@awak-app/simy-cli 0.7.23 → 0.7.26

package/README.md

@@ -1425,3 +1425,9 @@ interrupted write or approve a pending external action. Explicit task
 stop/pause, provider permission prompts and unanswered user questions remain
 boundaries. `runtime supervisor-disable` is a durable explicit stop and is never
 reversed by waking or booting. A later explicit enable is required.
+
+A recovery read can inspect the one unknown operation it is bound to while
+that operation continues to block writes. Observing the result settles local
+occupancy without accepting the task. Long-running tasks transmit current
+recovery context and recent work; the full history remains in durable state
+and can be inspected through `delivery status`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.23",
+  "version": "0.7.26",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -39,7 +39,7 @@
     "test:e2e:console:real-provider": "node ./scripts/real-provider-console-e2e.js",
     "test:e2e:console:fullstack": "node ./scripts/fullstack-cli-smoke.js",
     "check": "npm run check:auto-update && node --check ./src/desktop-executor.js && node --check ./src/local-task.js && node --check ./scripts/desktop-executor-e2e.js && node --check ./scripts/pre-guardrail-e2e.js && node --check ./scripts/fixtures/fake-desktop-provider.js && npm run check:syntax && npm run check:session-supervision-syntax && npm run check:real-provider-syntax && npm test && npm run check:package",
-    "check:session-supervision-syntax": "node --check ./src/session-supervision/session-list.js && node --check ./src/console/sessions.js && node --check ./src/session-supervision/remote-hosts.js && node --check ./src/session-supervision/remote-entry.js && node --check ./src/session-supervision/index.js && node --check ./src/session-supervision/discovery-window.js && node --check ./src/session-supervision/codex-app-server.js && node --check ./src/session-supervision/claude-sessions.js && node --check ./src/session-supervision/original-session-target.js && node --check ./src/session-supervision/action-association.js && node --check ./src/session-supervision/action-association-host.js && node --check ./src/session-supervision/action-association-api.js && node --check ./src/session-supervision/association-store.js && node --check ./src/session-supervision/action-deadline.js && node --check ./src/session-supervision/action-deadline-store.js && node --check ./src/codex-plugins/simy/hooks/action-association.mjs && node --check ./src/session-supervision/purpose-instruction.js && node --check ./src/session-supervision/purpose-recovery.js && node --check ./src/session-supervision/purpose-candidate.js && node --check ./src/codex-plugins/simy/hooks/scene-reasoning.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-cycle.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-rule-review.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-search.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-evidence.mjs && node --check ./src/session-supervision/purpose-observer.js && node --check ./src/session-supervision/purpose-verification.js && node --check ./src/codex-plugins/simy/hooks/purpose-workspace.mjs && node --check ./scripts/purpose-search-live-e2e.js",
+    "check:session-supervision-syntax": "node --check ./src/session-supervision/session-list.js && node --check ./src/console/sessions.js && node --check ./src/session-supervision/remote-hosts.js && node --check ./src/session-supervision/remote-entry.js && node --check ./src/session-supervision/index.js && node --check ./src/session-supervision/discovery-window.js && node --check ./src/session-supervision/codex-app-server.js && node --check ./src/session-supervision/claude-sessions.js && node --check ./src/session-supervision/original-session-target.js && node --check ./src/session-supervision/action-association.js && node --check ./src/session-supervision/action-association-host.js && node --check ./src/session-supervision/action-association-api.js && node --check ./src/session-supervision/association-store.js && node --check ./src/session-supervision/action-deadline.js && node --check ./src/session-supervision/action-deadline-store.js && node --check ./src/codex-plugins/simy/hooks/action-association.mjs && node --check ./src/session-supervision/purpose-instruction.js && node --check ./src/session-supervision/purpose-recovery.js && node --check ./src/session-supervision/purpose-candidate.js && node --check ./src/codex-plugins/simy/hooks/scene-reasoning.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-cycle.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-rule-review.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-search.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-evidence.mjs && node --check ./src/session-supervision/purpose-observer.js && node --check ./src/session-supervision/purpose-verification.js && node --check ./src/codex-plugins/simy/hooks/purpose-workspace.mjs && node --check ./scripts/purpose-search-live-e2e.js && node --check ./src/session-supervision/remote-managed-delivery.js",
     "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js && npm run check:sqm",
     "check:workflow-observation-sender": "node --check ./src/workflow-observation-sender.js",
     "check:sqm": "node --check ./src/sqm/provider-plugin-repair.js && node --check ./src/sqm/provider-plugin-status.js && node --check ./src/sqm/advisory-guidance.js && node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/reliability.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./src/sqm/agent-skill.js && node --check ./src/sqm/workflow-onboarding.js && node --check ./src/sqm/workflow-update.js && node --check ./src/sqm/history-store.js && node --check ./src/sqm/review-worker.js && node --check ./scripts/sqm-complete-loop-e2e.js && node --check ./scripts/sqm-local-review-e2e.js",

