@awak-app/simy-cli 0.7.25 → 0.7.26

package/README.md

@@ -1425,3 +1425,9 @@ interrupted write or approve a pending external action. Explicit task
 stop/pause, provider permission prompts and unanswered user questions remain
 boundaries. `runtime supervisor-disable` is a durable explicit stop and is never
 reversed by waking or booting. A later explicit enable is required.
+
+A recovery read can inspect the one unknown operation it is bound to while
+that operation continues to block writes. Observing the result settles local
+occupancy without accepting the task. Long-running tasks transmit current
+recovery context and recent work; the full history remains in durable state
+and can be inspected through `delivery status`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.25",
+  "version": "0.7.26",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -39,7 +39,7 @@
     "test:e2e:console:real-provider": "node ./scripts/real-provider-console-e2e.js",
     "test:e2e:console:fullstack": "node ./scripts/fullstack-cli-smoke.js",
     "check": "npm run check:auto-update && node --check ./src/desktop-executor.js && node --check ./src/local-task.js && node --check ./scripts/desktop-executor-e2e.js && node --check ./scripts/pre-guardrail-e2e.js && node --check ./scripts/fixtures/fake-desktop-provider.js && npm run check:syntax && npm run check:session-supervision-syntax && npm run check:real-provider-syntax && npm test && npm run check:package",
-    "check:session-supervision-syntax": "node --check ./src/session-supervision/session-list.js && node --check ./src/console/sessions.js && node --check ./src/session-supervision/remote-hosts.js && node --check ./src/session-supervision/remote-entry.js && node --check ./src/session-supervision/index.js && node --check ./src/session-supervision/discovery-window.js && node --check ./src/session-supervision/codex-app-server.js && node --check ./src/session-supervision/claude-sessions.js && node --check ./src/session-supervision/original-session-target.js && node --check ./src/session-supervision/action-association.js && node --check ./src/session-supervision/action-association-host.js && node --check ./src/session-supervision/action-association-api.js && node --check ./src/session-supervision/association-store.js && node --check ./src/session-supervision/action-deadline.js && node --check ./src/session-supervision/action-deadline-store.js && node --check ./src/codex-plugins/simy/hooks/action-association.mjs && node --check ./src/session-supervision/purpose-instruction.js && node --check ./src/session-supervision/purpose-recovery.js && node --check ./src/session-supervision/purpose-candidate.js && node --check ./src/codex-plugins/simy/hooks/scene-reasoning.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-cycle.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-rule-review.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-search.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-evidence.mjs && node --check ./src/session-supervision/purpose-observer.js && node --check ./src/session-supervision/purpose-verification.js && node --check ./src/codex-plugins/simy/hooks/purpose-workspace.mjs && node --check ./scripts/purpose-search-live-e2e.js",
+    "check:session-supervision-syntax": "node --check ./src/session-supervision/session-list.js && node --check ./src/console/sessions.js && node --check ./src/session-supervision/remote-hosts.js && node --check ./src/session-supervision/remote-entry.js && node --check ./src/session-supervision/index.js && node --check ./src/session-supervision/discovery-window.js && node --check ./src/session-supervision/codex-app-server.js && node --check ./src/session-supervision/claude-sessions.js && node --check ./src/session-supervision/original-session-target.js && node --check ./src/session-supervision/action-association.js && node --check ./src/session-supervision/action-association-host.js && node --check ./src/session-supervision/action-association-api.js && node --check ./src/session-supervision/association-store.js && node --check ./src/session-supervision/action-deadline.js && node --check ./src/session-supervision/action-deadline-store.js && node --check ./src/codex-plugins/simy/hooks/action-association.mjs && node --check ./src/session-supervision/purpose-instruction.js && node --check ./src/session-supervision/purpose-recovery.js && node --check ./src/session-supervision/purpose-candidate.js && node --check ./src/codex-plugins/simy/hooks/scene-reasoning.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-cycle.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-rule-review.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-search.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-evidence.mjs && node --check ./src/session-supervision/purpose-observer.js && node --check ./src/session-supervision/purpose-verification.js && node --check ./src/codex-plugins/simy/hooks/purpose-workspace.mjs && node --check ./scripts/purpose-search-live-e2e.js && node --check ./src/session-supervision/remote-managed-delivery.js",
     "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js && npm run check:sqm",
     "check:workflow-observation-sender": "node --check ./src/workflow-observation-sender.js",
     "check:sqm": "node --check ./src/sqm/provider-plugin-repair.js && node --check ./src/sqm/provider-plugin-status.js && node --check ./src/sqm/advisory-guidance.js && node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/reliability.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./src/sqm/agent-skill.js && node --check ./src/sqm/workflow-onboarding.js && node --check ./src/sqm/workflow-update.js && node --check ./src/sqm/history-store.js && node --check ./src/sqm/review-worker.js && node --check ./scripts/sqm-complete-loop-e2e.js && node --check ./scripts/sqm-local-review-e2e.js",

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.25";
+export const CLI_VERSION = "0.7.26";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/hooks/consistency-handoff.mjs

@@ -1,3 +1,48 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+// Keep every original receipt outside the mutable task record before collapsing
+// repeated inspections of the same contract, stage, decision and lease. This is
+// storage maintenance, never a completed action or permission to replay one.
