@awak-app/simy-cli 0.7.26 → 0.7.27

package/README.md

@@ -345,6 +345,8 @@ from the same maintained source as Codex; only provider terminology and hook/man
 format differ. Installing source files does not imply that either provider has enabled
 the plugin. Existing Claude settings, unrelated marketplaces, and plugins are preserved.
 
+State-only feature-improvement collection ships with the generated Claude plugin, but uploads require the paired desktop CLI runtime to refresh device consent and drain its local outbox. Without that paired authenticated runtime, the plugin remains default-off and does not enable Auto-continue.
+
 After that first installation, the daemon checks installed workflows at startup
 and every hour, including after a CLI automatic upgrade. It updates only existing
 platform installations and refreshes an already enabled SIMY Codex plugin through

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.26",
+  "version": "0.7.27",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -1,4 +1,5 @@
 import { connectionOverview, readSqmConnectionObservation } from './connection-overview.js';
+import { flushObservability, observeHeartbeat, syncObservabilityConsent } from './cli-observability.js';
 import { readLocalPhotoSource } from "./local-photos.js";
 import { resolveLocalTaskDestination, saveLocalTaskDestination } from "./local-task-destination.js";
 import { observePairedNativeIdentities } from './native-provider-identity.js';
@@ -939,6 +940,27 @@ export async function startAgent({
         deviceHeartbeatSucceeded = true;
         connectionStatus.success();
         notifyDesktopStatusChange();
+        // Delivery state persistence writes the bounded local outbox. Draining
+        // it here reuses the authenticated existing runtime; it never creates
+        // a daemon, changes Auto-continue, or blocks the device heartbeat.
+        const observabilityPaired = typeof requestedSession.account_id === 'string' && requestedSession.account_id.length > 0 &&
+          typeof requestedSession.device_id === 'string' && requestedSession.device_id.length > 0;
+        if (observabilityPaired) {
+          void syncObservabilityConsent({
+            root: sessionRoot,
+            apiOrigin,
+            apiBaseUrl: requestedSession.api_base_url,
+            token: requestedSession.token,
+            actor: { accountId: requestedSession.account_id, deviceId: requestedSession.device_id, organizationId: requestedSession.organization_id },
+            fetchImpl: dependencies.fetch || globalThis.fetch,
+          }).then(() => observeHeartbeat(sessionRoot)).then(() => flushObservability({
+            root: sessionRoot,
+            apiOrigin,
+            apiBaseUrl: requestedSession.api_base_url,
+            token: requestedSession.token,
+            fetchImpl: dependencies.fetch || globalThis.fetch,
+          })).catch(() => {});
+        }
         // Register the device immediately; provider subprocesses must not delay
         // browser authorization. Publish verified readiness after their probe.
         const publishVerifiedProviders = async () => {

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.26";
+export const CLI_VERSION = "0.7.27";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/cli-observability.js