package/src/agent.js

@@ -1,3 +1,4 @@
+import { connectionOverview, readSqmConnectionObservation } from './connection-overview.js';
 import { readLocalPhotoSource } from "./local-photos.js";
 import { resolveLocalTaskDestination, saveLocalTaskDestination } from "./local-task-destination.js";
 import { observePairedNativeIdentities } from './native-provider-identity.js';
@@ -1217,7 +1218,7 @@ export async function startAgent({
 
       if (req.method === "GET" && url.pathname === "/v1/auth/browser") {
         if (req.headers.host !== `127.0.0.1:${port}`) { json(res, 403, { error: "Invalid local host." }); return; }
-        const page = browserHandoffPage();
+        const page = browserHandoffPage(apiOrigin);
         res.writeHead(200, page.headers).end(page.html);
         return;
       }
@@ -1516,6 +1517,7 @@ export async function startAgent({
           const previousSession = session ?? reclaimableSession;
           const authorizedSession = {
             token: String(body.token || ""),
+            email: typeof body.email === "string" && body.email.length <= 254 ? body.email : null,
             device_id: typeof body.device_id === "string" ? body.device_id : null,
             api_origin: apiOrigin,
             api_base_url: apiBaseUrl,
@@ -2857,8 +2859,21 @@ export async function startAgent({
     const { codex, claude } = deferStartupSynchronization
       ? providerStatuses
       : await readProviderStatuses();
+    const overviewSession = session;
+    const overviewAccess = desktopAccess.snapshot();
+    let overviewSqm = { state: 'unknown' };
+    if (auth.state === 'signed_in' && !pendingOrganization) {
+      try { overviewSqm = await readSqmConnectionObservation({ endpoint: process.env.SIMY_SQM_BUNDLE_URL?.trim() || new URL('sqm/knowledge-bundle', resolveWebApiBaseUrl(apiOrigin, overviewSession?.api_base_url)).href,
+        accountId: overviewSession?.account_id || overviewSession?.auth_user_id || overviewSession?.device_id,
+        organizationId: overviewSession?.organization_id || overviewSession?.org_id }, { root: process.env.SIMY_SQM_CACHE_DIR || join(sessionRoot, 'sqm') }); } catch { /* A missing endpoint must not block the status frame. */ }
+    }
+    // An organization switch/sign-out while reading local metadata must not
+    // publish an old tenant's identity or SQM result in a fresh frame.
+    const overview = connectionOverview({ webOrigin: apiOrigin, session, access: session === overviewSession ? overviewAccess : null,
+      signedIn: session === overviewSession && auth.state === 'signed_in', switching: Boolean(pendingOrganization), sqm: overviewSqm });
     return {
       schemaVersion: 1,
+      connectionOverview: overview,
       sampledAt: new Date().toISOString(),
       version: CLI_VERSION,
       webOrigin: apiOrigin,

package/src/auto-update.js

@@ -15,6 +15,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 
+import { daemonRestartCommand } from "./web-origin.js";
 import { openExternalUrl } from "./browser.js";
 import {
   installMacosInstallerRelease,
@@ -1094,7 +1095,7 @@ export function autoUpdateHelpText({ installMode = null, webOrigin = null } = {}
   return [
     "Recommended installation (enables verified CLI auto-update):",
     `  npm install -g ${CLI_PACKAGE_NAME}`,
-    "  simy --daemon",
+    `  ${daemonRestartCommand(webOrigin)}`,
   ].join("\n");
 }
 
