@awak-app/simy-cli 0.7.31 → 0.7.33

package/src/desktop-host.js

@@ -1,3 +1,5 @@
+import { createDesktopFrameWriter } from './desktop-frame-writer.js';
+import { boundedDiscovery } from './session-supervision/progressive-discovery.js';
 import { createClaudeDesktopArchiveController } from './session-supervision/claude-desktop-archive.js';
 import { createClaudeDesktopNativeAdapter } from './session-supervision/claude-desktop-native.js';
 import { applyControllerExecutionContext } from './session-supervision/execution-context.js';
@@ -8,6 +10,7 @@ import { createNotificationJournal } from './session-supervision/notification-jo
 import { createRemoteMetadata } from './session-supervision/remote-metadata.js';
 import { projectControllerCompletion } from './native-development-report-completion.js';
 import { remoteOperationFailure } from './session-supervision/remote-errors.js';
+import { updateConnectionEnvironment, sameUpdateIdentity } from './update-connection.js';
 import { copyDesktopText } from './desktop-clipboard.js';
 import { createRemoteHostManager, allowedActions, controllerPolicyActions } from './session-supervision/remote-hosts.js';
 import { manualAcceptanceCommand, manualAcceptanceContinuation } from './session-supervision/manual-acceptance-command.js';
@@ -40,7 +43,7 @@ import { controlDelivery, verifyDelivery, decideManualAcceptance, createRecordRe
 import { createManagedSupervisor } from "./delivery-hooks/supervisor.js";
 import { createActionAssociationHost } from "./session-supervision/action-association-host.js";
 import { createStopNotifier } from "./session-supervision/stop-notifications.js";
-import { AutoContinueUnavailableError, answerSession, continueSession, followupSession, resumeSession, discoverSessions, enrollSession, monitorSession, trackSession, setSessionAutoContinue } from "./session-supervision/index.js";
+import { AutoContinueUnavailableError, answerSession, continueSession, followupSession, resumeSession, discoverSessions, projectSessionAutoContinue, enrollSession, monitorSession, trackSession, setSessionAutoContinue, saveSessionAutoContinuePreference } from "./session-supervision/index.js";
 import { renewClaudeSessionOwner } from './session-supervision/claude-owner-renewal.js';
 import { createContinuationAnalysisManager } from "./session-supervision/analysis-manager.js";
 import { analyzeContinuation, readContinuationContext } from "./session-supervision/continuation-analysis.js";
@@ -149,35 +152,7 @@ function desktopActionError(action, error) {
   return "Action could not finish. Refresh the status and try again.";
 }
 
-// Status snapshots are replaceable; command receipts and stop notifications are
-// not. Never enqueue periodic snapshots behind a native reader that has paused.
-// Control frames retain the stream's FIFO order and never wait for GUI drain.
-export function createDesktopFrameWriter(output) {
-  let blocked = false, pendingStatus = null, statusClosed = false;
-  const drain = () => {
-    blocked = false;
-    const frame = pendingStatus;
-    pendingStatus = null;
-    if (!statusClosed && frame !== null) write(frame, true);
-  };
-  const write = (frame, isStatus = false) => {
-    if (isStatus && statusClosed) return;
-    if (isStatus && blocked) { pendingStatus = frame; return; }
-    // A control frame must not be followed by a snapshot captured before it.
-    // The next authorized projection will publish fresh state.
