@awak-app/simy-cli 0.7.21 → 0.7.23

package/src/desktop-host.js

@@ -1,4 +1,5 @@
 import { remoteOperationFailure } from './session-supervision/remote-errors.js';
+import { copyDesktopText } from './desktop-clipboard.js';
 import { createRemoteHostManager } from './session-supervision/remote-hosts.js';
 import { readDesktopAutoUpdate, writeDesktopAutoUpdate } from './desktop-update-settings.js';
 import { createUpdateRuntime } from './update-detachment/runtime.js';
@@ -15,6 +16,7 @@ import { randomUUID } from "node:crypto";
 import { readCodexStatistics, unavailableStatistics } from './session-supervision/statistics.js';
 import { readClaudeStatistics } from './session-supervision/claude-sessions.js';
 import { inspectProviderPlugins, unavailablePluginStatus } from './sqm/provider-plugin-status.js';
+import { repairProviderPlugin } from './sqm/provider-plugin-repair.js';
 import { openCodexAppServer } from './session-supervision/codex-app-server.js';
 import { conversationSqmChecks } from './session-supervision/sqm-presentation.js';
 import { stopOwnedDesktopHost } from "./desktop-force-quit.js";
@@ -22,7 +24,7 @@ import { stopDesktopWorkForUpdate } from './desktop-update-stop.js';
 import { desktopAccessReady, desktopActionAllowed, requireDesktopAccess, validDesktopAccessPath } from './desktop-access.js';
 import { createActionDeadlineService } from './session-supervision/action-deadline.js';
 import { deliveryHookStatus, openHookSetup } from "./delivery-hooks/desktop.js";
-import { controlDelivery, verifyDelivery, createRecordReader, updateRecord, recordProviderArchive, TERMINAL } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
+import { controlDelivery, verifyDelivery, createRecordReader, readRecord, updateRecord, recordProviderArchive, TERMINAL } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
 import { createManagedSupervisor } from "./delivery-hooks/supervisor.js";
 import { createActionAssociationHost } from "./session-supervision/action-association-host.js";
 import { createStopNotifier } from "./session-supervision/stop-notifications.js";
@@ -104,6 +106,7 @@ function desktopActionError(action, error) {
     };
     if (messages[error?.code]) return messages[error.code];
   }
+  if (action === 'authorization_copy') return 'Could not copy the connection link. Reopen the connection page and try again.';
   if (action === 'authorization_open' || error?.code === 'desktop_browser_unavailable') return "Could not open your browser. Open the verification link again, or check your default browser.";
   if (error?.code === "desktop_access_required") return "Sign in to an organization with SQM and Developer access before using SIMY.";
   if (action === "codex_hooks" || action === "claude_hooks") return "Could not open the setup guide. Check your default browser, or use /hooks inside the provider.";
@@ -408,6 +411,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       const link = await requireProviderLink({ root: deliveryRoot, provider: record.provider });
       return JSON.stringify([scope, link.epoch]);
     }, readRecords: () => recordReader.list(),
+    readCurrentRecord: (provider, session) => readRecord(deliveryRoot, provider, session),
     beforeClaim: record => actionAssociations.prepareCached?.(record) || record });
   let shuttingDown = null;
   let commands;
@@ -503,6 +507,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const changeProviderLink = async (provider, connected) => {
     if (!PROVIDER_LINKS.includes(provider)) throw new Error("Unsupported SIMY provider connection.");
     if (providerLinkBusy.has(provider)) throw new Error("SIMY connection is already changing.");
+    providerRepairControllers.get(provider)?.abort();
     providerLinkBusy.add(provider);
     providerLinkFeedback[provider] = { state: connected ? "connecting" : "disconnecting" };
     let phase = "read_settings";
@@ -527,7 +532,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
         phase = "authorize_connect";
         await authorizeWork();
         phase = "save_connect";
-        providerLinks = await writeProviderLink(root, provider, true);
+        providerLinks = await writeProviderLink(root, provider, true, { repairInvalidSettings: true });
       }
       delete providerLinkFeedback[provider];
       try { await agent.refreshProviderStatus?.(); }
@@ -575,6 +580,11 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const providerAuthBusy = new Set();
   let pluginInstallationActive = false, pluginSetupEpoch = 0;
   let providerPlugins = { codex: { state: 'checking' }, claude: { state: 'checking' } };
+  const providerRepairs = {}, providerRepairControllers = new Map(), providerRepairJobs = new Set();
+  const providerPluginEpochs = { codex: 0, claude: 0 };
+  const pluginDiagnostic = ({ provider, reason, elapsedMs }) => {
+    diagnostics.write(`provider plugin inspection provider=${provider} reason=${reason} elapsedMs=${elapsedMs}`);
+  };
   let pluginInspection = null, lastPluginInspectionAt = -Infinity;
   let pluginInspectionAbort = new AbortController();
   const refreshProviderPlugins = () => {
@@ -582,9 +592,17 @@ export async function startDesktopHost({ input = process.stdin, output = process
     if (pluginInspection) return pluginInspection;
     if (pluginInspectionAbort.signal.aborted) pluginInspectionAbort = new AbortController();
     lastPluginInspectionAt = Date.now();
-    pluginInspection = Promise.resolve().then(() => (dependencies.inspectProviderPlugins || inspectProviderPlugins)({ signal: pluginInspectionAbort.signal }))
-      .then(value => { providerPlugins = value; })
-      .catch(() => { providerPlugins = { codex: unavailablePluginStatus(), claude: unavailablePluginStatus() }; })
+    const epochs = { ...providerPluginEpochs };
+    const apply = value => {
+      for (const provider of PROVIDER_LINKS) {
+        if (!providerRepairControllers.has(provider) && epochs[provider] === providerPluginEpochs[provider]) {
+          providerPlugins[provider] = value[provider] || unavailablePluginStatus();
+        }
+      }
+    };
+    pluginInspection = Promise.resolve().then(() => (dependencies.inspectProviderPlugins || inspectProviderPlugins)({ signal: pluginInspectionAbort.signal, details: true, onDiagnostic: pluginDiagnostic }))
+      .then(apply)
+      .catch(() => apply({ codex: unavailablePluginStatus(), claude: unavailablePluginStatus() }))
       .finally(() => { pluginInspection = null; if (!closed && !relay) void publish().catch(() => {}); });
     return pluginInspection;
   };
@@ -608,6 +626,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     }]));
     status.pluginSetup = { ...pluginSetup };
     status.providerPlugins = structuredClone(providerPlugins);
+    status.providerRepairs = structuredClone(providerRepairs);
     for (const provider of ["codex", "claude"]) {
       if (providerAuth[provider]?.state === "awaiting_sign_in" && !providerAuthBusy.has(provider) && status.providers?.[provider]?.state === "ready") delete providerAuth[provider];
     }
@@ -804,6 +823,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     clearInterval(timer);
     teamThreads?.close();
     pluginInspectionAbort.abort();
+    for (const controller of providerRepairControllers.values()) controller.abort();
     activeStatisticsRead?.controller.abort();
     discoveryStopped = true;
     encodedStatus = null; lastStatus = null;
@@ -812,6 +832,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     // reader must never postpone cancellation of an owned Provider process.
     const results = await Promise.allSettled([stopDiscovery({ drain: true }), publishing, connectionPublishing,
       pluginInspection,
+      ...providerRepairJobs,
       remoteHosts?.close(), actionAssociations.close(), automaticContinuation?.close(), analysisManager?.close(),
       managedSupervisor.close(), recordReader.close(), stopWorkflows(),
       agent ? createAgentShutdown(agent)() : undefined]);
@@ -1163,7 +1184,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
         }
 