@@ -1131,7 +1132,7 @@ export function updateAction(version, { installMode = "global_npm", webOrigin }
   return {
     id: "install_global_cli",
     label: "Install and restart SIMY",
-    command: `npm install -g ${CLI_PACKAGE_NAME}@${version} && simy --daemon`,
+    command: `npm install -g ${CLI_PACKAGE_NAME}@${version} && ${daemonRestartCommand(webOrigin)}`,
   };
 }
 

package/src/browser-handoff.js

@@ -1,3 +1,4 @@
+import { normalizeWebOrigin } from "./web-origin.js";
 import { createDecipheriv, createHash } from "node:crypto";
 
 export const BROWSER_HANDOFF_TRANSPORT = "loopback_redirect_v1";
@@ -33,6 +34,14 @@ const copy = ja ? {
 };
 document.documentElement.lang = ja ? 'ja' : 'en';
 const title = document.getElementById('title'), message = document.getElementById('message');
+const environment = document.getElementById('environment');
+const origin = environment.dataset.origin;
+const host = new URL(origin).hostname;
+const label = origin === 'https://app.simy.one' ? (ja ? '本番' : 'Production')
+  : origin === 'https://app-dev.simy.one' ? (ja ? '開発' : 'Development')
+  : ['localhost', '127.0.0.1', '[::1]'].includes(host) ? (ja ? 'ローカル開発' : 'Local development')
+  : (ja ? 'カスタムホスト' : 'Custom host');
+environment.textContent = (ja ? '接続先環境' : 'Connection environment') + ': ' + label + ' · ' + origin;
 title.textContent = copy.title; message.textContent = copy.waiting;
 const handoff = new URLSearchParams(location.hash.slice(1)).get('handoff');
 history.replaceState(null, '', location.pathname);
@@ -54,15 +63,17 @@ history.replaceState(null, '', location.pathname);
 
 // A self-contained local page: credentials never enter the URL query, HTTP
 // request, history or third-party resources. Only the encrypted fragment does.
-const style = `:root{color-scheme:light dark;--bg:#ffffff;--card:#f6f5f4;--ink:#0d0d0d;--muted:#615d59;--line:#e6e6e6;--accent:#0075de} @media(prefers-color-scheme:dark){:root{--bg:#1a1918;--card:#252320;--ink:#f5f3f0;--muted:#b8b3ad;--line:#31302f;--accent:#3b9eff}}*{box-sizing:border-box}body{margin:0;min-height:100dvh;display:grid;place-items:center;padding:24px;background:var(--bg);color:var(--ink);font:16px/1.5 system-ui,sans-serif}main{max-width:480px;width:100%;padding:32px;border:1px solid var(--line);border-radius:12px;background:var(--card)}.brand{color:var(--accent);font-weight:600;font-size:14px}h1{font-size:24px;font-weight:600;margin:16px 0}p{color:var(--muted);margin:0}body[data-state=failed] h1{color:var(--ink)}`;
+const style = `:root{color-scheme:light dark;--bg:#ffffff;--card:#f6f5f4;--ink:#0d0d0d;--muted:#615d59;--line:#e6e6e6;--accent:#0075de} @media(prefers-color-scheme:dark){:root{--bg:#1a1918;--card:#252320;--ink:#f5f3f0;--muted:#b8b3ad;--line:#31302f;--accent:#3b9eff}}*{box-sizing:border-box}body{margin:0;min-height:100dvh;display:grid;place-items:center;padding:24px;background:var(--bg);color:var(--ink);font:16px/1.5 system-ui,sans-serif}main{max-width:480px;width:100%;padding:32px;border:1px solid var(--line);border-radius:12px;background:var(--card)}.brand{color:var(--accent);font-weight:600;font-size:14px}h1{font-size:24px;font-weight:600;margin:16px 0}p{color:var(--muted);margin:0}#environment{margin-top:16px;font-size:14px;overflow-wrap:anywhere}body[data-state=failed] h1{color:var(--ink)}`;
 const hash = value => createHash("sha256").update(value).digest("base64");
-export function browserHandoffPage() {
+export function browserHandoffPage(webOrigin) {
+  const origin = normalizeWebOrigin(webOrigin);
+  const escapedOrigin = origin.replace(/[&<>"']/g, value => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[value]);
   return {
     headers: {
       "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store",
       "Referrer-Policy": "no-referrer", "X-Content-Type-Options": "nosniff",
       "Content-Security-Policy": `default-src 'none'; script-src 'sha256-${hash(script)}'; style-src 'sha256-${hash(style)}'; connect-src 'self'; img-src data:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'`,
     },
-    html: `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>SIMY connection</title><link rel="icon" href="data:,"><style>${style}</style></head><body><main aria-live="polite" aria-atomic="true"><div class="brand">SIMY</div><h1 id="title">Connecting to SIMY</h1><p id="message">Keep SIMY open while connecting.</p><noscript>JavaScript is required. Return to SIMY and reconnect using a browser with JavaScript enabled.</noscript></main><script>${script}</script></body></html>`,
+    html: `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>SIMY connection</title><link rel="icon" href="data:,"><style>${style}</style></head><body><main aria-live="polite" aria-atomic="true"><div class="brand">SIMY</div><h1 id="title">Connecting to SIMY</h1><p id="message">Keep SIMY open while connecting.</p><p id="environment" data-origin="${escapedOrigin}">Connection environment: ${escapedOrigin}</p><noscript>JavaScript is required. Return to SIMY and reconnect using a browser with JavaScript enabled.</noscript></main><script>${script}</script></body></html>`,
   };
 }

