@awak-app/simy-cli 0.7.16 → 0.7.17

package/src/orchestrator/loop.js

@@ -1,3 +1,4 @@
+import { safetyCeilingRecoveryMessage } from "./recovery.js";
 import { randomUUID } from "node:crypto";
 import { completedWorkerResult } from "../coding-run-recovery.js";
 import { redactExecutionText } from "./execution-io.js";
@@ -203,16 +204,6 @@ async function runCodingLoopOwned({
     attempt.budget = refreshBudgetState(snapshot);
     recordBudgetWarnings(snapshot, attempt);
 
-    if (snapshot.budget.token_exhausted) {
-      await stopForBudget({
-        snapshot,
-        attempt,
-        reason: "token_budget_exhausted",
-        onUpdate,
-      });
-      return snapshot;
-    }
-
     if (!attempt.audit.passed) {
       snapshot.final_audit = attempt.audit;
       delete snapshot.metadata?.completed_worker_result;
@@ -351,10 +342,8 @@ async function reviewAttempt({ snapshot, attempt, executeIndependentAudit, shoul
   attempt.token_usage = mergeTokenUsage(attempt.token_usage, auditExecution.tokenUsage);
   attempt.budget = refreshBudgetState(snapshot);
   recordBudgetWarnings(snapshot, attempt);
-  if (attempt.budget.token_exhausted) {
-    await stopForBudget({ snapshot, attempt, reason: "token_budget_exhausted", onUpdate });
-    return true;
-  }
+  // Finish local evidence processing even when this completed review crossed
+  // its ceiling. Admission checks fence the next provider call.
 
   attempt.independent_audit.result_parse = normalizeResultParseDiagnostic(auditExecution.result_parse);
   attempt.independent_audit.reviewed_checks = reviewedChecks;
@@ -584,15 +573,6 @@ async function handleFailedAudit({
   onUpdate,
 }) {
   snapshot.charter.thread_state.failure_count += 1;
-  const budget = refreshBudgetState(snapshot);
-  if (budget.token_exhausted) {
-    return stopForBudget({
-      snapshot,
-      attempt,
-      reason: "token_budget_exhausted",
-      onUpdate,
-    });
-  }
   const diagnosticCircuit = evaluateRetryCircuit({ attempt, previousAttempt: snapshot.attempts.at(-2) ?? null, findings });
   const technicalStall = attempt.outcome_progress?.stalled || attempt.outcome_progress?.assessment_unavailable || diagnosticCircuit.open && !attempt.outcome_progress?.has_progress;
   if (technicalStall && !requiresHuman) {
@@ -643,7 +623,9 @@ async function handleFailedAudit({
     previousAttempt: snapshot.attempts.at(-2) ?? null,
     findings,
   });
-  if (retryCircuit.open && !attempt.outcome_progress?.has_progress) {
+  if (retryCircuit.open && !attempt.outcome_progress?.has_progress &&
+      !(attempt.audit?.passed && attempt.outcome_progress?.status === "insufficient_evidence" &&
+        !attempt.outcome_progress?.failed_ids?.length)) {
     const avoidedAttempts = Math.max(snapshot.charter.max_attempts - attemptNumber, 0);
     const circuitState = {
       state: "open",
@@ -683,34 +665,21 @@ async function handleFailedAudit({
     });
     return true;
   }
-  if (attempt.outcome_progress?.assessment_unavailable) {
-    const progress = attempt.outcome_progress;
+  if (attempt.outcome_progress?.assessment_unavailable && !requiresHuman) {
+    for (const finding of findings) {
+      if (finding.code === 'INDEPENDENT_AUDIT_UNAVAILABLE') {
+        finding.auto_fix_hint = 'Preserve the implementation and perform a direct check of the requested behavior using another available method. Continue concrete remaining work; do not generate evidence packages or replay completed external writes.';
+      }
+    }
     snapshot.final_audit = {
-      ...(snapshot.final_audit || {}),
-      passed: false,
-      summary: "Outcome progress could not be assessed across consecutive attempts.",
-      findings: [...(snapshot.final_audit?.findings || []), {
-        passed: false,
-        code: "OUTCOME_ASSESSMENT_UNAVAILABLE",
-        severity: "blocker",
-        target: "outcome_monitor",
-        explanation: "Two consecutive attempts could not establish an independent outcome assessment. Resolve the recorded verification failures and continue this run; this does not prove the work has stalled.",
-        repairability: "auto",
-        blocker_kind: "machine",
-      }],
-      auto_repairable: false,
-      requires_human: false,
+      ...(snapshot.final_audit || {}), passed: false,
+      auto_repairable: true, requires_human: false,
     };
-    appendEvent(snapshot, "blocked", "AI diagnosis could not recover the outcome assessment; preserve the concrete execution blocker.", {
-      code: "outcome_assessment_unavailable",
-      finding_codes: ["OUTCOME_ASSESSMENT_UNAVAILABLE"],
-      attempt_number: attemptNumber,
-      consecutive_unassessed_attempts: progress.consecutive_unassessed_attempts,
-      unavailable_reason: progress.unavailable_reason,
-      unproven_ids: progress.unproven_ids,
-    });
-    await publish(snapshot, "blocked", onUpdate);
-    return true;
+    appendEvent(snapshot, "re_instructing",
+      "Independent assessment is unavailable. Continue authorized work and check the actual outcome through another available method; do not recreate audit records.",
+      { code: "outcome_assessment_fallback", attempt_number: attemptNumber });
+    await publish(snapshot, "re_instructing", onUpdate);
+    return false;
   }
   if (requiresHuman) {
     appendEvent(snapshot, "waiting_human", "PR audit requires human input.", {
@@ -731,7 +700,6 @@ async function handleFailedAudit({
 }
 