         let commandProviderLink;
-        if (command.provider && !["refresh", "provider_connect", "provider_disconnect", "delivery_stop", "delivery_pause", "delivery_reject", "session_untrack", "session_unmonitor"].includes(action) &&
+        if (command.provider && !["provider_repair", "refresh", "provider_connect", "provider_disconnect", "delivery_stop", "delivery_pause", "delivery_reject", "session_untrack", "session_unmonitor"].includes(action) &&
           !(action === "session_set_auto_continue" && command.enabled === false)) {
           commandProviderLink = await requireProviderLink({ root: deliveryRoot, provider: command.provider });
         }
@@ -1188,7 +1209,48 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await remoteHosts.save({ alias: command.alias, label: command.label }, action === 'remote_host_remove');
           emit({ type: 'result', id: command.id, ok: true }); await publish(); return;
         }
-        if (action === "provider_connect" || action === "provider_disconnect") {
+        if (action === 'provider_repair') {
+          const provider = command.provider;
+          if (!PROVIDER_LINKS.includes(provider)) throw new Error('Unsupported provider.');
+          if (providerRepairControllers.has(provider) || providerLinkBusy.has(provider)) throw new Error('Provider repair is already running.');
+          const controller = new AbortController();
+          providerRepairControllers.set(provider, controller);
+          providerPluginEpochs[provider]++;
+          providerRepairs[provider] = { state: 'repairing' };
+          const beganAt = Date.now();
+          let repairJob;
+          try {
+            await publish();
+            repairJob = Promise.resolve().then(() => (dependencies.repairProviderPlugin || repairProviderPlugin)({
+              provider, signal: controller.signal, onDiagnostic: pluginDiagnostic,
+              authorize: async () => {
+                if (closed || relay || controller.signal.aborted) throw Object.assign(new Error('Repair cancelled.'), { reason: 'cancelled' });
+                await authorizeWork(commandScope);
+              },
+            }));
+            providerRepairJobs.add(repairJob);
+            const result = await repairJob;
+            if (closed || controller.signal.aborted) throw Object.assign(new Error('Repair cancelled.'), { reason: 'cancelled' });
+            await authorizeWork(commandScope);
+            if (result?.plugin?.state !== 'enabled') throw Object.assign(new Error('Repair was not verified.'), { reason: 'verification_failed' });
+            providerPlugins[provider] = result.plugin;
+            providerRepairs[provider] = { state: 'repaired' };
+            diagnostics.write(`provider plugin repair provider=${provider} result=repaired elapsedMs=${Date.now() - beganAt}`);
+          } catch (error) {
+            const reasons = ['timeout', 'cli_missing', 'invalid_inventory', 'command_failed', 'verification_failed',
+              'scope_requires_attention', 'source_conflict', 'busy', 'permission_denied', 'cancelled'];
+            const reason = reasons.includes(error?.reason) ? error.reason : 'command_failed';
+            providerRepairs[provider] = { state: 'failed', reason };
+            diagnostics.write(`provider plugin repair provider=${provider} result=failed reason=${reason} elapsedMs=${Date.now() - beganAt}`);
+            throw error;
+          } finally {
+            providerRepairJobs.delete(repairJob);
+            providerRepairControllers.delete(provider);
+            await publish();
+          }
+          emit({ type: 'result', id: command.id, ok: true });
+          return;
+        } else if (action === "provider_connect" || action === "provider_disconnect") {
           await changeProviderLink(command.provider, action === "provider_connect");
           emit({ type: "result", id: command.id, ok: true });
           return;
@@ -1270,6 +1332,11 @@ export async function startDesktopHost({ input = process.stdin, output = process
         else if (action === "sqm_set_engine_fallback") await agent.setSqmEngineFallback({ enabled: command.enabled, allowedProviders: command.allowedProviders });
         else if (action === "sqm_retry_environment") await agent.retrySqmEnvironment();
         else if (action === "organization_cancel") await agent.cancelOrganizationSelection();
+        else if (action === 'authorization_copy') {
+          const url = agent.getPendingAuthorizationUrl?.() || await agent.requestDesktopLogin();
+          if (!url || new URL(url).origin !== webOrigin || new URL(url).pathname !== '/local-cli/connect') throw new Error('No valid connection link.');
+          await (dependencies.copyText || copyDesktopText)(url);
+        }
         else if (action === "login" || action === "organization_select" || action === "authorization_open") {
           if (action === "organization_select" && (typeof command.organizationId !== "string" || !command.organizationId)) throw new Error("Select an organization first.");
           const url = action === "authorization_open" ? (agent.getPendingAuthorizationUrl?.() ?? agent.retryAuthorization?.())
@@ -1596,9 +1663,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
     };
     if (command.action === "quit" || command.action === "prepare_update_restart" || command.action === "update" && (command.force === true || stoppingForUpdate)) {
       void execute();
-    } else if (["login", "organization_select", "organization_cancel", "authorization_open"].includes(command.action)) {
+    } else if (["login", "organization_select", "organization_cancel", "authorization_open", "authorization_copy"].includes(command.action)) {
       authorizationQueue = authorizationQueue.then(execute).catch(() => {});
-    } else if (/^(codex|claude)_login$/.test(command.action || "") || ["provider_connect", "provider_disconnect"].includes(command.action)) {
+    } else if (/^(codex|claude)_login$/.test(command.action || "") || ["provider_repair", "provider_connect", "provider_disconnect"].includes(command.action)) {
       // Opening an auth terminal must not wait for an unrelated provider turn.
       // Per-provider busy guards prevent overlapping connection changes.
       void execute();