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.23";
+export const CLI_VERSION = "0.7.26";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/hooks/consistency-handoff.mjs

@@ -1,3 +1,48 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+// Keep every original receipt outside the mutable task record before collapsing
+// repeated inspections of the same contract, stage, decision and lease. This is
+// storage maintenance, never a completed action or permission to replay one.
+export async function compactConsistencyOutbox(root, record) {
+  const managed = record.run?.managed, outbox = managed?.consistencyOutbox;
+  if (!Array.isArray(outbox) || outbox.length < 2) return false;
+  const groups = new Map();
+  for (const item of outbox) {
+    const compatible = item.stage === 'executing' && item.decisionId && item.leaseId ||
+      item.stage === 'inspected' && item.targetTask && item.objectiveDigest;
+    const key = compatible
+      ? JSON.stringify([item.targetTask, item.version, item.objectiveDigest, item.stage, item.decisionId, item.leaseId, item.advisory === true, item.result])
+      : item;
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(item);
+  }
+  if (groups.size === outbox.length) return false;
+  const payload = JSON.stringify({ schema: 1, kind: 'execution_handoff_snapshot', provider: record.provider,
+    session: record.session, runId: record.run.id, requests: outbox });
+  const digest = createHash('sha256').update(payload).digest('hex');
+  const directory = join(root, 'consistency', 'handoff-history');
+  const file = join(directory, `${digest}.json`), temporary = `${file}.${randomUUID()}.tmp`;
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  try {
+    await writeFile(temporary, payload, { mode: 0o600 });
+    await rename(temporary, file);
+    if (await readFile(file, 'utf8') !== payload) throw new Error('Handoff history could not be retained.');
+  } finally { await rm(temporary, { force: true }); }
+  managed.consistencyOutbox = [...groups.values()].map(items => {
+    if (items.length === 1) return items[0];
+    const latest = items.at(-1);
+    return { ...latest, findings: [...new Set(items.flatMap(item => item.findings || []))],
+      ...Object.fromEntries(['createdAt', 'dueAt'].flatMap(key => {
+        const values = items.map(item => item[key]).filter(Number.isFinite);
+        return values.length ? [[key, Math.min(...values)]] : [];
+      })),
+      retainedHistory: { digest, requestCount: items.reduce((count, item) => count + (item.retainedHistory?.requestCount || 1), 0) } };
+  });
+  return true;
+}
+
 // Durable handoff deadlines concern unowned work, never a live effect lease.
 // Expiry queues diagnosis; it does not replay a write or grant permission.
 export const HANDOFF_RECEIPT_MS = 2 * 60_000;

