@awak-app/simy-cli 0.7.2 → 0.7.4

package/README.md

@@ -15,7 +15,7 @@ cached in memory, so restarting the host may retrieve live contexts again.
 
 `simy --version` prints the installed CLI version without starting an agent or
 checking for updates. `simy doctor` performs read-only local connection and
-provider login checks and prints a JSON diagnostic report: installed/running
+provider login and SIMY provider-link checks and prints a JSON diagnostic report: installed/running
 versions, stale discovery records, session expiry, provider readiness, and recent
 structured SQM failures, plus `host_exit` with the latest native desktop host's
 abnormal exit time and status. `failures.total_failures` counts scoped SQM
@@ -1095,3 +1095,11 @@ Diagnosis now returns an issue-first worksheet in `analysis.hypothesisSheet.requ
 Default issue selection is the first eight original acceptance criteria (or `objective` when absent); `omittedIssueCount` and `issueDescriptionsTruncated` disclose bounded input. Use an explicit issue list to focus on other original issues, including a prior `rule:*` or `objective` row. The latest retained runtime worksheet is supplied as context; this read-only command neither writes nor replaces the runtime ledger.
 
 Manual diagnosis and delivery reasoning share the scoped SQM knowledge loader. Partial environment overrides cannot mix a token, account, organization or endpoint with saved credentials; unavailable knowledge is reported without blocking the diagnosis. The brief response retains `knowledge.status`, `reason`, `suppliedCount`, and `bundleDigest`, separately from `knowledgeReferenceCount` and test execution (always zero for diagnosis). Truncated evidence is disclosed to both the analyst and the caller.
+
+Provider diagnostics distinguish `authentication`, `connection`, and `connection_ready`.
+If both login and SIMY connection are missing, `actions` lists both remedies in one
+report. Connection readiness does not certify model access or task completion.
+Diagnostics do not reconnect providers or enable existing tasks. Explicit refresh
+waits for a fresh probe when a pre-login check is already running. macOS login
+terminals preserve an explicitly configured `CODEX_HOME` or `CLAUDE_CONFIG_DIR`,
+without copying credentials.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.2";
+export const CLI_VERSION = "0.7.4";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/desktop-host.js

@@ -39,7 +39,7 @@ import { createCliAutoUpdater, readCliPackageInfo } from "./auto-update.js";
 import { createAgentShutdown } from "./shutdown.js";
 import { resolveWebOrigin } from "./web-origin.js";
 import { openAuthorizationUrl } from "./browser.js";
-import { inspectBackendExecutable } from "./backend-executable.js";
+import { inspectBackendExecutable, CODEX_WRITER_LOCK_MINIMUM_VERSION } from "./backend-executable.js";
 import { inspectSqmAgentSkill } from "./sqm/agent-skill.js";
 import { startWorkflowUpdates, syncInstalledWorkflows } from "./sqm/workflow-update.js";
 import { createNativeDevelopmentReportsApi, normalizeNativeDevelopmentReportSave } from "./native-development-reports.js";
@@ -120,7 +120,7 @@ function desktopActionError(action, error) {
 }
 
