@awak-app/simy-cli 0.7.16 → 0.7.17

package/README.md

@@ -25,6 +25,15 @@ for configuration, tests and remaining host integration requirements.
 
 Local execution agent for SIMY Local Tasks and Agentic Loop runs.
 
+To supervise an explicitly requested current goal after a finished Codex run, use
+`simy delivery followup --provider codex --session SESSION_ID --previous-run-id RUN_ID --objective "Current goal and expected result"`.
+It queues read-only reconciliation for the existing persistent supervisor. A new
+goal archives the old run's evidence; the same ordinary `reported_done` goal keeps
+its run identity and budgets while adopting managed outcome verification. Explicit
+stops, opt-out, pending approvals and unknown effects remain in force. This command
+does not install or activate a supervisor, and ordinary prompts never replace a
+finished run automatically. See [runtime operation](docs/local-delivery-runtime.md).
+
 Action candidate search runs once for each authenticated live conversation context,
 and again when that context changes or **Refresh** is selected. Background binding
 renewal uses the lightweight binding endpoint instead of repeating candidate search.
@@ -125,9 +134,21 @@ For interrupted Agentic work, `GET /v1/agentic-loop/:id/recovery` provides a
 read-only objective and checkout fingerprint. Reconcile an uncertain side effect
 with `POST` to that endpoint (`action: reconcile`, authoritative
 `operation_status`, `observation`, `evidence_refs`) before resuming. A paused
-run retains the legacy metadata endpoint
-`POST /v1/agentic-loop/:id/continuation-ceilings` for compatibility. These fields
-no longer impose local limits and changing them never resets usage or resumes work. Both routes require the original authorized
+Agentic run retains `POST /v1/agentic-loop/:id/continuation-ceilings` for an
+explicit safety-ceiling extension under the progress policy. Token and retry
+budgets are notification thresholds: they do not interrupt or stop useful work.
+Agentic Loop checks a separate safety ceiling before each new provider call:
+15,000,000 weighted Provider tokens and 50 executor attempts by default, using
+existing `provider_token_ceiling` and `attempt_ceiling` settings when present.
+The final attempt may still be reviewed if token allowance remains. Active
+processes finish and their results are retained even if usage crosses the ceiling.
+A safety stop preserves run identity, output, usage and approval gates. Review
+remaining work, explicitly extend the relevant ceiling within the existing
+15M-token/100-attempt validation bounds, then request continuation of the same
+run. A notification-threshold increase alone cannot clear a safety stop; at the
+maximum ceiling, further automatic calls remain blocked. Extension itself never
+resets usage or resumes work. Local Task and managed Delivery behavior is not
+changed by this Agentic safety gate. Both routes require the original authorized
 account, organization and device throughout the request.
 
 ## Provider reconnection and saved consent
@@ -160,6 +181,10 @@ login status, tasks, and updates separately. A Codex login check does not prove
 that a task can execute successfully; permissions and service availability are
 checked when work starts.
 
+When SIMY cannot verify a provider connection or plugin status, the connection
+panel shows **Checking connection status** and **Check again**. Check again
+refreshes the status without changing the saved connection setting.
+
 The sidebar's **Organization** selector is global across Sessions, Tasks and SQM
 and shows active memberships of the connected SIMY account. Switching is available
 while work is running and opens browser authorization for the selected organization.
@@ -248,11 +273,13 @@ npm install -g @awak-app/simy-cli
 simy --daemon
 ```
 
-When an interactive `simy --daemon` starts without managed SIMY workflows,
-the CLI asks once before installing the Codex and Claude Code plugin
-sources and Codex/Claude opt-in SQM skills. Existing unrelated plugins
-and hooks are preserved. Use `--install-workflows` for explicit non-interactive
-installation or `--no-workflow-prompt` to start the daemon without asking.
+When `simy --daemon` starts without managed SIMY workflows, the CLI automatically
+prepares the Codex and Claude Code plugin sources, including in non-interactive
+services. Background maintenance also prepares missing sources and refreshes
+existing enabled plugins. Unrelated plugins and hooks are preserved.
+`--install-workflows` remains available for explicit repair;
+`--no-workflow-prompt` skips initial preparation and background installation of
+missing sources. Provider plugin enablement and hook trust remain provider-owned.
 
 SQM checks apply when you explicitly select `@simy`, invoke the SQM skill, or ask to use SQM for the current task. Ordinary PR creation and `git push` do not opt in. Upgrading and restarting the daemon migrates the legacy global PR gate and shipped personal skills; unrelated hooks are preserved. Start a new coding session to reload skill instructions.
