some(item => item.session === origin.parentSession.session && item.cwd === origin.parentCwd)) continue;
       for (const file of descriptors.filter(item => item.session === origin.parentSession.session)) {
         const key = `${file.session}\0${origin.parentCwd}`;
         if (attempted.has(key) || attempted.size >= MAX_TRANSCRIPTS || signal?.aborted) break;
@@ -243,7 +251,10 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
     }
   }
   const sorted = [...result.values()].sort((a, b) => b.lastActivityAt - a.lastActivityAt || a.session.localeCompare(b.session));
-  return session ? sorted : recentSessionWindow(sorted, { limit: maximum, priority: item => priorities.has(item.session) });
+  return session ? sorted : [
+    ...recentSessionWindow(sorted.filter(item => item.archived !== true), { limit: maximum, priority: item => priorities.has(item.session) }),
+    ...recentSessionWindow(sorted.filter(item => item.archived === true), { limit: maximum, priority: item => priorities.has(item.session) }),
+  ];
 }
 
 export async function listClaudeSessions({ home, limit, prioritySessions, signal } = {}) {
@@ -256,6 +267,7 @@ export async function readClaudeSession(session, { home } = {}) {
   const matches = await collect({ home, limit: RECENT_SESSION_LIMIT, session: id });
   const selected = typeof session === 'object' && typeof session.cwd === 'string'
     ? matches.filter(item => item.cwd === session.cwd) : matches;
+  if (selected.length === 1 && selected[0].archived === true) throw Object.assign(new Error('Restore the original provider conversation before continuing.'), { code: 'session_archived' });
   return selected.length === 1 ? selected[0] : null;
 }
 
@@ -299,6 +311,52 @@ export async function readClaudeConversation(candidate, { home, signal } = {}) {
   return { ...selected[0].context, awaitingTurn: candidate.isRunning === true };
 }
 
+// Update recovery needs coverage of the complete saved transcript, not the
+// deliberately shortened text used for presentation. Stream and validate every
+// envelope while retaining only a digest and counters, never message prose.
+async function boundaryFromHandle(handle, opened, session, cwd, signal) {
+  const maxBytes = 64 * 1024 * 1024, maxLineBytes = 4 * 1024 * 1024;
+  if (!opened.size || opened.size > maxBytes) return null;
+  const hash = createHash('sha256'), buffer = Buffer.alloc(64 * 1024);
+  let offset = 0, pending = Buffer.alloc(0), rows = 0, messageCount = 0, lastMessageRef = null;
+  const decoder = new TextDecoder('utf-8', { fatal: true });
+  while (offset < opened.size) {
+    signal?.throwIfAborted();
+    const { bytesRead } = await handle.read(buffer, 0, Math.min(buffer.length, opened.size - offset), offset);
+    if (!bytesRead) return null;
+    const chunk = buffer.subarray(0, bytesRead); hash.update(chunk); offset += bytesRead;
+    pending = Buffer.concat([pending, chunk]);
+    let newline;
+    while ((newline = pending.indexOf(10)) !== -1) {
+      if (newline > maxLineBytes || ++rows > 250000) return null;
+      const line = pending.subarray(0, newline); pending = pending.subarray(newline + 1);
+      if (!line.length) continue;
+      let item;
+      try { item = JSON.parse(decoder.decode(line)); } catch { return null; }
+      if (!item || typeof item !== 'object' || Array.isArray(item)) return null;
+      if (unscopedFileHistory(item)) continue;
+      if (item.sessionId !== session || item.isSidechain === true) return null;
+      if (!['user', 'assistant'].includes(item.type) || item.isMeta === true) continue;
+      if (typeof item.cwd !== 'string' || !isAbsolute(item.cwd) || !within(cwd, resolve(item.cwd)) || typeof item.uuid !== 'string' || !item.uuid) return null;
+      if (item.type === 'user' && !textContent(item.message?.content).trim() && !item.message?.content?.every?.(part => part?.type === 'tool_result')) return null;
+      messageCount++; lastMessageRef = item.uuid;