 export async function startDesktopHost({ input = process.stdin, output = process.stdout, env = process.env,
-  dependencies = {}, exit = (code) => process.exit(code) } = {}) {
+  updatePackageRoot, dependencies = {}, exit = (code) => process.exit(code) } = {}) {
   const emit = (event) => output.write(`${JSON.stringify(event)}\n`);
   // A heartbeat remains a complete native frame. Only its observation time is
   // volatile; reuse the encoded body after comparing freshly authorized data.
@@ -758,7 +758,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
     updater = await (dependencies.createUpdater || (process.platform === "win32" ? (() => createWindowsDesktopUpdater({ version: packageInfo.version, disabled: env.SIMY_AUTO_UPDATE === "0" })) : createCliAutoUpdater))({
       daemon: true, interactive: true, webOrigin,
       disabled: env.SIMY_AUTO_UPDATE === "0",
-      dependencies: { packageInfo, logger: message => diagnostics.write(`update: ${message}`) },
+      ...(updatePackageRoot ? { packageRoot: updatePackageRoot } : {}),
+      dependencies: { packageInfo: updatePackageRoot ? await readCliPackageInfo(updatePackageRoot) : packageInfo,
+        logger: message => diagnostics.write(`update: ${message}`) },
     });
     agent = await (dependencies.startAgent || startAgent)({
       daemon: true, webOrigin, sessionRoot: root, quiet: true, updateManager: updater,
@@ -1440,7 +1442,7 @@ export async function openProviderLogin(provider, root, {
   execFileImpl = promisify(execFile), platform = process.platform, env = process.env,
 } = {}) {
   if (provider !== "codex" && provider !== "claude") throw new Error("Unsupported provider.");
-  const executable = await inspectExecutable(provider);
+  const executable = await inspectExecutable(provider, provider === "codex" ? { minimumVersion: CODEX_WRITER_LOCK_MINIMUM_VERSION } : {});
   if (!executable.available || !executable.executable) throw Object.assign(new Error("Provider is not installed."), { code: "provider_not_installed" });
   const label = provider === "claude" ? "Claude Code" : "Codex";
   const args = provider === "claude" ? ["auth", "login"] : ["login"];
@@ -1454,7 +1456,11 @@ export async function openProviderLogin(provider, root, {
   const directory = await mkdtemp(join(root, `${provider}-login-`));
   const script = join(directory, `Sign in to ${label}.command`);
   const quote = (s) => `'${s.replaceAll("'", "'\\''")}'`;
-  await writeFile(script, `#!/bin/bash\nexport PATH=${quote(env.PATH || "/usr/bin:/bin")}\n${quote(executable.executable)} ${args.join(" ")}\nresult=$?\nif [ "$result" -ne 0 ]; then\n  echo "Sign-in failed. Check the error above, then press Return to close."\n  read -r _\nfi\nrm -f -- ${quote(script)}\nrmdir -- ${quote(directory)}\nexit "$result"\n`, { mode: 0o700 });
+  // Terminal does not inherit custom provider homes from the desktop host.
+  // Preserve only path settings, never copy tokens or credential contents.
+  const homeKey = provider === "codex" ? "CODEX_HOME" : "CLAUDE_CONFIG_DIR";
+  const providerHome = typeof env[homeKey] === "string" && env[homeKey] ? `export ${homeKey}=${quote(env[homeKey])}\n` : "";
+  await writeFile(script, `#!/bin/bash\n${providerHome}export PATH=${quote(env.PATH || "/usr/bin:/bin")}\n${quote(executable.executable)} ${args.join(" ")}\nresult=$?\nif [ "$result" -ne 0 ]; then\n  echo "Sign-in failed. Check the error above, then press Return to close."\n  read -r _\nfi\nrm -f -- ${quote(script)}\nrmdir -- ${quote(directory)}\nexit "$result"\n`, { mode: 0o700 });
   await chmod(script, 0o700);
   try { await execFileImpl("/usr/bin/open", ["-a", "Terminal", script], { timeout: 10_000 }); }
   catch (error) { await rm(directory, { recursive: true, force: true }); throw error; }
@@ -1474,7 +1480,10 @@ function desktopStartupError(error, fallbackMessage = "SIMY could not start. Che
   };
 }
 
-export function startDesktopEntry() {
+// Immutable pins predate this option; their launcher must keep the old update fence.
+export const supportsDesktopUpdatePackageRoot = true;
+
+export function startDesktopEntry(options = {}) {
   let host;
   const stop = () => { void host?.close().finally(() => process.exit(0)); };
   process.once("SIGTERM", stop); process.once("SIGINT", stop);
@@ -1482,7 +1491,7 @@ export function startDesktopEntry() {
   // stdout is the native JSONL channel; stderr is the only unstructured output
   // and the native window does not display it, so keep it for support.
   captureRuntimeOutput(diagnostics, { stderr: process.stderr });
-  applyLoginShellPath({ diagnostics }).catch(() => {}).then(() => startDesktopHost()).then((value) => { host = value; }).catch((error) => {
+  applyLoginShellPath({ diagnostics }).catch(() => {}).then(() => startDesktopHost(options)).then((value) => { host = value; }).catch((error) => {
     diagnostics.write(`startup failed: ${error?.stack || error}`);
     process.stdout.write(`${JSON.stringify(desktopStartupError(error))}\n`);
     process.exitCode = 1;
@@ -1500,9 +1509,11 @@ if (isDesktopHostEntry()) {
     }
     const selected = await pinnedWorkflowSource({ root });
     if (selected) {
-      process.env.SIMY_AUTO_UPDATE = '0';
       const selectedHost = await import(pathToFileURL(join(selected, 'src/desktop-host.js')).href);
-      selectedHost.startDesktopEntry();
+      // A frozen workflow source has no installer marker. Keep update ownership
+      // with the invoking app bundle, without disabling updates for the host.
+      if (selectedHost.supportsDesktopUpdatePackageRoot !== true) process.env.SIMY_AUTO_UPDATE = '0';
+      selectedHost.startDesktopEntry({ updatePackageRoot: fileURLToPath(new URL('../', import.meta.url)) });
     } else startDesktopEntry();
   } catch (error) {
     process.stdout.write(JSON.stringify(desktopStartupError(error, 'Local desktop runtime integrity could not be verified. Inspect delivery runtime status; the previous task state was retained.')) + '\n');

