@awak-app/simy-cli 0.7.29 → 0.7.32

package/src/session-supervision/remote-metadata.js

@@ -0,0 +1,103 @@
+import { controllerExecutionContext } from './execution-context.js';
+import { readRecord, updateRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { createHash, randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { createActionAssociationHost } from './action-association-host.js';
+import { createActionDeadlineService } from './action-deadline.js';
+
+// Web metadata belongs to the controller. Separate roots prevent a cloned
+// provider UUID on another host from reusing a local binding or deadline.
+export function createRemoteMetadata({ root, webOrigin, onChange, createAssociations = createActionAssociationHost, createDeadlines = createActionDeadlineService }) {
+  const hosts = new Map();
+  function host(scope, hostId) {
+    const key = JSON.stringify([scope, hostId]);
+    if (!hosts.has(key)) {
+      const directory = join(root, 'controller-metadata', createHash('sha256').update(key).digest('hex'));
+      hosts.set(key, { recordsRoot: join(directory, 'records'), associations: createAssociations({ root: join(directory, 'records'), sessionRoot: root, webOrigin, onChange }),
+        deadlines: createDeadlines({ root: join(directory, 'deadlines') }), candidates: new Map(), active: new Set() });
+    }
+    return hosts.get(key);
+  }
+  async function decorate(scope, rows) {
+    const groups = new Map();
+    for (const row of rows) { if (!groups.has(row.hostId)) groups.set(row.hostId, []); groups.get(row.hostId).push(row); }
+    for (const [id, group] of groups) {
+      const h = host(scope, id);
+      // These are controller metadata records, never enrollments or executable
+      // remote runs. Keep the original execution task identity separate.
+      for (const row of group) {
+        const sourceTaskId = row.sourceActionTaskId;
+        if (!row.cwd || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(sourceTaskId || '')) continue;
+        await updateRecord(h.recordsRoot, row.provider, row.session, previous => previous || ({
+          schemaVersion: 1, provider: row.provider, session: row.session, cwd: row.cwd, run: null,
+          associationTaskId: sourceTaskId, controllerMigration: { sourceHostId: id, sourceTaskId },
+        }));
+      }
+      const candidates = group.map(row => ({ ...row, executionTaskId: row.binding?.mode === 'managed' ? row.binding.taskId || row.taskId : null, binding: { mode: 'unmanaged' } }));
+      await h.associations.decorateSessions(candidates);
+      for (let i = 0; i < candidates.length; i++) {
+        const candidate = candidates[i];
+        const context = await h.associations.deadlineContext(candidate);
+        if (context) {
+          if (group[i].sourceActionDeadline && h.deadlines.importSnapshot) await h.deadlines.importSnapshot(context, group[i].sourceActionDeadline);
+          candidate.actionDeadline = await h.deadlines.reconcile(context, { displayOnly: true });
+        }
+        h.candidates.set(`${candidate.provider}:${candidate.session}`, candidate);
+        Object.assign(group[i], { actionAssociation: candidate.actionAssociation, actionDeadline: candidate.actionDeadline, actionTaskId: candidate.taskId });
+      }
+    }
+    return rows;
+  }
+  async function syncPending(scope, enqueue) {
+    for (const [key, h] of hosts) {
+      const [account, hostId] = JSON.parse(key);
+      if (account !== scope) continue;
+      for (const [sessionKey, candidate] of h.candidates) {
+        if (h.active.has(sessionKey)) continue;
+        h.active.add(sessionKey);
+        try {
+        const record = await readRecord(h.recordsRoot, candidate.provider, candidate.session);
+        const intent = record?.controllerContextPending;
+        if (!intent) continue;
+        await enqueue({ action: 'session_sync_context', hostId, provider: candidate.provider, session: candidate.session,
+          requestId: intent, context: controllerExecutionContext(candidate) });
+        await updateRecord(h.recordsRoot, candidate.provider, candidate.session, current => {
+          if (current?.controllerContextPending === intent) delete current.controllerContextPending;
+          return current;
+        });
+        } finally { h.active.delete(sessionKey); }
+      }
+    }
+  }
+  return { decorate, syncPending,
+    async command(scope, command) {
+      const h = host(scope, command.hostId);
+      const candidate = h.candidates.get(`${command.provider}:${command.session}`);
+      if (!candidate) throw new Error('Refresh the conversation metadata.');
+      if (command.action === 'session_deadline_decide' && command.cancel === true) return;
+      const sessionKey = `${command.provider}:${command.session}`;
+      if (h.active.has(sessionKey)) throw new Error('Conversation metadata is updating; retry shortly.');
+      h.active.add(sessionKey);
+      try {
+      if (command.action !== 'session_action_refresh') await updateRecord(h.recordsRoot, command.provider, command.session, previous => ({
+        ...(previous || { schemaVersion: 1, provider: command.provider, session: command.session, cwd: candidate.cwd, run: null }),
+        controllerContextPending: randomUUID(),
+      }));
+      if (command.action === 'session_deadline_decide') {
+        if (command.cancel === true) return;
+        const context = await h.associations.deadlineContext(candidate);
+        if (!context || context.taskId !== command.taskId) throw new Error('Deadline context changed.');
+        await h.deadlines.reconcile(context);
+        const result = await h.deadlines.decide(context, { ...command, requestId: command.requestId || command.decisionId });
+        if (result.status === 'conflict') throw Object.assign(new Error('Deadline changed.'), { code: 'conflict' });
+      } else await h.associations.correct(command, candidate);
+      await h.associations.decorateSessions([candidate]);
+      const updatedContext = await h.associations.deadlineContext(candidate);
+      if (updatedContext) candidate.actionDeadline = await h.deadlines.reconcile(updatedContext, { displayOnly: true });
+      onChange?.();
+      return controllerExecutionContext(candidate);
+      } finally { h.active.delete(sessionKey); }
+    },
+    async close() { await Promise.all([...hosts.values()].map(h => h.associations.close())); hosts.clear(); },
+  };
+}

package/src/session-supervision/remote-session-list.js

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { readHosts } from './remote-hosts.js';
+import { readHosts, remoteSshArgs } from './remote-hosts.js';
 