@@ -0,0 +1,262 @@
+// State-only feature-improvement transport. It never imports provider clients or
+// serializes conversation content, paths, titles, logs, or credentials.
+import { randomUUID } from 'node:crypto';
+import { link, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { webApiHeaders, webApiUrl } from './web-api.js';
+// Keep this leaf module package-safe: hooks load it before the full CLI contract.
+const CLI_VERSION = '0.7.27';
+
+const STORE = 'cli-observability-state.json';
+const LEGACY_CONFIG = 'cli-observability.json';
+const LEGACY_OUTBOX = 'cli-observability-outbox.json';
+const MAX_BYTES = 256 * 1024, MAX_AGE = 7 * 24 * 60 * 60 * 1000, MAX_FLUSH = 50;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const EVENT_TYPES = new Set(['settings_changed', 'execution_requested', 'execution_started', 'execution_ended', 'result_confirmed', 'observation_gap', 'heartbeat']);
+const EXECUTION = new Set(['idle', 'start_requested', 'started', 'ended', 'unknown']);
+const RESULTS = new Set(['success', 'failed', 'waiting_human', 'reported_done', 'unknown']);
+const REASONS = new Set(['cancelled', 'needs_user_input', 'timeout', 'provider_error', 'transport_error', 'runtime_recovery', 'queue_overflow', 'sequence_gap', 'clock_skew', 'session_expired']);
+const keyFor = (provider, session) => `${provider}:${session}`;
+const file = (root, name) => join(root, name);
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+async function processIdentity(pid) {
+  if (!Number.isSafeInteger(pid) || pid < 2 || process.platform === 'win32') return null;
+  try { const { stdout } = await promisify(execFile)('/bin/ps', ['-p', String(pid), '-o', 'lstart=,comm='], { timeout: 500, maxBuffer: 2048 }); return stdout.trim() || ''; }
+  catch (error) { return error.code === 1 ? '' : null; }
+}
+function environmentFromOrigin(origin) {
+  try {
+    const url = new URL(origin);
+    if (url.protocol !== 'https:' || url.port || url.username || url.password || url.pathname !== '/' || url.search || url.hash) return null;
+    return url.hostname === 'app-dev.simy.one' ? 'dev' : url.hostname === 'app.simy.one' ? 'prod' : null;
+  } catch { return null; }
+}
+async function withStoreLock(root, operation) {
+  const lock = file(root, '.cli-observability.lock');
+  const owner = {
+    pid: process.pid,
+    identity: await processIdentity(process.pid),
+    token: randomUUID(),
+  };
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const candidate = `${lock}.${owner.token}.candidate`;
+  await writeFile(candidate, JSON.stringify(owner), { mode: 0o600, flag: 'wx' });
+  try {
+    for (let i = 0; i < 40; i++) {
+      try {
+        // link(2) publishes an already-complete owner file atomically.
+        await link(candidate, lock);
+        try {
+          return await operation();
+        } finally {
+          try {
+            const held = JSON.parse(await readFile(lock, 'utf8'));
+            if (held.token === owner.token) await rm(lock, { force: true });
+          } catch {}
+        }
+      } catch (error) {
+        if (error.code !== 'EEXIST') throw error;
+        let prior;
+        try {
+          prior = JSON.parse(await readFile(lock, 'utf8'));
+          const current = await processIdentity(prior?.pid);
+          if (current !== '' && !(current && prior?.identity && current !== prior.identity)) {
+            await sleep(10 + Math.floor(Math.random() * 10));
+            continue;
+          }
+          // Move the exact stale inode away. This avoids a stale contender
+          // deleting a replacement lock published by another process.
+          const reclaimed = `${lock}.${owner.token}.reclaimed`;
+          await rename(lock, reclaimed);
+          const moved = JSON.parse(await readFile(reclaimed, 'utf8'));
+          if (moved?.token !== prior?.token) {
+            // A release/reacquire raced us. Restore only if nobody has already
+            // published a replacement; never remove a lock we do not own.
+            try { await link(reclaimed, lock); } catch {}
+          }
+          await rm(reclaimed, { force: true });
+        } catch {}
+        await sleep(10 + Math.floor(Math.random() * 10));
+      }
+    }
+  } finally {
+    await rm(candidate, { force: true });
+  }
+  throw new Error('Observability store is busy.');
+}
+async function readJson(path, fallback) { try { return JSON.parse(await readFile(path, 'utf8')); } catch (error) { if (error.code === 'ENOENT') return fallback; throw error; } }
+async function saveJson(path, value) { await mkdir(dirname(path), { recursive: true, mode: 0o700 }); const tmp = `${path}.${randomUUID()}.tmp`; try { await writeFile(tmp, `${JSON.stringify(value)}\n`, { mode: 0o600 }); await rename(tmp, path); } finally { await rm(tmp, { force: true }); } }
+function blankConfig() { return { schemaVersion: 1, enabled: false, consentGeneration: null, environment: null, actor: null, conversations: {}, retry: { attempts: 0, at: 0 }, lost: false }; }
+function blankState() { return { schemaVersion: 1, config: blankConfig(), outbox: { schemaVersion: 1, events: [] } }; }
+function validConversation(value) { return value && ['codex', 'claude'].includes(value.provider) && typeof value.session === 'string' && /^[A-Za-z0-9_-]{1,256}$/.test(value.session) && UUID.test(String(value.conversationRef)) && ['dev', 'prod'].includes(value.environment); }
+function validGeneration(value) { return UUID.test(String(value)); }