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -8,7 +8,7 @@ import { currentRecoveryIncident, recordRecoveryIncident, recordRecoveryStage, s
 import { rememberPerspectives, perspectiveScope, recallPerspectives, perspectiveInstruction } from './perspective-memory.mjs';
 import { recordHypothesisSheet } from './hypothesis-sheet.mjs';
 import { bindControllerCompletion } from './completion-binding.mjs';
-import { recordHandoffStage } from './consistency-handoff.mjs';
+import { recordHandoffStage, compactConsistencyOutbox } from './consistency-handoff.mjs';
 import { retainApplicableRules } from './purpose-rule-policy.mjs';
 import { reconcileRequirements, retainControllerEvidence, reconcileFindings, findingText, evidenceLedger, currentPurposeObservation } from './purpose-evidence.mjs';
 import { workspaceIdentity } from './purpose-workspace.mjs';
@@ -116,11 +116,13 @@ export async function linkedProvider(root, provider) {
 const digest = value => createHash('sha256').update(value).digest('hex');
 const text = (value, max = 4000) => typeof value === 'string' ? value.trim().slice(0, max) : '';
 const exactText = value => typeof value === 'string' && Buffer.byteLength(value, 'utf8') <= 1000 ? value : null;
-export function canUpgradeDelivery(run) {
+export function canUpgradeDelivery(run, { automatic = false } = {}) {
   return Boolean(run && !run.managed && text(run.id) && text(run.objective) && Number.isFinite(run.startedAt) &&
     Number.isSafeInteger(run.maxFailures) && run.maxFailures > 0 &&
     (['active', 'paused', 'recovery_required'].includes(run.state) ||
-      run.state === 'blocked' && run.blocker === 'external_dependency'));
+      run.state === 'blocked' && run.blocker === 'external_dependency') &&
+    (!automatic || run.stopReason?.actor !== 'user' && (run.state !== 'paused' || run.stopReason?.actor === 'system' ||
+      /^(?:Paused because no progress was confirmed in \d+ minutes\.|No verified acceptance progress in \d+ minutes\.|Paused after \d+ steps without confirmed progress\.) Review the original conversation, then resume\.$/.test(run.reason || ''))));
 }
 const contextText = (value, max = 500) => text(value, max).replace(/\b(?:sk|key)-[A-Za-z0-9_-]{12,}\b|\bBearer\s+\S+|\b(?:password|token|api[_-]?key)\s*[:=]\s*\S+/gi, '[redacted]');
 export function recordPath(root, provider, session) {
@@ -275,7 +277,9 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
           delete criterion.check.path;
         }
       }
-      const serialized = JSON.stringify(next);
+      let serialized = JSON.stringify(next);
+      if (Buffer.byteLength(serialized) > MAX_STATE_BYTES / 2 && await compactConsistencyOutbox(root, next))
+        serialized = JSON.stringify(next);
       if (Buffer.byteLength(serialized) > MAX_STATE_BYTES) throw new Error('Delivery state exceeds 4 MiB; retain history before reducing task details.');
       if (serialized === previousBytes) return next;
       temporary = `${file}.${randomUUID()}.tmp`;
@@ -864,7 +868,8 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
       const fences = Object.values(gate.taskFences?.records || {}).filter(item => item.taskId === (prior.managed?.taskId || prior.id) && item.identity.provider === provider && item.identity.session === session);
       if (fences.some(item => !readTaskAdmission({ root: gateRoot, identity: item.identity, taskId: item.taskId }).canResume)) throw new Error('Existing task admission must be reconciled before enrolling follow-up work.');
     }
-    if (upgrading && ((!reconciling && !canUpgradeDelivery(previous.run)) || previous.run.id !== upgradeRunId)) throw new Error('Only the exact nonterminal ordinary loop can be upgraded; resolve its blocker or resume its original task first.');
+    if (upgrading && ((!reconciling && !canUpgradeDelivery(previous.run, { automatic: Boolean(autoContinueEpoch) })) ||
+        autoContinueEpoch && hasPendingUserStop(root, previous) || previous.run.id !== upgradeRunId)) throw new Error('Only the exact nonterminal ordinary loop can be upgraded; resolve its blocker or resume its original task first.');
     if (previous.run && !upgrading && !following) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
     if (upgrading && (text(objective) !== previous.run.objective || executionCwd && previous.run.executionCwd && executionCwd !== previous.run.executionCwd)) throw new Error('Upgrade must preserve the original objective and task directory.');
     const managedConfig = managed && { ...(managed === true ? {} : managed),
@@ -1201,6 +1206,18 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     const localReconciliation = flexibleReasoning(run.managed) && ['read','local_edit','local_test'].includes(uncertainAction?.kind);
     if (run.managed?.executionUncertain && run.managed.recoveryDiagnosisDecisionId === lastWork?.result?.decisionId && lastWork.result.status === 'observed' && (lastWork.result.evidence?.length || lastWork.result.observationSource === 'controller_tool_result' || localReconciliation) && lastWork.action.kind === 'read') {
       run.managed.recoveryEvidence = { decisionId: lastWork.result.decisionId, source: lastWork.result.observationSource || 'provider_reported_read', checkedAt: now };
+      const priorUnit = run.managed.purpose?.evidence?.units?.find(unit =>
+        unit.id === uncertain.decisionId && unit.status === 'unknown' &&
+        (!uncertain.attemptId || unit.attemptId === uncertain.attemptId));
+      if (priorUnit) {
+        priorUnit.status = 'observed';
+        // The read already met the reconciliation guard above, including a
+        // local observation reported without separate evidence references.