 // This read-only command never boots a remote desktop host or supervisor.
 export async function readRemoteSessionLists({ root = process.env.SIMY_HOME?.trim() || join(homedir(), '.simy'),
@@ -14,9 +14,7 @@ export async function readRemoteSessionLists({ root = process.env.SIMY_HOME?.tri
       if (!['all', 'codex', 'claude'].includes(provider)) throw new Error('No connected provider.');
       const command = `exec sh -lc 'exec simy sessions --json --local-only --provider ${provider}${includeArchived ? ' --include-archived' : ''}'`;
       const catalog = await new Promise((resolve, reject) => {
-        const child = spawnImpl('ssh', ['-T', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes',
-          '-o', 'ConnectTimeout=5', '-o', 'ServerAliveInterval=10', '-o', 'ServerAliveCountMax=2',
-          '--', host.alias, command], { stdio: ['ignore', 'pipe', 'pipe'], shell: false });
+        const child = spawnImpl('ssh', remoteSshArgs(host.alias, command), { stdio: ['ignore', 'pipe', 'pipe'], shell: false });
         let chunks = [], size = 0, done = false;
         const finish = (error, value) => {
           if (done) return; done = true;

package/src/session-supervision/session-archive-command.js

@@ -0,0 +1,45 @@
+import { randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { requestOwnerArchive } from './owner-transport.js';
+import { terminalText } from './session-list.js';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export async function runSessionArchiveCommand(argv, { output = process.stdout, errors = process.stderr,
+  root = process.env.SIMY_HOME?.trim() || join(homedir(), '.simy'), request = requestOwnerArchive } = {}) {
+  const operation = argv[0];
+  const options = { hostId: 'local' };
+  try {
+    if (!['archive', 'restore', 'provider-status', 'provider-setup'].includes(operation)) throw new Error('Unknown conversation operation.');
+    if (argv.includes('--help') || argv.includes('-h')) {
+      output.write('simy sessions archive|restore --provider claude|codex --session UUID [--host local|SSH_ALIAS] [--request-id ID]\nsimy sessions provider-status|provider-setup --provider claude [--host SSH_ALIAS --session UUID]\n\nArchive and restore affect the original provider conversation. SIMY must be running and connected to the provider. The graphical UI is unchanged. Results are JSON; verified means provider state was read back. A remote setup opens settings on that host.\n');
+      return 0;
+    }
+    const fields = new Map([['--provider', 'provider'], ['--session', 'session'], ['--host', 'hostId'], ['--request-id', 'requestId']]);
+    const seen = new Set();
+    for (let index = 1; index < argv.length; index++) {
+      const name = fields.get(argv[index]);
+      if (!name || seen.has(name) || !argv[index + 1] || argv[index + 1].startsWith('--')) throw new Error('Use explicit --provider, --session and --host options. See --help.');
+      seen.add(name); options[name] = argv[++index];
+    }
+    const setup = operation.startsWith('provider-');
+    if (!['claude', 'codex'].includes(options.provider) || setup && options.provider !== 'claude') throw new Error('Select a supported provider explicitly.');
+    if ((!setup || options.hostId !== 'local' || options.session !== undefined) && !UUID.test(options.session || '')) throw new Error('Select the exact conversation UUID using simy sessions --include-archived --json.');
+    if (options.hostId !== 'local') {
+      const alias = options.hostId.replace(/^remote-ssh-discovered:/, '');
+      if (!/^[a-zA-Z0-9][a-zA-Z0-9._@-]{0,127}$/.test(alias)) throw new Error('Use a registered SSH alias.');
+      options.hostId = 'remote-ssh-discovered:' + alias;
+    }
+    if (options.requestId !== undefined && !/^[a-zA-Z0-9_-]{1,128}$/.test(options.requestId)) throw new Error('Invalid request ID.');
+    const command = { id: randomUUID(), ...options,
+      action: setup ? 'session_provider_setup' : 'session_' + operation,
+      ...(setup ? { operation: operation === 'provider-status' ? 'inspect' : 'setup' } : { scope: 'provider', requestId: options.requestId || randomUUID() }) };
+    const controller = new AbortController(), cancel = () => controller.abort();
+    process.once('SIGINT', cancel); process.once('SIGTERM', cancel);
+    let result;
+    try { result = await request({ root, command, signal: controller.signal }); }
+    finally { process.removeListener('SIGINT', cancel); process.removeListener('SIGTERM', cancel); }
+    output.write(JSON.stringify({ ...result, requestId: command.requestId, hostId: command.hostId, provider: command.provider, session: command.session }) + '\n');
+    if (!result?.ok) return result?.code === 'remote_operation_unknown' ? 2 : 1;
+    return setup && result.data?.available !== true ? 2 : 0;
+  } catch (error) { errors.write('SIMY: ' + terminalText(error?.message || 'Archive result unavailable.') + '\n'); return 1; }
+}