 function recordBudgetWarnings(snapshot, attempt) {
-  if (snapshot.charter.continuation_policy !== "progress") return;
   snapshot.budget_notifications ??= {};
   for (const kind of ["token", "retry"]) {
     if (!snapshot.budget[`${kind}_warning`] || snapshot.budget_notifications[kind]) continue;
@@ -760,9 +728,9 @@ async function stopForBudget({ snapshot, attempt, reason, onUpdate }) {
   };
   if (attempt) attempt.budget = budget;
   const message =
-    reason === "token_budget_exhausted"
-      ? "Agentic loop reached its Provider token budget."
-      : "Agentic loop exhausted its retry budget.";
+    reason === "provider_token_ceiling_reached"
+      ? "Agentic loop reached its Provider token safety ceiling before the next call."
+      : "Agentic loop reached its attempt safety ceiling before the next call.";
   appendEvent(snapshot, "blocked", message, {
     code: reason,
     attempt_number: attempt?.attempt_number ?? null,
@@ -774,23 +742,23 @@ async function stopForBudget({ snapshot, attempt, reason, onUpdate }) {
 }
 
 function budgetFinding(reason, budget) {
-  if (reason === "token_budget_exhausted") {
+  if (reason === "provider_token_ceiling_reached") {
     return {
       passed: false,
-      code: "TOKEN_BUDGET_EXHAUSTED",
+      code: "PROVIDER_TOKEN_CEILING_REACHED",
       severity: "blocker",
       target: "provider_token_budget",
-      explanation: `The run used ${budget.tokens_used} of ${budget.hard_token_ceiling} Provider tokens. The ${budget.continuation_policy === "progress" ? "hard safety ceiling" : "budget"} prevents another provider call. Preserve this run and review its remaining acceptance conditions before resuming. Provider tokens are not billed as SIMY tokens.`,
+      explanation: safetyCeilingRecoveryMessage(reason, budget),
       repairability: "manual",
       auto_fix_hint: null,
     };
   }
   return {
     passed: false,
-    code: "RETRY_BUDGET_EXHAUSTED",
+    code: "ATTEMPT_CEILING_REACHED",
     severity: "blocker",
     target: "retry_budget",
-    explanation: budget.continuation_policy === "progress" ? `The run reached its hard ceiling of ${budget.hard_attempt_ceiling} attempts. Preserve the checkpoint and review remaining acceptance conditions before resuming.` : `The run used ${budget.retries_used} of ${budget.retry_budget} automatic retries.`,
+    explanation: safetyCeilingRecoveryMessage(reason, budget),
     repairability: "manual",
     auto_fix_hint: null,
   };

package/src/orchestrator/recovery.js

@@ -1,4 +1,4 @@
-import { suggestedProviderTokenBudget } from "./budget.js";
+import { suggestedProviderTokenBudget, MAX_PROVIDER_TOKEN_BUDGET } from "./budget.js";
 
 const RECOVERABLE_STATES = new Set(["waiting_human", "blocked", "failed"]);
 