 
@@ -369,27 +396,23 @@ stops, failures and repeated attempts without new verified outcomes, with task
 identity, agent, reasons and outcome timestamps. Missing evidence is shown as
 unknown; open time is never counted as productive time. See [work activity](docs/work-activity.md).
 
-Codex work proceeds directly in the current conversation by default. The local
-`delivery-loop` and `agentic-delivery-loop` Codex skills are retired and are not
-redistributed by workflow updates. If the user explicitly requests SIMY Delivery
-Loop, use the CLI Agentic Loop rather than the retired local skill. Installation,
-hook trust and ordinary PR creation never authorize starting a loop or SQM.
-Internal lifecycle and workspace-lease libraries remain available for existing
-explicitly opted-in managed tasks; this packaging change does not start, trust,
-resume or reset any task. Quality and PR review skills remain available.
-Already open Codex sessions may cache the old skill until a new session starts.
-
-Claude Code retains its opt-in, hook-based Delivery Loop from an independent
-workflow source. Install the plugin, review and enable SIMY hooks with `/hooks`,
-then request `/simy:delivery-loop` for the task. Installing or updating the plugin
-never approves hook trust. See [hook delivery behavior and limits](docs/delivery-hooks.md).
+The CLI prepares and maintains provider plugin sources automatically. Once the
+user enables the SIMY plugin and permits its hooks, a nonempty prompt starts
+checkpoint tracking in an eligible Codex or Claude conversation. The local Codex
+`delivery-loop` and `agentic-delivery-loop` skills remain retired; prompt hook
+context supplies checkpoint instructions without reinstalling those skills.
+Existing tasks, stops, permission waits and provider/session opt-outs are preserved.
+Use `simy delivery auto off --provider codex` (or `claude`) for a project override.
+Completion in this standard flow is provider-reported, not independently verified.
+See [hook delivery behavior and limits](docs/delivery-hooks.md).
 The Connection tab checks each provider's actual SIMY plugin inventory and
 shows installed/enabled, installed/disabled, missing, or unavailable separately
 from app sign-in. Claude enablement is checked from the home folder; project
 settings can differ, and project-scoped installations are labeled explicitly.
 
 `--no-auto-update` or `SIMY_AUTO_UPDATE=0` disables these background updates too;
-`--no-workflow-prompt` only suppresses the initial installation prompt.
+`--no-workflow-prompt` skips initial preparation and background installation of
+missing sources; existing sources still receive updates.
 
 This is the recommended installation because the CLI can safely install patch
 and minor releases, and the daemon restarts only when no Agentic Loop task is active. To run
@@ -1061,8 +1084,9 @@ that explicitly activated candidate when no live desktop owns the state director
 A live unknown/mismatched owner is preserved and reported. `runtime doctor` reports
 expected versus observed host identity, the all-state consistency monitor, and
 remaining task findings. `runtime legacy-hooks` routes only the exact shipped
-0.6.23/0.6.24 Codex hook entrypoints to the verified pin, retaining originals;
-customized hooks and trust settings remain unchanged. `runtime workflows` refreshes
+0.6.23/0.6.24 and commit 2052e787 Codex hook entrypoints to the verified pin.
+All exported helpers use that pin too; saved originals are never imported as
+a fallback. Customized hooks are reported as `customized_retained`. `runtime workflows` refreshes
 existing provider workflows without enabling them.
 
 `runtime doctor` also returns `taskReadiness` for every existing task: its original
@@ -1141,7 +1165,11 @@ unverified original model nor a different provider is substituted automatically.
 
 ### Manually consult SIMY about a stopped task
 
-Ask “SIMY CLIに相談して” in Codex to use the `simy:diagnose` skill. Supply the original session/task ID when asking from another chat. A terminal can use the same entry even when the original conversation is unresponsive:
+Ask “SIMY CLIに相談して” or “原因を調べて” in Codex to use the `simy:diagnose` skill for diagnosis only. “直して続きを進めて” explicitly requests repair and continuation within existing permissions. The skill resolves the current conversation or an existing selected/original job reference; from another chat, select the original job or refer to its conversation. Only an ambiguous target requires clarification, and users normally do not need to type internal IDs.
+
+The skill calls `delivery consult --scope diagnose` or `delivery consult --scope repair_continue --request-id USER_TURN_ID`. It preserves the chosen `--host`. Explicit references override existing selection, which overrides the observed current conversation; a missing or mismatched reference never redirects to another job. Repair delegates to the installed repair adapter, preserving stop, permission, budget and duplicate-work protections. If that adapter is absent, `recovery_unavailable` means no recovery was executed. Repair success is not original-task completion. See [the shared contract](docs/conversation-recovery-contract.md).