package/src/session-supervision/session-list.js

@@ -1,5 +1,9 @@
+import { createControllerStore, controllerScope } from './controller-store.js';
+import { readSession, isSessionValid } from '../session-store.js';
+import { resolveWebOrigin } from '../web-origin.js';
 import { readRemoteSessionLists } from './remote-session-list.js';
-import { hostname } from 'node:os';
+import { hostname, homedir } from 'node:os';
+import { join } from 'node:path';
 import { stripVTControlCharacters } from 'node:util';
 import { readProviderLinks } from '../provider-links.js';
 import { openCodexAppServer, listCodexSessions } from './codex-app-server.js';
@@ -23,7 +27,7 @@ export async function readLocalSessionList({ root, signal, includeArchived = fal
   if (!providers.length) throw Object.assign(new Error('Codex and Claude Code are disconnected from SIMY. Reconnect a provider before listing conversations.'), { code: 'provider_link_disconnected' });
   const results = await Promise.allSettled(providers.map(async provider => {
     signal?.throwIfAborted();
-    if (provider === 'claude') return (await listClaude({ all: true, signal })).filter(row => includeArchived || !row.archived);
+    if (provider === 'claude') return (await listClaude({ all: true, signal })).filter(row => includeArchived || !row.archived && !row.localHidden);
     const client = await openClient({ signal, cancelOnAbort: true });
     let sessions;
     try {
@@ -53,11 +57,33 @@ export async function readLocalSessionList({ root, signal, includeArchived = fal
       })) };
 }
 // Aggregate only explicitly registered hosts, preserving the host/provider/ID tuple.
-export async function readSessionList({ root, signal, provider = 'all', localOnly = false, includeArchived = false,
+export async function readSessionList({ root = process.env.SIMY_HOME?.trim() || join(homedir(), '.simy'), signal, provider = 'all', localOnly = false, includeArchived = false,
   readLinks = readProviderLinks, loadLocal = readLocalSessionList, loadRemote = readRemoteSessionLists } = {}) {
   const links = await readLinks(root);
   const providers = ['codex', 'claude'].filter(name => links[name]?.connected && (provider === 'all' || name === provider));
   if (!providers.length) throw Object.assign(new Error('Reconnect a provider before listing conversations.'), { code: 'provider_link_disconnected' });
+  const webOrigin = resolveWebOrigin(null, process.env);
+  const login = await readSession(webOrigin, root);
+  const scope = isSessionValid(login, Date.now(), webOrigin) ? controllerScope({ auth: { userId: login.account_id ?? login.auth_user_id }, access: { organizationId: login.organization_id } }) : null;
+  const store = createControllerStore(root);
+  const controller = scope ? await store.load(scope) : null;
+  const cache = controller?.catalog;
+  const cacheRows = (cache?.sessions || []).filter(row => providers.includes(row.provider) && (!localOnly || !row.hostId || row.hostId === 'local') && cache.providerLinks?.[row.provider]?.epoch === links[row.provider]?.epoch);
+  const decorate = rows => rows.map(row => {
+    const preference = scope ? store.get(scope, row) : {};
+    return { ...row, deleted: preference.deleted === true, ...(preference.pinned === undefined ? {} : { listPinned: preference.pinned }),
+      ...(preference.hidden === undefined ? {} : { localHidden: preference.hidden }),
+      ...(preference.statistics ? { statistics: { ...preference.statistics, ...(row.workState?.stale ? { stale: true, cached: true } : {}) } } : {}),
+      ...(preference.policy ? { controllerPolicy: preference.policy } : {}) };
+  }).filter(row => !row.deleted && (includeArchived || !row.archived && !row.localHidden));
+  if (cache && Number.isFinite(cache.observedAt) && cache.observedAt <= Date.now() && Date.now() - cache.observedAt <= 45_000) {
+    const current = await readLinks(root);
+    if (providers.some(name => !current[name]?.connected || current[name].epoch !== links[name].epoch)) throw Object.assign(new Error('Provider connection changed.'), { code: 'provider_link_changed' });
+    signal?.throwIfAborted();
+    const hosts = localOnly ? [] : cache.hosts || [];
+    const warnings = hosts.filter(host => host.state !== 'ready').map(host => `${terminalText(host.label || host.id)}: ${terminalText(host.reason || 'unavailable')}`);
+    return { host: hostname(), observedAt: new Date(cache.observedAt).toISOString(), complete: warnings.length === 0, warnings, hosts, sessions: decorate(cacheRows), source: 'controller' };
+  }
   const [local, remote] = await Promise.allSettled([
     loadLocal({ root, signal, provider, includeArchived, readLinks }),
     localOnly ? [] : loadRemote({ root, signal, providers, includeArchived }),
@@ -83,8 +109,14 @@ export async function readSessionList({ root, signal, provider = 'all', localOnl
       workState: { label: terminalText(row.workState?.label || '状態未確認') },
     })));
   }
+  // Keep offline history from the same authorized catalog, explicitly stale.
+  const identities = new Set(sessions.map(row => JSON.stringify([row.hostId || 'local', row.provider, row.session])));
+  for (const row of cacheRows) {
+    const key = JSON.stringify([row.hostId || 'local', row.provider, row.session]);
+    if (!identities.has(key)) sessions.push({ ...row, isRunning: false, workState: { state: 'unknown', label: '接続先を確認できません', stale: true, checkedAt: cache.observedAt }, statistics: row.statistics ? { ...row.statistics, stale: true, cached: true } : undefined });
+  }
   return { host: hostname(), observedAt: new Date().toISOString(), complete: warnings.length === 0, warnings, hosts,
-    sessions: [...new Map(sessions.map(row => [`${row.hostId}:${row.provider}:${row.session}`, row])).values()] };
+    sessions: decorate([...new Map(sessions.map(row => [`${row.hostId}:${row.provider}:${row.session}`, row])).values()]) };
 }
 
 export function formatSessionList(catalog, query = '') {
@@ -101,6 +133,10 @@ export function formatSessionList(catalog, query = '') {
 
 export async function runSessionListCommand(argv, { output = process.stdout, errors = process.stderr, input = process.stdin,
   load = readSessionList, renderInteractive } = {}) {
+  if (['archive', 'restore', 'provider-status', 'provider-setup'].includes(argv[0])) {
+    const { runSessionArchiveCommand } = await import('./session-archive-command.js');
+    return runSessionArchiveCommand(argv, { output, errors });
+  }
   let query = '', json = false, interactive = false, includeArchived = false, localOnly = false, provider = 'all';
   try {
     for (let i = 0; i < argv.length; i++) {