+        // Release only local occupancy, never acceptance or external effects.
+        if (['local_edit', 'local_test'].includes(priorUnit.action?.kind)) {
+          priorUnit.localExecutionSettledAt = now;
+        }
+      }
       delete run.managed.executionUncertain;
       resolveRecoveryReceipt(run, uncertain?.attemptId);
       delete run.managed.recoveryDiagnosisDecisionId;
@@ -1873,14 +1890,15 @@ export async function processIdentity(pid) {
 export async function claudeHookChannel(record, { session, cwd, inspectProcess = processIdentity, platform = process.platform } = {}) {
   const unavailable = (code, reason) => ({ ready: false, code, reason });
   if (platform === 'win32') return unavailable('platform_unsupported', 'Claude process verification is unavailable on Windows; monitoring remains available.');
-  if (!record) return unavailable('hook_missing', 'SIMY has not observed a session-start event for this conversation. Check the SIMY plugin and hook execution in the original Claude window.');
+  if (!record) return unavailable('hook_missing', 'Waiting for the original Claude hook. SIMY recovers automatically when the next verified prompt or response-end hook arrives. If no notifications arrive, check the SIMY plugin in the original Claude window.');
   if (record.provider !== 'claude' || record.session !== session) return unavailable('session_mismatch', 'The observed hook belongs to a different Claude conversation. Refresh this conversation.');
   try { if (record.cwd !== await realpath(cwd)) return unavailable('workspace_mismatch', 'The observed Claude hook belongs to a different folder. Refresh this conversation.'); }
   catch { return unavailable('workspace_unavailable', 'The Claude conversation folder could not be verified. Check the folder and refresh.'); }
   if (record.hookEndedAt || record.lastEvent === 'SessionEnd') return unavailable('session_ended', 'This Claude session has ended. Return to the original conversation to continue.');
+  if (!record.hookStartedAt && record.hookRecoveryBlocked) return unavailable('process_changed', 'A different Claude process reported this conversation. Reopen the original conversation to establish its hook owner.');
   if (!record.hookStartedAt) return unavailable(record.hookObservedAt ? 'process_unverified' : 'hook_missing', record.hookObservedAt
     ? 'The session-start hook ran, but SIMY could not identify its Claude process. Check the hook diagnostics.'
-    : 'SIMY has not observed a session-start event for this conversation. Check the SIMY plugin and hook execution in the original Claude window.');
+    : 'Waiting for the original Claude hook. SIMY recovers automatically when the next verified prompt or response-end hook arrives. If no notifications arrive, check the SIMY plugin in the original Claude window.');
   const owner = record.hookSessionProcess || record.process; // Existing verified records remain compatible.
   if (!owner?.identity || !Number.isSafeInteger(owner.pid) || owner.pid < 2) return unavailable('process_unverified', 'The session-start hook ran, but SIMY could not identify its Claude process. Check the hook diagnostics.');
   if (record.process?.pid !== owner.pid || record.process?.identity !== owner.identity) return unavailable('process_changed', 'A different Claude process reported this conversation. Refresh the original conversation.');
@@ -2019,6 +2037,22 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
         backgroundIdle: event === 'Stop' && Array.isArray(input.background_tasks) && input.background_tasks.length === 0 && Array.isArray(input.session_crons) && input.session_crons.length === 0 };
     }
     record.lastNotificationType = event === 'Notification' ? text(input.notification_type, 80) : null;
+    if (provider === 'claude' && event !== 'SessionStart' && identity && record.process &&
+        (record.process.pid !== identity.pid || record.process.identity !== identity.identity)) {
+      record.hookRecoveryBlocked = 'process_changed';
+    }
+    // A plugin loaded after the conversation opened can miss SessionStart.
+    // A real prompt/stop hook proves the same exact session and provider parent
+    // without fabricating a start event or adopting an existing task/owner.
+    if (provider === 'claude' && ['UserPromptSubmit', 'Stop'].includes(event) &&
+        !record.run && !record.hookStartedAt && !record.hookSessionProcess && !record.hookEndedAt && !record.hookRecoveryBlocked &&
+        !record.parentSession && !env.SIMY_PARENT_SESSION && !env.CODEX_THREAD_ID &&
+        !record.providerArchived && identity?.identity && Number.isSafeInteger(identity.pid) && identity.pid > 1 &&
+        (!record.process || record.process.pid === identity.pid && record.process.identity === identity.identity)) {
+      record.hookStartedAt = now;
+      record.hookSessionProcess = { ...identity };
+      record.hookRecovery = { source: event, recoveredAt: now, reason: 'session_start_missing' };
+    }
     if (identity) {
       // Legacy records have no frozen hook owner; a new process must not inherit
       // an old SessionStart admission through a later prompt or stop event.
@@ -2028,6 +2062,8 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
     }
     if (event === 'SessionStart') {
       record.hookObservedAt = now;
+      delete record.hookRecovery;
+      delete record.hookRecoveryBlocked;
       delete record.hookEndedAt;
       if (identity) { record.hookStartedAt = now; record.hookSessionProcess = { ...identity }; }
       else { delete record.hookStartedAt; delete record.hookSessionProcess; delete record.process; }