+export async function compactConsistencyOutbox(root, record) {
+  const managed = record.run?.managed, outbox = managed?.consistencyOutbox;
+  if (!Array.isArray(outbox) || outbox.length < 2) return false;
+  const groups = new Map();
+  for (const item of outbox) {
+    const compatible = item.stage === 'executing' && item.decisionId && item.leaseId ||
+      item.stage === 'inspected' && item.targetTask && item.objectiveDigest;
+    const key = compatible
+      ? JSON.stringify([item.targetTask, item.version, item.objectiveDigest, item.stage, item.decisionId, item.leaseId, item.advisory === true, item.result])
+      : item;
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(item);
+  }
+  if (groups.size === outbox.length) return false;
+  const payload = JSON.stringify({ schema: 1, kind: 'execution_handoff_snapshot', provider: record.provider,
+    session: record.session, runId: record.run.id, requests: outbox });
+  const digest = createHash('sha256').update(payload).digest('hex');
+  const directory = join(root, 'consistency', 'handoff-history');
+  const file = join(directory, `${digest}.json`), temporary = `${file}.${randomUUID()}.tmp`;
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  try {
+    await writeFile(temporary, payload, { mode: 0o600 });
+    await rename(temporary, file);
+    if (await readFile(file, 'utf8') !== payload) throw new Error('Handoff history could not be retained.');
+  } finally { await rm(temporary, { force: true }); }
+  managed.consistencyOutbox = [...groups.values()].map(items => {
+    if (items.length === 1) return items[0];
+    const latest = items.at(-1);
+    return { ...latest, findings: [...new Set(items.flatMap(item => item.findings || []))],
+      ...Object.fromEntries(['createdAt', 'dueAt'].flatMap(key => {
+        const values = items.map(item => item[key]).filter(Number.isFinite);
+        return values.length ? [[key, Math.min(...values)]] : [];
+      })),
+      retainedHistory: { digest, requestCount: items.reduce((count, item) => count + (item.retainedHistory?.requestCount || 1), 0) } };
+  });
+  return true;
+}
+
 // Durable handoff deadlines concern unowned work, never a live effect lease.
 // Expiry queues diagnosis; it does not replay a write or grant permission.
 export const HANDOFF_RECEIPT_MS = 2 * 60_000;

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -8,7 +8,7 @@ import { currentRecoveryIncident, recordRecoveryIncident, recordRecoveryStage, s
 import { rememberPerspectives, perspectiveScope, recallPerspectives, perspectiveInstruction } from './perspective-memory.mjs';
 import { recordHypothesisSheet } from './hypothesis-sheet.mjs';
 import { bindControllerCompletion } from './completion-binding.mjs';
-import { recordHandoffStage } from './consistency-handoff.mjs';
+import { recordHandoffStage, compactConsistencyOutbox } from './consistency-handoff.mjs';
 import { retainApplicableRules } from './purpose-rule-policy.mjs';
 import { reconcileRequirements, retainControllerEvidence, reconcileFindings, findingText, evidenceLedger, currentPurposeObservation } from './purpose-evidence.mjs';
 import { workspaceIdentity } from './purpose-workspace.mjs';
@@ -116,11 +116,13 @@ export async function linkedProvider(root, provider) {
 const digest = value => createHash('sha256').update(value).digest('hex');
 const text = (value, max = 4000) => typeof value === 'string' ? value.trim().slice(0, max) : '';
 const exactText = value => typeof value === 'string' && Buffer.byteLength(value, 'utf8') <= 1000 ? value : null;
-export function canUpgradeDelivery(run) {
+export function canUpgradeDelivery(run, { automatic = false } = {}) {
   return Boolean(run && !run.managed && text(run.id) && text(run.objective) && Number.isFinite(run.startedAt) &&
     Number.isSafeInteger(run.maxFailures) && run.maxFailures > 0 &&
     (['active', 'paused', 'recovery_required'].includes(run.state) ||
-      run.state === 'blocked' && run.blocker === 'external_dependency'));
+      run.state === 'blocked' && run.blocker === 'external_dependency') &&
+    (!automatic || run.stopReason?.actor !== 'user' && (run.state !== 'paused' || run.stopReason?.actor === 'system' ||
+      /^(?:Paused because no progress was confirmed in \d+ minutes\.|No verified acceptance progress in \d+ minutes\.|Paused after \d+ steps without confirmed progress\.) Review the original conversation, then resume\.$/.test(run.reason || ''))));
 }
 const contextText = (value, max = 500) => text(value, max).replace(/\b(?:sk|key)-[A-Za-z0-9_-]{12,}\b|\bBearer\s+\S+|\b(?:password|token|api[_-]?key)\s*[:=]\s*\S+/gi, '[redacted]');
 export function recordPath(root, provider, session) {
@@ -275,7 +277,9 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
           delete criterion.check.path;
         }
       }
-      const serialized = JSON.stringify(next);
+      let serialized = JSON.stringify(next);
+      if (Buffer.byteLength(serialized) > MAX_STATE_BYTES / 2 && await compactConsistencyOutbox(root, next))
+        serialized = JSON.stringify(next);
       if (Buffer.byteLength(serialized) > MAX_STATE_BYTES) throw new Error('Delivery state exceeds 4 MiB; retain history before reducing task details.');
       if (serialized === previousBytes) return next;
       temporary = `${file}.${randomUUID()}.tmp`;
@@ -864,7 +868,8 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
       const fences = Object.values(gate.taskFences?.records || {}).filter(item => item.taskId === (prior.managed?.taskId || prior.id) && item.identity.provider === provider && item.identity.session === session);
       if (fences.some(item => !readTaskAdmission({ root: gateRoot, identity: item.identity, taskId: item.taskId }).canResume)) throw new Error('Existing task admission must be reconciled before enrolling follow-up work.');
     }
-    if (upgrading && ((!reconciling && !canUpgradeDelivery(previous.run)) || previous.run.id !== upgradeRunId)) throw new Error('Only the exact nonterminal ordinary loop can be upgraded; resolve its blocker or resume its original task first.');
+    if (upgrading && ((!reconciling && !canUpgradeDelivery(previous.run, { automatic: Boolean(autoContinueEpoch) })) ||
+        autoContinueEpoch && hasPendingUserStop(root, previous) || previous.run.id !== upgradeRunId)) throw new Error('Only the exact nonterminal ordinary loop can be upgraded; resolve its blocker or resume its original task first.');
     if (previous.run && !upgrading && !following) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
     if (upgrading && (text(objective) !== previous.run.objective || executionCwd && previous.run.executionCwd && executionCwd !== previous.run.executionCwd)) throw new Error('Upgrade must preserve the original objective and task directory.');
     const managedConfig = managed && { ...(managed === true ? {} : managed),
@@ -1201,6 +1206,18 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     const localReconciliation = flexibleReasoning(run.managed) && ['read','local_edit','local_test'].includes(uncertainAction?.kind);
     if (run.managed?.executionUncertain && run.managed.recoveryDiagnosisDecisionId === lastWork?.result?.decisionId && lastWork.result.status === 'observed' && (lastWork.result.evidence?.length || lastWork.result.observationSource === 'controller_tool_result' || localReconciliation) && lastWork.action.kind === 'read') {
       run.managed.recoveryEvidence = { decisionId: lastWork.result.decisionId, source: lastWork.result.observationSource || 'provider_reported_read', checkedAt: now };
+      const priorUnit = run.managed.purpose?.evidence?.units?.find(unit =>
+        unit.id === uncertain.decisionId && unit.status === 'unknown' &&
+        (!uncertain.attemptId || unit.attemptId === uncertain.attemptId));
+      if (priorUnit) {
+        priorUnit.status = 'observed';
+        // The read already met the reconciliation guard above, including a
+        // local observation reported without separate evidence references.