package/src/session-supervision/sqm-presentation.js

@@ -1,14 +1,57 @@
+const count = value => Number.isSafeInteger(value) && value >= 0 ? value : null;
+const belongsToConversation = (candidate, check) => check.conversationProvider === candidate.provider && check.providerSession === candidate.session;
+const newestFirst = (a, b) => (b.finishedAt || b.startedAt || '').localeCompare(a.finishedAt || a.startedAt || '');
+const checkScope = check => check?.phase === 'min' ? 'Quick review of the changed work'
+  : check?.phase === 'full' ? 'Review of the changed work and its checks' : null;
+const newestAttemptFirst = (a, b) => (b.startedAt || b.finishedAt || '').localeCompare(a.startedAt || a.finishedAt || '') || newestFirst(a, b);
+
+// A description is not an executed check. Only recorded inspection coverage
+// supplies a count; historical rows without it remain unconfirmed.
+export function sqmResultPresentation(check) {
+  const checkCount = count(check?.checkCount);
+  const findingsCount = count(check?.findings);
+  const passedCheckCount = count(check?.passedCheckCount);
+  let state;
+  if (!check) state = 'not_run';
+  else if (check.state === 'running') state = 'running';
+  else if (['unavailable', 'interrupted'].includes(check.state) ||
+    check.state === 'failed' && (!['failed', 'preliminary_failed'].includes(check.outcome) ||
+      check.errorStage && check.errorStage !== 'evidence_upload')) state = 'unavailable';
+  else if (check.outcome === 'failed' || check.outcome === 'preliminary_failed' || findingsCount > 0) state = 'findings';
+  else if (check.state === 'verification_pending') state = 'needs_check';
+  else if (check.noApplicableChecks === true || checkCount === 0) state = 'no_applicable';
+  else if (check.state === 'completed' && check.outcome === 'passed' && check.phase === 'full' && checkCount > 0 &&
+    check.inspectionStatus === 'verified' && passedCheckCount === checkCount) state = 'passed';
+  else state = 'unconfirmed';
+  return { state, checkCount, passedCheckCount, inspectionStatus: check?.inspectionStatus || null, findingsCount, icon: state === 'passed' ? 'check' : state === 'findings' || state === 'needs_check' ? 'attention' : 'neutral',
+    checkedAt: check?.finishedAt || check?.startedAt || null, evidenceKind: checkCount === null ? null : 'static_check',
+    canRetry: state === 'unavailable' };
+}
+
+// The latest result lane includes unavailable/interrupted attempts. Keep the
+// historical recorded-results list below backwards compatible; hiding a failed
+// attempt there must not make the current lane display an older success.
+export function conversationSqmResult(candidate, checks) {
+  const latest = checks.filter(check => belongsToConversation(candidate, check)).sort(newestAttemptFirst)[0];
+  return { ...sqmResultPresentation(latest), id: latest?.key || null,
+    // Unavailable attempts are absent from the legacy history list. Retain
+    // their observed detail metadata without deriving counts from description.
+    checked: Array.isArray(latest?.checked) ? [...latest.checked] : null,
+    scope: checkScope(latest) };
+}
+
 // Never associate by repository or the AI that executed an analysis. A result
 // belongs under a conversation only when the original provider/session match.
 export function conversationSqmChecks(candidate, checks) {
-  return checks.filter(check => check.conversationProvider === candidate.provider && check.providerSession === candidate.session &&
-    !['unavailable', 'interrupted'].includes(check.state) && (check.state !== 'failed' || ['failed', 'preliminary_failed'].includes(check.outcome) && (!check.errorStage || check.errorStage === 'evidence_upload'))).sort((a, b) => (b.finishedAt || b.startedAt || '').localeCompare(a.finishedAt || a.startedAt || '')).slice(0, 5).map(check => ({
+  return checks.filter(check => belongsToConversation(candidate, check) &&
+    !['unavailable', 'interrupted'].includes(check.state) && (check.state !== 'failed' || ['failed', 'preliminary_failed'].includes(check.outcome) && (!check.errorStage || check.errorStage === 'evidence_upload'))).sort(newestFirst).slice(0, 5).map(check => ({
     id: check.key, state: check.state, checkedAt: check.finishedAt || check.startedAt,
-    scope: check.phase === 'min' ? 'Quick review of the changed work' : 'Review of the changed work and its checks',
+    scope: checkScope(check),
     result: check.state === 'running' ? 'Checking this work now.' : check.state === 'verification_pending'
       ? 'Some checks still need a person to confirm the result.' : check.outcome === 'preliminary_failed'
         ? 'The quick review found issues that need attention.' : check.outcome === 'failed' ? 'The review found issues that need attention.' : check.outcome === 'passed'
           ? check.noApplicableChecks ? 'No applicable checks were recorded for this work.' : check.phase === 'min' ? 'The quick review found no blocking issues.' : 'The recorded checks passed.' : 'The review finished. Open the recorded result for its coverage.',
     checked: check.checked || [], findings: check.findings ?? null,
+    presentation: sqmResultPresentation(check),
   }));
 }