package/src/orchestrator/audit.js

@@ -101,11 +101,11 @@ export async function auditAttempt(charter, attempt, { previousAttempt = null, s
       target: check.id,
       explanation: check.detail,
       repairability:
-        check.id === "executor_succeeded" && attempt.raw_output.blocked
+        check.id === "executor_succeeded" && attempt.raw_output?.blocked && attempt.raw_output?.blocker_kind === "human"
           ? "manual"
           : check.repairability,
       auto_fix_hint:
-        check.id === "executor_succeeded" && attempt.raw_output.blocked
+        check.id === "executor_succeeded" && attempt.raw_output?.blocked && attempt.raw_output?.blocker_kind === "human"
           ? null
           : `Resolve ${check.label.toLowerCase()} and check the result.`,
     }));

package/src/orchestrator/independent-audit.js

@@ -12,7 +12,7 @@ export function buildIndependentAuditInstruction(charter, attempt) {
   return buildWorkflowReportingInstruction({ auditor: true }) + "\n" + buildAcceptedHumanGuidanceInstruction(charter) + "\n" + section("requested_review", `Review the original request and actual behavior read-only. Report concrete defects, regressions and missing user outcomes. No preparation matrix, citation package, assurance score or mandatory screenshot record is required. Do not certify unobserved results or grant permission.
 Request: ${JSON.stringify({ requirement: charter.requirement, criteria: acceptanceCriterionRows(charter), mustNot: charter.must_not, experience: charter.completion_contract?.experience })}
 Current result: ${JSON.stringify({ summary: attempt.summary ?? null, residual_risks: attempt.residual_risks, tests: attempt.tests_run, observations: attempt.criterion_evidence, current: attempt.observed_evidence })}
-Return SIMY_AUDIT_JSON: with {passed,summary,findings,criterion_results,coverage_review:{user_outcome:{passed,verification_method,observed_result}}}. Check the original requested result even if the listed criteria mention only code or tests. Each criterion result describes criterion_id,passed,verification_method,observed_result. Each finding candidate must contain passed. Only passed=false entries are findings; never report passed=true evidence as a finding. Findings describe the concrete remaining defect and necessary repair.`);
+Return SIMY_AUDIT_JSON: with {passed,summary,findings,criterion_results,coverage_review:{user_outcome:{passed,verification_method,observed_result}}}. Check the original requested result even if the listed criteria mention only code or tests. Each criterion result describes criterion_id,passed,verification_method,observed_result. Each finding candidate must contain passed. Only passed=false entries are findings; never report passed=true evidence as a finding. Findings describe the concrete remaining defect and necessary repair. Set blocker_kind to machine for technical failures, external for unavailable dependencies, and human only for actual missing authorization, authentication interaction or an explicitly user-reserved decision. A legacy repairability=manual label or missing report does not establish a human dependency.`);
 }
 