@@ -13,7 +13,7 @@ export function recoveryContractForEvent({ snapshot, state, message, detail = {}
     schema_version: 1,
     state,
     reason_code: reasonCode,
-    user_message: recoveryMessage(reasonCode),
+    user_message: isSafetyCeiling(reasonCode) ? safetyCeilingRecoveryMessage(reasonCode, detail.budget) : recoveryMessage(reasonCode),
     primary_action_id: actions[0].id,
     actions,
     technical_details: {
@@ -22,6 +22,9 @@ export function recoveryContractForEvent({ snapshot, state, message, detail = {}
       max_attempts: positiveInteger(snapshot?.charter?.max_attempts),
       provider_token_budget: positiveInteger(snapshot?.charter?.token_budget),
       provider_tokens_used: nonNegativeInteger(detail?.budget?.tokens_used),
+      provider_token_ceiling: positiveInteger(detail?.budget?.hard_token_ceiling),
+      attempt_ceiling: positiveInteger(detail?.budget?.hard_attempt_ceiling),
+      continuation_policy: clean(detail?.budget?.continuation_policy) || null,
       token_budget: positiveInteger(snapshot?.charter?.token_budget),
       retry_budget: nonNegativeInteger(snapshot?.charter?.retry_budget),
       tokens_used: nonNegativeInteger(detail?.budget?.tokens_used),
@@ -115,6 +118,7 @@ function recoveryReasonCode(state, message, detail) {
     return "retry_strategy_unchanged";
   }
   if (code === "outcome_assessment_unavailable") return "outcome_assessment_unavailable";
+  if (["provider_token_ceiling_reached", "attempt_ceiling_reached"].includes(code)) return code;
   if (code === "token_budget_exhausted") return "token_budget_exhausted";
   if (code === "retry_budget_exhausted") return "retry_budget_exhausted";
   const findings = strings(detail.finding_codes);
@@ -138,6 +142,25 @@ function recoveryReasonCode(state, message, detail) {
   return "local_orchestration_failed";
 }
 
+function isSafetyCeiling(code) {
+  return ["provider_token_ceiling_reached", "attempt_ceiling_reached"].includes(code);
+}
+
+export function safetyCeilingRecoveryMessage(code, budget = {}) {
+  const token = code === "provider_token_ceiling_reached";
+  const limit = token ? budget?.hard_token_ceiling : budget?.hard_attempt_ceiling;
+  const used = token ? budget?.tokens_used : (budget?.retries_used ?? 0) + 1;
+  const maximum = token ? MAX_PROVIDER_TOKEN_BUDGET : 100;
+  const base = `SIMY retained this same run's work and usage. The ${token ? "Provider token" : "executor attempt"} safety ceiling prevents another call. Increasing a notification threshold alone does not permit another call. `;
+  if (budget?.continuation_policy !== "progress") {
+    return base + "The bounded policy does not permit a same-run safety extension. Keep this run and review its remaining acceptance conditions with the operator; guidance alone cannot resume provider work.";
+  }
+  if (!Number.isFinite(limit) || !Number.isFinite(used) || limit >= maximum || used >= maximum) {
+    return base + `The validated maximum is ${maximum.toLocaleString("en-US")}; no larger same-run ceiling is available. Preserve evidence and review remaining work with the operator; guidance alone cannot resume provider work.`;
+  }
+  return base + `Review remaining acceptance conditions and explicitly increase the relevant ceiling above both recorded usage and its current limit, up to ${maximum.toLocaleString("en-US")}. Then continue this same run. Extension never resets usage or resumes work, and other approvals remain required.`;
+}
+
 function recoveryMessage(reasonCode) {
   const messages = {
     repository_authorization_required:
@@ -198,6 +221,13 @@ function recoveryActions(reasonCode, budget = null) {
       newRunAction(),
     ];
   }
+  if (isSafetyCeiling(reasonCode)) {
+    return [guidanceAction(
+      "review_safety_ceiling",
+      "Review this run's safety ceiling",
+      safetyCeilingRecoveryMessage(reasonCode, budget),
+    )];
+  }
   if (reasonCode === "token_budget_exhausted") {
     const suggestedBudget = suggestedProviderTokenBudget(budget);
     if (!suggestedBudget || budget?.retry_exhausted === true) return [newRunAction()];