package/src/desktop-status.js

@@ -137,9 +137,19 @@ export function createProviderStatusInspector(provider, {
   let cached = null;
   let cachedAt = 0;
   let inFlight = null;
-  return async ({ force = false } = {}) => {
+  const refreshAfterFlight = new WeakMap();
+  return async function readStatus({ force = false } = {}) {
     const current = now();
     if (!force && cached && current - cachedAt < cacheMs) return structuredClone(cached);
+    if (inFlight && force) {
+      // A login can finish while a previous signed-out probe is in flight.
+      // Explicit refresh must observe after that probe, not return its old result.
+      const previous = inFlight;
+      if (!refreshAfterFlight.has(previous)) {
+        refreshAfterFlight.set(previous, previous.catch(() => {}).then(() => readStatus({ force: true })));
+      }
+      return structuredClone(await refreshAfterFlight.get(previous));
+    }
     if (inFlight) return structuredClone(await inFlight);
     inFlight = Promise.resolve(inspect({ ...inspectOptions, now: () => new Date(now()) }))
       .then((result) => {

package/src/doctor.js

@@ -1,3 +1,4 @@
+import { readProviderLinks } from "./provider-links.js";
 import { purposeSigningKeyPath, purposeVerificationCapability } from "./purpose-local-proof.js";
 import { readFile } from "node:fs/promises";
 import { connectionDiscoveryPath } from "./connection-discovery.js";
@@ -7,7 +8,7 @@ import { readDiagnosticLog } from "./diagnostic-log.js";
 import { readHostExitDiagnostics } from "./host-exit-diagnostics.js";
 
 export async function collectDiagnostics({ webOrigin, cliVersion, root = defaultSessionRoot(),
-  readSessionImpl = readSession, inspectProvider = inspectProviderStatus, fetchImpl = fetch,
+  readSessionImpl = readSession, inspectProvider = inspectProviderStatus, readLinks = readProviderLinks, fetchImpl = fetch,
   readFileImpl = readFile, alive = pid => { try { process.kill(pid, 0); return true; } catch { return false; } }, now = Date.now() } = {}) {
   const session = await readSessionImpl(webOrigin, root).catch(() => null);
   const valid = isSessionValid(session, now, webOrigin);
@@ -27,10 +28,14 @@ export async function collectDiagnostics({ webOrigin, cliVersion, root = default
         background: health.daemon === true };
     }
   } catch (error) { if (error.code !== "ENOENT") daemon.state = "unverified"; }
+  const links = await readLinks(root).catch(() => ({}));
   const providers = Object.fromEntries(await Promise.all(["codex", "claude"].map(async provider => {
     const result = await inspectProvider(provider).catch(() => ({ state: "unknown" }));
     return [provider, { state: ["ready", "signed_out", "missing", "outdated", "unknown"].includes(result?.state) ? result.state : "unknown",
       version: typeof result?.version === "string" && /^\d+\.\d+\.\d+(?:-[a-z0-9.-]+)?$/i.test(result.version) ? result.version : null,
+      connection: links[provider]?.settingsError || !links[provider] ? "unknown" : links[provider].connected ? "connected" : "disconnected",
+      authentication: result?.state === "ready" ? "signed_in" : result?.state === "signed_out" ? "signed_out" : "unknown",
+      connection_ready: result?.state === "ready" && links[provider]?.connected === true && !links[provider]?.settingsError,
       model_access: "unknown" }];
   })));
   const scope = session?.account_id && session?.organization_id ? { webOrigin, accountId: session.account_id, organizationId: session.organization_id } : null;
@@ -41,6 +46,11 @@ export async function collectDiagnostics({ webOrigin, cliVersion, root = default
     providers, failures, host_exit: await readHostExitDiagnostics(root),
     purpose_verification: await purposeVerificationCapability(purposeSigningKeyPath(root)).then(value => ({ state: value ? "available" : "not_initialized", key_id: value?.key_id || null, execution: "explicit_frozen_recipes_only" })).catch(() => ({ state: "unavailable", key_id: null, execution: "explicit_frozen_recipes_only" })),
     actions: [
+      ...Object.entries(providers).filter(([, provider]) => provider.connection === "disconnected")
+        .map(([provider]) => ({ id: `connect_${provider}`, action: "provider_connect", provider,
+          instruction: `Open SIMY settings and connect ${provider}. Provider login and SIMY connection are separate; existing tasks remain stopped.` })),
+      ...Object.entries(providers).filter(([, provider]) => provider.connection === "unknown")
+        .map(([provider]) => ({ id: `check_${provider}_connection`, instruction: "SIMY connection settings could not be read. Refresh connections; do not reset saved consent." })),
       ...(!valid ? [{ id: "reconnect_cli", command: "simy" }] : []),
       ...(["stale_record", "not_found", "unverified"].includes(daemon.state) ? [{ id: "inspect_daemon", command: "simy doctor" }] : []),
       ...(daemon.version_matches === false ? [{ id: "update_when_idle", command: "simy update --check" }] : []),

