@awak-app/simy-cli 0.7.20 → 0.7.22

package/src/delivery-hooks/command.js

@@ -144,19 +144,20 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
       output(JSON.stringify(result, null, 2)); return result.status === 'not_requested' ? 2 : 0;
     }
     if (['supervisor-enable', 'supervisor-disable', 'supervisor-watch', 'supervisor-status', 'supervisor-watchdog-install'].includes(args[0])) {
-      const options = parseDeliveryOptions(args.slice(1), new Set(['root']));
+      const options = parseDeliveryOptions(args.slice(1), new Set(['root', ...(args[0] === 'supervisor-enable' ? ['provider', 'session'] : [])]));
       const supervisorRoot = options.root || dirname(root);
       if (!isAbsolute(supervisorRoot)) throw new Error('Supervisor root must be absolute.');
       if (args[0] === 'supervisor-watch') {
         const controller = new AbortController(), interrupt = () => controller.abort('user_interrupt'), terminate = () => controller.abort('service_termination');
-        process.once('SIGINT', interrupt); process.once('SIGTERM', terminate);
+        process.once('SIGINT', interrupt); process.once('SIGTERM', terminate); process.once('SIGHUP', terminate);
         try { await watchSupervisor({ root: supervisorRoot, signal: controller.signal }); }
-        finally { process.removeListener('SIGINT', interrupt); process.removeListener('SIGTERM', terminate); }
+        finally { process.removeListener('SIGINT', interrupt); process.removeListener('SIGTERM', terminate); process.removeListener('SIGHUP', terminate); }
         return 0;
       }
       const result = args[0] === 'supervisor-status' ? await supervisorWatchdogStatus({ root: supervisorRoot })
         : args[0] === 'supervisor-watchdog-install' ? await installSupervisorService({ root: supervisorRoot })
-        : await setSupervisorWatchdog({ root: supervisorRoot, enabled: args[0] === 'supervisor-enable', webOrigin });
+        : await setSupervisorWatchdog({ root: supervisorRoot, enabled: args[0] === 'supervisor-enable', webOrigin,
+          ...((options.provider || options.session) ? { target: { provider: options.provider, session: options.session } } : {}) });
       output(JSON.stringify(result, null, 2)); return 0;
     }
     if (args[0] === 'policy-adopt') {
@@ -187,11 +188,12 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
     return 0;
   }
   if (action === 'supervise') {
-    if (args.length > 1 || args.length === 1 && args[0] !== '--once') throw new Error('Use simy delivery supervise [--once].');
+    const once = args.includes('--once');
+    const options = parseDeliveryOptions(args.filter(arg => arg !== '--once'), new Set(['activation-epoch']));
     const controller = new AbortController();
     const stop = () => controller.abort();
     process.once('SIGINT', stop); process.once('SIGTERM', stop);
-    try { await superviseLocalDelivery({ root, webOrigin, once: args[0] === '--once', signal: controller.signal }); }
+    try { await superviseLocalDelivery({ root, webOrigin, once, activationEpoch: options['activation-epoch'], signal: controller.signal }); }
     finally { process.removeListener('SIGINT', stop); process.removeListener('SIGTERM', stop); }
     return 0;
   }