package/src/provider-delegation.js

@@ -0,0 +1,336 @@
+import { StringDecoder } from 'node:string_decoder';
+import { isAbsolute } from 'node:path';
+import { matchesPairedNativeAccount } from './native-provider-identity.js';
+import { readRecord } from './codex-plugins/simy/hooks/delivery-loop.mjs';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { readClaudeSession } from './session-supervision/claude-sessions.js';
+import { EventEmitter } from 'node:events';
+import { PassThrough } from 'node:stream';
+import { realpath } from 'node:fs/promises';
+import { PROVIDER_LINKS } from './provider-links.js';
+import { normalizeProviderModelSelection } from './provider-model-selection.js';
+import { resolveDesktopExecutorCommand } from './desktop-executor.js';
+import { openCodexAppServer, readCodexSession } from './session-supervision/codex-app-server.js';
+
+const NATIVE_SESSION_MODES = Object.freeze({ codex: 'existing', claude: 'fork' });
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const fail = code => Object.assign(new Error(`Provider delegation unavailable: ${code}.`), { code });
+const identifier = value => typeof value === 'string' && value.trim() && value.length <= 256;
+
+// Routing identifiers and provider-reported account email, never credentials. API models stay in Crew's
+// registry/gateway and SIMY conversation; this native adapter does not invent
+// local executables or sessions for them.
+export function normalizeProviderDelegation(value, { provider, model } = {}) {
+  if (value == null) return null;
+  if (!value || typeof value !== 'object' || Array.isArray(value) ||
+      value.schema_version !== 'provider_delegation.v1' || value.provider !== provider ||
+      value.model !== model || !identifier(value.model) || !identifier(value.origin_task_id) ||
+      !identifier(value.origin_conversation_id) || !identifier(value.request_id) ||
+      !identifier(value.account_id) || !UUID.test(value.session_id || '') ||
+      !['existing', 'fork'].includes(value.session_mode)) throw fail('invalid_provider_delegation');
+  normalizeProviderModelSelection({ model: value.model });
+  if (!PROVIDER_LINKS.includes(provider)) throw fail('crew_gateway_required');
+  if (!Object.hasOwn(NATIVE_SESSION_MODES, provider)) throw fail('native_adapter_unavailable');
+  if (provider === 'claude' && value.session_mode !== 'fork') throw fail('claude_exact_session_writer_unavailable');
+  if (provider === 'claude' && value.allow_new_task !== true) throw fail('new_task_permission_required');
+  if (provider === 'codex' && value.session_mode !== 'existing') throw fail('unsupported_session_mode');
+  return Object.freeze(Object.fromEntries(['schema_version', 'provider', 'model', 'account_id', 'session_id', 'session_mode',
+    'origin_task_id', 'origin_conversation_id', 'request_id', 'allow_new_task', 'allow_new_task_request_id'].filter(key => value[key] !== undefined).map(key => [key, value[key]])));
+}
+
+// Accept P01's exact target shape at the existing Local Task boundary. A
+// target alone carries no task/session execution authority and cannot silently
+// fall back to a fresh native invocation.
+export function providerDelegationFromRequest(body, requestId) {
+  const target = body.delegation_target;
+  if (!body.delegation) {
+    if (target) throw fail('delegation_context_required');
+    return null;
+  }
+  const value = { ...body.delegation };
+  if (target) {
+    if (target.transport !== 'native') throw fail('crew_gateway_required');
+    for (const field of ['provider', 'model', 'account_id', 'session_id']) {
+      if (value[field] !== undefined && value[field] !== target[field]) throw fail('delegation_target_mismatch');
+      value[field] = target[field];
+    }
+  }
+  if (value.request_id !== requestId) throw fail('delegation_request_mismatch');
+  const normalized = normalizeProviderDelegation(value, { provider: body.backend, model: body.model });
+  if (body.native_identity && normalized.session_mode === 'fork' && normalized.allow_new_task_request_id !== requestId)
+    throw fail('native_new_task_permission_required');
+  return normalized;
+}
+
+export function providerDelegationTarget(value) {
+  return value ? Object.fromEntries(['provider', 'model', 'account_id', 'session_id'].map(key => [key, value[key]]).concat([['transport', 'native']])) : null;
+}
+
+export function providerDelegationCoverage(capabilities = []) {
+  return capabilities.map(item => {
+    const native = item.transport !== 'api' && PROVIDER_LINKS.includes(item.provider);