package/src/session-supervision/claude-desktop-lineage.js

@@ -0,0 +1,161 @@
+import { constants } from 'node:fs';
+import { lstat, open, readdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const LOCAL = /^local_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const MAX_FILES = 4096, MAX_BYTES = 256 * 1024;
+const cache = new Map();
+const observations = new Map();
+const fingerprint = info => [info.dev, info.ino, info.size, info.mtimeNs, info.ctimeNs].join(':');
+
+export function claudeDesktopSessionRoot(home = homedir()) {
+  return process.platform === 'win32' ? join(home, 'AppData', 'Roaming', 'Claude', 'claude-code-sessions')
+    : process.platform === 'darwin' ? join(home, 'Library', 'Application Support', 'Claude', 'claude-code-sessions')
+      : join(home, '.config', 'Claude', 'claude-code-sessions');
+}
+
+async function directories(path) {
+  try {
+    const info = await lstat(path);
+    if (!info.isDirectory() || info.isSymbolicLink()) return [];
+    return (await readdir(path, { withFileTypes: true })).filter(item => item.isDirectory() && !item.isSymbolicLink() && UUID.test(item.name)).slice(0, 32);
+  } catch { return []; }
+}
+
+// Complete top-level fields from a small JSON prefix. Strings and nested
+// objects may contain commas, so only JSON structure defines a safe boundary.
+function prefixObject(text) {
+  if (!text.trimStart().startsWith('{')) return null;
+  let depth = 0, quoted = false, escaped = false, boundary = -1;
+  for (let index = 0; index < text.length; index++) {
+    const char = text[index];
+    if (quoted) {
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === '{' || char === '[') depth++;
+    else if (char === '}' || char === ']') {
+      if (--depth === 0) return JSON.parse(text.slice(0, index + 1));
+    } else if (char === ',' && depth === 1) boundary = index;
+  }
+  return boundary < 0 ? null : JSON.parse(text.slice(0, boundary) + '}');
+}
+
+async function metadata(path, desktopId, sessions) {
+  let handle;
+  try {
+    const before = await lstat(path, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || before.size > BigInt(MAX_BYTES)) return null;
+    const key = fingerprint(before);
+    const cached = cache.get(path);
+    if (cached?.key === key && (cached.complete || sessions && !sessions.has(cached.value?.session))) return cached.value;
+    handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    if (fingerprint(await handle.stat({ bigint: true })) !== key) return null;
+    let complete = true, item;
+    if (sessions) {
+      const prefix = Buffer.alloc(Math.min(512, Number(before.size)));
+      const { bytesRead } = await handle.read(prefix, 0, prefix.length, 0);
+      complete = Number(before.size) <= bytesRead;
+      const text = prefix.subarray(0, bytesRead).toString('utf8');
+      item = complete ? JSON.parse(text) : prefixObject(text);
+    }
+    if (!item || !sessions || sessions.has(item.cliSessionId)) {
+      const bytes = Buffer.alloc(Number(before.size));
+      const { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+      item = JSON.parse(bytes.subarray(0, bytesRead).toString('utf8')); complete = true;
+    }
+    let value = null;
+    if (item.sessionId === desktopId && UUID.test(item.cliSessionId || '') && typeof item.cwd === 'string' && isAbsolute(item.cwd)) {
+      value = { desktopId, session: item.cliSessionId, cwd: resolve(item.cwd),
+        parentDesktopId: complete && LOCAL.test(item.spawnedFrom?.sessionId || '') ? item.spawnedFrom.sessionId : null };
+    }
+    const after = await lstat(path, { bigint: true });
+    if (fingerprint(after) !== key || fingerprint(await handle.stat({ bigint: true })) !== key || after.isSymbolicLink()) return null;
+    if (!complete && !value) return null;
+    // Cache only identity/lineage. Desktop files also contain private settings;
+    // none of those fields or conversation text leave this bounded reader.
+    cache.delete(path); cache.set(path, { key, value, complete });