+async function readStore(root) {
+  const existing = await readJson(file(root, STORE), null);
+  if (existing?.schemaVersion === 1 && existing.config?.conversations && Array.isArray(existing.outbox?.events)) return existing;
+  const oldConfig = await readJson(file(root, LEGACY_CONFIG), null), oldOutbox = await readJson(file(root, LEGACY_OUTBOX), null);
+  if (!oldConfig && !oldOutbox) return blankState();
+  const state = blankState(); state.config = { ...state.config, ...oldConfig, conversations: oldConfig?.conversations || oldConfig?.scopes || {}, lost: !(oldConfig && oldOutbox) };
+  state.outbox = oldOutbox || { schemaVersion: 1, events: [] }; return state;
+}
+async function saveStore(root, state) { await saveJson(file(root, STORE), state); }
+function status(state) { return { enabled: state.config.enabled === true, conversations: Object.values(state.config.conversations).map(({ provider, session, sequence }) => ({ provider, session, sequence })), queued: state.outbox.events.length }; }
+export async function readObservability(root) { return (await readStore(root)).config; }
+export async function observabilityStatus(root) { return status(await readStore(root)); }
+function stateFromRecord(record, now = Date.now()) {
+  const raw = record?.run?.state;
+  const fresh = Number.isFinite(record?.runtime?.observedAt) && now >= record.runtime.observedAt && now - record.runtime.observedAt <= 45_000;
+  const executionState = fresh && record.runtime?.isRunning === true ? 'started' : fresh && record.runtime?.isRunning === false ? 'idle' : ['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted'].includes(raw) ? 'ended' : 'unknown';
+  return { autoContinue: record?.autoContinue === true ? 'on' : record?.autoContinue === false ? 'off' : 'unknown', executionState,
+    result: raw === 'reported_done' ? 'reported_done' : 'unknown', ...(fresh && record.runtime?.isRunning === true ? { runtimeObservedAt: new Date(record.runtime.observedAt).toISOString() } : {}),
+    ...({ stopped: 'cancelled', budget_exhausted: 'timeout', paused: 'needs_user_input', blocked: 'needs_user_input', recovery_required: 'runtime_recovery' }[raw] ? { reasonCode: ({ stopped: 'cancelled', budget_exhausted: 'timeout', paused: 'needs_user_input', blocked: 'needs_user_input', recovery_required: 'runtime_recovery' })[raw] } : {}) };
+}
+export const observabilityStateFromRecord = stateFromRecord;
+function transition(previous, next) {
+  if (!previous || previous.autoContinue !== next.autoContinue) return previous ? 'settings_changed' : null;
+  if (previous.executionState !== next.executionState) return next.executionState === 'started' ? 'execution_started' : next.executionState === 'ended' ? 'execution_ended' : 'observation_gap';
+  return previous.result !== next.result && next.result !== 'unknown' ? 'result_confirmed' : null;
+}
+function event(conversation, key, type, state, now) {
+  if (!EVENT_TYPES.has(type) || !EXECUTION.has(state.executionState) || !RESULTS.has(state.result)) throw new Error('Invalid observability event.');
+  const request = { schema_version: 1, event_id: randomUUID(), consent_generation: conversation.consentGeneration, provider: conversation.provider, environment: conversation.environment, conversation_ref: conversation.conversationRef, sequence: conversation.sequence, event_type: type, occurred_at: new Date(now).toISOString(), auto_continue: state.autoContinue, execution_state: state.executionState, result: state.result, cli_version: CLI_VERSION };
+  if (state.reasonCode && REASONS.has(state.reasonCode)) request.reason_code = state.reasonCode;
+  if (type === 'execution_started' && state.runtimeObservedAt) request.runtime_observed_at = state.runtimeObservedAt;
+  if (state.missing === true) request.missing = true;
+  return { key, createdAt: now, request };
+}
+function limits(options = {}) { return { maxBytes: options.maxBytes ?? MAX_BYTES, maxAge: options.maxAge ?? MAX_AGE }; }
+function trim(state, now, options) {
+  const dropped = new Map(), { maxBytes, maxAge } = limits(options), remember = (item, reason) => { if (item?.key && !dropped.has(item.key)) dropped.set(item.key, reason); };
+  const retained = []; for (const item of state.outbox.events) { if (!Number.isFinite(item.createdAt) || item.createdAt < now - maxAge) remember(item, 'sequence_gap'); else retained.push(item); } state.outbox.events = retained;
+  while (Buffer.byteLength(JSON.stringify(state.outbox), 'utf8') > maxBytes && state.outbox.events.length) remember(state.outbox.events.shift(), 'queue_overflow');
+  return dropped;
+}
+function enqueueGap(state, key, reason, now) { const c = state.config.conversations[key]; if (!validConversation(c)) return; c.sequence = Number.isSafeInteger(c.sequence) && c.sequence >= 0 ? c.sequence + 1 : 1; state.outbox.events.push(event(c, key, 'observation_gap', { autoContinue: c.last?.autoContinue || 'unknown', executionState: 'unknown', result: 'unknown', reasonCode: reason, missing: true }, now)); }
+function materializeGaps(state, dropped, now, options) {
+  for (const [key, reason] of dropped) enqueueGap(state, key, reason, now);
+  // Gap markers are compact; preserve them in preference to ordinary events.
+  const { maxBytes } = limits(options);
+  const lateDrops = new Map();
+  while (Buffer.byteLength(JSON.stringify(state.outbox), 'utf8') > maxBytes) {
+    const index = state.outbox.events.findIndex(item => item.request?.event_type !== 'observation_gap');
+    if (index < 0) break;