package/src/delivery-hooks/lifecycle-recovery.js

@@ -0,0 +1,82 @@
+import { automaticContinuationAllowed, hasPendingUserStop, queuePurposeDiagnosis,
+  updateRecord, advanceDeliveryControlRevision } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { requireProviderLink } from '../provider-links.js';
+import { openCodexAppServer, readCodexObservation } from '../session-supervision/codex-app-server.js';
+
+function eligible(record) {
+  const run = record?.run, managed = run?.managed;
+  if (record?.provider !== 'codex' || record.autoContinue !== true || !automaticContinuationAllowed(record) ||
+      !managed?.purpose?.enabled || managed.resumeChannel !== 'codex_app_server' ||
+      !['active', 'recovery_required', 'blocked'].includes(run.state) || run.stopReason?.actor === 'user' ||
+      managed.resumeLease || managed.liveWorkspaceLease || managed.outcomeAudit?.lease ||
+      managed.nativeWait || managed.purpose.nativeBoundary || managed.providerWarning ||
+      managed.userQuestion || managed.understandingQuestion || managed.dependencyWait ||
+      managed.authenticationWait || managed.phase === 'understanding' || managed.usageBlocked) return false;
+  // A restart is never approval for an effect. Only a controller-generated
+  // local context-selection wait can yield to independent read diagnosis.
+  const pending = managed.pendingApproval;
+  if (pending && (pending.denied || pending.kind !== 'scope_change' || managed.decision?.assessment?.externalEffect !== 'local' ||
+      managed.decision.assessment.reversibility !== 'reversible' || managed.decision.assessment.inObjective !== true ||
+      managed.decision.assessment.userChoice !== false)) return false;
+  return true;
+}
+
+// Called once by the owning supervisor after a durable activation is loaded.
+// It preserves the same run, purpose, budgets and effect history, and queues a
+// read. An interrupted write is reconciled before any proposal to repeat it.
+export async function reconcileLifecycleRecovery({ root, records, eventId, authorize = async () => {}, sessionEndedAt }) {
+  for (const record of records) {
+    if (!eligible(record) || hasPendingUserStop(root, record)) continue;
+    try {
+      const link = await requireProviderLink({ root, provider: record.provider });
+      await authorize(record);
+      await updateRecord(root, record.provider, record.session, async current => {
+        if (!eligible(current) || hasPendingUserStop(root, current) || current.run.id !== record.run.id ||
+            current.run.revision !== record.run.revision || current.run.controlRevision !== record.run.controlRevision ||
+            current.autoContinueEpoch !== record.autoContinueEpoch || current.run.managed.lifecycleRecovery?.eventId === eventId ||
+            sessionEndedAt !== undefined && !endedSession(current, sessionEndedAt)) return current;
+        await requireProviderLink({ root, provider: record.provider, expectedEpoch: link.epoch });
+        await authorize(current);
+        const run = current.run, managed = run.managed, previousState = run.state;
+        const pending = managed.pendingApproval ? structuredClone(managed.pendingApproval) : null;
+        const queued = queuePurposeDiagnosis(run,
+          'The provider session ended or the local execution host returned after an interruption. Read the saved task and actual current artifacts first. Keep the original goal, corrections, permission ceiling, budgets and explicit stops. Reconcile unfinished or uncertain effects before proposing more work; do not replay a prior write or treat recovery as approval. Inspect the current execution context and choose useful authorized work.',
+          `lifecycle:${eventId}`, Date.now(), 'interrupted_owner');
+        if (queued) {
+          managed.lifecycleRecovery = { eventId, at: Date.now(), previousState, mode: 'read_before_continue', retainedApproval: pending };
+          advanceDeliveryControlRevision(run);
+          run.updatedAt = Date.now();
+        }
+        return current;
+      });
+    } catch (error) {
+      if (['provider_link_disconnected', 'provider_link_changed'].includes(error.code) ||
+          /^Delivery state (?:is busy; retry the command\.|lock owner is unavailable; inspect the lock before retrying\.)$/.test(error.message)) continue;
+      throw error;
+    }
+  }
+}
+
+function endedSession(record, at = record.hookEndedAt) {
+  return record.lastEvent === 'SessionEnd' && Number.isFinite(at) && at > 0 && record.hookEndedAt === at &&
+    record.run?.state === 'recovery_required' && record.run.recoveryCause === 'session_end';
+}
+
+async function observeEndedSession(record) {
+  const client = await openCodexAppServer();
+  try { return await readCodexObservation(client, record.session); }
+  finally { await client.close(); }
+}
+
+// A provider can end while the supervisor remains alive. Reconcile each such
+// event once, after confirming the original conversation has no active turn.
+export async function reconcileEndedSessions({ root, records, eventId, authorize, observe = observeEndedSession }) {
+  for (const record of records) {
+    if (!endedSession(record) || !eligible(record) || hasPendingUserStop(root, record)) continue;
+    let observation;
+    try { observation = await observe(record); } catch { continue; }
+    if (observation?.isRunning !== false) continue;
+    await reconcileLifecycleRecovery({ root, records: [record], authorize,
+      eventId: `${eventId}:session-end:${record.session}:${record.hookEndedAt}`, sessionEndedAt: record.hookEndedAt });
+  }
+}

package/src/delivery-hooks/local-supervisor.js

@@ -1,4 +1,8 @@
-import { dirname } from 'node:path';
+import { dirname, join } from 'node:path';
+import { listRecords } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { readSupervisorState } from './supervisor-owner.js';
+import { supervisorTargetMatches } from './supervisor-activation.js';
+import { reconcileLifecycleRecovery, reconcileEndedSessions } from './lifecycle-recovery.js';
 import { setTimeout as delay } from 'node:timers/promises';
 import { assertNoDesktopHostForOrigin } from '../desktop-process-lock.js';
 import { createManagedSupervisor } from './supervisor.js';
@@ -6,6 +10,8 @@ import { acquireSupervisorOwner } from './supervisor-owner.js';
 import { pendingSupervisorHandover, acknowledgeSupervisorDrain } from './supervisor-handover.js';
 
 export async function superviseLocalDelivery({ root, webOrigin, once = false, signal,
+  activationEpoch, readActivation = readSupervisorState, reconcileStartup = reconcileLifecycleRecovery,
+  reconcileSessionEnds = reconcileEndedSessions,
   createSupervisor = createManagedSupervisor, checkOwner = assertNoDesktopHostForOrigin, wait = delay,
   acquireOwner = acquireSupervisorOwner, pendingHandover = pendingSupervisorHandover,
   acknowledgeDrain = acknowledgeSupervisorDrain } = {}) {
@@ -16,13 +22,28 @@ export async function superviseLocalDelivery({ root, webOrigin, once = false, si
   const owner = await acquireOwner(dirname(root), { handoverVersion: 1 });
   try {
   await check();
+  const activationFile = join(dirname(root), 'supervisor-runtime/control.json');
+  const activation = activationEpoch ? await readActivation(activationFile) : null;
+  const activationCurrent = value => value?.version === 1 && value.enabled === true && value.epoch === activationEpoch;
+  if (activationEpoch && !activationCurrent(activation)) return;
+  const authorizeDispatch = async record => {
+    const current = await readActivation(activationFile);
+    if (!activationCurrent(current) || !supervisorTargetMatches(current, record)) throw new Error('Supervisor activation or target changed.');
+    return activationEpoch;
+  };
+  const readRecords = async () => (await listRecords(root)).filter(record => supervisorTargetMatches(activation, record));
+  if (activationEpoch) await reconcileStartup({ root, records: await readRecords(),
+    eventId: `${activationEpoch}:${owner.nonce}`, authorize: authorizeDispatch });
   const supervisor = createSupervisor({ root, webOrigin,
-    shouldYield: async () => Boolean(await pendingHandover(dirname(root), owner.nonce)) });
+    ...(activationEpoch ? { readRecords, authorizeDispatch } : {}),
+    shouldYield: async () => Boolean(activationEpoch && !activationCurrent(await readActivation(activationFile)) ||
+      await pendingHandover(dirname(root), owner.nonce)) });
   const stop = () => { void supervisor.close(); };
   signal?.addEventListener('abort', stop, { once: true });
   try {
     do {
       if (signal?.aborted) break;
+      if (activationEpoch && !activationCurrent(await readActivation(activationFile))) break;
       const handover = await pendingHandover(dirname(root), owner.nonce);
       if (handover) {
         await supervisor.drain();
@@ -30,6 +51,8 @@ export async function superviseLocalDelivery({ root, webOrigin, once = false, si
         break;
       }
       await check();
+      if (activationEpoch) await reconcileSessionEnds({ root, records: await readRecords(),
+        eventId: activationEpoch, authorize: authorizeDispatch });
       await supervisor.tick();
       if (once) { await supervisor.idle?.(); break; }
       try { await wait(3_000, undefined, { signal }); }