 export function buildIndependentAudit(execution, charter = null, attempt = null) {
@@ -60,11 +60,11 @@ export function buildIndependentAudit(execution, charter = null, attempt = null)
       severity: cleanString(item.severity).toLowerCase() || "major",
       target: cleanString(item.target) || "pull_request",
       explanation: cleanString(item.explanation) || "Independent audit finding.",
-      repairability: item.repairability === "manual" ? "manual" : "auto",
+      repairability: item.blocker_kind === "human" ? "manual" : "auto",
       disposition: ["defer", "dismiss"].includes(item.disposition) && cleanString(item.explanation)
         ? item.disposition : "fix",
       blocker_kind: ["machine", "human", "external"].includes(item.blocker_kind)
-        ? item.blocker_kind : item.repairability === "manual" ? "human" : "machine",
+        ? item.blocker_kind : "machine",
       auto_fix_hint: cleanString(item.auto_fix_hint) || null,
     }));
   const findings = evaluations.filter((item) => item.passed === false);

package/src/orchestrator/instruction.js

@@ -13,6 +13,7 @@ export function buildCodingInstruction(
   },
 ) {
   return [
+    section("automatic_recovery", "Continue authorized work without procedural sign-off. Repair technical failures automatically. For an actual blocker, report blocker_kind=machine for technical repair, external for an unavailable dependency, or human for missing authorization, authentication interaction or an explicitly reserved decision. Preserve native permissions and explicit stops; blocked=true alone does not require human input."),
     section("role", "Complete the user's requested outcome in this repository."),
     buildWorkflowReportingInstruction(),
     buildAcceptedHumanGuidanceInstruction(charter),

package/src/orchestrator/loop.js

@@ -113,7 +113,7 @@ async function runCodingLoopOwned({
       previousAttempt,
       previousFindings,
       promptInterventions,
-    });
+    }) + (snapshot.metadata?.automatic_recovery ? '\nAutomatic recovery of the same unfinished task: inspect the current failure and previous attempts, test a different cause or reversible repair, then return to the original requested work. Do not repeat an unchanged failing operation or ask the user to certify technical correctness. Preserve existing permissions and limits.' : '');
 
     let attempt = recoveredAttempt;
     if (!attempt) {
@@ -574,7 +574,18 @@ async function handleFailedAudit({
 }) {
   snapshot.charter.thread_state.failure_count += 1;
   const diagnosticCircuit = evaluateRetryCircuit({ attempt, previousAttempt: snapshot.attempts.at(-2) ?? null, findings });
-  const technicalStall = attempt.outcome_progress?.stalled || attempt.outcome_progress?.assessment_unavailable || diagnosticCircuit.open && !attempt.outcome_progress?.has_progress;
+  // A new commit does not resolve an unchanged review failure. Criteria can all
+  // pass while a required review finding still prevents acceptance. Compare
+  // concrete details: a shared generic code does not identify the same defect.
+  const priorAttempt = snapshot.attempts.at(-2);
+  const repeatedReview = !attempt.outcome_progress?.has_progress &&
+    diagnosticCircuit.previous_fingerprint?.review_findings_sha256 === diagnosticCircuit.fingerprint.review_findings_sha256 &&
+    priorAttempt?.outcome_progress?.objective_digest === attempt.outcome_progress?.objective_digest;
+  attempt.audit_retry_streak = repeatedReview ? (priorAttempt.audit_retry_streak || 1) + 1 : 1;
+  const reviewStalled = !requiresHuman && attempt.audit?.passed === true && attempt.independent_audit?.passed === false &&
+    attempt.audit_retry_streak >= 3 && attempt.outcome_progress?.status === "assessed" &&
+    !attempt.outcome_progress?.stalled && !attempt.outcome_progress?.assessment_unavailable;
+  const technicalStall = reviewStalled || attempt.outcome_progress?.stalled || attempt.outcome_progress?.assessment_unavailable || diagnosticCircuit.open && !attempt.outcome_progress?.has_progress;
   if (technicalStall && !requiresHuman) {
     const state = snapshot.charter.thread_state;
     const key = JSON.stringify([state.objective_contract?.current_digest, attempt.outcome_progress?.unproven_ids || [], findings.filter(row => row.code !== 'AI_STRATEGY_CHANGE_REQUIRED').map(row => row.code).sort()]);
@@ -590,18 +601,18 @@ async function handleFailedAudit({
       return false;
     }
   }
-  if (attempt.outcome_progress?.stalled) {
-    const unresolved = attempt.outcome_progress.unproven_ids;
+  if (reviewStalled || attempt.outcome_progress?.stalled) {
+    const unresolved = attempt.outcome_progress?.unproven_ids || [];
     snapshot.final_audit = {
       ...(snapshot.final_audit || {}),
       passed: false,
-      summary: "Independent review found no progress on the remaining user outcomes.",
+      summary: reviewStalled ? "Automatic diagnosis did not resolve the repeated review failure." : "Independent review found no progress on the remaining user outcomes.",
       findings: [...(snapshot.final_audit?.findings || []), {
         passed: false,
-        code: "OUTCOME_PROGRESS_STALLED",
+        code: reviewStalled ? "REVIEW_PROGRESS_STALLED" : "OUTCOME_PROGRESS_STALLED",
         severity: "blocker",
         target: "acceptance_criteria",
-        explanation: `The same user outcomes remain unproven after another attempt: ${unresolved.join(", ")}. Reassess the approach against the approved objective before more work.`,
+        explanation: reviewStalled ? "The same review findings remain after automatic diagnosis and another repair attempt. Preserve the failure for machine recovery; human certification cannot resolve it." : `The same user outcomes remain unproven after another attempt: ${unresolved.join(", ")}. Reassess the approach against the approved objective before more work.`,
         repairability: "auto",
         blocker_kind: "machine",
       }],
@@ -618,11 +629,7 @@ async function handleFailedAudit({
     await publish(snapshot, "blocked", onUpdate);
     return true;
   }
-  const retryCircuit = evaluateRetryCircuit({
-    attempt,
-    previousAttempt: snapshot.attempts.at(-2) ?? null,
-    findings,
-  });
+  const retryCircuit = diagnosticCircuit;
   if (retryCircuit.open && !attempt.outcome_progress?.has_progress &&
       !(attempt.audit?.passed && attempt.outcome_progress?.status === "insufficient_evidence" &&
         !attempt.outcome_progress?.failed_ids?.length)) {