+    const [removed] = state.outbox.events.splice(index, 1);
+    if (removed?.key && !dropped.has(removed.key) && !lateDrops.has(removed.key)) lateDrops.set(removed.key, 'queue_overflow');
+  }
+  // A marker may itself be the only remaining item and be larger than an
+  // artificially tiny test limit; production's 10 MiB limit easily holds it.
+  for (const [key, reason] of lateDrops) enqueueGap(state, key, reason, now);
+}
+function resetForIdentity(state, actor) { state.config = { ...blankConfig(), actor }; state.outbox = { schemaVersion: 1, events: [] }; }
+function sameActor(a, b) { return a && b && a.origin === b.origin && a.accountId === b.accountId && a.deviceId === b.deviceId && a.organizationId === b.organizationId; }
+export async function syncObservabilityConsent({ root, apiOrigin, apiBaseUrl, token, actor, fetchImpl = globalThis.fetch }) {
+  const environment = environmentFromOrigin(apiOrigin);
+  // Collection is defined only for canonical SIMY dev/prod origins. Fixtures,
+  // loopback hosts, and arbitrary origins stay inert without a network call.
+  if (!environment) {
+    const preflight = await readStore(root);
+    if (!preflight.config.enabled && preflight.outbox.events.length === 0) return status(preflight);
+    return withStoreLock(root, async () => {
+      const state = await readStore(root);
+      state.config = blankConfig();
+      state.outbox = { schemaVersion: 1, events: [] };
+      await saveStore(root, state);
+      return status(state);
+    });
+  }
+  const response = await fetchImpl(webApiUrl('devices/heartbeat/?observability=consent', { webOrigin: apiOrigin, apiBaseUrl }), { method: 'POST', headers: webApiHeaders({ token }), body: '{}', signal: AbortSignal.timeout(5_000) });
+  const payload = await response.json().catch(() => null); if (!response.ok) throw new Error('SIMY Web could not read observability consent.');
+  const identity = { origin: apiOrigin, accountId: actor?.accountId || null, deviceId: actor?.deviceId || null, organizationId: actor?.organizationId || null };
+  const generation = payload?.consent_generation;
+  const active = payload?.enabled === true && validGeneration(generation) && typeof identity.accountId === 'string' && identity.accountId.length > 0 && typeof identity.deviceId === 'string' && identity.deviceId.length > 0;
+  // A negative first response is deliberately side-effect free. The periodic
+  // device heartbeat can ask the server for consent, but default OFF must not
+  // create a collector directory that races ordinary temporary-root cleanup.
+  const preflight = await readStore(root);
+  const needsCleanup = preflight.config.enabled || validGeneration(preflight.config.consentGeneration) ||
+    preflight.outbox.events.length > 0 || Object.keys(preflight.config.conversations).length > 0;
+  if (!active && !needsCleanup) return status(preflight);
+  return withStoreLock(root, async () => {
+    const state = await readStore(root);
+    if (!active) {
+      if (state.config.actor && !sameActor(state.config.actor, identity)) resetForIdentity(state, identity); else state.config.actor = identity;
+      state.outbox.events = [];
+      for (const c of Object.values(state.config.conversations)) { c.sequence = 0; c.last = null; }
+      state.config.enabled = false;
+      state.config.environment = environment;
+      state.config.consentGeneration = null;
+      state.config.retry = { attempts: 0, at: 0 };
+      await saveStore(root, state);
+      return status(state);
+    }
+    if (state.config.actor && !sameActor(state.config.actor, identity)) resetForIdentity(state, identity); else state.config.actor = identity;
+    if (state.config.consentGeneration && state.config.consentGeneration !== generation) {
+      state.outbox.events = [];
+      for (const c of Object.values(state.config.conversations)) { c.sequence = 0; c.last = null; }
+    }
+    state.config.enabled = true;
+    state.config.environment = environment;
+    state.config.consentGeneration = generation;
+    state.config.retry = { attempts: 0, at: 0 };
+    await saveStore(root, state);
+    return status(state);
+  });
+}
+// Called only after authoritative record persistence. The lock covers every
+// state/outbox write; it is intentionally never held while network I/O runs.
+export async function observeDeliveryRecord(root, record, now = Date.now(), options = {}) {
+  if (!record || !['codex', 'claude'].includes(record.provider) || typeof record.session !== 'string') return false;
+  // Default OFF must be inert: do not create a lock, directory, or queue until
+  // the paired device has recorded active consent. Recheck under the lock so a
+  // concurrent consent change cannot publish an event under a stale generation.
+  const preflight = (await readStore(root)).config;
+  if (!preflight.enabled || !validGeneration(preflight.consentGeneration) || !['dev', 'prod'].includes(preflight.environment)) return false;
+  return withStoreLock(root, async () => { const state = await readStore(root), config = state.config; if (!config.enabled || !validGeneration(config.consentGeneration) || !['dev', 'prod'].includes(config.environment)) return false;
+    const key = keyFor(record.provider, record.session); let c = config.conversations[key];
+    if (!c) { c = config.conversations[key] = { provider: record.provider, session: record.session, environment: config.environment, conversationRef: randomUUID(), consentGeneration: config.consentGeneration, sequence: 0, last: stateFromRecord(record, now), lastObservedAt: now };