+    }
+    if (pending.length > maxLineBytes) return null;
+  }
+  const after = await handle.stat();
+  if (pending.length || !messageCount || after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs) return null;
+  return { schemaVersion: 1, complete: true, digest: hash.digest('hex'), byteLength: offset, messageCount, lastMessageRef };
+}
+
+export async function readClaudeBoundary(candidate, { home, signal = AbortSignal.timeout(8000) } = {}) {
+  signal.throwIfAborted();
+  if (!UUID.test(candidate?.session || '') || typeof candidate?.cwd !== 'string') return null;
+  const matches = (await collect({ home, session: candidate.session, includeBoundary: true, signal })).filter(item => item.cwd === candidate.cwd);
+  signal.throwIfAborted();
+  if (matches.length !== 1 || Number.isFinite(candidate.lastActivityAt) && matches[0].lastActivityAt !== candidate.lastActivityAt) return null;
+  return matches[0].boundary || null;
+}
+
 export async function readClaudeStatistics(candidate, { home, signal } = {}) {
   signal?.throwIfAborted();
   if (!UUID.test(candidate?.session || '')) return unavailableStatistics();

package/src/session-supervision/codex-app-server.js

@@ -1,3 +1,6 @@
+import { captureDispatchProvenance } from '../update-detachment/provenance.js';
+import { captureDispatchOwner, assertTaskAdmission, dispatchWithFence, queueDispatchReceipt, rootFromDelivery } from '../update-detachment/dispatch-gate.js';
+import { normalizePullRequests } from './pull-requests.js';
 import { delegatedNativeSandbox, canWriteWorkspace, authorizedWorktreeGitRoots } from './native-delegation.js';
 import { flexibleReasoning } from '../codex-plugins/simy/hooks/purpose-cycle.mjs';
 import { collectPurposeObservations, refreshPurposeObservations, repositoryIdentity } from './purpose-observer.js';
@@ -17,7 +20,7 @@ import { createInterface } from 'node:readline';
 import { homedir } from 'node:os';
 import { basename, isAbsolute, join, relative, sep } from 'node:path';
 import { CODEX_WRITER_LOCK_MINIMUM_VERSION, compareVersions, inspectBackendExecutable } from '../backend-executable.js';
-import { canExecuteAutonomousExternal, assessedCheckpointContract, deliveryProgressContext, taskDirectory, understandingCheckpointContract } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { hasPendingUserStop, recordPath, rootDirectory, canExecuteAutonomousExternal, assessedCheckpointContract, deliveryProgressContext, taskDirectory, understandingCheckpointContract } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { boundConversation, boundProviderGoal, textContent } from './conversation-context.js';
 import { JsonDataUrlFilter } from './json-data-url-filter.js';
 import { RECENT_SESSION_LIMIT } from './discovery-window.js';
@@ -202,13 +205,19 @@ export function codexThreadMetadata(thread) {
   if (thread.parentThreadId || thread.source?.subAgent || thread.source?.subagent) return null;
   return {
     provider: 'codex', session: thread.id, cwd: thread.cwd,
+    pullRequests: normalizePullRequests(thread.pullRequests || thread.artifacts?.filter?.(item => item.type === 'pull_request')),
     ...(typeof thread.forkedFromId === 'string' && /^[0-9a-f-]{36}$/i.test(thread.forkedFromId) && thread.forkedFromId !== thread.id
       ? { parentSession: { provider: 'codex', session: thread.forkedFromId } } : {}),
     title: typeof thread.name === 'string' && thread.name.trim() ? thread.name.slice(0, 200) : '',
     source: typeof thread.source === 'string' ? thread.source : thread.source?.type || 'unknown',
     lastActivityAt: Number.isFinite(thread.updatedAt) ? thread.updatedAt * 1000 : null,
     model: typeof thread.model === 'string' ? thread.model : null,
-    observation: { source: 'codex_app_server', observedAt: Date.now() },
+    // Preserve native wait flags for presentation without changing isRunning,
+    // which also protects the provider writer lock. Unknown flags fail closed.