package/src/delivery-hooks/supervisor-activation.js

@@ -0,0 +1,25 @@
+import { join } from 'node:path';
+import { readRecord, automaticContinuationAllowed } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+
+// Activation is durable OS recovery consent, separate from task permissions.
+// A scoped activation binds the existing run/consent, never a future task that
+// happens to reuse the conversation id.
+export async function supervisorTarget(root, target) {
+  if (!target || !['codex', 'claude'].includes(target.provider) || typeof target.session !== 'string' || !target.session) {
+    throw new Error('Select an exact provider and session for supervisor recovery.');
+  }
+  const record = await readRecord(join(root, 'delivery-hooks'), target.provider, target.session);
+  if (!record?.run?.managed || record.autoContinue !== true || !record.autoContinueEpoch ||
+      !automaticContinuationAllowed(record) || ['stopped', 'paused', 'completed', 'reported_done', 'budget_exhausted'].includes(record.run.state)) {
+    throw new Error('Supervisor activation requires an existing opted-in task; explicit task stops remain stopped.');
+  }
+  return { provider: record.provider, session: record.session, runId: record.run.id, autoContinueEpoch: record.autoContinueEpoch };
+}
+
+export function supervisorTargetMatches(control, record) {
+  if (!Object.hasOwn(control || {}, 'targets')) return true;
+  return Array.isArray(control.targets) && control.targets.some(target =>
+    target.provider === record.provider && target.session === record.session &&
+    typeof target.runId === 'string' && target.runId === record.run?.id &&
+    typeof target.autoContinueEpoch === 'string' && target.autoContinueEpoch === record.autoContinueEpoch);
+}

package/src/delivery-hooks/supervisor-service.js

@@ -24,12 +24,12 @@ export function supervisorServiceDefinition({ root, entry, node = process.execPa
   if (platform === 'linux') {
     const name = 'simy-delivery-supervisor.service';
     return { name, file: join(home, '.config/systemd/user', name),
-      content: `# ${marker}\n[Unit]\nDescription=SIMY Delivery supervisor recovery\n\n[Service]\nType=simple\nExecStart=${[node, ...args].map(systemdArgument).join(' ')}\nRestart=on-failure\nRestartSec=15\nKillMode=process\n\n[Install]\nWantedBy=default.target\n` };
+      content: `# ${marker}\n[Unit]\nDescription=SIMY Delivery supervisor recovery\n\n[Service]\nType=simple\nExecStart=${[node, ...args].map(systemdArgument).join(' ')}\nRestart=always\nRestartSec=15\nKillMode=process\n\n[Install]\nWantedBy=default.target\n` };
   }
   if (platform === 'darwin') {
     const name = 'com.awak.simy.delivery-supervisor';
     return { name, file: join(home, 'Library/LaunchAgents', `${name}.plist`), content:
-      `<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><!-- ${marker} --><dict><key>Label</key><string>${name}</string><key>ProgramArguments</key><array>${[node, ...args].map(arg => `<string>${xml(arg)}</string>`).join('')}</array><key>RunAtLoad</key><true/><key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict><key>ThrottleInterval</key><integer>15</integer></dict></plist>` };
+      `<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><!-- ${marker} --><dict><key>Label</key><string>${name}</string><key>ProgramArguments</key><array>${[node, ...args].map(arg => `<string>${xml(arg)}</string>`).join('')}</array><key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>15</integer></dict></plist>` };
   }
   if (platform === 'win32') {
     const name = 'SIMYDeliverySupervisor';