+    while (cache.size > MAX_FILES) cache.delete(cache.keys().next().value);
+    return value;
+  } catch { cache.delete(path); return null; }
+  finally { await handle?.close(); }
+}
+
+// Desktop spawn parents use local_* IDs, whereas transcripts and SIMY use CLI
+// UUIDs. Resolve them within the same account AND organization partition.
+export async function readClaudeDesktopLineage({ home = homedir(), root = claudeDesktopSessionRoot(home), signal, sessions = null } = {}) {
+  if (signal?.aborted) return new Map();
+  const files = [];
+  for (const account of await directories(root)) {
+    for (const org of await directories(join(root, account.name))) {
+      const partition = join(root, account.name, org.name);
+      let entries;
+      try { entries = await readdir(partition, { withFileTypes: true }); } catch { continue; }
+      for (const file of entries) {
+        if (files.length >= MAX_FILES) break;
+        const desktopId = file.name.slice(0, -5);
+        if (file.isFile() && !file.isSymbolicLink() && file.name.endsWith('.json') && LOCAL.test(desktopId))
+          files.push({ path: join(partition, file.name), partition, desktopId });
+      }
+    }
+  }
+  const partitions = new Map(), claims = new Map();
+  let next = 0;
+  await Promise.all(Array.from({ length: Math.min(8, files.length) }, async () => {
+    while (next < files.length && !signal?.aborted) {
+      const file = files[next++], item = await metadata(file.path, file.desktopId, sessions);
+      if (!item) continue;
+      if (!partitions.has(file.partition)) partitions.set(file.partition, new Map());
+      partitions.get(file.partition).set(item.desktopId, item);
+      claims.set(item.session, (claims.get(item.session) || 0) + 1);
+    }
+  }));
+  if (signal?.aborted) return new Map();
+  const lineage = new Map();
+  for (const partition of partitions.values()) for (const item of partition.values()) {
+    const parent = partition.get(item.parentDesktopId);
+    if (!parent || claims.get(item.session) !== 1 || claims.get(parent.session) !== 1 || parent.session === item.session) continue;
+    lineage.set(item.session, { cwd: item.cwd, parentCwd: parent.cwd,
+      parentSession: { provider: 'claude', session: parent.session },
+      source: 'claude_desktop_spawned_from' });
+  }
+  // Reject cyclic Desktop metadata rather than inventing a root or parent.
+  for (const session of [...lineage.keys()]) {
+    const seen = new Set(); let cursor = session;
+    while (lineage.has(cursor)) {
+      if (seen.has(cursor)) { for (const id of seen) lineage.delete(id); break; }
+      seen.add(cursor); cursor = lineage.get(cursor).parentSession.session;
+    }
+  }
+  return lineage;
+}
+
+// A cold Desktop directory can contain years of session settings. Let the
+// sidebar retain its last complete lineage while that read-only scan finishes;
+// discovery and unrelated provider controls must not wait for the entire scan.
+export async function observeClaudeDesktopLineage(options = {}, { read = readClaudeDesktopLineage, budgetMs = 1500 } = {}) {
+  if (options.signal?.aborted) return new Map();
+  const root = options.root || claudeDesktopSessionRoot(options.home);
+  let entry = observations.get(root);
+  if (!entry) {
+    entry = { value: new Map(), pending: null };
+    observations.set(root, entry);
+    while (observations.size > 16) observations.delete(observations.keys().next().value);
+  }
+  if (!entry.pending) {
+    entry.pending = read(options).then(value => {
+      // An aborted shared scan is incomplete, so every joiner keeps the last tree.
+      if (!options.signal?.aborted) entry.value = value;
+      return entry.value;
+    }, () => entry.value)
+      .finally(() => { entry.pending = null; });
+  }
+  let timer;
+  try {
+    return await Promise.race([entry.pending,
+      new Promise(resolve => { timer = setTimeout(() => resolve(entry.value), budgetMs); })]);
+  } finally { clearTimeout(timer); }
+}