+    const mode = Object.hasOwn(NATIVE_SESSION_MODES, item.provider) ? NATIVE_SESSION_MODES[item.provider] : null;
+    return { provider: item.provider, readiness: item.readiness,
+      execution_target: native ? 'local' : 'crew_gateway',
+      session_mode: native ? mode : 'simy_context',
+      ...(native && mode ? { supported_session_modes: [mode],
+        continuation_mode: mode === 'existing' ? 'same_session' : 'fresh_explicit_fork',
+        cancel_scope: mode === 'existing' ? 'owned_turn' : 'owned_fork_process',
+        disconnect_recovery: 'hold_unknown_without_replay' } : {}),
+      limitation: !native ? 'requires_crew_gateway' : !mode ? 'native_adapter_unavailable' :
+        item.provider === 'claude' ? 'exact_session_writer_unavailable' : null };
+  });
+}
+
+export async function resolveDelegatedProviderCommand(input, { openClient = openCodexAppServer,
+  resolveCommand = resolveDesktopExecutorCommand, readClaude = readClaudeSession,
+  supervisionRoot, pairedDeviceId, providerLinkEpoch,
+  onWorkspaceAuthorized = null,
+  readSupervision = target => readRecord(supervisionRoot, target.provider, target.session_id),
+  inspectClaudeAccount = async bin => JSON.parse((await promisify(execFile)(bin, ['auth', 'status', '--json'], { timeout: 5000, maxBuffer: 65536 })).stdout) } = {}) {
+  const selection = normalizeProviderDelegation(input.delegation, { provider: input.backend, model: input.model });
+  const accountMatches = email => input.nativeIdentity ? matchesPairedNativeAccount(input.nativeIdentity,
+    { deviceId: pairedDeviceId, provider: selection.provider, email, connectionEpoch: providerLinkEpoch ?? null }) && input.nativeIdentity.account_id === selection.account_id
+    : email === selection.account_id;
+  if (!selection) return resolveCommand(input);
+  let claudeCommand;
+  if (selection.provider === 'claude') {
+    if (input.nativeIdentity && selection.allow_new_task_request_id !== selection.request_id) throw fail('new_task_permission_required');
+    claudeCommand = await resolveCommand(input);
+    if (claudeCommand.verification === 'explicit_command_override') throw fail('provider_selection_unverifiable');
+    // Keep ordinary provider approval. Never use the desktop adapter's legacy
+    // skip-permissions flag for a delegation.
+    claudeCommand.args = ['-p', input.instruction, '--output-format', 'stream-json', '--verbose',
+      '--model', selection.model, '--resume', selection.session_id, '--fork-session',
+      '--permission-mode', input.permissionMode === 'read_only' ? 'plan' : 'default'];
+  }
+  return { bin: 'codex-app-server', args: [], env: {}, backend: input.backend,
+    spawn() {
+      const child = new EventEmitter();
+      child.stdout = new PassThrough(); child.stderr = new PassThrough();
+      const controller = new AbortController();
+      let ownedChild;
+      child.kill = signal => {
+        const alreadyAborted = controller.signal.aborted;
+        controller.abort(Object.assign(fail('provider_cancelled'), { nativeSignal: signal || 'SIGINT' }));
+        // Abort invokes the owned Claude listener exactly once. Only a later
+        // escalation forwards another signal; Codex owns an RPC turn instead.
+        if (alreadyAborted) ownedChild?.kill(signal);
+        return true;
+      };
+      // Match the existing process interface; stopLocalTask only signals this
+      // owned turn through kill(), never an original session process.
+      setImmediate(async () => {
+        try {
+          const emit = event => child.stdout.write(`${JSON.stringify(event)}\n`);
+          if (selection.provider === 'claude') await runClaudeDelegation({ ...input, selection,
+            command: claudeCommand, readClaude, inspectClaudeAccount, accountMatches, signal: controller.signal, emit, onChild: value => { ownedChild = value; } });
+          else await runCodexDelegation({ ...input, selection, signal: controller.signal, openClient, emit, readSupervision, accountMatches, onWorkspaceAuthorized });
+          child.stdout.end(); child.stderr.end(); child.emit('close', 0);
+        } catch (error) {
+          const message = fail(error.code || 'provider_result_unknown').message;
+          child.stdout.write(`${JSON.stringify({ type: 'simy.delegation.state', state: error.delegationState || (selection.provider === 'claude' && !ownedChild ? 'failed' : 'result_unknown') })}\n`);
+          child.stdout.end(`${JSON.stringify(selection.provider === 'claude' ?