package/src/orchestrator/recovery.js

@@ -1,4 +1,4 @@
-import { suggestedProviderTokenBudget, MAX_PROVIDER_TOKEN_BUDGET } from "./budget.js";
+import { suggestedProviderTokenBudget, MAX_PROVIDER_TOKEN_BUDGET, budgetState } from "./budget.js";
 
 const RECOVERABLE_STATES = new Set(["waiting_human", "blocked", "failed"]);
 
@@ -8,13 +8,17 @@ export function recoveryContractForEvent({ snapshot, state, message, detail = {}
 
   const reasonCode = recoveryReasonCode(state, message, detail);
   const attemptNumber = positiveInteger(detail.attempt_number);
-  const actions = recoveryActions(reasonCode, detail.budget);
+  const machineStopped = state === "blocked" && snapshot?.final_audit?.requires_human === false &&
+    ["outcome_progress_stalled", "retry_circuit_open"].includes(detail.code);
+  const actions = machineStopped ? [] : recoveryActions(reasonCode, detail.budget);
+  const automaticRecovery = machineStopped && !budgetState(snapshot).exhausted;
   return {
     schema_version: 1,
     state,
-    reason_code: reasonCode,
-    user_message: isSafetyCeiling(reasonCode) ? safetyCeilingRecoveryMessage(reasonCode, detail.budget) : recoveryMessage(reasonCode),
-    primary_action_id: actions[0].id,
+    reason_code: automaticRecovery ? 'machine_recovery_pending' : machineStopped ? "machine_recovery_exhausted" : reasonCode,
+    ...(machineStopped ? { requires_user_action: false } : {}),
+    user_message: automaticRecovery ? 'The task remains unfinished. SIMY will retry this same task after a recovery cooldown while its connection is enabled. No manual confirmation is required.' : machineStopped ? "Automatic diagnosis and repair attempts could not resolve the technical failure. The task remains unfinished; failure details are retained. No human approval or success declaration is required." : isSafetyCeiling(reasonCode) ? safetyCeilingRecoveryMessage(reasonCode, detail.budget) : recoveryMessage(reasonCode),
+    primary_action_id: actions[0]?.id ?? null,
     actions,
     technical_details: {
       event_code: clean(detail.code) || null,
@@ -104,9 +108,10 @@ export function isRecoveryContract(value) {
       value.schema_version === 1 &&
       typeof value.reason_code === "string" &&
       typeof value.user_message === "string" &&
-      typeof value.primary_action_id === "string" &&
       Array.isArray(value.actions) &&
-      value.actions.length > 0,
+      (typeof value.primary_action_id === "string" && value.actions.length > 0 ||
+        value.state === "blocked" && ['machine_recovery_pending', 'machine_recovery_exhausted'].includes(value.reason_code) &&
+        value.requires_user_action === false && value.primary_action_id === null && value.actions.length === 0),
   );
 }
 

package/src/orchestrator/retry.js

@@ -39,6 +39,7 @@ export function buildRetryFingerprint(attempt, findings) {
     commit_sha: commitSha,
     finding_codes: normalizedFindings.map((finding) => finding.code),
     findings_sha256: sha256(findingPayload),
+    review_findings_sha256: sha256(stableJson(normalizeFindings(findings, true))),
     evidence_sha256: sha256(evidencePayload),
   };
 }
@@ -52,7 +53,7 @@ function findingsForAttempt(attempt) {
   ];
 }
 
-function normalizeFindings(findings) {
+function normalizeFindings(findings, includeDetails = false) {
   return (Array.isArray(findings) ? findings : [])
     .filter((finding) => finding && typeof finding === "object")
     .map((finding) => ({
@@ -62,6 +63,11 @@ function normalizeFindings(findings) {
       severity: cleanString(finding.severity).toLowerCase() || null,
       target: cleanString(finding.target) || null,
       repairability: cleanString(finding.repairability).toLowerCase() || null,
+      ...(includeDetails ? {
+        explanation: cleanString(finding.explanation) || null,
+        auto_fix_hint: cleanString(finding.auto_fix_hint) || null,
+        blocker_kind: cleanString(finding.blocker_kind) || null,
+      } : {}),
     }))
     .sort(compareStableValues);
 }