+        // Release only local occupancy, never acceptance or external effects.
+        if (['local_edit', 'local_test'].includes(priorUnit.action?.kind)) {
+          priorUnit.localExecutionSettledAt = now;
+        }
+      }
       delete run.managed.executionUncertain;
       resolveRecoveryReceipt(run, uncertain?.attemptId);
       delete run.managed.recoveryDiagnosisDecisionId;
@@ -1873,14 +1890,15 @@ export async function processIdentity(pid) {
 export async function claudeHookChannel(record, { session, cwd, inspectProcess = processIdentity, platform = process.platform } = {}) {
   const unavailable = (code, reason) => ({ ready: false, code, reason });
   if (platform === 'win32') return unavailable('platform_unsupported', 'Claude process verification is unavailable on Windows; monitoring remains available.');
-  if (!record) return unavailable('hook_missing', 'SIMY has not observed a session-start event for this conversation. Check the SIMY plugin and hook execution in the original Claude window.');
+  if (!record) return unavailable('hook_missing', 'Waiting for the original Claude hook. SIMY recovers automatically when the next verified prompt or response-end hook arrives. If no notifications arrive, check the SIMY plugin in the original Claude window.');
   if (record.provider !== 'claude' || record.session !== session) return unavailable('session_mismatch', 'The observed hook belongs to a different Claude conversation. Refresh this conversation.');
   try { if (record.cwd !== await realpath(cwd)) return unavailable('workspace_mismatch', 'The observed Claude hook belongs to a different folder. Refresh this conversation.'); }
   catch { return unavailable('workspace_unavailable', 'The Claude conversation folder could not be verified. Check the folder and refresh.'); }
   if (record.hookEndedAt || record.lastEvent === 'SessionEnd') return unavailable('session_ended', 'This Claude session has ended. Return to the original conversation to continue.');
+  if (!record.hookStartedAt && record.hookRecoveryBlocked) return unavailable('process_changed', 'A different Claude process reported this conversation. Reopen the original conversation to establish its hook owner.');
   if (!record.hookStartedAt) return unavailable(record.hookObservedAt ? 'process_unverified' : 'hook_missing', record.hookObservedAt
     ? 'The session-start hook ran, but SIMY could not identify its Claude process. Check the hook diagnostics.'
-    : 'SIMY has not observed a session-start event for this conversation. Check the SIMY plugin and hook execution in the original Claude window.');
+    : 'Waiting for the original Claude hook. SIMY recovers automatically when the next verified prompt or response-end hook arrives. If no notifications arrive, check the SIMY plugin in the original Claude window.');
   const owner = record.hookSessionProcess || record.process; // Existing verified records remain compatible.
   if (!owner?.identity || !Number.isSafeInteger(owner.pid) || owner.pid < 2) return unavailable('process_unverified', 'The session-start hook ran, but SIMY could not identify its Claude process. Check the hook diagnostics.');
   if (record.process?.pid !== owner.pid || record.process?.identity !== owner.identity) return unavailable('process_changed', 'A different Claude process reported this conversation. Refresh the original conversation.');
@@ -2019,6 +2037,22 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
         backgroundIdle: event === 'Stop' && Array.isArray(input.background_tasks) && input.background_tasks.length === 0 && Array.isArray(input.session_crons) && input.session_crons.length === 0 };
     }
     record.lastNotificationType = event === 'Notification' ? text(input.notification_type, 80) : null;
+    if (provider === 'claude' && event !== 'SessionStart' && identity && record.process &&
+        (record.process.pid !== identity.pid || record.process.identity !== identity.identity)) {
+      record.hookRecoveryBlocked = 'process_changed';
+    }
+    // A plugin loaded after the conversation opened can miss SessionStart.
+    // A real prompt/stop hook proves the same exact session and provider parent
+    // without fabricating a start event or adopting an existing task/owner.
+    if (provider === 'claude' && ['UserPromptSubmit', 'Stop'].includes(event) &&
+        !record.run && !record.hookStartedAt && !record.hookSessionProcess && !record.hookEndedAt && !record.hookRecoveryBlocked &&
+        !record.parentSession && !env.SIMY_PARENT_SESSION && !env.CODEX_THREAD_ID &&
+        !record.providerArchived && identity?.identity && Number.isSafeInteger(identity.pid) && identity.pid > 1 &&
+        (!record.process || record.process.pid === identity.pid && record.process.identity === identity.identity)) {
+      record.hookStartedAt = now;
+      record.hookSessionProcess = { ...identity };
+      record.hookRecovery = { source: event, recoveredAt: now, reason: 'session_start_missing' };
+    }
     if (identity) {
       // Legacy records have no frozen hook owner; a new process must not inherit
       // an old SessionStart admission through a later prompt or stop event.
@@ -2028,6 +2062,8 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
     }
     if (event === 'SessionStart') {
       record.hookObservedAt = now;
+      delete record.hookRecovery;
+      delete record.hookRecoveryBlocked;
       delete record.hookEndedAt;
       if (identity) { record.hookStartedAt = now; record.hookSessionProcess = { ...identity }; }
       else { delete record.hookStartedAt; delete record.hookSessionProcess; delete record.process; }

package/src/codex-plugins/simy/hooks/loop-kernel/work-frontier.mjs

@@ -37,7 +37,7 @@ export function compactWorkHistory(ledger, historyLimit = 64) {
 }
 
 /** Pure projection of the existing evidence.units; never grants authority or dispatches. */
-export function planWorkFrontier(ledger, { prObservations = {}, stopped = false, preferredUnitId = null } = {}) {
+export function planWorkFrontier(ledger, { prObservations = {}, stopped = false, preferredUnitId = null, reconcileUnknownUnitId = null } = {}) {
   if (!ledger || !Array.isArray(ledger.units)) throw new Error('Existing work-unit ledger required.');
   const units = ledger.units;
   const ids = new Set();
@@ -88,9 +88,11 @@ export function planWorkFrontier(ledger, { prObservations = {}, stopped = false,
       }
       if (!reason) {
         const conflict = [...holders, ...proposals.map(id => byId.get(id))].find(other => other.id !== unit.id && conflicts(unit, other) &&
-          // A read establishes the result of an observed effect. Check all
-          // other holders; a label must never bypass live/unknown writers.