package/src/session-supervision/claude-sessions.js

@@ -6,6 +6,7 @@ import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { boundConversation, CONVERSATION_LIMITS, textContent } from './conversation-context.js';
 import { sessionTitle } from './session-titles.js';
 import { RECENT_SESSION_LIMIT, recentSessionWindow } from './discovery-window.js';
+import { observeClaudeDesktopLineage } from './claude-desktop-lineage.js';
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const MAX_PROJECTS = 256;
@@ -185,6 +186,14 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
     }));
   }
   if (signal?.aborted) return [];
+  const desktopLineage = !session && cacheMetadata
+    ? await observeClaudeDesktopLineage({ home, signal, sessions: new Set(descriptors.map(item => item.session)) }) : new Map();
+  const decorateLineage = candidate => {
+    const origin = desktopLineage.get(candidate.session);
+    if (origin?.cwd === candidate.cwd && !candidate.parentSession)
+      return { ...candidate, parentSession: origin.parentSession, parentSessionSource: origin.source };
+    return candidate;
+  };
   const selected = session ? descriptors : recentSessionWindow(descriptors, {
     limit: maximum, priority: item => priorities.has(item.session),
   });
@@ -195,13 +204,44 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
   await Promise.all(Array.from({ length: Math.min(includeContext || includeStatistics ? 1 : 8, filesToInspect.length) }, async () => {
     while (nextFile < filesToInspect.length && !signal?.aborted) {
       const file = filesToInspect[nextFile++];
-      const candidate = await inspectTranscript(root, file.projectName, file.fileName, observedAt, includeContext, cacheMetadata, includeStatistics, signal);
+      let candidate = await inspectTranscript(root, file.projectName, file.fileName, observedAt, includeContext, cacheMetadata, includeStatistics, signal);
       if (!candidate) continue;
+      candidate = decorateLineage(candidate);
       const key = `${candidate.session}\0${candidate.cwd}${includeContext || includeStatistics ? `\0${file.projectName}\0${file.fileName}` : ''}`;
       if (!result.has(key) || candidate.lastActivityAt > result.get(key).lastActivityAt) result.set(key, candidate);
     }
   }));
   if (signal?.aborted) return [];
+  // Resolve old parents outside the recent window through their own validated
+  // transcript. Never manufacture selectable conversations from Desktop JSON.
+  if (!session) {
+    const attempted = new Set(result.keys());
+    for (const child of result.values()) {
+      const origin = desktopLineage.get(child.session);
+      if (!origin || child.parentSessionSource !== origin.source || [...result.values()].some(item => item.session === origin.parentSession.session && item.cwd === origin.parentCwd)) continue;
+      for (const file of descriptors.filter(item => item.session === origin.parentSession.session)) {
+        const key = `${file.session}\0${origin.parentCwd}`;
+        if (attempted.has(key) || attempted.size >= MAX_TRANSCRIPTS || signal?.aborted) break;
+        attempted.add(key);
+        const parent = await inspectTranscript(root, file.projectName, file.fileName, observedAt, false, cacheMetadata, false, signal);
+        if (parent?.cwd === origin.parentCwd) result.set(key, decorateLineage(parent));
+      }
+    }
+  }
+  // Both endpoints must be unambiguous validated transcript identities. A
+  // Desktop file alone cannot attach a child to a missing or different cwd.
+  const identities = new Map();
+  for (const item of result.values()) {
+    if (!identities.has(item.session)) identities.set(item.session, []);
+    identities.get(item.session).push(item);
+  }
+  for (const [key, item] of result) if (item.parentSessionSource === 'claude_desktop_spawned_from') {
+    const origin = desktopLineage.get(item.session), parents = identities.get(origin.parentSession.session) || [];
+    if (identities.get(item.session).length !== 1 || parents.length !== 1 || parents[0].cwd !== origin.parentCwd) {
+      const { parentSession, parentSessionSource, ...independent } = item;
+      result.set(key, independent);
+    }
+  }
   const sorted = [...result.values()].sort((a, b) => b.lastActivityAt - a.lastActivityAt || a.session.localeCompare(b.session));
   return session ? sorted : recentSessionWindow(sorted, { limit: maximum, priority: item => priorities.has(item.session) });
 }

package/src/session-supervision/codex-app-server.js

@@ -194,7 +194,8 @@ export async function openCodexAppServer({ inspectExecutable = inspectCodexAppSe
 
 export function codexThreadMetadata(thread) {
   if (!thread || typeof thread.id !== 'string' || !/^[0-9a-f-]{36}$/i.test(thread.id) || typeof thread.cwd !== 'string' || !thread.cwd || thread.ephemeral) return null;
-  if (thread.parentThreadId) return null;
+  // Internal workers are display-only lineage, never independent admission.
+  if (thread.parentThreadId || thread.source?.subAgent || thread.source?.subagent) return null;
   return {
     provider: 'codex', session: thread.id, cwd: thread.cwd,
     ...(typeof thread.forkedFromId === 'string' && /^[0-9a-f-]{36}$/i.test(thread.forkedFromId) && thread.forkedFromId !== thread.id