package/src/provider-links.js

@@ -14,12 +14,13 @@ async function readSettings(root) {
   let payload;
   try { payload = JSON.parse(await readFile(join(root, 'provider-links.json'), 'utf8')); }
   catch (error) { if (error.code === 'ENOENT') return defaults(); throw error; }
-  if (payload?.schemaVersion !== 1 || !payload.providers || PROVIDER_LINKS.some(provider => {
+  if (payload?.schemaVersion !== 1) throw new Error('Unsupported SIMY provider connection settings version.');
+  if (!payload.providers || PROVIDER_LINKS.some(provider => {
     const value = payload.providers[provider];
     return !value || typeof value.connected !== 'boolean' || typeof value.requiresConsent !== 'boolean' ||
       value.epoch !== null && (typeof value.epoch !== 'string' || !value.epoch || value.epoch.length > 128) ||
       value.consentEpoch !== undefined && (value.consentEpoch !== value.epoch || !value.consentEpoch || value.connected !== false || typeof value.enabled !== 'boolean');
-  })) throw new Error('Invalid SIMY provider connection settings.');
+  })) throw Object.assign(new Error('Invalid SIMY provider connection settings.'), { code: 'invalid_provider_link_settings' });
   return Object.fromEntries(PROVIDER_LINKS.map(provider => [provider, {
     connected: payload.providers[provider].consentEpoch ? payload.providers[provider].enabled : payload.providers[provider].connected,
     ...(payload.providers[provider].consentEpoch ? { consentEpoch: payload.providers[provider].consentEpoch } : {}),
@@ -52,13 +53,22 @@ export async function requireProviderLink({ root = join(defaultRoot(), 'delivery
   return link;
 }
 
-export function writeProviderLink(root = defaultRoot(), provider, connected) {
+export function writeProviderLink(root = defaultRoot(), provider, connected, { repairInvalidSettings = false } = {}) {
   validateProvider(provider);
   if (typeof connected !== 'boolean') throw new Error('Choose whether this provider is connected to SIMY.');
   const key = resolve(root);
   const previous = writeQueues.get(key) || Promise.resolve();
   const pending = previous.catch(() => {}).then(async () => {
-    const providers = await readSettings(root);
+    let providers;
+    try { providers = await readSettings(root); }
+    catch (error) {
+      if (!repairInvalidSettings || !connected || !(error instanceof SyntaxError || error.code === 'invalid_provider_link_settings')) throw error;
+      // Only an explicit Connect action restores this provider. Retain the
+      // damaged file and leave all other providers disconnected.
+      const original = await readFile(join(root, 'provider-links.json'));
+      await writeFile(join(root, `provider-links.invalid-${randomUUID()}.json`), original, { mode: 0o600, flag: 'wx' });
+      providers = disconnected();
+    }
     // Reconnection restores discovery only. Session execution consent is cleared
     // separately and must be selected again, including after a host restart.
     const epoch = randomUUID();

package/src/runner.js

@@ -59,6 +59,7 @@ import {
   assertRecoveryActor, completedWorkerResult, recoveryActorBinding, refreshRecoveryAudit, refreshRecoveryBudgetAudit,
 } from "./coding-run-recovery.js";
 import { workflowRunEnv } from "./dev-work-events.js";
+import { canRecoverCodingRun, codingRecoveryDue, scheduleCodingRecovery } from './coding-run-automatic-recovery.js';
 
 const execFileAsync = promisify(execFile);
 const MAX_LOCAL_LOG_LINES = 1_000;
@@ -321,6 +322,7 @@ export function restoreRun({ snapshot, session, apiOrigin, localPath = null, loc
   run.startedAt = restoredSnapshot.created_at || null;
   run.completedAt = restoredSnapshot.updated_at || null;
   run.controlState = restoredState === "stopped" ? "stopped" : "waiting_human";
+  if (canRecoverCodingRun(run)) run.controlState = 'complete';
   run.restoredFromState = restoredFromState;
   run.restoredObjectiveUnverified = objectiveUnverified;
   run.restoredCompletedWorkerResult = Boolean(recoverableResult);
@@ -430,6 +432,23 @@ export async function continueLocalCodingRun(run, guidance, dependencies = {}) {
   return executeLocalCodingRun(run, dependencies, { humanGuidance: message, resume: true });
 }
 
+// Automated recovery is not human guidance and does not reset stop intent,
+// usage, the objective, or the existing task identity.
+export async function recoverLocalCodingRun(run, dependencies = {}, now = Date.now()) {
+  if (!canRecoverCodingRun(run)) return run.snapshot;
+  if (!run.snapshot.metadata?.automatic_recovery) {
+    scheduleCodingRecovery(run.snapshot, now);
+    if (run.localStateRoot) await saveCodingRunSnapshot(run.localStateRoot, run.snapshot);
+    return run.snapshot;
+  }
+  if (!codingRecoveryDue(run, now)) return run.snapshot;
+  assertRunCanContinue(run);
+  run.completedAt = null;
+  run.controlState = 'running';
+  run.resumeCount += 1;
+  return executeLocalCodingRun(run, dependencies, { resume: true });
+}
+
 function assertRunCanContinue(run) {
   if (run.operation || run.child) throw new Error("The selected Agentic Loop run is still active.");
   if (!RESUMABLE_STATES.has(run.status)) {
@@ -1324,6 +1343,11 @@ async function updateRun(run, state) {
   run.snapshot.state = state;
   run.snapshot.metadata = { ...run.snapshot.metadata, pr_lifecycle_state: state };
   run.snapshot.updated_at = new Date().toISOString();
+  if (state === 'blocked' && run.snapshot.final_audit?.requires_human === false &&
+      ['outcome_progress_stalled', 'retry_circuit_open'].includes(run.snapshot.events.at(-1)?.detail?.code) &&
+      !budgetState(run.snapshot).exhausted) {
+    scheduleCodingRecovery(run.snapshot);
+  }
   run.completedAt = TERMINAL_STATES.has(state) ? run.snapshot.updated_at : null;
   if (state === "waiting_human" || state === "pr_ready_for_review") {
     run.controlState = "waiting_human";

package/src/sqm/agent-skill.js

@@ -100,14 +100,16 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
   };
 }
 