-          !(unit.action?.kind === 'read' && unit.writeResources.length === 0 && other.status === 'observed'));
+          // Inspect observed effects, or one controller-bound unknown effect.
+          // Keep all writers fenced and check every other resource holder.
+          !(unit.action?.kind === 'read' && unit.writeResources.length === 0 &&
+            (other.status === 'observed' || unit.id === preferredUnitId &&
+              other.status === 'unknown' && other.id === reconcileUnknownUnitId)));
         if (conflict) reason = `resource_conflict:${conflict.id}`;
       }
       if (!reason) { state = 'proposed'; proposals.push(unit.id); }
@@ -103,7 +105,7 @@ export function planWorkFrontier(ledger, { prObservations = {}, stopped = false,
   const inputDigest = hash({ purposeRevision: ledger.purposeRevision, unitsOmitted: ledger.unitsOmitted,
     units: units.map(({ id, owner, status, purposeRevision, dependsOn, readResources, writeResources, waitReason, pr, action, effectReconciledRevision, localExecutionSettledAt }) =>
       ({ id, owner, status, purposeRevision, dependsOn, readResources, writeResources, waitReason, pr, action, effectReconciledRevision, localExecutionSettledAt })),
-    prObservations, stopped, preferredUnitId });
+    prObservations, stopped, preferredUnitId, reconcileUnknownUnitId });
   return { version: 1, inputDigest, proposals, rows, authority: 'proposal_only' };
 }
 

package/src/codex-plugins/simy/hooks/update-dispatch-gate.mjs

@@ -66,6 +66,42 @@ export function confirmDispatch({ root = detachmentRoot(), attemptId }) {
     if (!attempt || !Object.values(state.receipts).some(item => item.attemptId === attemptId && item.resultRef)) fail('result_required');
     attempt.phase = 'confirmed'; state.revision++; atomicSave(path(root), state); return state; });
 }
+// Transport settlement is independent of acceptance of the provider's report.
+// Only an observed terminal event for the exact owned turn may use this path.
+export function queueProviderTerminalReceipt({ root = detachmentRoot(), attemptId, providerSession, providerExecutionId, status, response = '' }) {
+  if (!['completed', 'failed', 'interrupted'].includes(status) || typeof response !== 'string' ||
+      !providerSession || !providerExecutionId) fail('terminal_evidence_invalid');
+  root = realpathSync(root);
+  const state = read(root), attempt = state.attempts[digest(attemptId)];
+  if (!attempt?.provenance || attempt.provenance.providerSession !== providerSession) fail('terminal_identity_mismatch');
+  const ref = join(root, 'update-detachment', 'provider-results', digest([attemptId, providerExecutionId]) + '.json');
+  const evidence = { schemaVersion: 1, kind: 'provider_terminal', attemptId, providerSession, providerExecutionId, status,
+    taskHash: attempt.taskHash, identityHash: attempt.identityHash, generation: attempt.generation,
+    responseDigest: digest(response), response: response.slice(0, 65536), truncated: response.length > 65536 };
+  const prior = readState(ref);
+  if (prior && digest(prior) !== digest(evidence)) fail('terminal_evidence_conflict');
+  if (!prior) atomicSave(ref, evidence);
+  const item = { schemaVersion: 1, kind: 'terminal_receipt', attemptId, providerExecutionId, resultRef: ref,
+    receiptId: `terminal:${attemptId}:${providerExecutionId}`, evidenceDigest: digest(evidence) };
+  atomicSave(join(root, 'update-detachment', 'intake', digest(item) + '.json'), item);
+  try { flushDispatchIntake(root); } catch (error) { if (error.code !== 'state_busy') throw error; }
+  return ref;
+}
+function applyTerminalReceipt(state, item, root) {
+  const ref = item.resultRef, attempt = state.attempts[digest(item.attemptId)];
+  const expected = join(resolve(root), 'update-detachment', 'provider-results', digest([item.attemptId, item.providerExecutionId]) + '.json');
+  if (ref !== expected || realpathSync(ref) !== ref) fail('terminal_evidence_invalid');
+  const evidence = readState(ref);
+  if (!evidence || digest(evidence) !== item.evidenceDigest || evidence.schemaVersion !== 1 || evidence.kind !== 'provider_terminal' ||
+      !['completed', 'failed', 'interrupted'].includes(evidence.status) || evidence.attemptId !== item.attemptId ||
+      evidence.providerExecutionId !== item.providerExecutionId || !attempt?.provenance ||
+      evidence.providerSession !== attempt.provenance.providerSession || evidence.taskHash !== attempt.taskHash ||
+      evidence.identityHash !== attempt.identityHash || evidence.generation !== attempt.generation) fail('terminal_identity_mismatch');
+  const priorTurns = Object.values(state.receipts).filter(row => row.attemptId === item.attemptId).map(row => row.providerExecutionId).filter(Boolean);
+  if (priorTurns.some(id => id !== item.providerExecutionId)) fail('terminal_evidence_conflict');
+  applyReceipt(state, item);
+  attempt.phase = 'confirmed';
+}
 export function dispatchWithFence(owner, { taskId, attemptId = randomUUID(), identity = null, provenance = null }, send) {
   if (!owner || typeof send !== 'function' || typeof taskId !== 'string' || !taskId || typeof attemptId !== 'string' || !attemptId) fail('dispatch_identity_required');
   return withLock(path(owner.root), () => {
@@ -165,7 +201,9 @@ export function flushDispatchIntake(root = detachmentRoot()) {
     for (const name of names) {
       if (!/^[a-f0-9]{64}\.json$/.test(name)) continue;
       const item = readState(join(directory, name));
-      if (item?.kind === 'receipt') applyReceipt(state, item); else applyIdentityIntake(state, item);
+      if (item?.kind === 'receipt') applyReceipt(state, item);
+      else if (item?.kind === 'terminal_receipt') applyTerminalReceipt(state, item, root);
+      else applyIdentityIntake(state, item);
       applied.push(name);
     }
     if (applied.length) { state.revision++; atomicSave(path(root), state); for (const name of applied) unlinkSync(join(directory, name)); }

package/src/connection-health.js

@@ -0,0 +1,253 @@
+import { execFile, spawn } from 'node:child_process';
+import { lookup } from 'node:dns/promises';
+import { networkInterfaces, homedir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { readSession, isSessionValid } from './session-store.js';
+import { readProviderLinks } from './provider-links.js';
+import { inspectProviderStatus } from './desktop-status.js';
+import { resolveWebOrigin } from './web-origin.js';
+
+const execute = promisify(execFile);
+const aliasPattern = /^[a-zA-Z0-9][a-zA-Z0-9._@-]{0,127}$/;
+export const shellQuote = value => "'" + String(value).replaceAll("'", "'\\''") + "'";
+const clean = value => String(value).replace(/[\x00-\x1f\x7f-\x9f]/g, '').slice(0, 180);
+const check = (layer, state, code, message) => ({ layer, state, code, message });
+
+// Fixed messages deliberately exclude response bodies, SSH output and credentials.