-    if (!isStatus) pendingStatus = null;
-    const accepted = output.write(frame);
-    if (accepted === false && !blocked && !statusClosed) {
-      blocked = true;
-      output.once('drain', drain);
-    }
-  };
-  return { write, close() {
-    statusClosed = true;
-    pendingStatus = null;
-    output.removeListener('drain', drain);
-  } };
-}
+export { createDesktopFrameWriter } from './desktop-frame-writer.js';
 
 export async function startDesktopHost({ input = process.stdin, output = process.stdout, env = process.env,
   updatePackageRoot, dependencies = {}, exit = (code) => process.exit(code) } = {}) {
@@ -286,6 +261,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const remoteMetadata = createRemoteMetadata({ root, webOrigin, onChange: () => { if (!closed && !relay) setImmediate(() => void publish().catch(() => {})); } });
   let teamThreads;
   let currentAccess = { state: 'checking', organizationId: null, organizationName: null };
+  let updateIdentityRevision = 0;
   let preferenceScope = null, emailSync = null, emailSyncRetryAt = 0;
   let nativeDevelopmentReports = { state: 'loading', enrollments: [] };
   let nativeDevelopmentReportsScope = null;
@@ -304,6 +280,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     const previouslyReady = desktopAccessReady(currentAccess);
     currentAccess = access || { state: 'unavailable', organizationId: null, organizationName: null };
     if (previousScope !== accessScope(currentAccess) || previouslyReady && !desktopAccessReady(currentAccess)) {
+      updateIdentityRevision++;
       // A privilege loss also invalidates consent reads, even when the
       // credential/organization revision itself did not change.
       nativeDevelopmentReports = { state: 'loading', enrollments: [] };
@@ -317,7 +294,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       statisticsCache.clear();
       activeStatisticsRead?.controller.abort();
       explicitAnalyses.clear();
-      discoveryController?.abort();
+      discoveryController?.abort(); enrichmentController?.abort();
       sessionRefreshAgain = Boolean(sessionRefresh) && desktopAccessReady(currentAccess);
       for (const item of sessionStatus.sessions) automaticContinuation?.revoke(item.provider, item.session);
       sessionStatus = { sessions: [], providers: {}, refreshedAt: null, initialLoading: true }; sessionRefreshedAt = 0;
@@ -562,12 +539,50 @@ export async function startDesktopHost({ input = process.stdin, output = process
   let commands;
   let sessionStatus = { sessions: [], providers: { codex: { discovery: "loading", reason: null }, claude: { discovery: "loading", reason: null } }, refreshedAt: null, initialLoading: true };
   let sessionRefresh = null, sessionRefreshedAt = 0, sessionRefreshAgain = false, discoveryController = null, discoveryStopped = false;
+  let enrichmentController = null, sessionEnrichment = null;
+  let catalogAnalysisJob = null, catalogAnalysisAgain = false;
+  const withCurrentSettings = (sessions, records) => {
+    const byKey = new Map(records.map(record => [`${record.provider}:${record.session}`, record]));
+    return sessions.map(candidate => projectSessionAutoContinue(candidate, byKey.get(`${candidate.provider}:${candidate.session}`)));
+  };
+  const refreshCatalogAnalysis = () => {
+    catalogAnalysisAgain = true;
+    if (catalogAnalysisJob) return catalogAnalysisJob;
+    const scope = accessScope(currentAccess), manager = analysisManager;
+    catalogAnalysisJob = Promise.resolve().then(async () => {
+      while (catalogAnalysisAgain) {
+        catalogAnalysisAgain = false;
+        const records = await recordReader.list();
+        if (closed || relay || discoveryStopped || manager !== analysisManager ||
+            !desktopAccessReady(currentAccess) || accessScope(currentAccess) !== scope || !coordinator.acceptsNewWork()) return;
+        await manager.update(analysisSessions(withCurrentSettings(sessionStatus.sessions, records)));
+      }
+    }).catch(() => {}).finally(() => {
+      catalogAnalysisJob = null;
+      if (catalogAnalysisAgain && !closed && !relay && !discoveryStopped) void refreshCatalogAnalysis();
+    });
+    return catalogAnalysisJob;
+  };