package/src/delivery-hooks/supervisor-watchdog.js

@@ -1,3 +1,4 @@
+import { supervisorTarget } from './supervisor-activation.js';
 import { spawn } from 'node:child_process';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -19,7 +20,9 @@ async function verifiedPin(root) {
   return { digest: pin.digest, release: pin.release };
 }
 export async function setSupervisorWatchdog({ root, enabled, webOrigin,
-  inspectPin = verifiedPin, now = Date.now(), expectedEpoch } = {}) {
+  inspectPin = verifiedPin, now = Date.now(), expectedEpoch, target } = {}) {
+  if (target && !enabled) throw new Error('A recovery target requires explicit enable.');
+  const binding = target ? await supervisorTarget(root, target) : null;
   const pin = enabled ? await inspectPin(root) : null;
   const lock = await acquireDesktopProcessLock(join(folder(root), 'control-lock'), {
     alive: supervisorProcessAlive, identity: supervisorProcessIdentity });
@@ -27,6 +30,8 @@ export async function setSupervisorWatchdog({ root, enabled, webOrigin,
   const previous = await readSupervisorState(controlPath(root));
   if (expectedEpoch !== undefined && previous?.epoch !== expectedEpoch) return previous;
   const control = { version: 1, enabled: enabled === true, epoch: randomUUID(), updatedAt: now,
+    selection: { source: 'explicit_command', action: enabled ? 'enable' : 'disable', at: now },
+    ...(binding ? { targets: [binding] } : {}),
     ...(pin ? { ...pin, webOrigin: resolveWebOrigin(webOrigin) } : {}) };
   await saveSupervisorState(controlPath(root), control);
   return control;
@@ -49,9 +54,11 @@ export function createSupervisorWatchdog({ root, inspectPin = verifiedPin, readC
     if (closed) return;
     const at = clock(), control = await readControl();
     controlEpoch = control?.epoch;
+    const wake = lastWall !== null && (at < lastWall || at - lastWall > 60_000);
+    lastWall = at;
     const previous = pendingPin || await readSupervisorState(statePath(root));
     const state = { version: 1, handoverVersion: 1, watcherNonce, at, action: 'observe', supervisor: null, lastExit,
-      lastLaunchAt: launchTime ?? previous?.lastLaunchAt ?? null, epoch: control?.epoch || null };
+      lastLaunchAt: launchTime ?? previous?.lastLaunchAt ?? null, epoch: control?.epoch || null, lifecycle: wake ? 'wake' : 'observe' };
     if (!control || control.version !== 1 || control.enabled !== true) { state.action = 'disabled'; await save(state); return state; }
     state.supervisor = await observeOwner(root, { now: at });
     if (state.supervisor.state === 'running') {
@@ -77,10 +84,8 @@ export function createSupervisorWatchdog({ root, inspectPin = verifiedPin, readC
     }
     // Resume/sleep or clock regression is an observation boundary, never proof
     // that a live provider stopped. Re-observe on the next tick first.
-    if (lastWall !== null && (at < lastWall || at - lastWall > 60_000)) {
-      lastWall = at; state.action = 'wake_reobserve'; await save(state); return state;
+    if (wake) { state.action = 'wake_reobserve'; await save(state); return state;
     }
-    lastWall = at;
     try { await checkDesktop(root, null); }
     catch (error) {
       if (error.code !== 'process_conflict') throw error;
@@ -102,7 +107,7 @@ export function createSupervisorWatchdog({ root, inspectPin = verifiedPin, readC
         !finalControl?.enabled || finalControl.epoch !== control.epoch) {
       state.action = 'launch_cancelled'; await save(state); return state;
     }
-    const args = [join(pin.release, 'src/index.js'), 'delivery', 'supervise', '--host', control.webOrigin, '--no-auto-update'];
+    const args = [join(pin.release, 'src/index.js'), 'delivery', 'supervise', '--activation-epoch', control.epoch, '--host', control.webOrigin, '--no-auto-update'];
     child = launch(process.execPath, args, { env: { ...process.env, SIMY_HOME: root, SIMY_AUTO_UPDATE: '0' },
       detached: process.platform !== 'win32', stdio: 'ignore', windowsHide: true });
     const launched = child;