+const remedies = {
+  dns: ['名前解決に失敗しました', '接続先名・SSHのHostName・DNS設定を確認してください。社内名やVPN内の名前なら、必要なVPNに接続して再確認してください。'],
+  proxy_dns: ['プロキシの名前解決に失敗しました', 'HTTP_PROXY・HTTPS_PROXY・ALL_PROXYの接続先名と、その名前を解決するVPN/DNSを確認してください。'],
+  proxy_auth: ['プロキシ認証が必要です', 'プロキシの認証期限・アカウントを確認し、組織指定の認証方法で更新してください。'],
+  proxy_config: ['プロキシ設定を解釈できません', 'プロキシ環境変数のURL形式・ポート・対応方式を確認してください。'],
+  proxy_connect: ['プロキシ経由の接続に失敗しました', 'プロキシへの到達性と転送先の許可、NO_PROXYの適用範囲を確認してください。'],
+  refused: ['接続先が接続を拒否しました', '接続先のサービスが起動しているか、ポートと待受アドレス、拒否するファイアウォール規則を確認してください。'],
+  route: ['接続先への経路がありません', 'ネットワーク・VPN・ルーティングと接続先の稼働状態を確認してください。'],
+  timeout: ['接続がタイムアウトしました', 'VPN・ファイアウォール・接続先停止が候補です。タイムアウトだけでは原因を特定できません。経路と接続先の受信規則を確認してください。'],
+  reset: ['接続が途中で切断されました', '接続先サービス・プロキシ・VPNの状態を確認し、診断を再実行してください。'],
+  tls_expired: ['証明書の期限または端末時刻に問題があります', '端末の日付と時刻を確認してください。期限切れのサーバー証明書は管理者が更新し、更新後に再確認してください。'],
+  tls_name: ['証明書と接続先名が一致しません', '証明書が対象とする正しいDNS名を使うか、管理者に証明書の修正を依頼してください。'],
+  tls_trust: ['証明書の信頼を検証できません', '証明書チェーンを管理者に確認してください。社内CAを使う場合は正しいCAをCURL_CA_BUNDLEまたはSSL_CERT_FILEに設定して再確認してください。'],
+  tls_client: ['クライアント証明書を利用できません', 'サービスが要求するクライアント証明書の有効期限・秘密鍵・読取権限を確認してください。'],
+  tls: ['TLS接続に失敗しました', '接続先のHTTPSポート・TLS対応・証明書と、TLSを中継するプロキシを確認してください。'],
+  key_changed: ['SSHホスト鍵が以前と異なります', '相手側でssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pubを実行し、正しい端末か管理者と照合してからknown_hostsを更新してください。'],
+  key_unknown: ['SSHホスト鍵が未確認です', '相手側のホスト鍵指紋を確認したうえで、通常のssh接続で初回登録してください。'],
+  key_permissions: ['SSH秘密鍵の権限が広すぎます', '自分が所有する秘密鍵のアクセス権を本人のみ読書き可能に修正してください。秘密鍵の内容を共有する必要はありません。'],
+  key_missing: ['SSH秘密鍵を読み取れません', 'SSH設定のIdentityFile、鍵ファイルの存在・所有者・読取権限を確認してください。'],
+  ssh_certificate: ['SSH証明書が無効または期限切れです', '端末時刻とSSH証明書の期限を確認し、発行元の手順で更新してください。'],
+  ssh_auth: ['SSH認証に失敗しました', 'SSHのUser・IdentityFile・相手側のauthorized_keysを確認してください。パスフレーズが必要な鍵はssh-agentへ読み込みます。'],
+  ssh_agent: ['SSHエージェントが署名できません', 'ssh-add -lでエージェントの鍵を確認し、鍵のロックやハードウェアキーの状態を確認してください。'],
+  ssh_config: ['SSH設定を読み取れません', 'SSHのHost・HostName・Port・ProxyJump・ProxyCommandの設定とIncludeファイルを確認してください。'],
+  ssh_forward: ['SSHのポート転送が許可されていません', '相手側のAllowTcpForwarding・PermitListen・鍵ごとの転送制限を管理者に確認してください。'],
+  ssh_missing: ['OpenSSHが見つかりません', 'この端末にOpenSSHクライアントをインストールして再確認してください。'],
+  cli_missing: ['相手のSIMY CLIが見つかりません', '相手側にSIMY CLIをインストールし、SSHのログインシェルのPATHでsimyが見つかることを確認してください。'],
+  auth: ['認証が必要、または期限切れです', 'サービスのログイン・OAuth再認証またはAPIキー更新を行ってください。APIキーは--token-envで環境変数名を指定できます。'],
+  permission: ['接続先がアクセスを拒否しました（403）', '対象アカウント・組織・APIスコープとサービス側のアクセス規則を確認してください。403だけでは権限不足とWAFによる拒否を区別できません。'],
+  rate_limit: ['サービスの利用制限に達しました（429）', 'サービスの利用制限と再試行時刻を確認し、待ってから再確認してください。'],
+  service: ['接続先サービスで障害が発生しています', 'サービスの稼働状況を確認し、復旧後に再確認してください。'],
+  endpoint: ['APIの接続先が見つかりません', 'APIのURL・バージョン・パスが正しいか確認してください。'],
+  method: ['この接続先はHEAD診断に対応していません', 'サービスが公開する読取専用のヘルスチェックURLで再確認してください。'],
+  redirect: ['別のページへ転送されました', 'ログイン画面または移転先の可能性があります。サービスの正しい接続先と認証方法を確認してください。'],
+  curl_missing: ['Web診断用のcurlが見つかりません', 'curlをインストールして再確認してください。'],
+  unknown: ['接続状態を確定できません', '対象の接続先と設定を確認し、診断を再実行してください。'],
+};
+
+export function issueFor(code, layer = 'connection', state = 'failed') {
+  const [message, instruction] = remedies[code] || remedies.unknown;
+  return { ...check(layer, state, code, message), instruction };
+}
+
+export function classifySshFailure(error) {
+  const text = `${error?.stderr || ''}\n${error?.stdout || ''}`;
+  if (error?.code === 'ENOENT') return 'ssh_missing';
+  if (/REMOTE HOST IDENTIFICATION HAS CHANGED|Offending .* key/i.test(text)) return 'key_changed';
+  if (/Host key verification failed|No .* host key is known/i.test(text)) return 'key_unknown';
+  if (/UNPROTECTED PRIVATE KEY|bad permissions|Permissions .* too open/i.test(text)) return 'key_permissions';
+  if (/Certificate invalid|certificate has expired|certificate is not yet valid/i.test(text)) return 'ssh_certificate';
+  if (/sign_and_send_pubkey.*signing failed|agent refused operation/i.test(text)) return 'ssh_agent';
+  if (/Load key .* (?:Permission denied|invalid format)|no such identity|Identity file .* not accessible/i.test(text)) return 'key_missing';
+  if (/Permission denied|Too many authentication failures|Authentication failed/i.test(text)) return 'ssh_auth';