+
+For terminal use and older CLIs, the read-only diagnosis command remains available even when the original conversation is unresponsive:
 
 ```sh
 ~/.simy/bin/simy delivery diagnose --provider codex --session ORIGINAL_SESSION --task-id ORIGINAL_TASK
@@ -1159,6 +1187,103 @@ Default issue selection is the first eight original acceptance criteria (or `obj
 
 Manual diagnosis and delivery reasoning share the scoped SQM knowledge loader. Partial environment overrides cannot mix a token, account, organization or endpoint with saved credentials; unavailable knowledge is reported without blocking the diagnosis. The brief response retains `knowledge.status`, `reason`, `suppliedCount`, and `bundleDigest`, separately from `knowledgeReferenceCount` and test execution (always zero for diagnosis). Truncated evidence is disclosed to both the analyst and the caller.
 
+### Local Task delivery to an authorized device folder
+
+A single-invocation, repository-write durable Local Task can include
+`execution_spec.local_destination`:
+
+```json
+{
+  "device_id": "paired-device-id",
+  "repository": "Organization/repository",
+  "relative_directory": "deliverables"
+}
+```
+
+The repository must match the execution workspace and resolve through the CLI's
+existing authorized repository inventory. Alternatively, an explicitly delegated
+native Codex task may specify `authorized_root` instead of `repository`. That
+absolute directory must be within the existing native session's verified cwd or
+`sandbox.writableRoots`; the native adapter reports these roots after verifying
+current account, model, workspace and existing permissions. No new grant is made.
+The directory must already exist. Read-only tasks and stepped execution do not
+support delivery. A folder outside existing native roots must be selected through
+the original provider's workspace permission flow; a repository scan alone does
+not authorize arbitrary folder writes.
+
+The worker verifies current output bytes, publishes each file without replacing
+existing files, and checks size, SHA-256 and path identity through local readback.
+An identical existing file is a safe replay; a different revision is preserved and
+delivery fails. Only verified local receipts are persisted in the private task
+snapshot; the original turn's result summary includes confirmed paths. A folder
+save is not a claim that an office application rendered or opened the file.
+
+Offline claims are left to the existing durable lease/reconnect path; no local
+success or alternate device fallback is synthesized. Stop/lease checks also apply
+before file publication. Multiple file delivery may be partial if a later file
+fails; the turn does not report success in that case. Existing local outputs are
+kept for reconciliation without rerunning an uncertain provider operation.
+
+Cloud inputs continue through the existing verified attachment store and outputs
+through the existing artifact contract. This contract does not advertise native
+browser/Photos automation: `browser_capability` remains unknown until an actual
+adapter is observed. It does not substitute a server browser for the owner's
+logged-in browser or grant authority to submit payment/card forms.
+
+The same destination is accepted on the existing native
+`POST /v1/local-tasks/start` body as `local_destination`. It is included in the
+request fingerprint, checked before the native turn, and saved before terminal
+success. Reconcile returns the same Local Task, original conversation identity
+and verified destination receipts. A changed destination under the same request
+key conflicts instead of running another native turn. Direct repository tasks
+use the same private, ignored output folder layout as durable repository tasks,
+so outputs stay inside existing native workspace permissions.
+
+Optional `local_photo_source: {device_id, asset_ids}` is a bounded PhotoKit
+metadata source for 1–20 explicitly selected asset identifiers. The local adapter
+requires existing Swift developer tooling (and never launches its installer),
+checks current Photos authorization, never requests permission or enumerates
+the library, and returns only selected IDs, dimensions, date and location. It
+does not export images or claim visual photo recognition. Missing authorization
+or unavailable selected IDs holds the work before provider invocation; users can
+supply the photo through the existing attachment flow. No native Photos or
+browser capability is inferred for a generic model. PhotoKit source reference:
+[PHPhotoLibrary](https://developer.apple.com/documentation/photos/phphotolibrary).
+
+Owner-browser execution uses Crew's existing `browser_action` capability and
+paired Chrome extension queue, independently of CLI/native model execution.
+P10's companion browser change adds explicit `device_id` and an optional
+`interaction_scope: "observe_only"` that permits only observation primitives in
+an existing tab. It cannot type into card fields, click or submit. Its original
+queue task/device/deadline and result are retained across offline re-entry.
+
+When the result gateway is offline after file delivery, the existing private task
+snapshot retains the exact terminal receipt. The same paired device retries only
+that receipt on reconnect/restart, preserving the original turn and files. It
+does not claim a new task or re-invoke the provider. A fenced lease remains
+unconfirmed and never becomes permission to replay the work.