+      if (config.lost) { enqueueGap(state, key, 'sequence_gap', now); config.lost = false; await saveStore(root, state); return true; }
+      await saveStore(root, state); return false; // baseline is never a historical event
+    }
+    if (!validConversation(c)) return false; c.consentGeneration = config.consentGeneration; c.environment = config.environment;
+    const next = stateFromRecord(record, now), type = transition(c.last, next); c.last = next; c.lastObservedAt = now; if (!type) { await saveStore(root, state); return false; }
+    c.sequence = Number.isSafeInteger(c.sequence) && c.sequence >= 0 ? c.sequence + 1 : 1; state.outbox.events.push(event(c, key, type, next, now)); materializeGaps(state, trim(state, now, options), now, options); await saveStore(root, state); return true; });
+}
+export async function observeHeartbeat(root, now = Date.now(), options = {}) {
+  const preflight = (await readStore(root)).config;
+  if (!preflight.enabled || !validGeneration(preflight.consentGeneration)) return false;
+  return withStoreLock(root, async () => {
+    const state = await readStore(root), config = state.config;
+    if (!config.enabled || !validGeneration(config.consentGeneration)) return false;
+    const active = Object.entries(config.conversations).filter(([, conversation]) =>
+      validConversation(conversation) && Number.isFinite(conversation.lastObservedAt) &&
+      now - conversation.lastObservedAt >= 0 && now - conversation.lastObservedAt <= 90_000);
+    if (!active.length) return false;
+    const start = Number.isSafeInteger(config.heartbeatCursor) ? config.heartbeatCursor % active.length : 0;
+    const selected = Array.from({ length: Math.min(25, active.length) }, (_, index) => active[(start + index) % active.length]);
+    config.heartbeatCursor = (start + selected.length) % active.length;
+    for (const [key, conversation] of selected) {
+      // A newer heartbeat supersedes an unsent one for this conversation.
+      state.outbox.events = state.outbox.events.filter(item => !(item.key === key && item.request?.event_type === 'heartbeat'));
+      conversation.consentGeneration = config.consentGeneration;
+      conversation.sequence = Number.isSafeInteger(conversation.sequence) && conversation.sequence >= 0 ? conversation.sequence + 1 : 1;
+      state.outbox.events.push(event(conversation, key, 'heartbeat', conversation.last || { autoContinue: 'unknown', executionState: 'unknown', result: 'unknown' }, now));
+    }
+    materializeGaps(state, trim(state, now, options), now, options);
+    await saveStore(root, state);
+    return true;
+  });
+}
+function retryAt(now, attempts) { return now + Math.min(60_000, 1_000 * 2 ** Math.min(attempts, 5)) + Math.floor(Math.random() * 500); }
+export async function flushObservability({ root, apiOrigin, apiBaseUrl, token, fetchImpl = globalThis.fetch, now = Date.now() }) {
+  const preflight = (await readStore(root)).config;
+  if (!preflight.enabled || !validGeneration(preflight.consentGeneration)) return { sent: 0, queued: 0 };
+  const snapshot = await withStoreLock(root, async () => { const state = await readStore(root); if (!state.config.enabled || !validGeneration(state.config.consentGeneration) || state.config.retry.at > now) return null; if (state.config.actor?.origin !== apiOrigin) return null; return { generation: state.config.consentGeneration, actor: state.config.actor, events: [...state.outbox.events].sort((left, right) => Number(left.request?.event_type === 'heartbeat') - Number(right.request?.event_type === 'heartbeat')).slice(0, MAX_FLUSH) }; });
+  if (!snapshot?.events.length) return { sent: 0, queued: snapshot ? 0 : (await observabilityStatus(root)).queued, ...(snapshot ? {} : { retryPending: true }) };
+  const delivered = new Set(), rejected = new Set(); let failed = false, resync = false;
+  for (const item of snapshot.events) { try { const response = await fetchImpl(webApiUrl('devices/heartbeat/?observability=event', { webOrigin: apiOrigin, apiBaseUrl }), { method: 'POST', headers: webApiHeaders({ token }, { 'Content-Type': 'application/json' }), body: JSON.stringify(item.request), signal: AbortSignal.timeout(5_000) }); if (response.ok) { delivered.add(item.request.event_id); continue; } if ([400, 409, 422].includes(response.status)) { rejected.add(item.request.event_id); continue; } if ([401, 403].includes(response.status)) resync = true; failed = true; break; } catch { failed = true; break; } }
+  return withStoreLock(root, async () => { const state = await readStore(root); if (!state.config.enabled || state.config.consentGeneration !== snapshot.generation || !sameActor(state.config.actor, snapshot.actor)) { state.outbox.events = []; await saveStore(root, state); return { sent: 0, queued: 0 }; }
+    state.outbox.events = state.outbox.events.filter(item => !delivered.has(item.request.event_id) && !rejected.has(item.request.event_id)); for (const item of snapshot.events) if (rejected.has(item.request.event_id)) enqueueGap(state, item.key, 'sequence_gap', now); if (resync) state.config.enabled = false; state.config.retry = failed ? { attempts: state.config.retry.attempts + 1, at: retryAt(now, state.config.retry.attempts) } : { attempts: 0, at: 0 }; await saveStore(root, state); return { sent: delivered.size, queued: state.outbox.events.length, ...(failed ? { retryPending: true } : {}) }; });
+}