+  if (/Could not resolve hostname|Name or service not known|Temporary failure in name resolution/i.test(text)) return 'dns';
+  if (/Connection refused/i.test(text)) return 'refused';
+  if (/No route to host|Network is unreachable/i.test(text)) return 'route';
+  if (/timed out|timeout/i.test(text) || error?.killed) return 'timeout';
+  if (/administratively prohibited|remote port forwarding failed/i.test(text)) return 'ssh_forward';
+  if (/Bad configuration|Bad port|unsupported option|Bad owner or permissions on/i.test(text)) return 'ssh_config';
+  if (/Connection reset|Connection closed|kex_exchange_identification/i.test(text)) return 'reset';
+  if (text.includes('SIMY_CLI_MISSING')) return 'cli_missing';
+  return 'unknown';
+}
+
+export function classifyWebFailure(result) {
+  const error = String(result.stderr || '');
+  if (result.missing) return 'curl_missing';
+  if (result.exitCode) {
+    if (/Unsupported proxy syntax|Unsupported proxy|Malformed.*proxy/i.test(error)) return 'proxy_config';
+    if (result.exitCode === 5) return 'proxy_dns';
+    if (result.exitCode === 6) return 'dns';
+    if (result.exitCode === 28) return 'timeout';
+    if (result.exitCode === 58) return 'tls_client';
+    if ([60, 77, 83, 90].includes(result.exitCode)) {
+      if (/expired|not yet valid/i.test(error)) return 'tls_expired';
+      if (/no alternative certificate subject|does not match|subject name/i.test(error)) return 'tls_name';
+      return 'tls_trust';
+    }
+    if (result.exitCode === 35) return 'tls';
+    if (result.exitCode === 97 || result.connectStatus >= 400) return result.connectStatus === 407 ? 'proxy_auth' : 'proxy_connect';
+    if (/Connection refused|Couldn't connect to server/i.test(error) && result.exitCode === 7) return /Connection refused/i.test(error) ? 'refused' : 'unknown';
+    if (/No route to host|Network is unreachable/i.test(error)) return 'route';
+    if ([52, 55, 56].includes(result.exitCode)) return 'reset';
+    return 'unknown';
+  }
+  const status = result.httpStatus;
+  if (status >= 200 && status < 300) return null;
+  if (status === 401) return 'auth';
+  if (status === 403) return 'permission';
+  if (status === 407) return 'proxy_auth';
+  if (status === 404) return 'endpoint';
+  if (status === 405 || status === 501) return 'method';
+  if (status === 429) return 'rate_limit';
+  if (status >= 500) return 'service';
+  if (status >= 300 && status < 400) return 'redirect';
+  return 'unknown';
+}
+
+export function parseConnectionTarget(value = 'simy', webOrigin = resolveWebOrigin()) {
+  if (value === 'simy') return { kind: 'simy', url: new URL(webOrigin), display: 'SIMY' };
+  if (['provider:codex', 'provider:claude'].includes(value)) return { kind: 'provider', provider: value.slice(9), display: value };
+  if (/^https?:\/\//i.test(value)) {
+    const url = new URL(value);
+    if (url.username || url.password || /[\x00-\x20\x7f]/.test(value)) throw new Error('ログイン名やパスワードを含まないWebアドレスを指定してください。');
+    url.hash = '';
+    return { kind: 'web', url, display: clean(url.origin) };
+  }
+  const alias = value.replace(/^ssh:/, '');
+  if (!aliasPattern.test(alias)) throw new Error('接続先を確認してください。SIMYを調べるなら simy connections recover、別のパソコンを調べるなら simy connections で一覧を確認してください。');
+  return { kind: 'ssh', alias, display: alias };
+}
+
+export function networkContext(env = process.env, interfaces = networkInterfaces()) {
+  return {
+    activeInterfaceCount: Object.values(interfaces).filter(addresses => addresses?.some(address => !address.internal)).length,
+    vpnInterfaces: Object.entries(interfaces).filter(([name, addresses]) => /^(tun|tap|utun|wg|tailscale|ppp)/i.test(name) && addresses?.some(a => !a.internal)).map(([name]) => clean(name)),
+    proxyConfigured: Boolean(env.https_proxy || env.HTTPS_PROXY || env.http_proxy || env.HTTP_PROXY || env.all_proxy || env.ALL_PROXY),
+    noProxyConfigured: Boolean(env.no_proxy || env.NO_PROXY),
+    customCaConfigured: Boolean(env.CURL_CA_BUNDLE || env.SSL_CERT_FILE || env.SSL_CERT_DIR),
+  };
+}
+
+// curl applies the user's proxy/NO_PROXY and CA configuration. Credentials and
+// query strings travel over stdin, not child argv; redirects are never followed.