package/src/session-supervision/stop-notifications.js

@@ -1,29 +1,55 @@
 import { createHash } from 'node:crypto';
-import { deliveryStop } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { repairNotificationAuthority } from './notification-authority.js';
+import { deliveryStop, pendingAcceptance } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 
-const pendingManualChecks = run => (run.managed.acceptanceCriteria || []).filter(item =>
-  item.check?.type === 'manual' && !Object.hasOwn(run.managed.verified || {}, item.id));
+const knownAcceptance = run => Array.isArray(run?.managed?.acceptanceCriteria) && run.managed.acceptanceCriteria.length > 0 &&
+  run.managed.acceptanceCriteria.every(item => typeof item?.id === 'string' && item.id && ['manual', 'semantic', 'file_exists', 'file_contains', 'file_equals'].includes(item.check?.type)) &&
+  new Set(run.managed.acceptanceCriteria.map(item => item.id)).size === run.managed.acceptanceCriteria.length &&
+  run.managed.verified && typeof run.managed.verified === 'object' && !Array.isArray(run.managed.verified);
+const completionEvidence = run => run.managed.acceptanceCriteria.every(item => {
+  const proof = run.managed.verified[item.id];
+  return proof && ['user', 'user_attestation', 'file_exists', 'file_contains', 'file_equals', 'independent_codex_session', 'independent_claude_review'].includes(proof.source) &&
+    Number.isFinite(proof.checkedAt) && proof.checkedAt > 0 && (!Object.hasOwn(proof, 'passed') || proof.passed === true) &&
+    !['failed', 'error', 'unverified', 'not_run'].includes(proof.status);
+});
+const pendingManualChecks = run => knownAcceptance(run) ? pendingAcceptance(run).filter(item => item.check === 'manual' && item.id !== 'enrollment') : [];
+const identity = value => typeof value === 'string' && value.length > 0 && value.length <= 4000 && !/[\u0000-\u001f\u007f]/u.test(value);
 
 // Auto-continue works while nobody is watching, so a person must learn when it
 // stops. Map a stopped run to a notification kind; the native window owns copy.
 export function stopNotificationKind(run, now = Date.now()) {
-  if (!run?.managed?.autoContinueEpoch && !run?.managed?.repairRequest) return null;
+  if (!run?.managed?.autoContinueEpoch && !repairNotificationAuthority(run)) return null;
   if (run.stopReason?.actor === 'user') return null;
   // The clock keeps aging while paused; the persisted human decision takes
   // precedence over a threshold that was reached only after that decision.
   if (run.state === 'paused') return /^(Paused by user\.|Automatic continuation paused by user\.|User interrupted the provider\.|Stopped by user\.)$/.test(run.reason || '') ? null : deliveryStop(run, now) ? 'paused' : null;
   if (run.state === 'auto_resuming' && !run.managed.resumeLease?.owner) return 'needs_decision';
+  if (run.state === 'blocked' && run.managed.controllerDecisionWait && !run.providerRequest) return null;
   if (run.state === 'blocked') return run.blocker === 'external_dependency' || run.managed.dependencyWait ? null : 'needs_decision';
   if (run.state === 'verification_pending') return pendingManualChecks(run).length ? 'needs_decision' : null;
   if (run.state === 'recovery_required' && run.managed.autoRecovery !== true) return 'needs_decision';
   if (run.state === 'failed' || run.state === 'budget_exhausted') return 'failed';
-  if (run.state === 'completed') return 'finished';
+  if (run.state === 'completed') return knownAcceptance(run) && pendingAcceptance(run).length === 0 && completionEvidence(run) ? 'finished' : null;
   return null;
 }
 
+// Shared by source events and read-only desktop projection. This opaque value
+// binds a stopped continuation's epoch without exposing its private lease data.
+export function stopNotificationId(record, kind) {
+  const run = record?.run;
+  if (!['needs_decision', 'failed', 'paused', 'finished'].includes(kind) ||
+      !['codex', 'claude'].includes(record?.provider) || !identity(record?.session) ||
+      !identity(run?.id) || !identity(run?.managed?.taskId)) return null;
+  const request = run.managed.pendingApproval || run.managed.understandingQuestion;
+  const criterionIds = run.state === 'verification_pending' ? pendingManualChecks(run).map(item => item.id).sort() : [];
+  return createHash('sha256').update(JSON.stringify([record.provider, record.session, run.managed.taskId,
+    run.id, run.managed.autoContinueEpoch, kind, run.blocker || null, request?.id || null, run.providerRequest?.id || null,
+    run.managed.userQuestion || null, criterionIds, repairNotificationAuthority(run)?.id || null])).digest('hex').slice(0, 32);
+}
+
 // The first observation is a baseline: restarting SIMY must not replay alerts
 // for runs that stopped earlier. Each distinct stop is announced once.
-export function createStopNotifier({ emit, now = Date.now } = {}) {
+export function createStopNotifier({ hostId, emit, now = Date.now } = {}) {
   // Retain one stop fingerprint per task for this process. A temporarily empty
   // discovery result must not turn the same historical stop into a new alert.
   const seen = new Map();
@@ -34,7 +60,11 @@ export function createStopNotifier({ emit, now = Date.now } = {}) {
         if (record.providerArchived || record.localHidden) continue;
         const run = record?.run;
         const kind = stopNotificationKind(run, now());
-        const key = JSON.stringify([record.provider, record.session, run?.managed?.taskId]);
+        // hostId comes from the record-reader's verified connection, never a
+        // guessed alias or a provider frame. Unknown legacy identities stay quiet.
+        if (!identity(hostId) || !['codex', 'claude'].includes(record.provider) || !identity(record.session) ||
+          !identity(run?.id) || !identity(run?.managed?.taskId)) continue;
+        const key = JSON.stringify([hostId, record.provider, record.session, run.managed.taskId]);
         if (!kind) {
           if (run?.state === 'active' || run?.state === 'auto_resuming') seen.delete(key);
           continue;
@@ -42,14 +72,15 @@ export function createStopNotifier({ emit, now = Date.now } = {}) {
         // Revisions and generated summaries change during maintenance without
         // creating a new human task. Only a different stop/explicit request does.
         const request = run.managed.pendingApproval || run.managed.understandingQuestion;
-        const id = createHash('sha256').update(JSON.stringify([record.provider, record.session, run.managed.taskId,
-          run.id, run.managed.autoContinueEpoch, kind, run.blocker || null, request?.id || null,
-          run.managed.userQuestion || null])).digest('hex').slice(0, 32);
+        const criterionIds = run.state === 'verification_pending' ? pendingManualChecks(run).map(item => item.id).sort() : [];
+        const id = stopNotificationId(record, kind);
         if (seen.get(key) === id) continue;
         seen.set(key, id);
         const detail = request?.text || request?.summary || run.managed.userQuestion ||
           (run.state === 'verification_pending' ? pendingManualChecks(run).map(item => item.description).filter(Boolean).join('; ') : null);
-        if (!baseline) emit({ type: 'notify', id, kind, provider: record.provider, session: record.session,
+        if (!baseline) emit({ type: 'notify', id, kind, hostId, provider: record.provider, session: record.session,
+          runId: run.id, taskId: run.managed.taskId,
+          ...(repairNotificationAuthority(run) ? { repairRequestId: repairNotificationAuthority(run).id } : {}), ...(criterionIds.length ? { criterionIds } : {}),
           objective: String(run.objective || '').slice(0, 200),
           ...(detail ? { detail: String(detail).slice(0, 500) } : {}) });
       }