+            { type: 'result', is_error: true, result: message } : { type: 'turn.failed', error: { message } })}\n`);
+          child.stderr.end(); child.emit('close', 1);
+        }
+      });
+      return child;
+    },
+  };
+}
+
+async function runCodexDelegation({ selection, instruction, getInstruction, repositoryPath, permissionMode, signal, openClient, emit, beforeDispatch, readSupervision, accountMatches, nativeIdentity, workspaceMode, onWorkspaceAuthorized, dispatchNative = send => send() }) {
+  if (signal.aborted) throw Object.assign(fail('provider_cancelled'), { delegationState: 'stopped' });
+  const preserveSupervision = async () => {
+    if ((await readSupervision(selection))?.run) throw fail('existing_supervised_task');
+  };
+  let client;
+  try { await preserveSupervision(); client = await openClient({}); }
+  catch (error) { error.delegationState = 'failed'; throw error; }
+  let turnId, starting, primaryError, completed = false, unsubscribe = () => {};
+  try {
+    signal.throwIfAborted();
+    const account = await client.request('account/read', { refreshToken: false });
+    if (!accountMatches(account.account?.email)) throw fail('provider_account_mismatch');
+    const metadata = await readCodexSession(client, selection.session_id, { signal });
+    if (metadata.isRunning === true) throw fail('provider_session_busy');
+    const configuration = await client.request('thread/resume', { threadId: selection.session_id, excludeTurns: true });
+    if (configuration.thread?.id !== selection.session_id || configuration.model !== selection.model ||
+        !configuration.cwd || await realpath(configuration.cwd) !== await realpath(nativeIdentity ? metadata.cwd : repositoryPath) ||
+        workspaceMode === 'repository' && await realpath(configuration.cwd) !== await realpath(repositoryPath)) throw fail('provider_session_mismatch');
+    // Do not mutate provider permissions. An incompatible requested scope must
+    // be resolved in the original provider, never silently widened here.
+    if (permissionMode === 'read_only' ? configuration.sandbox?.type !== 'readOnly' :
+        configuration.sandbox?.type !== 'workspaceWrite' || configuration.sandbox.networkAccess !== false) throw fail('provider_permission_mismatch');
+    if (configuration.sandbox?.type === 'workspaceWrite') {
+      const roots = configuration.sandbox.writableRoots ?? [];
+      if (!Array.isArray(roots) || roots.some(root => typeof root !== 'string' || !isAbsolute(root))) throw fail('provider_permission_mismatch');
+      await onWorkspaceAuthorized?.([configuration.cwd, ...roots]);
+    }
+    await beforeDispatch?.();
+    signal.throwIfAborted();
+    await preserveSupervision();
+    const currentAccount = await client.request('account/read', { refreshToken: false });
+    if (!accountMatches(currentAccount.account?.email)) throw fail('provider_account_mismatch');
+    await beforeDispatch?.();
+    signal.throwIfAborted();
+    const currentInstruction = getInstruction ? await getInstruction() : instruction;
+    if (typeof currentInstruction !== 'string' || !currentInstruction.trim()) throw fail('provider_instruction_unavailable');
+    await new Promise((resolve, reject) => {
+      let started = false, hasResult = false, settled = false;
+      let cleanup = () => {};
+      const finish = error => {
+        if (settled) return;
+        settled = true; cleanup();
+        if (error) reject(error); else resolve();
+      };
+      const buffered = [];
+      const consume = (method, params, requestId) => {
+        if (settled) return;
+        if (params.threadId !== selection.session_id || (params.turnId || params.turn?.id) !== turnId) return;
+        if (requestId !== undefined) {
+          emit({ type: 'simy.delegation.question', question: { ...params, method }, request_id: requestId });
+          finish(fail('provider_input_required')); return;
+        }
+        if (method === 'item/completed' && params.item?.type === 'agentMessage' && typeof params.item.text === 'string') {
+          hasResult ||= Boolean(params.item.text.trim());
+          emit({ type: 'item.completed', item: { type: 'agent_message', text: params.item.text } });
+        }
+        if (method === 'turn/completed') {
+          completed = true;
+          if (params.turn.status === 'completed' && hasResult) finish();
+          else finish(fail('provider_turn_failed'));
+        }
+      };
+      unsubscribe = client.onNotification((method, params, requestId) => {
+        if (!started) { if (buffered.length < 100) buffered.push([method, params, requestId]); return; }