package/src/desktop-host.js

@@ -1,3 +1,4 @@
+import { remoteOperationFailure } from './session-supervision/remote-errors.js';
 import { createRemoteHostManager } from './session-supervision/remote-hosts.js';
 import { readDesktopAutoUpdate, writeDesktopAutoUpdate } from './desktop-update-settings.js';
 import { createUpdateRuntime } from './update-detachment/runtime.js';
@@ -14,6 +15,7 @@ import { randomUUID } from "node:crypto";
 import { readCodexStatistics, unavailableStatistics } from './session-supervision/statistics.js';
 import { readClaudeStatistics } from './session-supervision/claude-sessions.js';
 import { inspectProviderPlugins, unavailablePluginStatus } from './sqm/provider-plugin-status.js';
+import { repairProviderPlugin } from './sqm/provider-plugin-repair.js';
 import { openCodexAppServer } from './session-supervision/codex-app-server.js';
 import { conversationSqmChecks } from './session-supervision/sqm-presentation.js';
 import { stopOwnedDesktopHost } from "./desktop-force-quit.js";
@@ -25,7 +27,7 @@ import { controlDelivery, verifyDelivery, createRecordReader, updateRecord, reco
 import { createManagedSupervisor } from "./delivery-hooks/supervisor.js";
 import { createActionAssociationHost } from "./session-supervision/action-association-host.js";
 import { createStopNotifier } from "./session-supervision/stop-notifications.js";
-import { AutoContinueUnavailableError, answerSession, continueSession, resumeSession, discoverSessions, enrollSession, monitorSession, trackSession, setSessionAutoContinue } from "./session-supervision/index.js";
+import { AutoContinueUnavailableError, answerSession, continueSession, followupSession, resumeSession, discoverSessions, enrollSession, monitorSession, trackSession, setSessionAutoContinue } from "./session-supervision/index.js";
 import { createContinuationAnalysisManager } from "./session-supervision/analysis-manager.js";
 import { analyzeContinuation, readContinuationContext } from "./session-supervision/continuation-analysis.js";
 import { continueAnalyzedSession, createAutomaticContinuation } from "./session-supervision/automatic-continuation.js";
@@ -177,8 +179,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
       auto_update_busy: updateSettings.auto_update_busy === true } };
     if (env.SIMY_REMOTE_CHILD === "1") status = { ...status, remoteSessionProtocol: 1 };
     if (remoteHosts) {
-      void remoteHosts.update(providerLinks.codex.connected ? status : { ...status, access: { state: "unavailable" } }).catch(() => {});
-      if (providerLinks.codex.connected) status = remoteHosts.project(status);
+      void remoteHosts.update(PROVIDER_LINKS.some(provider => providerLinks[provider].connected) ? status : { ...status, access: { state: "unavailable" } }).catch(() => {});
+      if (PROVIDER_LINKS.some(provider => providerLinks[provider].connected)) status = remoteHosts.project(status, { providerLinks });
     }
     if (updateProgress) status = { ...status, update: { ...status.update, ...updateProgress } };
     const { sampledAt, ...content } = status;
@@ -502,6 +504,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const changeProviderLink = async (provider, connected) => {
     if (!PROVIDER_LINKS.includes(provider)) throw new Error("Unsupported SIMY provider connection.");
     if (providerLinkBusy.has(provider)) throw new Error("SIMY connection is already changing.");
+    providerRepairControllers.get(provider)?.abort();
     providerLinkBusy.add(provider);
     providerLinkFeedback[provider] = { state: connected ? "connecting" : "disconnecting" };
     let phase = "read_settings";
@@ -574,6 +577,11 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const providerAuthBusy = new Set();
   let pluginInstallationActive = false, pluginSetupEpoch = 0;
   let providerPlugins = { codex: { state: 'checking' }, claude: { state: 'checking' } };
+  const providerRepairs = {}, providerRepairControllers = new Map(), providerRepairJobs = new Set();
+  const providerPluginEpochs = { codex: 0, claude: 0 };
+  const pluginDiagnostic = ({ provider, reason, elapsedMs }) => {
+    diagnostics.write(`provider plugin inspection provider=${provider} reason=${reason} elapsedMs=${elapsedMs}`);
+  };
   let pluginInspection = null, lastPluginInspectionAt = -Infinity;
   let pluginInspectionAbort = new AbortController();
   const refreshProviderPlugins = () => {
@@ -581,9 +589,17 @@ export async function startDesktopHost({ input = process.stdin, output = process
     if (pluginInspection) return pluginInspection;
     if (pluginInspectionAbort.signal.aborted) pluginInspectionAbort = new AbortController();
     lastPluginInspectionAt = Date.now();
-    pluginInspection = Promise.resolve().then(() => (dependencies.inspectProviderPlugins || inspectProviderPlugins)({ signal: pluginInspectionAbort.signal }))
-      .then(value => { providerPlugins = value; })
-      .catch(() => { providerPlugins = { codex: unavailablePluginStatus(), claude: unavailablePluginStatus() }; })
+    const epochs = { ...providerPluginEpochs };
+    const apply = value => {
+      for (const provider of PROVIDER_LINKS) {
+        if (!providerRepairControllers.has(provider) && epochs[provider] === providerPluginEpochs[provider]) {
+          providerPlugins[provider] = value[provider] || unavailablePluginStatus();
+        }
+      }
+    };
+    pluginInspection = Promise.resolve().then(() => (dependencies.inspectProviderPlugins || inspectProviderPlugins)({ signal: pluginInspectionAbort.signal, details: true, onDiagnostic: pluginDiagnostic }))
+      .then(apply)
+      .catch(() => apply({ codex: unavailablePluginStatus(), claude: unavailablePluginStatus() }))
       .finally(() => { pluginInspection = null; if (!closed && !relay) void publish().catch(() => {}); });
     return pluginInspection;
   };
@@ -607,6 +623,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     }]));
     status.pluginSetup = { ...pluginSetup };
     status.providerPlugins = structuredClone(providerPlugins);
+    status.providerRepairs = structuredClone(providerRepairs);
     for (const provider of ["codex", "claude"]) {
       if (providerAuth[provider]?.state === "awaiting_sign_in" && !providerAuthBusy.has(provider) && status.providers?.[provider]?.state === "ready") delete providerAuth[provider];
     }
@@ -803,6 +820,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     clearInterval(timer);
     teamThreads?.close();
     pluginInspectionAbort.abort();
+    for (const controller of providerRepairControllers.values()) controller.abort();
     activeStatisticsRead?.controller.abort();
     discoveryStopped = true;
     encodedStatus = null; lastStatus = null;
@@ -811,6 +829,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     // reader must never postpone cancellation of an owned Provider process.
     const results = await Promise.allSettled([stopDiscovery({ drain: true }), publishing, connectionPublishing,
       pluginInspection,
+      ...providerRepairJobs,
       remoteHosts?.close(), actionAssociations.close(), automaticContinuation?.close(), analysisManager?.close(),
       managedSupervisor.close(), recordReader.close(), stopWorkflows(),
       agent ? createAgentShutdown(agent)() : undefined]);
@@ -1162,12 +1181,12 @@ export async function startDesktopHost({ input = process.stdin, output = process
         }
 