package/src/session-supervision/codex-children.js

@@ -0,0 +1,59 @@
+import { lstat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { recentSessionWindow } from './discovery-window.js';
+import { sessionTitle } from './session-titles.js';
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+// The provider list intentionally omits internal workers. Show their explicit
+// spawn lineage as read-only rows, without turning them into standalone tasks.
+// Never scan transcripts, infer relationships from cwd, or modify Codex state.
+export async function readCodexChildSessions({ parents = [], includeArchived = false,
+  codexHome = process.env.CODEX_HOME || join(homedir(), '.codex'), limit = 200 } = {}) {
+  const roots = [...new Set(parents.filter(item => item.provider === 'codex' && UUID.test(item.session)).map(item => item.session))];
+  if (!roots.length) return [];
+  const path = join(codexHome, 'state_5.sqlite');
+  let db;
+  try {
+    const info = await lstat(path);
+    if (!info.isFile() || info.isSymbolicLink()) return [];
+    // Optional on older Node installations; the bundled desktop uses Node 22.
+    const { DatabaseSync } = await import('node:sqlite');
+    db = new DatabaseSync(path, { readOnly: true });
+    db.exec('PRAGMA query_only = ON; PRAGMA busy_timeout = 50');
+    const rows = db.prepare(`WITH RECURSIVE family(id, depth) AS (
+      SELECT id, 0 FROM threads WHERE id IN (${roots.map(() => '?').join(',')})
+      UNION SELECT e.child_thread_id, f.depth + 1 FROM thread_spawn_edges e
+        JOIN family f ON f.id = e.parent_thread_id WHERE f.depth < 32
+    ) SELECT t.id, t.cwd, t.name, t.source, t.model, t.updated_at, t.archived,
+        e.parent_thread_id, MIN(f.depth) AS depth
+      FROM family f JOIN threads t ON t.id = f.id
+      JOIN thread_spawn_edges e ON e.child_thread_id = t.id
+      WHERE f.depth > 0 GROUP BY t.id ORDER BY depth, t.updated_at DESC LIMIT 2000`).all(...roots);
+    const candidates = [];
+    for (const row of rows) {
+      let source;
+      try { source = JSON.parse(row.source); } catch { continue; }
+      const spawn = source?.subagent?.thread_spawn || source?.subAgent?.thread_spawn;
+      if (!UUID.test(row.id) || !UUID.test(row.parent_thread_id) || row.id === row.parent_thread_id ||
+          spawn?.parent_thread_id !== row.parent_thread_id || typeof row.cwd !== 'string' || !row.cwd) continue;
+      candidates.push({ provider: 'codex', session: row.id, cwd: row.cwd,
+        parentSession: { provider: 'codex', session: row.parent_thread_id }, delegated: true,
+        title: sessionTitle(row.name) || sessionTitle(sessionTitle(spawn.agent_path).split('/').at(-1)) || sessionTitle(spawn.agent_nickname),
+        source: 'subAgentThreadSpawn', model: row.model, archived: row.archived === 1,
+        lastActivityAt: row.updated_at * 1000,
+        observation: { source: 'codex_local_index', observedAt: Date.now() }, availability: 'read_only' });
+    }
+    const selected = recentSessionWindow(candidates.filter(item => includeArchived || !item.archived), { limit });
+    // An active grandchild must retain an archived connecting parent.
+    const byId = new Map(candidates.map(item => [item.session, item]));
+    const included = new Set(selected.map(item => item.session));
+    for (const item of selected) {
+      const parent = byId.get(item.parentSession.session);
+      if (parent && !included.has(parent.session)) { included.add(parent.session); selected.push(parent); }
+    }
+    return selected;
+  } catch { return []; }
+  finally { db?.close(); }
+}

package/src/session-supervision/index.js

@@ -9,6 +9,7 @@ import { listCodexSessions, codexThreadMetadata, openCodexAppServer, readCodexSe
 import { listClaudeSessions, readClaudeSession } from './claude-sessions.js';
 import { loadPurposeRuleSet } from './purpose-instruction.js';
 import { originalSessionTarget } from './original-session-target.js';
+import { readCodexChildSessions } from './codex-children.js';
 import { readCodexTitles, sessionTitle } from './session-titles.js';
 import { RECENT_SESSION_LIMIT, recentSessionWindow, retainedSession } from './discovery-window.js';
 import { requireProviderLink } from '../provider-links.js';
@@ -113,8 +114,16 @@ async function requireClaudeChannel(record, metadata, inspectProcess) {
   if (!channel.ready) throw Object.assign(new Error(channel.reason), { code: channel.code });
 }
 