+        consume(method, params, requestId);
+      });
+      const cancelled = () => finish(fail('provider_cancelled'));
+      signal.addEventListener('abort', cancelled, { once: true });
+      const closed = () => finish(fail('provider_result_unknown'));
+      client.child.once('close', closed);
+      cleanup = () => { signal.removeEventListener('abort', cancelled); client.child.off('close', closed); };
+      // The official provider writer lock acquired by thread/resume arbitrates
+      // races with the original app. No busy fallback, steer, or second task.
+      if (signal.aborted) { finish(fail('provider_cancelled')); return; }
+      starting = dispatchNative(() => client.request('turn/start', { threadId: selection.session_id, model: selection.model,
+        input: [{ type: 'text', text: currentInstruction }] })).then(response => {
+        turnId = response?.turn?.id; started = true;
+        if (!turnId) finish(fail('provider_result_unknown'));
+        else { emit({ type: 'thread.started', thread_id: selection.session_id }); for (const event of buffered) consume(...event); }
+      }, finish);
+    });
+    emit({ type: 'turn.completed' });
+  } catch (error) {
+    primaryError = error;
+    if (!starting || completed) error.delegationState = 'failed';
+    throw error;
+  } finally {
+    unsubscribe();
+    // A cancelled request may have been accepted before its response arrived.
+    // Collect that exact ID before interrupting; never issue another start.
+    if (starting && !turnId) await starting.catch(() => {});
+    if (turnId && !completed && !client.closed) {
+      try {
+        await client.request('turn/interrupt', { threadId: selection.session_id, turnId }, 2000);
+        if (primaryError?.code === 'provider_input_required') primaryError.delegationState = 'needs_user';
+        if (primaryError?.code === 'provider_cancelled') primaryError.delegationState = 'stopped';
+      } catch {
+        if (primaryError) primaryError.delegationState = 'result_unknown';
+      }
+    }
+    // Transport cleanup cannot erase a known terminal result or primary error.
+    try { await client.close(); } catch { /* The submitted turn is never replayed. */ }
+  }
+}
+
+async function runClaudeDelegation({ selection, repositoryPath, command, readClaude,
+  inspectClaudeAccount, signal, emit, beforeDispatch, onChild, accountMatches, nativeIdentity, workspaceMode, dispatchNative = send => send() }) {
+  signal.throwIfAborted();
+  const metadata = await readClaude(selection.session_id);
+  if (!metadata?.cwd || (!nativeIdentity || workspaceMode === 'repository') && await realpath(metadata.cwd) !== await realpath(repositoryPath)) throw fail('provider_session_mismatch');
+  const nativeCwd = await realpath(metadata.cwd);
+  const account = await inspectClaudeAccount(command.bin);
+  if (account.loggedIn !== true || !accountMatches(account.email)) throw fail('provider_account_mismatch');
+  await beforeDispatch?.();
+  signal.throwIfAborted();
+  // Recheck the official identity after asynchronous lease/link guards, just as
+  // the Codex adapter does. A selected account cannot change while waiting.
+  const currentAccount = await inspectClaudeAccount(command.bin);
+  if (currentAccount.loggedIn !== true || !accountMatches(currentAccount.email)) throw fail('provider_account_mismatch');
+  await beforeDispatch?.();
+  signal.throwIfAborted();
+  await new Promise((resolve, reject) => {
+    let pending = '', terminal = false, nativeSession = null, question = false, terminalFailed = false, invalidStream = false, settled = false;
+    const decoder = new StringDecoder('utf8');
+    const child = dispatchNative(() => command.spawn(command.bin, command.args, { cwd: nativeCwd,
+      env: { ...process.env, ...command.env }, stdio: ['ignore', 'pipe', 'pipe'] }));
+    // This is only the newly forked process; the original owner is never signalled.
+    onChild?.(child);
+    const cancel = () => child.kill(signal.reason?.nativeSignal || 'SIGINT');
+    signal.addEventListener('abort', cancel, { once: true });
+    const cleanup = () => signal.removeEventListener('abort', cancel);
+    child.stderr?.resume();
+    const consume = line => {
+      let event; try { event = JSON.parse(line); } catch { return; }
+      if (!event || typeof event !== 'object' || Array.isArray(event)) return;
+      if (event.type === 'system' && event.subtype === 'init') {