         let commandProviderLink;
-        if (command.provider && !["refresh", "provider_connect", "provider_disconnect", "delivery_stop", "delivery_pause", "delivery_reject", "session_untrack", "session_unmonitor"].includes(action) &&
+        if (command.provider && !["provider_repair", "refresh", "provider_connect", "provider_disconnect", "delivery_stop", "delivery_pause", "delivery_reject", "session_untrack", "session_unmonitor"].includes(action) &&
           !(action === "session_set_auto_continue" && command.enabled === false)) {
           commandProviderLink = await requireProviderLink({ root: deliveryRoot, provider: command.provider });
         }
         if (command.hostId && command.hostId !== 'local') {
-          if (!remoteHosts || command.provider !== 'codex') throw Object.assign(new Error('Remote host is unavailable.'), { code: 'remote_host_unavailable' });
+          if (!remoteHosts || !PROVIDER_LINKS.includes(command.provider)) throw Object.assign(new Error('Remote host is unavailable.'), { code: 'remote_host_unavailable' });
           await authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch);
           const status = await agent.getDesktopStatus();
           // Status collection can yield while provider consent is revoked.
@@ -1187,7 +1206,48 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await remoteHosts.save({ alias: command.alias, label: command.label }, action === 'remote_host_remove');
           emit({ type: 'result', id: command.id, ok: true }); await publish(); return;
         }
-        if (action === "provider_connect" || action === "provider_disconnect") {
+        if (action === 'provider_repair') {
+          const provider = command.provider;
+          if (!PROVIDER_LINKS.includes(provider)) throw new Error('Unsupported provider.');
+          if (providerRepairControllers.has(provider) || providerLinkBusy.has(provider)) throw new Error('Provider repair is already running.');
+          const controller = new AbortController();
+          providerRepairControllers.set(provider, controller);
+          providerPluginEpochs[provider]++;
+          providerRepairs[provider] = { state: 'repairing' };
+          const beganAt = Date.now();
+          let repairJob;
+          try {
+            await publish();
+            repairJob = Promise.resolve().then(() => (dependencies.repairProviderPlugin || repairProviderPlugin)({
+              provider, signal: controller.signal, onDiagnostic: pluginDiagnostic,
+              authorize: async () => {
+                if (closed || relay || controller.signal.aborted) throw Object.assign(new Error('Repair cancelled.'), { reason: 'cancelled' });
+                await authorizeWork(commandScope);
+              },
+            }));
+            providerRepairJobs.add(repairJob);
+            const result = await repairJob;
+            if (closed || controller.signal.aborted) throw Object.assign(new Error('Repair cancelled.'), { reason: 'cancelled' });
+            await authorizeWork(commandScope);
+            if (result?.plugin?.state !== 'enabled') throw Object.assign(new Error('Repair was not verified.'), { reason: 'verification_failed' });
+            providerPlugins[provider] = result.plugin;
+            providerRepairs[provider] = { state: 'repaired' };
+            diagnostics.write(`provider plugin repair provider=${provider} result=repaired elapsedMs=${Date.now() - beganAt}`);
+          } catch (error) {
+            const reasons = ['timeout', 'cli_missing', 'invalid_inventory', 'command_failed', 'verification_failed',
+              'scope_requires_attention', 'source_conflict', 'busy', 'permission_denied', 'cancelled'];
+            const reason = reasons.includes(error?.reason) ? error.reason : 'command_failed';
+            providerRepairs[provider] = { state: 'failed', reason };
+            diagnostics.write(`provider plugin repair provider=${provider} result=failed reason=${reason} elapsedMs=${Date.now() - beganAt}`);
+            throw error;
+          } finally {
+            providerRepairJobs.delete(repairJob);
+            providerRepairControllers.delete(provider);
+            await publish();
+          }
+          emit({ type: 'result', id: command.id, ok: true });
+          return;
+        } else if (action === "provider_connect" || action === "provider_disconnect") {
           await changeProviderLink(command.provider, action === "provider_connect");
           emit({ type: "result", id: command.id, ok: true });
           return;
@@ -1529,6 +1589,19 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await (dependencies.monitorSession || monitorSession)({ root: join(root, "delivery-hooks"), provider: command.provider,
             session: command.session, monitor: action === "session_monitor", expectedProviderEpoch: commandProviderLink?.epoch });
           await refreshSessions(true);
+        } else if (action === "session_followup") {
+          const candidate = await selectedSession(command);
+          if (!candidate.followup?.previousRunId || command.previousRunId !== candidate.followup.previousRunId) {
+            throw new Error('The finished task changed. Refresh this conversation before starting its follow-up.');
+          }
+          if (typeof command.objective !== 'string' || !command.objective.trim() || command.objective.length > 4000) {
+            throw new Error('Enter the current goal to continue.');
+          }
+          await authorizeProvider(candidate.provider, commandScope, selectedLinkEpochs.get(candidate));
+          await (dependencies.followupSession || followupSession)({ root: join(root, 'delivery-hooks'),
+            provider: command.provider, session: command.session, previousRunId: command.previousRunId,
+            objective: command.objective, followupAutoContinue: true, expectedProviderEpoch: selectedLinkEpochs.get(candidate) });
+          await refreshSessions(true);
         } else if (action === "session_enroll") {
           await (dependencies.enrollSession || enrollSession)({ root: join(root, "delivery-hooks"), provider: command.provider,
             session: command.session, objective: command.objective, acceptanceCriteria: command.acceptanceCriteria,
@@ -1571,7 +1644,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
             providerLinkFeedback[provider] = { state: 'error', message: desktopActionError(command.action, error) };
           }
         }
-        emit({ type: "result", id: command.id, ok: false, ...(error?.code === 'cancelled' || statisticsRequest?.controller.signal.aborted ? { code: 'cancelled' } : {}), message: ["update", "prepare_update_restart"].includes(command.action) && updateProgress ? updateProgress.message : desktopActionError(command.action, error) });
+        emit({ type: "result", id: command.id, ok: false, ...(remoteOperationFailure(error?.code).code ? { code: error.code } : {}), ...(error?.code === 'cancelled' || statisticsRequest?.controller.signal.aborted ? { code: 'cancelled' } : {}), message: ["update", "prepare_update_restart"].includes(command.action) && updateProgress ? updateProgress.message : desktopActionError(command.action, error) });
       } finally {
         // Access rejection can happen before the shared reader is constructed.
         if (statisticsRequest && !statisticsRequest.promise && activeStatisticsRead === statisticsRequest) {
@@ -1584,7 +1657,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       void execute();
     } else if (["login", "organization_select", "organization_cancel", "authorization_open"].includes(command.action)) {
       authorizationQueue = authorizationQueue.then(execute).catch(() => {});
-    } else if (/^(codex|claude)_login$/.test(command.action || "") || ["provider_connect", "provider_disconnect"].includes(command.action)) {
+    } else if (/^(codex|claude)_login$/.test(command.action || "") || ["provider_repair", "provider_connect", "provider_disconnect"].includes(command.action)) {
       // Opening an auth terminal must not wait for an unrelated provider turn.
       // Per-provider busy guards prevent overlapping connection changes.
       void execute();