+    observation: { source: 'codex_app_server', observedAt: Date.now(),
+      ...(thread.status?.type === 'active' ? { activeFlags: Array.isArray(thread.status.activeFlags)
+        && thread.status.activeFlags.every(flag => ['waitingOnApproval', 'waitingOnUserInput'].includes(flag))
+        ? [...new Set(thread.status.activeFlags)] : null } : {}) },
     ...(thread.status?.type === 'active' || thread.status?.type === 'idle' ? { isRunning: thread.status.type === 'active' } : {}),
     availability: 'unknown',
   };
@@ -618,6 +627,10 @@ async function frozenNativeSandbox(record, root, signal) {
 }
 
 export async function executeCodexAppServer(record, { webOrigin, openClient = openCodexAppServer, signal, authorizePreparation = async () => {}, beforeDispatch = async () => {}, onStarted = async () => {}, onActivity = () => {}, onUsage = () => {}, onEvidence = async () => {}, observeExternal = collectPurposeObservations, root, auditOnly = false, opinionOnly = false, peerAction, runPeerReview = runStructuredProviderReview } = {}) {
+  const dispatchOwner = captureDispatchOwner(root ? rootFromDelivery(root) : undefined);
+  let dispatchAttemptId;
+  const provenance = captureDispatchProvenance({ root: dispatchOwner.root, provider: record.provider, providerSession: record.session, worktree: taskDirectory(record), taskId: record.run.managed.taskId, recordRef: recordPath(root || rootDirectory(), record.provider, record.session) });
+  assertTaskAdmission(dispatchOwner, { taskId: provenance.taskId, provenance });
   const run = record.run, decision = run.managed?.decision;
   if(run.managed?.enrollment?.nativeAuthorityDigest && run.managed.enrollment.nativeAuthorityDigest!==createHash('sha256').update(JSON.stringify([run.managed.providerSandbox,run.managed.providerSandboxSource])).digest('hex'))throw new CodexAppServerError('permission_narrowed','Frozen native enrollment authority changed; do not dispatch with the altered ceiling.');
   if (!decision || !run.managed.autonomyPolicy) throw new CodexAppServerError('decision', 'An assessed action is required before Codex dispatch.');
@@ -653,11 +666,16 @@ export async function executeCodexAppServer(record, { webOrigin, openClient = op
       prompt: peerOpinionPrompt(record, sourceContext, peerAction),
       output_schema: { type: 'object', properties: { opinion: { type: 'string' } }, required: ['opinion'], additionalProperties: false },
     }, { signal, readOnlyAnalysis: true, allowAutomaticRetry: false,
+      dispatchTransport: initiate => dispatchWithFence(dispatchOwner, { taskId: run.managed.taskId || record.session, attemptId: run.managed.resumeLease?.id, provenance }, attemptId => {
+        if (root && hasPendingUserStop(root, record)) throw new CodexAppServerError('cancelled', 'User stopped this provider task.');
+        dispatchAttemptId = attemptId;
+        return initiate();
+      }),
       beforeDispatch: async () => { await authorizePreparation(); await beforeDispatch({ type: 'readOnly', networkAccess: false }); },
       onContext: session => { if (peerSession && peerSession !== session) ambiguousContext = true; peerSession = session; },
       onUsage: observed => { usage = observed; onUsage(observed); } });
     if (!peerSession || peerSession === record.session || ambiguousContext || typeof reply.output?.opinion !== 'string' || !reply.output.opinion.trim()) throw new CodexAppServerError('identity', 'Independent peer context or opinion unavailable.');
-    return { code: 0, opinion: { text: evidenceExcerpt(reply.output.opinion, 2000).text, source: 'independent_codex_session', session: peerSession, model: reply.model }, usage, toolEvidence: [] };
+    return { code: 0, dispatchAttemptId, opinion: { text: evidenceExcerpt(reply.output.opinion, 2000).text, source: 'independent_codex_session', session: peerSession, model: reply.model }, usage, toolEvidence: [] };
   }
   // Connector schemas can exceed ordinary checkpoint limits; keep review pages
   // bounded to one server and a separate finite transport ceiling.