package/src/session-supervision/work-state.js

@@ -1,13 +1,71 @@
 // Display-only state. Tracking/auto-continue consent is never evidence of execution.
 export const WORK_STATE_TTL_MS = 45_000;
 const freshObservation = (checkedAt, now) => Number.isFinite(checkedAt) && checkedAt <= now && now - checkedAt <= WORK_STATE_TTL_MS;
+// Ownership is a presentation axis, independent of the precise work state.
+// A saved preference, resumable task or next-step string cannot prove that a
+// controller can execute it (notably an ended Claude Stop-hook conversation).
+const OWNERSHIP_ORDER = { needs_you: 0, ai_working: 1, simy_continues: 2, waiting: 3, done: 4, archived: 5 };
+function scheduledContinuation(candidate, run) {
+  if (candidate.dispatchReadiness?.state === 'blocked') return false;
+  const managed = run?.managed && typeof run.managed === 'object' ? run.managed : {};
+  if (run?.pendingApproval || managed.pendingApproval || run?.understandingQuestion || managed.understandingQuestion ||
+      managed.userQuestion || run?.dependencyWait || managed.dependencyWait || run?.executionUncertain || managed.executionUncertain ||
+      managed.nativeWait || managed.purpose?.nativeBoundary || run?.providerWarning || managed.providerWarning ||
+      candidate.decisionRequest?.kind === 'approval' || candidate.decisionRequest?.kind === 'question') return false;
+  // Acceptance-pending is a stopped execution lane. A controller capability or
+  // a resumable next-step string does not schedule another provider turn.
+  if (run?.state === 'verification_pending') return false;
+  if (['starting', 'recovering'].includes(candidate.autoContinueStatus) && candidate.autoContinue === true) return true;
+  if (['queued', 'analyzing'].includes(candidate.analysis?.state)) return true;
+  const autoRecovery = run?.autoRecovery === true || managed.autoRecovery === true;
+  if (autoRecovery && ['recovery_required', 'auto_resuming'].includes(run?.state)) return true;
+  // This channel has an actual host controller, unlike a passive Stop hook.
+  const controlled = candidate.provider === 'codex' &&
+    (run?.capability === 'codex_app_server' || managed.resumeChannel === 'codex_app_server');
+  return controlled && candidate.autoContinue === true && candidate.dispatchReadiness?.state === 'ready' &&
+    candidate.autoContinueStatus === 'supervising' && run?.state === 'active';
+}
+
+function onlyManualAcceptancePending(run) {
+  if (run?.state !== 'verification_pending') return false;
+  if (Array.isArray(run.pendingAcceptance)) return run.pendingAcceptance.length > 0 && run.pendingAcceptance.every(item => item.check === 'manual');
+  const managed = run.managed;
+  if (!managed || typeof managed !== 'object' || !Array.isArray(managed.acceptanceCriteria) || managed.independentReviewRequired) return false;
+  const pending = managed.acceptanceCriteria.filter(item => !Object.hasOwn(managed.verified || {}, item.id));
+  return pending.length > 0 && pending.every(item => item.check?.type === 'manual');
+}
+
+export function sessionWorkOwnership(work, candidate = {}, run) {
+  let ownership;
+  switch (work?.state) {
+    case 'running': ownership = 'ai_working'; break;
+    case 'approval': case 'question': case 'blocked': case 'error': case 'stopped': ownership = 'needs_you'; break;
+    case 'starting': case 'recovering':
+      ownership = scheduledContinuation(candidate, run) ? 'simy_continues' : 'waiting'; break;
+    case 'checking':
+      ownership = onlyManualAcceptancePending(run) ? 'needs_you' : scheduledContinuation(candidate, run) ? 'simy_continues' : 'waiting'; break;
+    case 'unfinished':
+      ownership = scheduledContinuation(candidate, run) ? 'simy_continues' : 'needs_you'; break;
+    case 'completed': case 'idle': ownership = 'done'; break;
+    case 'archived': ownership = 'archived'; break;
+    case 'waiting': case 'review': case 'changes_requested': case 'pr_unknown': case 'unknown': case 'family_unfinished':
+      ownership = 'waiting'; break;
+    // Future and incomplete states never manufacture a decision or execution.
+    default: ownership = 'waiting';
+  }
+  return { ownership, ownershipReason: work?.reason || '' };
+}
+
 export function sessionWorkState(candidate, run, { now = Date.now(), provider } = {}) {
   const checkedAt = candidate.observation?.observedAt ?? null;
   const stale = !freshObservation(checkedAt, now);
   const fetchFailed = provider?.discovery === 'unavailable';
   const freshness = { checkedAt, stale, fetchFailed };
-  const result = (state, label, reason, nextAction = null, needsAttention = false) =>
-    ({ state, label, reason, nextAction, needsAttention, ...freshness });