+function navigationParent(item, record) {
+  // A user's explicit link remains authoritative. Desktop's verified direct
+  // parent is stronger than an inherited launch environment in an old hook.
+  return record?.parentSessionSource === 'explicit' ? record.parentSession
+    : item.parentSessionSource === 'claude_desktop_spawned_from' ? item.parentSession
+      : record?.parentSession || item.parentSession;
+}
+
 export async function discoverSessions({ root, openClient = openCodexAppServer, listClaude = listClaudeSessions,
-  inspectProcess = processIdentity, now = Date.now(), signal, listCodexTitles = readCodexTitles, codexHome, connectedProviders = ['codex', 'claude'], includeArchived = false } = {}) {
+  inspectProcess = processIdentity, now = Date.now(), signal, listCodexTitles = readCodexTitles, listCodexChildren = readCodexChildSessions, codexHome, connectedProviders = ['codex', 'claude'], includeArchived = false } = {}) {
   const assertActive = () => { if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation discovery was cancelled.'); };
   assertActive();
   const connected = new Set(connectedProviders);
@@ -199,7 +208,7 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   }
   const requiredAncestors = new Set();
   for (const item of byKey.values()) {
-    let parent = recordsByKey.get(`${item.provider}:${item.session}`)?.parentSession || item.parentSession;
+    let parent = navigationParent(item, recordsByKey.get(`${item.provider}:${item.session}`));
     for (let depth = 0; parent && depth < 256; depth++) {
       const key = `${parent.provider}:${parent.session}`;
       if (requiredAncestors.has(key)) break;
@@ -226,7 +235,8 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   // visible even during a truncated discovery or provider outage.
   const catalog = [...byKey.values()].map(item => {
     const record = recordsByKey.get(`${item.provider}:${item.session}`);
-    return { ...item, ...((record?.parentSession || item.parentSession) ? { parentSession: record?.parentSession || item.parentSession } : {}) };
+    const parentSession = navigationParent(item, record);
+    return { ...item, ...(parentSession ? { parentSession } : {}) };
   });
   const items = [...recentSessionWindow(catalog.filter(item => item.archived !== true), {
     priority: item => retainedSession(recordsByKey.get(`${item.provider}:${item.session}`)),
@@ -242,11 +252,25 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       const ancestor = catalogByKey.get(key); includedKeys.add(key); items.push(ancestor); parent = ancestor.parentSession;
     }
   }
+  // Keep the human conversation window intact; workers are supplementary rows.
+  if (connected.has('codex')) {
+    const children = await listCodexChildren({ parents: items, codexHome, includeArchived });
+    for (const child of children) {
+      const key = `${child.provider}:${child.session}`;
+      if (!includedKeys.has(key)) { includedKeys.add(key); items.push(child); }
+    }
+  }
   const projected = new Array(items.length);
   const codexTitles = items.some(item => item.provider === 'codex' && !sessionTitle(item.title)) ? await listCodexTitles() : new Map();
   assertActive();
   let nextItem = 0;
   const project = async item => {
+    if (item.delegated === true) return { ...item,
+      tracked: false, autoContinue: false, binding: { mode: 'unmanaged', taskId: null },
+      continuationMode: 'manual', continuationReasonCode: 'parent_controlled',
+      autoContinueAvailability: { canEnable: false, reasonCode: 'parent_controlled', reason: 'This delegated conversation is controlled by its parent.' },
+      capabilities: { canMonitor: false, canPurposeContinue: false, canAnalyze: false, canEnroll: false, canContinue: false, canAutoContinue: false },
+      originalSessionTarget: originalSessionTarget(item.provider, item.session) };
     const record = recordsByKey.get(`${item.provider}:${item.session}`);
     const run = record?.run;
     const archived = item.archived === true || record?.providerArchived === true;
@@ -283,7 +307,7 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       } catch { /* Unverified process leaves runtime status unknown. */ }
     }
     return { provider: item.provider, session: item.session, cwd: item.cwd,
-      ...((item.parentSession || record?.parentSession) ? { parentSession: record?.parentSession || item.parentSession } : {}),
+      ...(navigationParent(item, record) ? { parentSession: navigationParent(item, record) } : {}),
       title: sessionTitle(item.title) || (item.provider === 'codex' ? codexTitles.get(item.session) || '' : ''), source: item.source,
       ...(typeof isRunning === 'boolean' ? { isRunning } : {}),
       ...(item.latestTurnId ? { latestTurnId: item.latestTurnId } : {}),