@@ -844,9 +862,10 @@ export async function executeCodexAppServer(record, { webOrigin, openClient = op
       });
       signal?.addEventListener('abort', cancelled, { once: true });
       client.child.once('close', closed);
-      turnStart = client.request('turn/start', { threadId: targetSession, input: [{ type: 'text', text: `${prompt}\n${purposeInstruction}` }], cwd: isolated ? executionCwd : record.cwd,
-        model: run.managed.resumeModel, ...(isolated ? {sandboxPolicy} : {}) })
-        .then(async response => { turnId = response?.turn?.id; activeTurnId = turnId; if (!turnId) finish(new CodexAppServerError('turn_failed', 'Codex did not start a turn.')); else {
+      const targetProvenance = captureDispatchProvenance({ root: dispatchOwner.root, provider: record.provider, providerSession: targetSession, worktree: isolated ? executionCwd : record.cwd, taskId: run.managed.taskId || record.session, recordRef: recordPath(root || rootDirectory(), record.provider, record.session) });
+      turnStart = dispatchWithFence(dispatchOwner, { taskId: run.managed.taskId || record.session, attemptId: run.managed.resumeLease?.id, provenance: targetProvenance }, attemptId => { assertTaskAdmission(dispatchOwner, { taskId: provenance.taskId, provenance }); if (root && hasPendingUserStop(root, record)) throw new CodexAppServerError('cancelled', 'User stopped this provider task.'); dispatchAttemptId = attemptId; return client.request('turn/start', { threadId: targetSession, input: [{ type: 'text', text: `${prompt}\n${purposeInstruction}` }], cwd: isolated ? executionCwd : record.cwd,
+        model: run.managed.resumeModel, ...(isolated ? {sandboxPolicy} : {}) }); })
+        .then(async response => { turnId = response?.turn?.id; activeTurnId = turnId; if (turnId) queueDispatchReceipt({ root: dispatchOwner.root, attemptId: dispatchAttemptId, receiptId: `provider:${dispatchAttemptId}:${turnId}`, providerExecutionId: turnId }); if (!turnId) finish(new CodexAppServerError('turn_failed', 'Codex did not start a turn.')); else {
           startReceipt = Promise.resolve().then(() => onStarted({ turnId, session: targetSession }));
           await startReceipt;
           startRecorded = true;
@@ -901,14 +920,14 @@ export async function executeCodexAppServer(record, { webOrigin, openClient = op
         review.findings.push(criterion ? { id: 'workspace-audit-binding', requirementId: `criterion:${criterion.id}`, source: 'controller_workspace_inventory', owner: 'controller', gap, verification: 'Establish the correct authorized workspace scope and independently bind its actual artifacts before acceptance.', reopenReason: 'The current workspace identity is unavailable or its scope changed.' } : gap);
       }
       review = assessIndependentInspection(review, { toolEvidence, observations: reviewObservations, criteria: effectiveAcceptanceCriteria(run.managed), flexible: flexibleReasoning(run.managed) });
-      return { code: 0, verification: { ...review, source: 'independent_codex_session', session: targetSession, workspaceDigest: boundAfter }, usage, toolEvidence };
+      return { code: 0, dispatchAttemptId, verification: { ...review, source: 'independent_codex_session', session: targetSession, workspaceDigest: boundAfter }, usage, toolEvidence };
     }
     const currentEvidence = beforeEvidence ? await captureWorkspace() : null;
     const controllerEvidence = beforeEvidence ? { source: 'adapter_capture', actionId: decision.id,
       baseline: run.managed.purpose.evidence?.baseline ? undefined : { ...beforeEvidence, kind: 'first_managed_observation', continuation: run.continuations },
       current: currentEvidence, before: beforeEvidence.digest, after: currentEvidence?.digest, receipts: toolEvidence } : undefined;
-    if (!run.managed.purpose?.enabled) return { code: 0, checkpoint };
-    return { code: 0, checkpoint, usage, providerTurnId: activeTurnId, providerSessionId:targetSession, toolEvidence, sourceContext, controllerEvidence };
+    if (!run.managed.purpose?.enabled) return { code: 0, dispatchAttemptId, checkpoint };
+    return { code: 0, dispatchAttemptId, checkpoint, usage, providerTurnId: activeTurnId, providerSessionId:targetSession, toolEvidence, sourceContext, controllerEvidence };
   } catch (error) {
     if (activeTurnId) error.providerTurnId ||= activeTurnId;
     if(targetSession!==record.session)error.providerSessionId ||=targetSession;

package/src/session-supervision/index.js

@@ -1,3 +1,5 @@
+import { sessionWorkState, compareSessionWork } from './work-state.js';
+import { normalizePullRequests } from './pull-requests.js';
 import { completionClaimUnbound } from '../codex-plugins/simy/hooks/completion-binding.mjs';
 import { pauseOrigin } from './autonomous-upgrade.js';
 import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/acceptance-policy.mjs';
@@ -123,7 +125,8 @@ function navigationParent(item, record) {
 }
 
 export async function discoverSessions({ root, openClient = openCodexAppServer, listClaude = listClaudeSessions,