+  const result = (state, label, reason, nextAction = null, needsAttention = false) => {
+    const work = { state, label, reason, nextAction, needsAttention, ...freshness };
+    const ownership = sessionWorkOwnership(work, candidate, run);
+    return { ...work, ...ownership, needsAttention: ownership.ownership === 'simy_continues' ? false : needsAttention || onlyManualAcceptancePending(run) };
+  };
   if (candidate.archived || candidate.localHidden) return result('archived', 'アーカイブ済み', candidate.localHidden ? 'この一覧だけで非表示にしています。' : '元の会話がアーカイブされています。', 'restore');
   let nativeRuntimeUnknown = false;
   if (Object.hasOwn(candidate.observation || {}, 'activeFlags')) {
@@ -18,6 +76,10 @@ export function sessionWorkState(candidate, run, { now = Date.now(), provider }
   }
   // Never display a cached active flag as a live observation after a sleep/outage.
   if (!nativeRuntimeUnknown && !stale && !fetchFailed && candidate.isRunning === true) return result('running', 'AIが対応中', '元のAIが実行中です。');
+  if (run?.state === 'blocked' && run.providerRequest?.source === 'provider_hook') {
+    const question = run.providerRequest.kind === 'question';
+    return result(question ? 'question' : 'approval', question ? '回答待ち' : '承認待ち', '元のAIが現在の権限要求・質問への対応を待っています。', 'open_original', true);
+  }
   const approval = run?.pendingApproval || run?.managed?.pendingApproval;
   const question = run?.understandingQuestion || run?.managed?.understandingQuestion || run?.managed?.userQuestion;
   const phase = run?.phase || run?.managed?.phase;
@@ -28,6 +90,14 @@ export function sessionWorkState(candidate, run, { now = Date.now(), provider }
     return result('approval', '承認待ち', candidate.decisionRequest?.context || '実行する操作の確認が必要です。', 'review_approval', true);
   if (question || phase === 'needs_clarification' || candidate.analysis?.state === 'needs_user' || candidate.decisionRequest?.kind === 'question')
     return result('question', '回答待ち', candidate.decisionRequest?.question || '続けるために回答が必要です。', 'answer', true);
+  // Saved consent is not execution: name the real dispatch blocker rather than
+  // presenting a fenced conversation as waiting for its AI.
+  if (candidate.autoContinue === true && candidate.dispatchReadiness?.state === 'blocked' && !['completed', 'stopped'].includes(run?.state))
+    return result('blocked', '自動継続を送信できません', candidate.autoContinueReason || '自動継続はオンですが、作業を送信できません。',
+      candidate.dispatchReadiness.code === 'update_recovery_required' ? 'update_reconnect' : candidate.dispatchReadiness.code === 'writer_reconnect_required' ? 'reconnect_original' : 'open_original', true);
+  if (run?.state === 'verification_pending' &&
+      (onlyManualAcceptancePending(run) || candidate.autoContinueStatus === 'needs_user'))
+    return result('unfinished', '残りの作業あり', '実際の結果の確認が残っています。', 'open_original', true);
   if (candidate.autoContinue === true && ['starting', 'recovering'].includes(candidate.autoContinueStatus))
     return result(candidate.autoContinueStatus, candidate.autoContinueStatus === 'starting' ? '自動継続を準備中' : '自動復旧中',
       candidate.autoContinueReason || '自動継続はオンで保存されています。');
@@ -37,7 +107,10 @@ export function sessionWorkState(candidate, run, { now = Date.now(), provider }
   if (['failed', 'recovery_required', 'budget_exhausted'].includes(run?.state) || candidate.analysis?.state === 'failed' || candidate.autoContinueStatus === 'error')
     return result('error', '対応が必要', run?.reason || '作業が中断されています。', run?.canResume || run?.canReplan ? 'resume' : 'open_original', true);
   if (run?.dependencyWait || run?.managed?.dependencyWait) return result('waiting', '依存条件待ち', '条件が変わるまで待機します。');
-  if (['blocked', 'verification_pending', 'reported_done', 'paused'].includes(run?.state) || candidate.analysis?.state === 'continue' && candidate.autoContinue !== true || candidate.autoContinueStatus === 'needs_user')
+  if (['verification_pending', 'reported_done'].includes(run?.state))
+    return result('checking', '完了状態を確認中', '実際の結果の確認が残っています。');
+  if (run?.state === 'blocked' && candidate.autoContinueStatus === 'watching') return result('checking', 'AIが状況確認中', candidate.autoContinueReason || '既存の許可と実行条件を確認しています。');
+  if (['blocked', 'paused'].includes(run?.state) || candidate.analysis?.state === 'continue' && candidate.autoContinue !== true || candidate.autoContinueStatus === 'needs_user')
     return result('unfinished', '残りの作業あり', run?.reason || candidate.analysis?.reason || '未完了の作業を再開できます。', 'resume', true);
   if (nativeRuntimeUnknown) return result('unknown', '実行状態を確認できません', '元のAIの最新の実行状態を確認できません。', 'refresh');
   const prs = candidate.pullRequests || [];
@@ -55,13 +128,22 @@ export function sessionWorkState(candidate, run, { now = Date.now(), provider }
 