+
+
+For a paired native Codex write, `workspace_mode: task_sandbox` remains artifact
+management metadata. It does not move the selected native conversation. After
+current account/model/cwd/sandbox and lease checks, the CLI places the execution's
+private output directory under that verified native cwd at
+`.simy/local-tasks/<execution-id>/outputs` and rebuilds the provider instruction.
+Both generation and final destination therefore stay inside existing native
+write permissions. No new sandbox root or cwd override is sent to the provider.
+Readonly native tasks and Claude's ordinary permission flow do not acquire this
+Codex-specific writable-root capability.
+
+Web/Backend admission must preserve the optional destination and selected Photos
+request in the existing canonical native execution spec and request hash, pinned
+to the same selected paired device. These fields express intent; no `verified`
+flag, path in model context, previous receipt or old native root is a grant.
+Every new execution rechecks current device/account/link/session/lease and actual
+native roots or PhotoKit authorization. Follow-up preserves the chosen profile;
+a changed destination requires a fresh explicit admission, never a rewrite of an
+already-used request key. Revisions use the explicitly requested new artifact
+name; another revision already present at the same path is preserved and held.
+
 Provider diagnostics distinguish `authentication`, `connection`, and `connection_ready`.
 If both login and SIMY connection are missing, `actions` lists both remedies in one
 report. Connection readiness does not certify model access or task completion.
@@ -1192,3 +1317,32 @@ Search covers the current recent window (up to 200 active conversations and,
 with `--include-archived`, up to 200 archived conversations); older entries outside
 that window are not searched. This view respects the saved
 Codex provider connection setting and never enables automatic continuation.
+
+The existing per-provider heartbeat now includes `device_io` with
+`schema_version: local_device_io.v1`. It distinguishes Codex verified native-cwd
+staging/root delivery, Claude's provider permission flow, and selected Photos
+metadata requiring existing macOS authorization. It contains no paths or grants;
+normal provider/device readiness and runtime reauthorization still apply.
+The ordinary worker also sends `X-SIMY-Device-IO: local_device_io.v1` with its
+existing native protocol header. Web/gateway should preserve this marker and
+Backend should require it at claim/invocation when a destination/Photos profile
+is requested, so an old worker cannot silently ignore those required outputs.
+
+### Delivery entry routes
+
+Crew owns `sessionLoopOptions` in the distributed loop kernel. Codex enrollment,
+Continue, follow-up, desktop controls and automatic continuation use purpose v2
+by default; old false/v1 enrollment flags cannot select the retired mode.
+Explicit strict/balanced policies and human acceptance criteria remain binding.
+Compatible saved tasks migrate without replacing identity, history or budget.
+
+`~/.simy/bin/simy` is the installed CLI entry. Point any earlier shell alias or
+PATH symlink to it. `runtime legacy-hooks` switches known installed plugin caches
+to the same pin; check its output for customized hooks that still need review.
+`runtime supervisor-watchdog-install` registers the stable Node entry
+`~/.simy/bin/simy-runtime.mjs`, which resolves the verified runtime pin on each
+process start, instead of retaining a release-specific service path.
+When supervision is already live, install the candidate, request
+`runtime supervisor-handover --release ABSOLUTE_RELEASE`, and wait for activation.
+The watcher preserves the live supervisor while service registration is updated.
+No command here enrolls an unrelated conversation or renews an existing budget.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.16",
+  "version": "0.7.17",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -43,7 +43,7 @@
     "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js && npm run check:sqm",
     "check:workflow-observation-sender": "node --check ./src/workflow-observation-sender.js",
     "check:sqm": "node --check ./src/sqm/advisory-guidance.js && node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/reliability.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./src/sqm/agent-skill.js && node --check ./src/sqm/workflow-onboarding.js && node --check ./src/sqm/workflow-update.js && node --check ./src/sqm/history-store.js && node --check ./src/sqm/review-worker.js && node --check ./scripts/sqm-complete-loop-e2e.js && node --check ./scripts/sqm-local-review-e2e.js",
-    "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js",
+    "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js && node --check ./scripts/codex-plugin-runtime-e2e.js",