-export async function installSqmAgentSkill({ home = homedir(), platforms = Object.keys(TARGETS) } = {}) {
+export async function installSqmAgentSkill({ home = homedir(), platforms = Object.keys(TARGETS), migrateLegacyGate = true } = {}) {
   const requested = [...new Set(platforms)];
   if (!requested.length || requested.some((platform) => !Object.hasOwn(TARGETS, platform))) {
     throw new Error("platforms must contain codex and/or claude");
   }
   if (requested.includes("codex")) await installCodexPlugin({ home });
   if (requested.includes("claude")) await installClaudePlugin({ home });
-  await retireLegacySqmGate({ home });
+  // Explicit single-provider repair must not migrate another provider's hooks.
+  // Ordinary setup and workflow updates retain the existing migration behavior.
+  if (migrateLegacyGate) await retireLegacySqmGate({ home });
   for (const platform of requested) {
     await atomicText(path.join(home, ...TARGETS[platform]), SKILL_CONTENT, 0o600);
   }

package/src/sqm/failure-circuit.js

@@ -6,6 +6,10 @@ import { CLI_VERSION } from "../cli-contract.js";
 import { defaultSessionRoot } from "../session-store.js";
 
 export const SQM_FAILURE_PAUSE_THRESHOLD = 6;
+export const SQM_RECOVERY_DELAY_MS = 5 * 60_000;
+const MAX_RECOVERY_DELAY_MS = 30 * 60_000;
+const exhausted = state => state.failures >= SQM_FAILURE_PAUSE_THRESHOLD || (state.providerFailures || 0) >= 2;
+const recoveryDelay = state => Math.min(MAX_RECOVERY_DELAY_MS, SQM_RECOVERY_DELAY_MS * 2 ** Math.min(state.recoveryAttempts || 0, 3));
 const scopeKey = scope => JSON.stringify([scope?.webOrigin, scope?.accountId, scope?.organizationId]);
 const validVersion = value => typeof value === "string" && /^\d+\.\d+\.\d+$/.test(value);
 
@@ -21,6 +25,9 @@ export function createSqmFailureCircuitStore({ root = defaultSessionRoot() } = {
         const state = JSON.parse(await readFile(path(scope), "utf8"));
         if (!validVersion(state.version) || !Number.isInteger(state.failures) || state.failures < 0 || state.failures > SQM_FAILURE_PAUSE_THRESHOLD || (state.inFlight !== undefined && typeof state.inFlight !== "boolean") || (state.providerFailures !== undefined && (!Number.isInteger(state.providerFailures) || state.providerFailures < 0 || state.providerFailures > 2)) || (state.providerRetryAt !== undefined && (!Number.isFinite(state.providerRetryAt) || state.providerRetryAt < 0)))
           throw new Error("Invalid saved SQM failure state.");
+        if (state.recoveryAt !== undefined && (!Number.isFinite(state.recoveryAt) || state.recoveryAt < 0) ||
+            state.recoveryAttempts !== undefined && (!Number.isSafeInteger(state.recoveryAttempts) || state.recoveryAttempts < 0))
+          throw new Error("Invalid saved SQM recovery state.");
         return state;
       } catch (error) { if (error.code === "ENOENT") return null; throw error; }
     },
@@ -37,12 +44,17 @@ export function createSqmFailureCircuitStore({ root = defaultSessionRoot() } = {
 