package/src/index.js

@@ -149,7 +149,7 @@ async function runCommand(installMode) {
   simy sqm lint       Validate module reliability before publication
   simy sqm replay     Replay modules against labelled historical snapshots
   simy update --check Check the installed and latest stable CLI versions
-  simy sessions       Show local Codex conversations (--interactive for search/navigation)
+  simy sessions       Show local and registered remote Codex/Claude conversations (--interactive for search/navigation)
   simy update         ${installMode === "macos_installer" ? "Show Apple Silicon update status and installer action" : "Install an eligible stable CLI update"}
 
 Options:

package/src/session-supervision/claude-sessions.js

@@ -160,17 +160,17 @@ async function inspectTranscript(root, projectName, fileName, observedAt, includ
   finally { await handle?.close(); }
 }
 
-async function collect({ home = homedir(), limit = 100, session = null, prioritySessions = [], includeContext = false, cacheMetadata = false, includeStatistics = false, includeBoundary = false, signal } = {}) {
+async function collect({ home = homedir(), all = false, limit = 100, session = null, prioritySessions = [], includeContext = false, cacheMetadata = false, includeStatistics = false, includeBoundary = false, signal } = {}) {
   if (signal?.aborted) return [];
   const root = await projectsRoot(home);
   if (!root) return [];
-  const maximum = Number.isInteger(limit) ? Math.max(1, Math.min(limit, RECENT_SESSION_LIMIT)) : 100;
+  const maximum = all ? Infinity : Number.isInteger(limit) ? Math.max(1, Math.min(limit, RECENT_SESSION_LIMIT)) : 100;
   const observedAt = Date.now();
   const result = new Map();
   const descriptors = [], priorities = new Set(prioritySessions);
   let projects;
   try { projects = await readdir(root, { withFileTypes: true }); } catch { return []; }
-  for (const entry of projects.filter(item => item.isDirectory() && !item.isSymbolicLink()).slice(0, MAX_PROJECTS)) {
+  for (const entry of projects.filter(item => item.isDirectory() && !item.isSymbolicLink()).slice(0, all || session ? undefined : MAX_PROJECTS)) {
     if (signal?.aborted) return [];
     const project = join(root, entry.name);
     let files;
@@ -203,11 +203,11 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
         ...(!candidate.parentSession && origin.parentSession ? { parentSession: origin.parentSession, parentSessionSource: origin.source } : {}) };
     return candidate;
   };
-  const selected = session ? descriptors : [
+  const selected = session || all ? descriptors : [
     ...recentSessionWindow(descriptors.filter(item => desktopLineage.get(item.session)?.providerArchived !== true), { limit: maximum, priority: item => priorities.has(item.session) }),
     ...recentSessionWindow(descriptors.filter(item => desktopLineage.get(item.session)?.providerArchived === true), { limit: maximum, priority: item => priorities.has(item.session) }),
   ];
-  const filesToInspect = selected.slice(0, MAX_TRANSCRIPTS);
+  const filesToInspect = all ? selected : selected.slice(0, MAX_TRANSCRIPTS);
   let nextFile = 0;
   // Catalog prefixes are bounded independently of full transcript size. Use a
   // small I/O pool; exact-context/statistics reads stay serial and identity-safe.
@@ -259,8 +259,8 @@ async function collect({ home = homedir(), limit = 100, session = null, priority
   ];
 }
 
-export async function listClaudeSessions({ home, limit, prioritySessions, signal } = {}) {
-  return collect({ home, limit, prioritySessions, signal, cacheMetadata: true });
+export async function listClaudeSessions({ home, all = false, limit, prioritySessions, signal } = {}) {
+  return collect({ home, all, limit, prioritySessions, signal, cacheMetadata: true });
 }
 
 export async function readClaudeSession(session, { home } = {}) {

package/src/session-supervision/codex-app-server.js

@@ -16,7 +16,7 @@ import { workspaceIdentity, verificationInstruction, normalizeVerification, asse
 import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/acceptance-policy.mjs';
 import { buildPurposeInstruction } from './purpose-instruction.js';
 import { peerOpinionPrompt } from '../codex-plugins/simy/hooks/purpose-cycle.mjs';
-import { runStructuredProviderReview } from '../sqm/review-worker.js';
+import { runCodexPeerOpinion } from './codex-peer-opinion.js';
 import { associationContract } from '../codex-plugins/simy/hooks/action-association.mjs';
 import { spawn } from 'node:child_process';
 import { realpath, stat, open } from 'node:fs/promises';
@@ -235,11 +235,13 @@ export function codexThreadMetadata(thread) {
   };
 }
 