     "check:syntax": "node --check ./src/purpose-local-proof.js && node --check ./src/device-signing-identity.js && node --check ./src/index.js && node --check ./src/install-update.js && node --check ./src/agent.js && node --check ./src/connection-discovery.js && node --check ./src/connection-diagnostics.js && node --check ./src/launch-authorization.js && node --check ./src/codex-plugins/simy/hooks/connection-reminder.mjs && node --check ./src/codex-plugins/simy/hooks/dev-work.mjs && node --check ./src/dev-work-events.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/login-shell-path.js && node --check ./src/hook-runtime.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/pr-preparation.js && node --check ./src/orchestrator/minimum-completion.js && node --check ./src/orchestrator/delivery/scripts/check-minimum-completion.mjs && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./src/coding-run-store.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js && node --check ./src/codex-plugins/simy/hooks/delivery-loop.mjs && node --check ./src/delivery-hooks/command.js && node --check ./src/delivery-hooks/desktop.js && node --check ./src/delivery-hooks/supervisor.js && node --check ./src/delivery-hooks/recovery.js && node --check ./src/delivery-hooks/supervisor-owner.js && node --check ./src/delivery-hooks/supervisor-watchdog.js && node --check ./src/delivery-hooks/supervisor-service.js && node --check ./scripts/supervisor-watchdog-live-e2e.js && node --check ./src/codex-plugins/simy/hooks/recovery-incident.mjs && node --check ./src/session-supervision/automatic-continuation.js && node --check ./src/session-supervision/stop-notifications.js",
     "check:package": "node ./scripts/check-package-contents.js",
     "build:macos-installer:dev": "bash packaging/build-macos-arm64.sh --unsigned-dev",
@@ -52,6 +52,7 @@
     "build:macos-installer:production": "bash packaging/build-macos-arm64.sh --production",
     "test:e2e:claude-parity": "node ./scripts/claude-parity-runtime-e2e.js",
     "test:e2e:claude-plugin": "node ./scripts/claude-plugin-runtime-e2e.js",
+    "test:e2e:codex-plugin": "node ./scripts/codex-plugin-runtime-e2e.js",
     "test:e2e:flexible-delivery": "node --test --test-name-pattern=\"flexible prototype\" test/purpose-search.test.js",
     "test:e2e:sqm-faults": "node ./scripts/sqm-complete-loop-e2e.js"
   },

package/src/agent.js

@@ -1,3 +1,7 @@
+import { readLocalPhotoSource } from "./local-photos.js";
+import { resolveLocalTaskDestination, saveLocalTaskDestination } from "./local-task-destination.js";
+import { observePairedNativeIdentities } from './native-provider-identity.js';
+import { providerDelegationFromRequest } from './provider-delegation.js';
 import { createLedgerExecutionWorker, discoverLedgerWorkers } from './update-detachment/worker-ledger.js';
 import { normalizeProviderModelSelection } from "./provider-model-selection.js";
 import { assertConnectionScope, connectionScope, connectionDiagnostic } from "./connection-diagnostics.js";
@@ -147,6 +151,7 @@ import {
 import {
   createDurableLocalTaskApi,
   createDurableLocalTaskWorker,
+  prepareRepositoryWorkspace,
 } from "./durable-local-task-worker.js";
 import { createLocalTaskAttachmentStore } from "./local-task-attachment-store.js";
 import {
@@ -297,12 +302,20 @@ export async function startAgent({
     if (!link?.connected || expected && link.epoch !== expected.epoch) throw Object.assign(new Error("Reconnect this provider to SIMY before using it."), { code: "provider_link_disconnected" });
     return link;
   };
+  let nativeIdentityCapability = null, nativeIdentityActor = null, nativeIdentityObservedAt = 0, nativeIdentityReadInFlight = null;
+  const nativeActor = () => JSON.stringify([apiOrigin, session?.account_id, session?.organization_id, session?.device_id]);
   let providerStatuses = { codex: { state: "unknown" }, claude: { state: "unknown" } };
   const providerRecoveryRevisions = { codex: 0, claude: 0 };
   const refreshAvailableCapabilities = () => {
     const features = contractSourceCapabilities.features;
     availableCapabilities = withCliContract({
       ...contractSourceCapabilities,
+      ...(features?.native_delegation === true || dependencies.observePairedNativeIdentities ? {
+        native_delegation: nativeIdentityActor === nativeActor() && isSessionValid(session, Date.now(), apiOrigin)
+          ? { ...nativeIdentityCapability, identities: (nativeIdentityCapability?.identities || []).filter(identity =>
+            providerLinks[identity.provider]?.connected && (providerLinks[identity.provider]?.epoch ?? null) === identity.connection_epoch) }
+          : { schema_version: 'native_delegation_capability.v1', device_id: session?.device_id || null, identities: [] },
+      } : {}),
       ...(purposeSigner ? { purpose_verification: purposeSigner } : {}),
       ...(features ? { features: { ...features, purpose_host_verification: Boolean(purposeSigner) && isSessionValid(session, Date.now(), apiOrigin), ...(Object.hasOwn(features, "sqm_local_review")
         ? { sqm_local_review: features.sqm_local_review === true && sqmEnabled && !pendingOrganization && desktopWorkAllowed() } : {}) } } : {}),
@@ -489,6 +502,24 @@ export async function startAgent({
           notifyDesktopStatusChange();
         }
       })]);
+      if ((contractSourceCapabilities.features?.native_delegation === true || dependencies.observePairedNativeIdentities) && session?.device_id && !nativeIdentityReadInFlight && (force || nativeIdentityActor !== nativeActor() || Date.now() - nativeIdentityObservedAt > 60000)) {
+        const actor = nativeActor();
+        const observation = (async () => {
+          const observed = await (dependencies.observePairedNativeIdentities || observePairedNativeIdentities)({
+            deviceId: session.device_id, providerStatuses, providerLinks });
+          if (!shuttingDown && actor === nativeActor()) {
+            nativeIdentityCapability = observed; nativeIdentityActor = actor; nativeIdentityObservedAt = Date.now();
+            refreshAvailableCapabilities();
+            notifyDesktopStatusChange();
+            // Official account observation must not delay the existing desktop
+            // startup/status path. Publish its catalog when it is actually ready.