 // One counter per organization on this machine, shared by both local engines.
 // Neither reconnecting nor an empty claim demonstrates successful analysis.
-export function createSqmFailureCircuit({ version = CLI_VERSION, store = null } = {}) {
+export function createSqmFailureCircuit({ version = CLI_VERSION, store = null, now = Date.now } = {}) {
   if (!validVersion(version)) throw new Error("SQM failure circuit requires a SIMY version.");
   const states = new Map();
   const unreadableScopes = new Set();
+  const scheduleRecovery = state => {
+    if (!exhausted(state) || state.recoveryAt > now()) return false;
+    state.recoveryAt = Math.max(state.providerRetryAt || 0, now() + recoveryDelay(state));
+    return true;
+  };
   const save = async (scope, state) => {
-    try { await store?.write(scope, { version: state.version, failures: state.failures, inFlight: state.inFlight === true, ...(state.providerFailures ? { providerFailures: state.providerFailures, providerRetryAt: state.providerRetryAt } : {}) }); state.storageError = false; }
+    try { await store?.write(scope, { version: state.version, failures: state.failures, inFlight: state.inFlight === true, ...(state.recoveryAt !== undefined ? { recoveryAt: state.recoveryAt, recoveryAttempts: state.recoveryAttempts || 0 } : {}), ...(state.providerFailures ? { providerFailures: state.providerFailures, providerRetryAt: state.providerRetryAt } : {}) }); state.storageError = false; }
     catch (error) { state.storageError = true; throw error; }
   };
   const load = async scope => {
@@ -52,7 +64,7 @@ export function createSqmFailureCircuit({ version = CLI_VERSION, store = null }
       let saved;
       try { saved = await store?.read(scope); unreadableScopes.delete(key); }
       catch (error) { unreadableScopes.add(key); throw error; }
-      state = saved ? { version: saved.version, failures: saved.failures, inFlight: saved.inFlight === true, providerFailures: saved.providerFailures || 0, providerRetryAt: saved.providerRetryAt || 0 } : { version, failures: 0, inFlight: false };
+      state = saved ? { version: saved.version, failures: saved.failures, inFlight: saved.inFlight === true, providerFailures: saved.providerFailures || 0, providerRetryAt: saved.providerRetryAt || 0, ...(saved.recoveryAt !== undefined ? { recoveryAt: saved.recoveryAt, recoveryAttempts: saved.recoveryAttempts || 0 } : {}) } : { version, failures: 0, inFlight: false };
       states.set(key, state);
       // An unfinished review from this same version means the last host exited
       // without a result or graceful cancellation. Count it once on restart.
@@ -60,6 +72,7 @@ export function createSqmFailureCircuit({ version = CLI_VERSION, store = null }
         state.failures = Math.min(SQM_FAILURE_PAUSE_THRESHOLD, state.failures + 1);
         if (state.providerFailures === 1) state.providerFailures = 2;
         state.inFlight = false;
+        scheduleRecovery(state);
         await save(scope, state);
       }
     }
@@ -67,20 +80,35 @@ export function createSqmFailureCircuit({ version = CLI_VERSION, store = null }
       state.version = version;
       state.providerFailures = 0; state.providerRetryAt = 0;
       state.failures = 0;
+      delete state.recoveryAt; delete state.recoveryAttempts;
       state.inFlight = false;
       await save(scope, state);
     } else if (state.storageError) await save(scope, state);
+    // Migrate a legacy update-only pause once, retaining counters and scope.
+    if (exhausted(state) && state.recoveryAt === undefined) {
+      scheduleRecovery(state); await save(scope, state);
+    }
     return state;
   };
   return {
-    async canClaim(scope, now = Date.now()) {
+    async canClaim(scope, time = now()) {
       const state = await load(scope);
-      return state.failures < SQM_FAILURE_PAUSE_THRESHOLD && (state.providerFailures || 0) < 2 && now >= (state.providerRetryAt || 0);
+      if (time < (state.providerRetryAt || 0) || state.inFlight) return false;
+      if (!exhausted(state)) return true;
+      if (time < state.recoveryAt) return false;
+      // Reserve the next cooldown before claiming. Empty claims, reconnects and
+      // cancelled work never reset failures or allow a burst of recovery turns.
+      state.recoveryAttempts = Math.min((state.recoveryAttempts || 0) + 1, 3);
+      state.recoveryAt = time + recoveryDelay(state);
+      await save(scope, state);
+      return true;
     },
     async providerFailure(scope, retryAt, retryAttempt = 0) {
       const state = await load(scope);
       state.providerFailures = retryAttempt === 1 ? 2 : Math.min(2, (state.providerFailures || 0) + 1);
       state.providerRetryAt = retryAt;
+      scheduleRecovery(state);
+      if (state.recoveryAt !== undefined) state.recoveryAt = Math.max(state.recoveryAt, retryAt);
       await save(scope, state);
     },
     async providerRetryUsed(scope) {
@@ -104,12 +132,14 @@ export function createSqmFailureCircuit({ version = CLI_VERSION, store = null }
       state.failures = Math.min(SQM_FAILURE_PAUSE_THRESHOLD, state.failures + 1);
       if (state.inFlight && state.providerFailures === 1) state.providerFailures = 2;
       state.inFlight = false;
+      scheduleRecovery(state);
       await save(scope, state);
     },
     async success(scope) {
       const state = await load(scope);
       state.failures = 0;
       state.providerFailures = 0; state.providerRetryAt = 0;
+      delete state.recoveryAt; delete state.recoveryAttempts;
       state.inFlight = false;
       await save(scope, state);
     },
@@ -117,10 +147,12 @@ export function createSqmFailureCircuit({ version = CLI_VERSION, store = null }
       const state = states.get(scopeKey(scope));
       const paused = (state?.failures || 0) >= SQM_FAILURE_PAUSE_THRESHOLD || (state?.providerFailures || 0) >= 2;
       return { consecutive_failures: state?.failures || 0,
-        paused_until_update: paused,
+        paused_until_update: false,
+        recovery_pending: paused && state?.inFlight !== true,
+        next_retry_at: paused ? state.recoveryAt ?? null : null,
         provider_retry_exhausted: (state?.providerFailures || 0) >= 2,
         provider_recovery_pending: state?.providerFailures === 1,
-        paused_at_version: paused ? state.version : null,
+        paused_at_version: null,
         storage_unavailable: state?.storageError === true || unreadableScopes.has(scopeKey(scope)) };
     },
   };

package/src/sqm/provider-command.js

@@ -16,7 +16,7 @@ export function runProviderCommand(command, args, { env, cwd, timeout = 10_000,
     };
     const timer = setTimeout(() => {
       child.kill("SIGTERM");
-      finish(new Error("Provider plugin command timed out."));
+      finish(Object.assign(new Error("Provider plugin command timed out."), { code: 'provider_timeout' }));
     }, timeout);
     timer.unref?.();
     const capture = (stream, append) => {