 export function compareSessionWork(a, b) {
   const priority = item => item.workState?.state === 'running' ? 0 : item.workState?.needsAttention ? 1 : 2;
-  return priority(a) - priority(b) || (b.lastActivityAt || 0) - (a.lastActivityAt || 0) || `${a.provider}:${a.session}`.localeCompare(`${b.provider}:${b.session}`);
+  const group = item => item.workState?.ownership || sessionWorkOwnership(item.workState, item).ownership;
+  const groupPriority = item => OWNERSHIP_ORDER[group(item)] ?? OWNERSHIP_ORDER.waiting;
+  const paused = item => group(item) === 'needs_you' && item.workState?.state === 'stopped' ? 1 : 0;
+  return groupPriority(a) - groupPriority(b) || paused(a) - paused(b) || priority(a) - priority(b) ||
+    (b.lastActivityAt || 0) - (a.lastActivityAt || 0) || `${a.provider}:${a.session}`.localeCompare(`${b.provider}:${b.session}`);
 }
 
 // Completion belongs to the whole known family. Idle history alone does not
 // create a human task; positively unfinished descendants do prevent completion.
 export function reconcileFamilyCompletion(sessions) {
   const byKey = new Map(sessions.map(item => [`${item.provider}:${item.session}`, item]));
+  // Reconciliation may run over a cached frame after children have expired.
+  // Derive the family owner again rather than retaining yesterday's activity.
+  for (const item of sessions) if (item.workState?.state === 'family_unfinished') {
+    item.workState = { ...item.workState, ownership: 'waiting', ownershipReason: item.workState.reason, ownershipObservedAt: null };
+  }
   for (const child of sessions) {
     if (['idle', 'completed', 'archived'].includes(child.workState?.state)) continue;
     const seen = new Set(); let parent = child.parentSession;
@@ -71,7 +153,19 @@ export function reconcileFamilyCompletion(sessions) {
       seen.add(key); const ancestor = byKey.get(key);
       if (!ancestor) break;
       if (ancestor.workState?.state === 'completed') ancestor.workState = { ...ancestor.workState,
-        state: 'family_unfinished', label: '子の作業が未完了', reason: '関連する子の作業が残っています。', nextAction: 'review_children', needsAttention: false };
+        state: 'family_unfinished', label: '子の作業が未完了', reason: '関連する子の作業が残っています。', nextAction: 'review_children', needsAttention: false,
+        ownership: 'waiting', ownershipReason: '関連する子の作業が残っています。' };
+      if (ancestor.workState?.state === 'family_unfinished') {
+        const childOwner = child.workState?.ownership || sessionWorkOwnership(child.workState, child).ownership;
+        const currentOwner = ancestor.workState.ownership;
+        const childObservedAt = child.workState.ownershipObservedAt ?? child.workState.checkedAt;
+        if ((OWNERSHIP_ORDER[childOwner] ?? OWNERSHIP_ORDER.waiting) < (OWNERSHIP_ORDER[currentOwner] ?? OWNERSHIP_ORDER.waiting) ||
+            childOwner === 'ai_working' && currentOwner === childOwner && Number.isFinite(childObservedAt) &&
+            childObservedAt > (ancestor.workState.ownershipObservedAt ?? -Infinity)) {
+          ancestor.workState = { ...ancestor.workState, ownership: childOwner,
+            ownershipObservedAt: childOwner === 'ai_working' ? childObservedAt : null };
+        }
+      }
       parent = ancestor.parentSession;
     }
   }
@@ -82,8 +176,14 @@ export function reconcileFamilyCompletion(sessions) {
 // reader is blocked. Expire live labels there too, without losing pending work.
 export function expireSessionWorkState(candidate, now = Date.now()) {
   const previous = candidate.workState;
+  // Family activity inherits the child's observation clock, not the parent's.
+  if (previous?.state === 'family_unfinished' && previous.ownership === 'ai_working' &&
+      !freshObservation(previous.ownershipObservedAt ?? previous.checkedAt, now)) {
+    return { ...candidate, workState: { ...previous, ownership: 'waiting', ownershipReason: previous.reason, stale: true } };
+  }
   if (!previous || freshObservation(previous.checkedAt, now)) return candidate;
   if (previous.state !== 'running') return previous.stale ? candidate : { ...candidate, workState: { ...previous, stale: true } };
   return { ...candidate, workState: { ...previous, state: 'unknown', label: '実行状態を確認できません',
-    reason: '最終確認後の実行状態は不明です。', nextAction: 'refresh', needsAttention: false, stale: true } };
+    reason: '最終確認後の実行状態は不明です。', nextAction: 'refresh', needsAttention: false, stale: true,
+    ownership: 'waiting', ownershipReason: '最終確認後の実行状態は不明です。' } };
 }

package/src/sqm/agent-skill.js

@@ -8,7 +8,7 @@ import { hookRuntimeCommand } from "../hook-runtime.js";
 import { inspectClaudePlugin, installClaudePlugin } from "./claude-plugin.js";
 
 export const SQM_AGENT_SKILL_ID = "simy-sqm-pr-check";
-export const SQM_AGENT_SKILL_VERSION = "3.3.0";
+export const SQM_AGENT_SKILL_VERSION = "3.4.0";
 export const SIMY_CODEX_PLUGIN_ID = "simy";
 export const SIMY_CODEX_PLUGIN_VERSION = "0.1.0";
 
@@ -22,12 +22,12 @@ const LEGACY_SKILL_DIGEST = "c9ab46e855280196dbc93fd36ba849418e0c4e500dd6e4b7b03
 
 const SKILL_CONTENT = `---
 name: ${SQM_AGENT_SKILL_ID}
-description: Run SIMY Software Quality Monitor checks for PR work when the user explicitly invokes @simy, this skill, or asks to use SQM. Ordinary PR creation or git push alone does not activate this skill.
+description: Run SIMY Software Quality Monitor checks for PR work when the user asks @simy for a quality check, invokes this SQM skill, or asks to use SQM. Conversation continuation uses the separate continue entry. Ordinary PR creation or git push alone does not activate this skill.
 ---
 
 # SIMY SQM PR check
 
-Apply this workflow only when the user has explicitly selected \`@simy\`, invoked this skill, or requested SQM for the current task. A quoted mention, repository organization, installed plugin, or ordinary request to create a PR is not opt-in. Honor a later request to stop using SQM.
+Apply this workflow only when the user has explicitly requested quality checks with \`@simy\`, invoked this SQM skill, or requested SQM for the current task. A request to start or continue the original task uses SIMY's \`continue\` entry; selecting that entry does not request SQM. A quoted mention, repository organization, installed plugin, or ordinary request to create a PR is not opt-in. Honor a later request to stop using SQM.
 
 Without opt-in, continue the requested work without running SQM or making it a prerequisite. You may briefly offer SQM if useful; do not delay the work waiting for an optional answer. Follow any independent repository checks required by the project.