-  inspectProcess = processIdentity, now = Date.now(), signal, listCodexTitles = readCodexTitles, listCodexChildren = readCodexChildSessions, codexHome, connectedProviders = ['codex', 'claude'], includeArchived = false } = {}) {
+  inspectProcess = processIdentity, now: requestedNow, signal, listCodexTitles = readCodexTitles, listCodexChildren = readCodexChildSessions, codexHome, connectedProviders = ['codex', 'claude'], includeArchived = false } = {}) {
+  const now = requestedNow ?? Date.now();
   const assertActive = () => { if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation discovery was cancelled.'); };
   assertActive();
   const connected = new Set(connectedProviders);
@@ -174,11 +177,13 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   for (let index = 0; index < records.length; index++) {
     assertActive();
     const record = records[index];
-    if (record.provider !== 'codex') continue;
-    const isArchived = archiveStates.get(record.session) === true;
+    const claudeItem = record.provider === 'claude' ? claude.find(item => item.session === record.session && item.cwd === record.cwd) : null;
+    const archiveState = record.provider === 'codex' ? archiveStates.get(record.session) ?? (activeCodex.has(record.session) ? false : undefined) : claudeItem?.archived;
+    if (typeof archiveState !== 'boolean') continue;
+    const isArchived = archiveState;
     if (isArchived) await recordProviderArchive(root, record.provider, record.session, true, now);
     if (isArchived && record.providerArchived === true) continue;
-    if (!isArchived && !(record.providerArchived === true && (activeCodex.has(record.session) || archiveStates.get(record.session) === false))) continue;
+    if (!isArchived && !(record.providerArchived === true && archiveState === false)) continue;
     try { records[index] = await updateRecord(root, record.provider, record.session, current => {
       if (!current) return current;
       current.providerArchived = isArchived;
@@ -204,7 +209,7 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   const recordsByKey = new Map(records.map(record => [`${record.provider}:${record.session}`, record]));
   for (const item of [...discovered, ...claude, ...archivedCodex]) {
     if (includeArchived && item.archived === true) { byKey.set(`${item.provider}:${item.session}`, item); continue; }
-    if ((item.provider !== 'codex' || archiveStates.get(item.session) !== true) && recordsByKey.get(`${item.provider}:${item.session}`)?.providerArchived !== true) byKey.set(`${item.provider}:${item.session}`, item);
+    if (item.archived !== true && (item.provider !== 'codex' || archiveStates.get(item.session) !== true) && recordsByKey.get(`${item.provider}:${item.session}`)?.providerArchived !== true) byKey.set(`${item.provider}:${item.session}`, item);
   }
   const requiredAncestors = new Set();
   for (const item of byKey.values()) {
@@ -224,7 +229,7 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
     const key = `${record.provider}:${record.session}`;
     // A hook observation can belong to an AI-created worker. Only explicit
     // supervision may restore a conversation absent from provider discovery.
-    if (!byKey.has(key) && (retainedSession(record) || requiredAncestors.has(key) && (record.observedAt || record.admission?.validatedAt))) byKey.set(key, {
+    if (!byKey.has(key) && (retainedSession(record) || includeArchived && record.listHidden === true || requiredAncestors.has(key) && (record.observedAt || record.admission?.validatedAt))) byKey.set(key, {
       provider: record.provider, session: record.session, cwd: record.cwd, title: '', archived, source: record.admission?.source || 'hook',
       lastActivityAt: record.observedAt || record.admission?.validatedAt || record.run?.updatedAt || null,
       observation: { source: record.admission?.source || `${record.provider}_hook`, observedAt: record.observedAt || record.admission?.validatedAt || null },
@@ -236,11 +241,11 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   const catalog = [...byKey.values()].map(item => {
     const record = recordsByKey.get(`${item.provider}:${item.session}`);
     const parentSession = navigationParent(item, record);
-    return { ...item, ...(parentSession ? { parentSession } : {}) };
+    return { ...item, localHidden: record?.listHidden === true, ...(parentSession ? { parentSession } : {}) };
   });
-  const items = [...recentSessionWindow(catalog.filter(item => item.archived !== true), {
+  const items = [...recentSessionWindow(catalog.filter(item => item.archived !== true && !item.localHidden), {
     priority: item => retainedSession(recordsByKey.get(`${item.provider}:${item.session}`)),
-  }), ...recentSessionWindow(catalog.filter(item => item.archived === true))];
+  }), ...recentSessionWindow(catalog.filter(item => item.archived === true || item.localHidden), { priority: item => item.localHidden })];
   // Include archived ancestors of active rows even when archive visibility is off.