+        if (!UUID.test(event.session_id || '') || event.session_id === selection.session_id || event.model !== selection.model ||
+            nativeSession && nativeSession !== event.session_id) {
+          invalidStream = true; child.kill('SIGINT'); return;
+        }
+        nativeSession = event.session_id;
+        emit({ type: 'simy.delegation.session', session_id: nativeSession });
+      }
+      if (!nativeSession || event.session_id && event.session_id !== nativeSession) return;
+      if (event.type === 'result') {
+        const denials = Array.isArray(event.permission_denials) ? event.permission_denials : [];
+        const questions = denials.flatMap(item => Array.isArray(item?.tool_input?.questions) ? item.tool_input.questions : []);
+        const message = questions.map(item => item?.question).filter(item => typeof item === 'string').join('\n') ||
+          (typeof event.result === 'string' && event.result.trim() ? event.result : null) ||
+          (Array.isArray(event.errors) ? event.errors.filter(item => typeof item === 'string').join('\n') : '') ||
+          denials.map(item => item?.tool_input?.description || item?.tool_input?.command).filter(item => typeof item === 'string').join('\n');
+        terminal = typeof event.result === 'string' && Boolean(event.result.trim()) || denials.length > 0 ||
+          Array.isArray(event.errors) && event.errors.some(item => typeof item === 'string' && item.trim());
+        terminalFailed = event.is_error === true || String(event.subtype || '').startsWith('error');
+        if (denials.length && !message) invalidStream = true;
+        if (denials.length && message) {
+          question = true;
+          emit({ type: 'simy.delegation.question', question: { message, permission_denials: denials, ...(questions.length ? { questions } : {}) } });
+          event.is_error = true;
+        }
+      }
+      if (event.type === 'result' && typeof event.result === 'string')
+        emit({ type: 'assistant', message: { content: [{ type: 'text', text: event.result }] } });
+      emit(event);
+    };
+    child.stdout.on('data', chunk => {
+      if (settled) return;
+      pending += decoder.write(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      if (Buffer.byteLength(pending) > 256 * 1024) { invalidStream = true; child.kill('SIGINT'); return; }
+      const lines = pending.split('\n'); pending = lines.pop();
+      for (const line of lines) consume(line);
+    });
+    child.once('error', error => { if (settled) return; settled = true; cleanup(); const failure = fail('provider_result_unknown');
+      if (['ENOENT', 'EACCES'].includes(error?.code) && !child.pid) failure.delegationState = 'failed';
+      reject(failure); });
+    child.once('close', (code, closeSignal) => {
+      if (settled) return; settled = true;
+      cleanup();
+      pending += decoder.end();
+      if (!invalidStream && pending.trim()) consume(pending);
+      const rejectState = (reason, state) => reject(Object.assign(fail(reason), { delegationState: state }));
+      if (invalidStream || !nativeSession) rejectState('provider_result_unknown', 'result_unknown');
+      else if (signal.aborted) rejectState('provider_cancelled',
+        code === 130 || closeSignal === 'SIGINT' ? 'stopped' : 'result_unknown');
+      else if (question && terminal) rejectState('provider_input_required', 'needs_user');
+      else if (terminalFailed && terminal) rejectState('provider_turn_failed', 'failed');
+      else if (code !== 0 || !terminal) rejectState('provider_result_unknown', 'result_unknown');
+      else resolve();
+    });
+    if (signal.aborted) cancel();
+  });
+}

package/src/runner.js

@@ -1,3 +1,4 @@
+import { safetyCeilingRecoveryMessage } from "./orchestrator/recovery.js";
 import { captureDispatchProvenance } from './update-detachment/provenance.js';
 import { captureDispatchOwner, assertTaskAdmission, dispatchWithFence, observeDispatchEvent, queueDispatchReceipt } from './update-detachment/dispatch-gate.js';
 import { execFile, execFileSync } from "node:child_process";
@@ -461,7 +462,7 @@ export async function increaseLocalCodingRunProviderTokenBudget(run, value) {
   }
   const currentBudget = refreshBudgetState(run.snapshot);
   if (currentBudget.retry_exhausted) {
-    throw new Error("The Agentic Loop run also used its retry budget. Start a new run to continue.");
+    throw new Error(safetyCeilingRecoveryMessage("attempt_ceiling_reached", currentBudget));
   }
   const previousBudget = currentBudget.token_budget;
   const previousAudit = run.snapshot.final_audit;