-export async function listCodexSessions({ client, maxPages = 40, pageSize = 25, maxSessions = RECENT_SESSION_LIMIT, archived = false, inspectState = false, prioritySessions = [], observationBudgetMs = 3000, codexHome } = {}) {
+export async function listCodexSessions({ client, all = false, signal, maxPages = 40, pageSize = 25, maxSessions = RECENT_SESSION_LIMIT, archived = false, inspectState = false, prioritySessions = [], observationBudgetMs = 3000, codexHome } = {}) {
   const sessions = [];
-  const windowSize = Math.min(maxSessions, maxPages * pageSize);
+  const windowSize = all ? Infinity : Math.min(maxSessions, maxPages * pageSize);
+  const cursors = new Set(), ids = new Set();
   let cursor = null, listed = 0, pages = 0, batchSize = pageSize;
   while (pages < Math.max(maxPages, Math.ceil(windowSize / batchSize)) && listed < windowSize) {
+    signal?.throwIfAborted();
     const limit = Math.min(batchSize, windowSize - listed);
     let response;
     try { response = await client.request('thread/list', { cursor, limit, sourceKinds: SOURCE_KINDS,
@@ -251,14 +253,21 @@ export async function listCodexSessions({ client, maxPages = 40, pageSize = 25,
       batchSize = Math.max(1, Math.floor(limit / 2));
       continue;
     }
-    const threads = (response?.data || []).slice(0, limit);
+    if (!Array.isArray(response?.data) || response.data.length > limit)
+      throw new CodexAppServerError('invalid_page', 'Codex returned an invalid conversation page.');
+    const threads = response.data;
     listed += threads.length; pages++;
     for (const thread of threads) {
       const metadata = codexThreadMetadata(thread);
-      if (metadata && SOURCE_KINDS.includes(metadata.source)) sessions.push(metadata);
+      if (metadata && SOURCE_KINDS.includes(metadata.source) && !ids.has(metadata.session)) {
+        ids.add(metadata.session); sessions.push(metadata);
+      }
     }
     cursor = response?.nextCursor || null;
     if (!cursor) break;
+    if (typeof cursor !== 'string' || cursors.has(cursor))
+      throw new CodexAppServerError('invalid_page', 'Codex repeated a conversation page cursor.');
+    cursors.add(cursor);
   }
   const deadline = Date.now() + Math.max(1, Math.min(observationBudgetMs, 5000));
   // A recent page can omit an explicitly supervised conversation, including
@@ -645,7 +654,7 @@ async function frozenNativeSandbox(record, root, signal) {
   return policy;
 }
 
-export async function executeCodexAppServer(record, { webOrigin, openClient = openCodexAppServer, signal, authorizePreparation = async () => {}, beforeDispatch = async () => {}, onStarted = async () => {}, onActivity = () => {}, onUsage = () => {}, onEvidence = async () => {}, observeExternal = collectPurposeObservations, root, auditOnly = false, opinionOnly = false, peerAction, runPeerReview = runStructuredProviderReview } = {}) {
+export async function executeCodexAppServer(record, { webOrigin, openClient = openCodexAppServer, signal, authorizePreparation = async () => {}, beforeDispatch = async () => {}, onStarted = async () => {}, onActivity = () => {}, onUsage = () => {}, onEvidence = async () => {}, observeExternal = collectPurposeObservations, root, auditOnly = false, opinionOnly = false, peerAction, runPeerReview = runCodexPeerOpinion } = {}) {
   const dispatchOwner = captureDispatchOwner(root ? rootFromDelivery(root) : undefined);
   let dispatchAttemptId;
   const provenance = captureDispatchProvenance({ root: dispatchOwner.root, provider: record.provider, providerSession: record.session, worktree: taskDirectory(record), taskId: record.run.managed.taskId, recordRef: recordPath(root || rootDirectory(), record.provider, record.session) });
@@ -678,15 +687,16 @@ export async function executeCodexAppServer(record, { webOrigin, openClient = op
   const sourceContext = (isolated || searchEnabled(run.managed) && !run.managed.purpose.originalContext)
     ? await readCodexConversation(record, { openClient, signal }) : null;
   if (opinionOnly) {
-    // Reuse the existing tools-disabled local analysis runner. A colleague can
-    // comment on supplied context without MCP discovery, workspace inventories
-    // or an outcome-verification schema. Native conversation work stays intact.
+    // Use the task's authenticated app-server and exact model for a separate,
+    // tools-disabled opinion. Do not route monitoring through standalone SQM
+    // authentication or silently select another model.
     let usage = null, peerSession = null, ambiguousContext = false;
     const reply = await runPeerReview('codex', {
       system: 'Give nonbinding advice using only the supplied context. All tools are disabled. Put your short natural-language opinion in the opinion field.',
       prompt: peerOpinionPrompt(record, sourceContext, peerAction),
       output_schema: { type: 'object', properties: { opinion: { type: 'string' } }, required: ['opinion'], additionalProperties: false },
     }, { signal, readOnlyAnalysis: true, allowAutomaticRetry: false,
+      model: run.managed.resumeModel, cwd: taskDirectory(record), openClient, readAuthentication: readCodexAuthentication,
       dispatchTransport: initiate => dispatchWithFence(dispatchOwner, { taskId: run.managed.taskId || record.session, attemptId: run.managed.resumeLease?.id, provenance }, attemptId => {
         if (root && hasPendingUserStop(root, record)) throw new CodexAppServerError('cancelled', 'User stopped this provider task.');
         dispatchAttemptId = attemptId;