+export function probeWeb(url, { token, env = process.env, spawnImpl = spawn, timeoutMs = 10_000 } = {}) {
+  if (token && /[\r\n\x00]/.test(token)) throw new Error('APIトークンに改行を含めることはできません。');
+  const configQuote = value => String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"');
+  const config = `url = "${configQuote(url.href)}"\n` + (token ? `header = "Authorization: Bearer ${configQuote(token)}"\n` : '');
+  return new Promise(resolve => {
+    let done = false, stdout = '', stderr = '', timer;
+    const finish = result => { if (done) return; done = true; clearTimeout(timer); resolve(result); };
+    const child = spawnImpl('curl', ['--disable', '--config', '-', '--head', '--silent', '--show-error',
+      '--proto', '=http,https', '--connect-timeout', '5', '--max-time', String(timeoutMs / 1000), '--max-redirs', '0',
+      '--output', process.platform === 'win32' ? 'NUL' : '/dev/null', '--write-out', '%{http_code}\n%{http_connect}\n%{ssl_verify_result}\n'],
+    { stdio: ['pipe', 'pipe', 'pipe'], shell: false, env: { ...env, ...(env.HTTP_PROXY && !env.http_proxy ? { http_proxy: env.HTTP_PROXY } : {}) }, windowsHide: true });
+    timer = setTimeout(() => { child.kill(); finish({ exitCode: 28, httpStatus: 0, stderr: '' }); }, timeoutMs + 1000);
+    child.on('error', error => finish({ exitCode: 1, missing: error.code === 'ENOENT', httpStatus: 0, stderr: '' }));
+    child.stdin.on('error', () => {});
+    child.stdout.on('data', data => { stdout = (stdout + data).slice(-4096); });
+    child.stderr.on('data', data => { stderr = (stderr + data).slice(-8192); });
+    child.on('close', code => {
+      const [status, connect, verify] = stdout.trim().split(/\r?\n/).map(Number);
+      finish({ exitCode: Number.isInteger(code) ? code : 1, httpStatus: status || 0, connectStatus: connect || 0, tlsVerifyResult: verify, stderr });
+    });
+    child.stdin.end(config);
+  });
+}
+
+async function dnsCheck(host, lookupImpl) {
+  let timer;
+  try {
+    await Promise.race([lookupImpl(host.replace(/^\[|\]$/g, '')), new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('timeout')), 3000); })]);
+    return check('dns', 'passed', 'dns_resolved', '接続先名を解決できました');
+  } catch { return issueFor('dns', 'dns'); }
+  finally { clearTimeout(timer); }
+}
+
+export async function diagnoseConnection(value, { webOrigin = resolveWebOrigin(), root = process.env.SIMY_HOME?.trim() || join(homedir(), '.simy'),
+  env = process.env, tokenEnv, executeImpl = execute, probeWebImpl = probeWeb, lookupImpl = lookup,
+  inspectProvider = inspectProviderStatus, readLinks = readProviderLinks, readSessionImpl = readSession,
+  interfaces = networkInterfaces(), now = Date.now() } = {}) {
+  const target = parseConnectionTarget(value, webOrigin);
+  if (tokenEnv && (target.kind !== 'web' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(tokenEnv) || !env[tokenEnv])) throw new Error('接続キーの指定を読み取れませんでした。--token-env は外部Webサービス用です。接続キーを保存した設定の名前を指定してください。分からない場合はサービスの担当者に確認してください。');
+  if (tokenEnv && target.url.protocol !== 'https:' && !['localhost', '127.0.0.1', '[::1]'].includes(target.url.hostname)) throw new Error('接続キーを送るときは、https:// で始まる安全なWebアドレス（HTTPS）を指定してください。');
+  const report = { schemaVersion: 1, target: { kind: target.kind, display: target.display }, status: 'unverified', checks: [], context: networkContext(env, interfaces), actions: [] };
+  const addAction = (id, title, instructions, command) => report.actions.push({ id, title, instructions, ...(command ? { command } : {}) });
+  if (target.kind === 'ssh') {
+    let config;
+    try {
+      const resolved = await executeImpl('ssh', ['-G', '--', target.alias], { timeout: 5000, maxBuffer: 256 * 1024, env });
+      const fields = new Map(resolved.stdout.split(/\r?\n/).map(line => { const at = line.indexOf(' '); return [line.slice(0, at), line.slice(at + 1)]; }));
+      config = { hostname: fields.get('hostname'), port: Number(fields.get('port')), jump: fields.get('proxyjump'), proxy: fields.get('proxycommand') };
+      report.checks.push(check('ssh_config', 'passed', 'ssh_config_resolved', '現在のSSH設定を読み取りました'));
+      if (config.hostname && ![config.jump, config.proxy].some(v => v && v !== 'none')) {
+        report.checks.push(await dnsCheck(config.hostname, lookupImpl));
+      } else report.checks.push(check('dns', 'unknown', 'ssh_proxy_dns', '踏み台・プロキシ経由の名前解決はSSH接続で確認します'));
+      const result = await executeImpl('ssh', ['-T', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes', '-o', 'ConnectTimeout=8', '--', target.alias,
+        "sh -lc 'if command -v simy >/dev/null 2>&1; then printf SIMY_CLI_PRESENT; else printf SIMY_CLI_MISSING; exit 127; fi'"],
+      { timeout: 12_000, maxBuffer: 64 * 1024, env });
+      if (!result.stdout?.endsWith('SIMY_CLI_PRESENT')) throw new Error('unexpected probe');
+      // Successful SSH can resolve a name unavailable to the local DNS probe.