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -20,6 +20,8 @@ import { homedir } from 'node:os';
 import { atomicSave, readState } from './update-state-store.mjs';
 import { captureHookOwner, fenceHook, rootFromDelivery, readDispatchGate, readTaskAdmission } from './update-dispatch-gate.mjs';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+const observeDeliveryRecord = (...args) => import('../../../cli-observability.js')
+  .then(({ observeDeliveryRecord: observe }) => observe(...args)).catch(() => false);
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { acquireWorkspaceLease, releaseWorkspaceLease } from './workspace-lease.mjs';
@@ -116,6 +118,13 @@ export async function linkedProvider(root, provider) {
 const digest = value => createHash('sha256').update(value).digest('hex');
 const text = (value, max = 4000) => typeof value === 'string' ? value.trim().slice(0, max) : '';
 const exactText = value => typeof value === 'string' && Buffer.byteLength(value, 'utf8') <= 1000 ? value : null;
+// Candidate discovery reserves an association ID even when no Action exists.
+// Only a confirmed no-match snapshot can distinguish that reservation from
+// existing ownership; missing, bound and unlinked snapshots remain protected.
+export function associationBlocksFollowup(record) {
+  return Boolean(record?.associationTaskId) &&
+    !(record.actionAssociation?.status === 'no_match' && record.actionAssociation.binding === null);
+}
 export function canUpgradeDelivery(run, { automatic = false } = {}) {
   return Boolean(run && !run.managed && text(run.id) && text(run.objective) && Number.isFinite(run.startedAt) &&
     Number.isSafeInteger(run.maxFailures) && run.maxFailures > 0 &&
@@ -262,7 +271,7 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
   // Recovery requires positive process-death evidence and a serialized second
   // observation. Unknown/legacy owners are never reclaimed by age.
   const lockToken = await waitForStateLock(lock, inspectProcess);
-  let temporary;
+  let temporary, observation, result;
   try {
     const stored = await read(file, MAX_STATE_BYTES);
     const previous = await applyArchiveFence(root, applyProviderConsent(stored, await providerLinkState(root, provider)));
@@ -294,9 +303,29 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
           await new Promise(resolve => setTimeout(resolve, 25 * (attempt + 1)));
         }
       }
-    }
-    return next;
+      // This is intentionally post-persistence and best-effort: visibility
+      // recording cannot make an existing delivery state update fail or cause
+      // a task to start, stop, or retry.
+      // Runtime identity is revalidated by the caller that has a fresh direct
+      // observation. Persistence alone is never treated as execution evidence.
+      observation = { ...next, runtime: null };
+    }
+    result = next;
   } finally { if (temporary) await rm(temporary, { force: true }); await releaseStateLock(lock, lockToken); }
+  // Do not wait on process inspection or the collector while holding the
+  // delivery state lock. A matching fresh identity is required for start.
+  if (observation) void (async () => {
+    const runtime = observation.runtime || result?.runtime;
+    const verified = result?.autoContinue === true && result.run?.managed &&
+      runtime?.isRunning === true && runtime.process?.identity &&
+      Number.isSafeInteger(runtime.process?.pid) &&
+      await inspectProcess(runtime.process.pid).catch(() => null) === runtime.process.identity;
+    await observeDeliveryRecord(dirname(root), {
+      ...observation,
+      runtime: verified ? runtime : null,
+    });
+  })().catch(() => {});
+  return result;
 }
 export async function readRecord(root = rootDirectory(), provider, session) {
   const path = recordPath(root, provider, session);
@@ -863,7 +892,7 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
       if (following && text(objective) === prior.objective) throw new Error('Follow-up requires a new objective; use the original task controls for unfinished work.');
       if (hasPendingUserStop(root, previous) || previous.providerArchived || previous.automaticStartBlocked || previous.autoContinue === false && previous.autoContinueEpoch ||
           prior.managed?.resumeLease || prior.managed?.liveWorkspaceLease || prior.managed?.outcomeAudit?.lease || prior.managed?.executionUncertain || prior.managed?.pendingApproval || prior.managed?.nativeWait ||
-          ['pending', 'transferred', 'pending_received'].includes(prior.managed?.handoff?.status) || previous.associationTaskId) throw new Error('Resolve the existing stop, opt-out, ownership, approval or uncertain result before enrolling follow-up work.');
+          ['pending', 'transferred', 'pending_received'].includes(prior.managed?.handoff?.status) || associationBlocksFollowup(previous)) throw new Error('Resolve the existing stop, opt-out, ownership, approval or uncertain result before enrolling follow-up work.');
       const gateRoot = rootFromDelivery(root), gate = readDispatchGate(gateRoot);
       const fences = Object.values(gate.taskFences?.records || {}).filter(item => item.taskId === (prior.managed?.taskId || prior.id) && item.identity.provider === provider && item.identity.session === session);
       if (fences.some(item => !readTaskAdmission({ root: gateRoot, identity: item.identity, taskId: item.taskId }).canResume)) throw new Error('Existing task admission must be reconciled before enrolling follow-up work.');