+            if (deferStartupSynchronization) void heartbeat().catch(error => reportHeartbeatError(error, quiet));
+          }
+        })();
+        nativeIdentityReadInFlight = observation;
+        void observation.finally(() => { if (nativeIdentityReadInFlight === observation) nativeIdentityReadInFlight = null; }).catch(() => {});
+        if (!deferStartupSynchronization) await observation;
+      }
       const binaryStateChanged = ["codex", "claude"].some((provider) =>
         previous[provider]?.version !== providerStatuses[provider]?.version ||
         previous[provider]?.state !== providerStatuses[provider]?.state);
@@ -544,7 +575,21 @@ export async function startAgent({
       await callback?.(...args);
       await guard();
     };
-    return { ...options, sessionRoot, beforeProviderInvocation: wrap(options.beforeProviderInvocation), beforeSpawn: wrap(options.beforeSpawn) };
+    return { ...options, sessionRoot, delegationOptions: { supervisionRoot: join(sessionRoot, "delivery-hooks"), pairedDeviceId: session?.device_id, providerLinkEpoch: link?.epoch ?? null, ...options.delegationOptions,
+        onWorkspaceAuthorized: async roots => {
+          await guard();
+          if (task.local_destination?.authorized_root) {
+            await resolveLocalTaskDestination({ local_destination: task.local_destination, operation: task.operation,
+              permission_mode: task.permission_mode, workspace_mode: task.workspace_mode, repository: task.repository }, {
+              deviceId: session?.device_id, resolveRepository: ensureRepositoryIndexed, nativeWritableRoots: roots,
+            });
+          }
+          task.native_writable_roots = [...roots];
+          await options.delegationOptions?.onWorkspaceAuthorized?.(roots);
+          await guard();
+        } },
+      beforeCompletion: options.beforeCompletion ? wrap(options.beforeCompletion) : null,
+      beforeProviderInvocation: wrap(options.beforeProviderInvocation), beforeSpawn: wrap(options.beforeSpawn) };
   };
   const codingRuntimeOptions = run => {
     const wrap = (custom, marker) => async context => {
@@ -856,7 +901,7 @@ export async function startAgent({
     notifyDesktopStatusChange();
     let deviceHeartbeatSucceeded = false;
     const requestedSession = session;
-    const advertisedProviders = JSON.stringify(providerStatuses);
+    const advertisedProviders = JSON.stringify([providerStatuses, nativeIdentityCapability]);
     heartbeatInFlight = Promise.resolve()
       .then(async () => { if (enforceDesktopAccess) await desktopAccess.refresh(true); })
       .then(() =>
@@ -878,7 +923,7 @@ export async function startAgent({
         // browser authorization. Publish verified readiness after their probe.