+      report.checks = report.checks.filter(c => !(c.layer === 'dns' && c.state === 'failed'));
+      report.checks.push(check('ssh', 'passed', 'ssh_ready', 'SSH認証と相手のSIMY CLIを確認しました'));
+      report.checks.push(check('cli_auth', 'unknown', 'cli_auth_unverified', '相手のSIMYログインはCLIを開いて確認してください'));
+      addAction('open_cli', '相手のCLIを開く', '相手側のログイン・組織を確認して接続します。', `simy connections connect ${target.alias}`);
+    } catch (error) {
+      const code = classifySshFailure(error);
+      report.checks.push(issueFor(code, 'ssh'));
+      if (['ssh_auth', 'ssh_agent', 'key_missing', 'key_permissions'].includes(code)) {
+        addAction('ssh_login', 'SSHの対話認証を試す', 'パスフレーズや本人の操作が必要な鍵を使って再認証し、その後に再確認します。', `ssh -T -o StrictHostKeyChecking=yes -- ${target.alias} true`);
+      }
+      if (['timeout', 'route', 'refused'].includes(code)) addAction('reverse', '逆向き経路を利用する', '接続を開始できる側で相手のSSHエイリアスを指定します。', 'simy connections tunnel <相手のSSHエイリアス>');
+    }
+  } else if (target.kind === 'provider') {
+    const state = await inspectProvider(target.provider).catch(() => ({ state: 'unknown' }));
+    const links = await readLinks(root).catch(() => ({}));
+    if (state.state === 'ready') report.checks.push(check('provider_auth', 'passed', 'provider_ready', 'CLIのインストールと保存されたログインを確認しました'));
+    else if (state.state === 'signed_out') {
+      report.checks.push(issueFor('auth', 'provider_auth'));
+      addAction('provider_login', 'プロバイダーにログインする', 'プロバイダーの公式ログインを起動し、完了後に再確認します。', target.provider === 'codex' ? 'codex login' : 'claude auth login');
+    } else {
+      report.checks.push(check('provider_auth', 'failed', 'provider_unavailable', 'CLIが未インストール・更新待ち、またはログイン状態を確認できません'));
+      addAction('provider_setup', '公式CLIのインストール・更新を確認', 'プロバイダー公式のインストール手順でCLIを導入・更新し、PATHとログイン状態を確認してください。');
+    }
+    if (links[target.provider]?.connected === true) report.checks.push(check('provider_link', 'passed', 'provider_linked', 'SIMYとの連携は有効です'));
+    else {
+      report.checks.push(check('provider_link', 'failed', 'provider_disconnected', 'SIMYとの連携が無効、または設定を読み取れません'));
+      if (links[target.provider]?.connected === false && !links[target.provider]?.settingsError) addAction('provider_link', 'SIMYとの連携を有効にする', 'このプロバイダーをSIMYに再接続します。会話の実行許可は別途設定します。');
+    }
+    report.checks.push(check('provider_service', 'unknown', 'provider_api_unverified', 'API接続・モデルの利用権限はサービスのURLを指定して診断してください'));
+  } else {
+    report.checks.push(await dnsCheck(target.url.hostname, lookupImpl));
+    const web = await Promise.resolve().then(() => probeWebImpl(target.url, { token: tokenEnv ? env[tokenEnv] : undefined, env })).catch(() => ({ exitCode: 1, httpStatus: 0 }));
+    const code = classifyWebFailure(web);
+    if (!web.exitCode && web.httpStatus > 0) report.checks = report.checks.filter(c => !(c.layer === 'dns' && c.state === 'failed'));
+    if (!web.exitCode && web.httpStatus > 0) report.checks.push(check('http_transport', 'passed', 'http_reached', `HTTP応答を受信しました（${web.httpStatus}）`));
+    report.checks.push(code ? issueFor(code, 'web', ['method', 'redirect', 'unknown'].includes(code) ? 'unknown' : 'failed') : check('web', 'passed', 'web_ready', '指定URLへのHEADリクエストが成功しました'));
+    if (target.kind === 'simy') {
+      const session = await readSessionImpl(webOrigin, root).catch(() => null);
+      if (isSessionValid(session, now, webOrigin)) report.checks.push(check('simy_auth', 'passed', 'session_current', '保存されたSIMY認証の期限は有効です（サーバー側の失効は未確認）'));
+      else {
+        report.checks.push(issueFor('auth', 'simy_auth'));
+        addAction('simy_login', 'SIMYの接続・ログインを開く', '別のターミナルで下のコマンドを実行し、表示されたブラウザで認証を完了してから戻って再確認してください。', `simy --daemon --host ${shellQuote(webOrigin)}`);
+      }
+    } else if (code === 'auth') addAction('web_login', 'サービスのログインページを開く', 'サービス側でログイン・APIキー・OAuthを更新して再確認します。ブラウザのログインとAPIキーは別の認証です。');
+  }
+  for (const item of report.checks.filter(c => c.instruction)) addAction(`resolve_${item.code}`, item.message, item.instruction);
+  if (report.checks.some(c => ['timeout', 'route', 'refused', 'dns'].includes(c.code))) {
+    addAction('network_settings', 'VPN・経路・ファイアウォールを確認', report.context.vpnInterfaces.length
+      ? 'VPN用と思われるネットワークインターフェースはあります。対象のVPNへのログインと到達先ルート、相手側の受信規則を確認してください。'
+      : 'VPN接続・OSの経路設定・相手の稼働状態・必要なポートの受信規則を確認してください。VPNインターフェースがないことだけでVPN障害とは断定できません。');
+  }
+  report.status = report.checks.some(c => c.state === 'failed') ? 'needs_action'
+    : report.checks.some(c => ['web_ready', 'ssh_ready', 'provider_ready'].includes(c.code)) ? 'reachable' : 'unverified';
+  addAction('retry', '修復後に再確認', '設定・認証の更新後、同じ接続先を再診断します。');
+  return report;
+}