package/src/delivery-hooks/command.js

@@ -20,6 +20,7 @@ import { routeLegacyHooks } from './legacy-hook-routing.js';
 import { activateLocalDesktop, watchLocalRuntime, installRuntimeWatchdog } from './runtime-watchdog.js';
 import { desktopRuntimeStatus, installLocalDesktop } from './desktop-runtime.js';
 import { consistencyMonitorStatus, consistencyFindings } from './consistency-monitor.js';
+import { observabilityStatus } from '../cli-observability.js';
 
 async function readCheckpointInput(input) {
   const chunks = [];
@@ -45,6 +46,12 @@ function parseDeliveryOptions(args, allowed) {
 
 export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = process.cwd(), webOrigin, input = process.stdin, output = console.log } = {}) {
   const [action, ...args] = argv;
+  if (action === 'observability') {
+    const [operation, ...flags] = args;
+    if (operation !== 'status' || flags.length) throw new Error('Use simy delivery observability status. Change the single device-consent checkbox in SIMY settings.');
+    const sessionRoot = dirname(root);
+    output(JSON.stringify(await observabilityStatus(sessionRoot), null, 2)); return 0;
+  }
   if (action === 'history-recovery') {
     const [operation,...flags] = args;
     const options = parseDeliveryOptions(flags,new Set(['audit','digest']));
@@ -211,6 +218,7 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
   }
   if (action === 'activity') return runActivityCommand(args, { root, output });
   if (!action || action === '--help') {
+    output('simy delivery observability status — show the state-only telemetry status for this device. The single default-OFF consent checkbox is in SIMY settings; disabling it stops uploads and discards pending telemetry. It never enables Auto-continue or starts a task.');
     output('simy delivery followup --provider codex --session ID --previous-run-id ID --objective TEXT — explicitly supervise the current goal after an exact finished run. A new goal archives the prior run; the same ordinary reported_done goal retains its identity and budgets for read-only reconciliation. Uses the existing supervisor; never reopens stopped, failed or budget-exhausted work.');
     output('simy delivery auto on|off|status --provider codex|claude — inspect or override CLI automatic start for this project directory (on by default). The next nonempty prompt in a conversation without a loop starts checkpoint tracking. Existing loops are preserved; provider hooks must already be enabled.');
     output('simy delivery redelegate-native --provider codex --session ID --task-id ID --consent-ref REF — explicitly delegate current native local edit/test permissions to an exact legacy task. Preserves enrollment, history, budgets and stops; does not resume or grant external actions.');

package/src/desktop-host.js

@@ -763,7 +763,6 @@ export async function startDesktopHost({ input = process.stdin, output = process
         scope: requestedScope,
         deviceSession: localCliApiSession(),
       });
-      stopNotifier.observe(records);
       const projection = await actionAssociations.beginProjection?.({ records });
       status.deliveryHooks = await (dependencies.deliveryHookStatus || deliveryHookStatus)({ root: deliveryRoot, records: projection?.records || records }).catch(() => ({ error: "Delivery hook status unavailable", providers: {}, runs: [] }));
       await actionAssociations.decorate(status.deliveryHooks, projection);
@@ -822,7 +821,12 @@ export async function startDesktopHost({ input = process.stdin, output = process
         status = { ...structuredClone(latestConnectionStatus), deliveryHooks: status.deliveryHooks, sessionSupervision: status.sessionSupervision };
       }
       status.teamThreads = teamThreads?.snapshot();
-      if (!closed && !relay) emitStatus(status);
+      if (!closed && !relay) {
+        // Native stop admission waits for this authorized projection, so an old
+        // running frame cannot suppress a newly stopped conversation.
+        stopNotifier.observe(records);
+        emitStatus(status);
+      }
     }).finally(() => { publishing = null; if (publishAgain && !closed) { publishAgain = false; setImmediate(() => { void publish().catch(() => {}); }); } });
     return publishing;
   };

package/src/session-supervision/index.js

@@ -7,7 +7,7 @@ import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/accepta
 import { purposeFailureMode } from '../codex-plugins/simy/hooks/purpose-search.mjs';
 import { realpath } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
-import { TERMINAL as TERMINAL_RUNS, advanceDeliveryControlRevision, deliveryDecisionRevision, canUpgradeDelivery, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord, recordProviderArchive } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { TERMINAL as TERMINAL_RUNS, advanceDeliveryControlRevision, deliveryDecisionRevision, associationBlocksFollowup, canUpgradeDelivery, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord, recordProviderArchive } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { listCodexSessions, codexThreadMetadata, openCodexAppServer, readCodexSession, readCodexArchiveStates, CodexAppServerError } from './codex-app-server.js';
 import { listClaudeSessions, readClaudeSession } from './claude-sessions.js';
 import { loadPurposeRuleSet } from './purpose-instruction.js';
@@ -336,7 +336,7 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       // implicit reset through the auto-continue preference.
       followup: !archived && supported && item.provider === 'codex' &&
         run?.state === 'reported_done' && !run.managed && run.id && !record.automaticStartBlocked &&
-        !record.associationTaskId && !(record.autoContinue === false && record.autoContinueEpoch)
+        !associationBlocksFollowup(record) && !(record.autoContinue === false && record.autoContinueEpoch)
         ? { previousRunId: run.id } : null,
       ...autoContinueState(record, isRunning, availability),
       lastActivityAt: item.lastActivityAt, createdAt: item.createdAt ?? null, observation, availability: item.availability,