   const hasUnfinishedSessions = records => records.some(record => record.autoContinue === true || record.run && !TERMINAL.has(record.run.state)) ||
     sessionStatus.sessions.some(candidate => candidate.autoContinue === true || ['queued', 'analyzing'].includes(analysisManager.project(candidate).analysis?.state));
+  const discoveryDrains = new Set();
+  const trackDiscoveryDrain = operation => {
+    const settled = Promise.resolve(operation).then(() => {}, () => {});
+    discoveryDrains.add(settled);
+    void settled.then(() => discoveryDrains.delete(settled));
+  };
   const stopDiscovery = async ({ drain = false } = {}) => {
-    discoveryController?.abort();
+    discoveryController?.abort(); enrichmentController?.abort();
     sessionRefreshAgain = false;
-    if (drain && !dependencies.discoverSessions) await sessionRefresh;
+    if (drain) {
+      let timer;
+      try {
+        await Promise.race([
+          Promise.allSettled([sessionRefresh, sessionEnrichment, catalogAnalysisJob, ...discoveryDrains]),
+          new Promise((_, reject) => { timer = setTimeout(() => reject(Object.assign(new Error('Conversation discovery has not finished closing; runtime handoff was refused.'), { code: 'discovery_drain_incomplete' })), dependencies.discoveryDrainTimeoutMs ?? 4000); }),
+        ]);
+      } finally { clearTimeout(timer); }
+    }
   };
   let confirmedUpdateStop;
   const stopWorkForUpdate = () => confirmedUpdateStop ||= (async () => {
@@ -604,27 +619,59 @@ export async function startDesktopHost({ input = process.stdin, output = process
       const controller = discoveryController = new AbortController();
       const attempt = { id: randomUUID(), requestedAt: Date.now(), state: 'pending' };
       sessionStatus = { ...sessionStatus, discoveryAttempt: attempt };
-      sessionRefresh = Promise.resolve().then(() => { if (controller.signal.aborted) return null; return (dependencies.discoverSessions || discoverSessions)({ root: deliveryRoot, signal: controller.signal, includeArchived: true, includeSelectionCandidates: true, connectedProviders: PROVIDER_LINKS.filter(provider => providerLinks[provider].connected) }); })
+      enrichmentController?.abort();
+      const applyCatalog = async (value, sourceSignal = controller.signal) => {
+        if (closed || relay || controller.signal.aborted || sourceSignal.aborted || sessionStatus.discoveryAttempt?.id !== attempt.id) return;
+        const latestAccess = await accessSnapshot();
+        if (closed || relay || controller.signal.aborted || sourceSignal.aborted || sessionStatus.discoveryAttempt?.id !== attempt.id) return;
+        if (!desktopAccessReady(latestAccess) || accessScope(latestAccess) !== requestedScope) {
+          sessionRefreshAgain = desktopAccessReady(latestAccess); return;
+        }
+        const complete = new Set(value.completeProviders || (value.historyLoading === undefined ? PROVIDER_LINKS : []));
+        const merge = (previous, incoming) => {
+          const rows = new Map(previous.filter(item => !complete.has(item.provider)).map(item => [`${item.provider}:${item.session}`, item]));
+          for (const item of incoming || []) rows.set(`${item.provider}:${item.session}`, item);
+          return [...rows.values()];
+        };
+        sessionStatus = { ...sessionStatus, ...value,
+          sessions: linkedSessions(merge(sessionStatus.sessions, value.sessions)).sort(compareSessionWork),
+          selectionCandidates: merge(sessionStatus.selectionCandidates || [], value.selectionCandidates),
+          initialLoading: false, completeProviders: [...complete], discoveryAttempt: attempt };
+        sessionRefreshedAt = Date.now();
+        void publish().catch(() => {});
+        void refreshCatalogAnalysis();
+      };
+      sessionRefresh = boundedDiscovery(signal => (dependencies.discoverSessions || discoverSessions)({
+        root: deliveryRoot, signal, onDrain: trackDiscoveryDrain, includeArchived: true, includeSelectionCandidates: true,
+        connectedProviders: PROVIDER_LINKS.filter(provider => providerLinks[provider].connected),
+        timeoutMs: dependencies.discoveryTimeoutMs ?? 30_000,
+        onProgress: value => applyCatalog(value, signal),
+      }), { signal: controller.signal, timeoutMs: (dependencies.discoveryTimeoutMs ?? 30_000) + 1000, onDrain: dependencies.discoverSessions ? undefined : trackDiscoveryDrain })