package/src/codex-plugins/simy/hooks/loop-kernel/work-frontier.mjs

@@ -37,7 +37,7 @@ export function compactWorkHistory(ledger, historyLimit = 64) {
 }
 
 /** Pure projection of the existing evidence.units; never grants authority or dispatches. */
-export function planWorkFrontier(ledger, { prObservations = {}, stopped = false, preferredUnitId = null } = {}) {
+export function planWorkFrontier(ledger, { prObservations = {}, stopped = false, preferredUnitId = null, reconcileUnknownUnitId = null } = {}) {
   if (!ledger || !Array.isArray(ledger.units)) throw new Error('Existing work-unit ledger required.');
   const units = ledger.units;
   const ids = new Set();
@@ -88,9 +88,11 @@ export function planWorkFrontier(ledger, { prObservations = {}, stopped = false,
       }
       if (!reason) {
         const conflict = [...holders, ...proposals.map(id => byId.get(id))].find(other => other.id !== unit.id && conflicts(unit, other) &&
-          // A read establishes the result of an observed effect. Check all
-          // other holders; a label must never bypass live/unknown writers.
-          !(unit.action?.kind === 'read' && unit.writeResources.length === 0 && other.status === 'observed'));
+          // Inspect observed effects, or one controller-bound unknown effect.
+          // Keep all writers fenced and check every other resource holder.
+          !(unit.action?.kind === 'read' && unit.writeResources.length === 0 &&
+            (other.status === 'observed' || unit.id === preferredUnitId &&
+              other.status === 'unknown' && other.id === reconcileUnknownUnitId)));
         if (conflict) reason = `resource_conflict:${conflict.id}`;
       }
       if (!reason) { state = 'proposed'; proposals.push(unit.id); }
@@ -103,7 +105,7 @@ export function planWorkFrontier(ledger, { prObservations = {}, stopped = false,
   const inputDigest = hash({ purposeRevision: ledger.purposeRevision, unitsOmitted: ledger.unitsOmitted,
     units: units.map(({ id, owner, status, purposeRevision, dependsOn, readResources, writeResources, waitReason, pr, action, effectReconciledRevision, localExecutionSettledAt }) =>
       ({ id, owner, status, purposeRevision, dependsOn, readResources, writeResources, waitReason, pr, action, effectReconciledRevision, localExecutionSettledAt })),
-    prObservations, stopped, preferredUnitId });
+    prObservations, stopped, preferredUnitId, reconcileUnknownUnitId });
   return { version: 1, inputDigest, proposals, rows, authority: 'proposal_only' };
 }
 