package/src/session-supervision/stop-notifications.js

@@ -1,15 +1,20 @@
 import { createHash } from 'node:crypto';
 import { deliveryStop } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 
+const pendingManualChecks = run => (run.managed.acceptanceCriteria || []).filter(item =>
+  item.check?.type === 'manual' && !Object.hasOwn(run.managed.verified || {}, item.id));
+
 // Auto-continue works while nobody is watching, so a person must learn when it
 // stops. Map a stopped run to a notification kind; the native window owns copy.
 export function stopNotificationKind(run, now = Date.now()) {
   if (!run?.managed?.autoContinueEpoch && !run?.managed?.repairRequest) return null;
+  if (run.stopReason?.actor === 'user') return null;
   // The clock keeps aging while paused; the persisted human decision takes
   // precedence over a threshold that was reached only after that decision.
-  if (run.state === 'paused') return run.reason === 'Paused by user.' ? null : deliveryStop(run, now) ? 'paused' : null;
+  if (run.state === 'paused') return /^(Paused by user\.|Automatic continuation paused by user\.|User interrupted the provider\.|Stopped by user\.)$/.test(run.reason || '') ? null : deliveryStop(run, now) ? 'paused' : null;
   if (run.state === 'auto_resuming' && !run.managed.resumeLease?.owner) return 'needs_decision';
-  if (run.state === 'blocked' || run.state === 'verification_pending' || run.state === 'reported_done') return 'needs_decision';
+  if (run.state === 'blocked') return run.blocker === 'external_dependency' || run.managed.dependencyWait ? null : 'needs_decision';
+  if (run.state === 'verification_pending') return pendingManualChecks(run).length ? 'needs_decision' : null;
   if (run.state === 'recovery_required' && run.managed.autoRecovery !== true) return 'needs_decision';
   if (run.state === 'failed' || run.state === 'budget_exhausted') return 'failed';
   if (run.state === 'completed') return 'finished';
@@ -19,24 +24,35 @@ export function stopNotificationKind(run, now = Date.now()) {
 // The first observation is a baseline: restarting SIMY must not replay alerts
 // for runs that stopped earlier. Each distinct stop is announced once.
 export function createStopNotifier({ emit, now = Date.now } = {}) {
-  // Retain one stop fingerprint per currently observed task, rather than an
-  // event cache whose eviction could replay the entire historical baseline.
+  // Retain one stop fingerprint per task for this process. A temporarily empty
+  // discovery result must not turn the same historical stop into a new alert.
   const seen = new Map();
   let baseline = true;
   return {
     observe(records) {
       for (const record of records) {
-        const run = record?.run, kind = stopNotificationKind(run, now());
+        if (record.providerArchived || record.localHidden) continue;
+        const run = record?.run;
+        const kind = stopNotificationKind(run, now());
         const key = JSON.stringify([record.provider, record.session, run?.managed?.taskId]);
-        if (!kind) continue;
-        const id = createHash('sha256').update(JSON.stringify([record.provider, record.session, run.managed.taskId, run.id, kind, run.blocker, run.reason])).digest('hex').slice(0, 32);
+        if (!kind) {
+          if (run?.state === 'active' || run?.state === 'auto_resuming') seen.delete(key);
+          continue;
+        }
+        // Revisions and generated summaries change during maintenance without
+        // creating a new human task. Only a different stop/explicit request does.
+        const request = run.managed.pendingApproval || run.managed.understandingQuestion;
+        const id = createHash('sha256').update(JSON.stringify([record.provider, record.session, run.managed.taskId,
+          run.id, run.managed.autoContinueEpoch, kind, run.blocker || null, request?.id || null,
+          run.managed.userQuestion || null])).digest('hex').slice(0, 32);
         if (seen.get(key) === id) continue;
         seen.set(key, id);
+        const detail = request?.text || request?.summary || run.managed.userQuestion ||
+          (run.state === 'verification_pending' ? pendingManualChecks(run).map(item => item.description).filter(Boolean).join('; ') : null);
         if (!baseline) emit({ type: 'notify', id, kind, provider: record.provider, session: record.session,
-          objective: String(run.objective || '').slice(0, 200) });
+          objective: String(run.objective || '').slice(0, 200),
+          ...(detail ? { detail: String(detail).slice(0, 500) } : {}) });
       }
-      // Temporary provider absence or a diagnostic pass is not a new stop.
-      // Retain fingerprints until a materially different outcome is observed.
       baseline = false;
     },
   };

package/src/sqm/claude-plugin.js

@@ -28,7 +28,14 @@ export async function claudePluginFiles() {
   for (const name of ["loop-kernel.mjs", "loop-kernel/index.mjs", "loop-kernel/policy.json", "loop-kernel/pin.json", "loop-kernel/outcome-review.mjs", "loop-kernel/work-frontier.mjs", "loop-kernel/task-pool.mjs"]) {
     files.set(`hooks/${name}`, await readFile(path.join(SOURCE, "hooks", name), "utf8"));
   }
-  files.set("hooks/delivery-loop.mjs", await readFile(path.join(SOURCE, "hooks/delivery-loop.mjs"), "utf8"));
+  const collector = await readFile(new URL("../cli-observability.js", import.meta.url), "utf8");
+  files.set("hooks/cli-observability.mjs", collector.replace("./web-api.js", "./web-api.mjs"));
+  files.set("hooks/web-api.mjs", await readFile(new URL("../web-api.js", import.meta.url), "utf8"));
+  const deliveryLoop = await readFile(path.join(SOURCE, "hooks/delivery-loop.mjs"), "utf8");
+  files.set("hooks/delivery-loop.mjs", deliveryLoop.replace(
+    "const observeDeliveryRecord = (...args) => import('../../../cli-observability.js')\n  .then(({ observeDeliveryRecord: observe }) => observe(...args)).catch(() => false);",
+    "import { observeDeliveryRecord } from './cli-observability.mjs';",
+  ));
   files.set("hooks/recovery-incident.mjs", await readFile(path.join(SOURCE, "hooks/recovery-incident.mjs"), "utf8"));
   files.set("hooks/minimal-sufficient.mjs", await readFile(path.join(SOURCE, "hooks/minimal-sufficient.mjs"), "utf8"));
   files.set("hooks/outcome-progress.mjs", await readFile(path.join(SOURCE, "hooks/outcome-progress.mjs"), "utf8"));