         const publishVerifiedProviders = async () => {
           await readProviderStatuses();
-          if (!shuttingDown && JSON.stringify(providerStatuses) !== advertisedProviders) {
+          if (!shuttingDown && JSON.stringify([providerStatuses, nativeIdentityCapability]) !== advertisedProviders) {
             await heartbeatDevice({ apiOrigin, apiBaseUrl: session.api_base_url, token: session.token,
               port, capabilities: refreshAvailableCapabilities(), repoInventory: repositoryInventory });
           }
@@ -1011,6 +1056,8 @@ export async function startAgent({
       createDurableLocalTaskWorker;
     durableLocalTaskWorker = createWorker({
       api: durableApi,
+      enableBoundedSubtasks:
+        availableCapabilities.features.bounded_local_task_subtasks === true,
       registry: localTaskRegistry,
       storageRoot: taskStorageRoot,
       workspaceRoot: dependencies.localTaskWorkspaceRoot,
@@ -1029,6 +1076,7 @@ export async function startAgent({
         return (dependencies.runLocalTask || startLocalTask)(task, providerRuntimeOptions(task, options, scope, link));
       },
       attachmentStore: localTaskAttachmentStore,
+      readPhotoSource: dependencies.readLocalPhotoSource || readLocalPhotoSource,
       getDeviceId: () => session?.device_id || null,
       beginWork: () => acquireUpdateWork(updateManager),
       onError: (error) => reportDurableLocalTaskError(error, quiet),
@@ -1777,12 +1825,17 @@ export async function startAgent({
           });
           return;
         }
-        let requestFingerprint;
+        let requestFingerprint, providerDelegation;
         try {
+          providerDelegation = providerDelegationFromRequest(body, idempotencyKey);
           requestFingerprint = createLocalTaskRequestFingerprint({
             instruction,
             backend: body.backend,
             model: body.model,
+            delegation: providerDelegation,
+            localDestination: body.local_destination,
+            localPhotoSource: body.local_photo_source,
+            nativeIdentity: body.native_identity,
             operation: guardrail.operation,
             permissionMode: guardrail.permission_mode,
             workspaceMode,
@@ -1882,7 +1935,7 @@ export async function startAgent({
             workspace = {
               ...prepared,
               id,
-              workspace_path: indexedRepository.local_path,
+              ...(await prepareRepositoryWorkspace({ repositoryPath: indexedRepository.local_path, expectedRepository: repository, localTaskId: id, prepareOutputs: body.permission_mode === "workspace_write" })),
             };
           } else {
             const id = createLocalTaskId();
@@ -1895,6 +1948,19 @@ export async function startAgent({
               })),
             };
           }
+          if (body.local_destination?.authorized_root && providerDelegation?.provider !== "codex") {
+            throw Object.assign(new Error("The selected folder requires an already authorized native Codex workspace."), { code: "local_task_destination_unconfirmed" });
+          }
+          let deliveryTask = null;
+          const destinationSpec = { ...body, workspace_mode: workspaceMode, repository };
+          const resolveDestination = () => resolveLocalTaskDestination(destinationSpec, {
+            deviceId: session?.device_id,
+            resolveRepository: ensureRepositoryIndexed,
+            nativeWritableRoots: deliveryTask?.native_writable_roots,
+          });
+          let destination = body.local_destination && !body.local_destination.authorized_root ? await resolveDestination() : null;
+          const photoContext = body.local_photo_source ? await (dependencies.readLocalPhotoSource || readLocalPhotoSource)(body.local_photo_source, { deviceId: session?.device_id }) : null;
+          await authorizeDesktopWork(requestAccessScope);
           const stagedAttachments = await stagePreparedRunAttachments({
             runId: workspace.id,
             prepared: preparedAttachments,
@@ -1905,6 +1971,10 @@ export async function startAgent({
             instruction,
             backend: body.backend,
             model: body.model,
+            delegation: providerDelegation,
+            localDestination: body.local_destination,
+            localPhotoSource: body.local_photo_source,
+            nativeIdentity: body.native_identity,
             operation: guardrail.operation,
             permissionMode: guardrail.permission_mode,
             workspaceMode,
@@ -1915,6 +1985,7 @@ export async function startAgent({
             outputsRoot: workspace.outputs_root,
             outputsRootExpected: workspace.outputs_root_expected,
             attachments: stagedAttachments,
+            localPhotoContext: photoContext,
             expectedOutputs: body.expected_outputs,
             scenarioPack,
             providerTokenBudget: body.provider_token_budget,
@@ -1927,6 +1998,7 @@ export async function startAgent({
             workflowStartIntent,
             purposeVerification,
           });
+          deliveryTask = task;
           if (purposeVerification) await preparePurposeVerification(task, { session, apiOrigin, clientRequestId: idempotencyKey, keyPath: purposeKeyPath,
             authorize: async () => {
               await authorizeDesktopWork(requestAccessScope);
@@ -1937,7 +2009,27 @@ export async function startAgent({
           requestClaim.complete(task);
           requestClaimCompleted = true;
           const runLocalTask = dependencies.runLocalTask || startLocalTask;