package/src/codex-plugins/simy/hooks/update-dispatch-gate.mjs

@@ -66,6 +66,42 @@ export function confirmDispatch({ root = detachmentRoot(), attemptId }) {
     if (!attempt || !Object.values(state.receipts).some(item => item.attemptId === attemptId && item.resultRef)) fail('result_required');
     attempt.phase = 'confirmed'; state.revision++; atomicSave(path(root), state); return state; });
 }
+// Transport settlement is independent of acceptance of the provider's report.
+// Only an observed terminal event for the exact owned turn may use this path.
+export function queueProviderTerminalReceipt({ root = detachmentRoot(), attemptId, providerSession, providerExecutionId, status, response = '' }) {
+  if (!['completed', 'failed', 'interrupted'].includes(status) || typeof response !== 'string' ||
+      !providerSession || !providerExecutionId) fail('terminal_evidence_invalid');
+  root = realpathSync(root);
+  const state = read(root), attempt = state.attempts[digest(attemptId)];
+  if (!attempt?.provenance || attempt.provenance.providerSession !== providerSession) fail('terminal_identity_mismatch');
+  const ref = join(root, 'update-detachment', 'provider-results', digest([attemptId, providerExecutionId]) + '.json');
+  const evidence = { schemaVersion: 1, kind: 'provider_terminal', attemptId, providerSession, providerExecutionId, status,
+    taskHash: attempt.taskHash, identityHash: attempt.identityHash, generation: attempt.generation,
+    responseDigest: digest(response), response: response.slice(0, 65536), truncated: response.length > 65536 };
+  const prior = readState(ref);
+  if (prior && digest(prior) !== digest(evidence)) fail('terminal_evidence_conflict');
+  if (!prior) atomicSave(ref, evidence);
+  const item = { schemaVersion: 1, kind: 'terminal_receipt', attemptId, providerExecutionId, resultRef: ref,
+    receiptId: `terminal:${attemptId}:${providerExecutionId}`, evidenceDigest: digest(evidence) };
+  atomicSave(join(root, 'update-detachment', 'intake', digest(item) + '.json'), item);
+  try { flushDispatchIntake(root); } catch (error) { if (error.code !== 'state_busy') throw error; }
+  return ref;
+}
+function applyTerminalReceipt(state, item, root) {
+  const ref = item.resultRef, attempt = state.attempts[digest(item.attemptId)];
+  const expected = join(resolve(root), 'update-detachment', 'provider-results', digest([item.attemptId, item.providerExecutionId]) + '.json');
+  if (ref !== expected || realpathSync(ref) !== ref) fail('terminal_evidence_invalid');
+  const evidence = readState(ref);
+  if (!evidence || digest(evidence) !== item.evidenceDigest || evidence.schemaVersion !== 1 || evidence.kind !== 'provider_terminal' ||
+      !['completed', 'failed', 'interrupted'].includes(evidence.status) || evidence.attemptId !== item.attemptId ||
+      evidence.providerExecutionId !== item.providerExecutionId || !attempt?.provenance ||
+      evidence.providerSession !== attempt.provenance.providerSession || evidence.taskHash !== attempt.taskHash ||
+      evidence.identityHash !== attempt.identityHash || evidence.generation !== attempt.generation) fail('terminal_identity_mismatch');
+  const priorTurns = Object.values(state.receipts).filter(row => row.attemptId === item.attemptId).map(row => row.providerExecutionId).filter(Boolean);
+  if (priorTurns.some(id => id !== item.providerExecutionId)) fail('terminal_evidence_conflict');
+  applyReceipt(state, item);
+  attempt.phase = 'confirmed';
+}
 export function dispatchWithFence(owner, { taskId, attemptId = randomUUID(), identity = null, provenance = null }, send) {
   if (!owner || typeof send !== 'function' || typeof taskId !== 'string' || !taskId || typeof attemptId !== 'string' || !attemptId) fail('dispatch_identity_required');
   return withLock(path(owner.root), () => {
@@ -165,7 +201,9 @@ export function flushDispatchIntake(root = detachmentRoot()) {
     for (const name of names) {
       if (!/^[a-f0-9]{64}\.json$/.test(name)) continue;
       const item = readState(join(directory, name));
-      if (item?.kind === 'receipt') applyReceipt(state, item); else applyIdentityIntake(state, item);
+      if (item?.kind === 'receipt') applyReceipt(state, item);
+      else if (item?.kind === 'terminal_receipt') applyTerminalReceipt(state, item, root);
+      else applyIdentityIntake(state, item);
       applied.push(name);
     }
     if (applied.length) { state.revision++; atomicSave(path(root), state); for (const name of applied) unlinkSync(join(directory, name)); }