   const catalogByKey = new Map(catalog.map(item => [`${item.provider}:${item.session}`, item]));
   const includedKeys = new Set(items.map(item => `${item.provider}:${item.session}`));
@@ -295,14 +300,14 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
     const continuationIssue = liveHook && run ? !run.managed && !upgradeable
       ? { code: 'existing_loop', reason: 'This conversation already has a Delivery Loop. Use its existing controls.' }
       : TERMINAL_RUNS.has(run.state) ? { code: 'task_settled', reason: 'This supervised task has settled. Review its existing status before continuing.' } : null : null;
-    let isRunning = item.isRunning;
+    let isRunning = item.isRunning, observation = item.observation;
     const hookIsNewer = Number.isFinite(record?.runtime?.observedAt) && Number.isFinite(item.lastActivityAt) && record.runtime.observedAt > item.lastActivityAt;
     if ((isRunning === undefined || isRunning === false && hookIsNewer) && record?.runtime?.process?.identity && record.cwd === item.cwd) {
       try {
         // A hook newer than the persisted provider activity may describe a
         // new turn. Require its same live process; older hooks cannot override
         // a more recent completed provider turn.
-        if (record.runtime.isRunning && await inspectProcess(record.runtime.process.pid) === record.runtime.process.identity) isRunning = true;
+        if (record.runtime.isRunning && await inspectProcess(record.runtime.process.pid) === record.runtime.process.identity) { isRunning = true; observation = { ...item.observation, observedAt: record.runtime.observedAt }; }
         else if (isRunning === undefined && !record.runtime.isRunning) isRunning = false;
       } catch { /* Unverified process leaves runtime status unknown. */ }
     }
@@ -314,12 +319,14 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       ...(item.providerGoal !== undefined ? { providerGoal: item.providerGoal } : {}),
       ...(item.goalReadState ? { goalReadState: item.goalReadState } : {}),
       tracked: typeof record?.tracked === 'boolean' ? record.tracked : record?.monitor === true,
+      providerArchived: archived, localHidden: record?.listHidden === true,
       archived,
+      pullRequests: normalizePullRequests(item.pullRequests),
       autoContinue: !archived && record?.autoContinue === true,
       autoContinueEpoch: record?.autoContinue === true ? record.autoContinueEpoch : null,
       autoContinueAvailability: availability,
       ...autoContinueState(record, isRunning, availability),
-      lastActivityAt: item.lastActivityAt, observation: item.observation, availability: item.availability,
+      lastActivityAt: item.lastActivityAt, observation, availability: item.availability,
       taskId: run?.managed?.taskId || record?.associationTaskId || null,
       binding: { mode, taskId: run?.managed?.taskId || record?.associationTaskId || null },
       originalSessionTarget: originalSessionTarget(item.provider, item.session),
@@ -343,8 +350,12 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
     }
   }));
   assertActive();
-  projected.sort((a, b) => (b.lastActivityAt || 0) - (a.lastActivityAt || 0));
-  return { sessions: projected, providers: { codex: { discovery: !connected.has('codex') ? 'disconnected' : codexError ? 'unavailable' : 'ready', reason: codexError }, claude: { discovery: !connected.has('claude') ? 'disconnected' : claudeError ? 'unavailable' : 'local_index', reason: claudeError } }, refreshedAt: now };
+  // Provider reads stamp observations after discovery starts. Compare them at
+  // projection time, while preserving an explicitly supplied verification clock.
+  const stateNow = requestedNow ?? Date.now();
+  for (const candidate of projected) candidate.workState = sessionWorkState(candidate, recordsByKey.get(`${candidate.provider}:${candidate.session}`)?.run, { now: stateNow });
+  projected.sort(compareSessionWork);
+  return { sessions: includeArchived ? projected : projected.filter(item => !item.archived && !item.localHidden), providers: { codex: { discovery: !connected.has('codex') ? 'disconnected' : codexError ? 'unavailable' : 'ready', reason: codexError }, claude: { discovery: !connected.has('claude') ? 'disconnected' : claudeError ? 'unavailable' : 'local_index', reason: claudeError } }, refreshedAt: now };
 }
 
 // Saving consent needs an exact admitted identity, not another provider RPC.