-          const runtimeOptions = providerRuntimeOptions(task, { session, apiOrigin, beforeSpawn: async localTask => {
+          const runtimeOptions = providerRuntimeOptions(task, { session, apiOrigin,
+            beforeCompletion: body.local_destination ? async completed => {
+              await authorizeDesktopWork(requestAccessScope);
+              const current = await resolveDestination();
+              if (destination && (current.root !== destination.root || current.directory !== destination.directory)) {
+                throw Object.assign(new Error("The authorized save folder changed."), { code: "local_task_destination_unconfirmed" });
+              }
+              destination ||= current;
+              completed.local_destination_receipts = [];
+              await saveLocalTaskDestination({ task: completed, destination: current,
+                assertActive: async () => {
+                  await authorizeDesktopWork(requestAccessScope);
+                  if (completed.stop_requested) throw Object.assign(new Error("Local delivery was stopped."), { code: "local_task_destination_unconfirmed" });
+                },
+                onReceipt: async receipt => {
+                  completed.local_destination_receipts.push(receipt);
+                  await persistLocalTask(completed);
+                },
+              });
+            } : null,
+            beforeSpawn: async localTask => {
               if (purposeWorkspaceBusy(localTask.workspace_path)) throw Object.assign(new Error("Independent verification owns this workspace."), { code: "purpose_verification_workspace_busy" });
               if (purposeVerification) {
                 await authorizeDesktopWork(requestAccessScope);
@@ -1999,6 +2091,10 @@ export async function startAgent({
           return;
         }
         const body = await readJson(req);
+        if (body.delegation || body.delegation_target) {
+          json(res, 409, { error: 'Provider delegation requires the existing Local Task admission.', code: 'delegation_local_task_required' });
+          return;
+        }
         const instruction = String(body.instruction || "").trim();
         if (!instruction) {
           json(res, 400, { error: "instruction is required" });
@@ -2705,7 +2801,7 @@ export async function startAgent({
       if (codingRunMonitorTimer) clearInterval(codingRunMonitorTimer);
       updateManager?.stop?.();
       await Promise.all([stopDesktopTasks(), codexWorkPatternSync?.close?.(),
-        codexWorkPatternSyncInFlight, codingRunMonitorInFlight]);
+        codexWorkPatternSyncInFlight, codingRunMonitorInFlight, nativeIdentityReadInFlight?.catch(() => {})]);
       try {
         await (dependencies.removeConnectionDiscovery || removeConnectionDiscovery)(
           connectionDiscovery,
@@ -2830,6 +2926,29 @@ export async function startAgent({
       sqmLocalReviewWorker?.retry?.(); notifyDesktopStatusChange();
     },
     async retrySqmEnvironment() { await authorizeDesktopWork(); sqmLocalReviewWorker?.retry?.(); notifyDesktopStatusChange(); },
+    getTeamThreadsScope() {
+      return { key: desktopScopeRevision(),
+        fenceKey: createHash('sha256').update(JSON.stringify([apiOrigin, session?.account_id ?? null, session?.organization_id ?? null, session?.device_id ?? null])).digest('hex'),
+        organizationId: session?.organization_id ?? null,
+        authenticated: !shuttingDown && !pendingOrganization && isSessionValid(session, Date.now(), apiOrigin) && Boolean(session?.device_id),
+        allowed: !shuttingDown && desktopWorkAllowed() && desktopAccessReady(desktopAccess.snapshot()) };
+    },
+    async requestTeamThreads(body, signal) {
+      const selected = session;
+      const scope = desktopScopeRevision();
+      const off = body?.operation === 'consent' && body.enabled === false;
+      if (!off) await authorizeDesktopWork(scope);
+      if (shuttingDown || pendingOrganization || !isSessionValid(selected, Date.now(), apiOrigin) || selected !== session) throw new Error('Team sign-in required');
+      const response = await (dependencies.fetch || globalThis.fetch)(webApiUrl('team-threads', { webOrigin: apiOrigin, apiBaseUrl: selected.api_base_url }), {
+        method: body ? 'POST' : 'GET', headers: webApiHeaders({ token: selected.token }, body ? { 'Content-Type': 'application/json' } : {}),
+        ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.any([signal, AbortSignal.timeout(10_000)]), cache: 'no-store', redirect: 'error',
+      });
+      if (scope !== desktopScopeRevision() || selected !== session || signal.aborted) throw new Error('Team sign-in changed');
+      if (!response.ok) throw Object.assign(new Error('Shared conversations unavailable'), { status: response.status });
+      const raw = await response.text();
+      if (raw.length > 1_048_576) throw new Error('Team response too large');
+      return JSON.parse(raw);
+    },
     async createDesktopWebSession() {
       const scope = await authorizeDesktopWork();
       const selected = session;
@@ -3298,6 +3417,7 @@ function capabilitiesFromInspections(codex, claude) {
       },
     },
     features: {
+      team_threads: true,
       repository_scan_approval: true,
       executor_version_preflight: true,
       desktop_executor: true,
@@ -3308,6 +3428,7 @@ function capabilitiesFromInspections(codex, claude) {
       local_task_streaming: true,
       local_task_idempotency: true,
       local_task_model: true,
+      native_delegation: true,
       progress_continuation_policy: true,
       local_task_reconciliation: true,
       local_task_control_plane: true,