         .then(async value => {
+          await applyCatalog(value);
           if (closed || relay || controller.signal.aborted) return;
-          const latestAccess = await accessSnapshot();
-          if (closed || relay || controller.signal.aborted) return;
-          if (!desktopAccessReady(latestAccess) || accessScope(latestAccess) !== requestedScope) {
-            await analysisManager.update([]);
-            sessionRefreshAgain = desktopAccessReady(latestAccess);
-            return;
-          }
-          const sessions = await observePullRequests(linkedSessions(value.sessions), { signal: controller.signal });
-          const afterObservation = await accessSnapshot();
-          if (controller.signal.aborted || !desktopAccessReady(afterObservation) || accessScope(afterObservation) !== requestedScope) {
-            await analysisManager.update([]); sessionRefreshAgain = desktopAccessReady(afterObservation); return;
-          }
-          if (coordinator.acceptsNewWork()) await analysisManager.update(analysisSessions(sessions));
-          if (controller.signal.aborted) return;
-          sessionStatus = { ...value, sessions, initialLoading: false,
-            discoveryAttempt: { ...attempt, state: 'succeeded', completedAt: Date.now() } }; sessionRefreshedAt = Date.now(); })
+          const failed = Object.values(value.providers || {}).some(provider => provider.discovery === 'unavailable');
+          sessionStatus = { ...sessionStatus, historyLoading: false,
+            discoveryAttempt: { ...attempt, state: failed ? 'failed' : 'succeeded', completedAt: Date.now() } };
+          // Publish before PR/network observation and queue maintenance. Neither
+          // operation owns the first usable catalog or the discovery promise.
+          void publish().catch(() => {});
+          const enrichment = enrichmentController = new AbortController();
+          const catalog = sessionStatus;
+          sessionEnrichment = boundedDiscovery(async signal => {
+            // Queue maintenance and PR checks are independent background work.
+            const queue = signal.aborted ? Promise.resolve() : refreshCatalogAnalysis();
+            const sessions = await observePullRequests(catalog.sessions, { signal });
+            const latestAccess = await accessSnapshot();
+            if (closed || relay || signal.aborted || !desktopAccessReady(latestAccess) || accessScope(latestAccess) !== requestedScope || sessionStatus !== catalog) return;
+            sessionStatus = { ...sessionStatus, sessions: linkedSessions(sessions) };
+            await queue;
+            if (!signal.aborted) void publish().catch(() => {});
+          }, { signal: enrichment.signal, timeoutMs: dependencies.enrichmentTimeoutMs ?? 10_000, onDrain: trackDiscoveryDrain })
+            .catch(() => {}).finally(() => { if (enrichmentController === enrichment) { enrichmentController = null; sessionEnrichment = null; } });
+        })
         .catch(() => { if (closed || relay || controller.signal.aborted) return; sessionStatus = { ...sessionStatus, initialLoading: false,
-          discoveryAttempt: { ...attempt, state: 'failed', completedAt: Date.now() },
+          historyLoading: false, discoveryAttempt: { ...attempt, state: 'failed', completedAt: Date.now() },
           providers: { codex: { discovery: "unavailable", reason: "Conversation discovery unavailable." }, claude: { discovery: "unavailable", reason: "Conversation discovery unavailable." } } }; sessionRefreshedAt = Date.now(); })
         .finally(() => { if (discoveryController === controller) discoveryController = null; sessionRefresh = null; if (sessionRefreshAgain && !closed && !relay) { sessionRefreshAgain = false; refreshSessions(true); }
           if (!closed) setImmediate(() => { void publish().catch(() => {}); }); });
@@ -639,7 +686,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     // Preference changes may use the observation already displayed by the UI.
     // Execution still takes the fresh-discovery path and rechecks opt-in epochs.
     const matches = item => item.provider === command.provider && item.session === command.session;
-    let candidate = preferObserved ? sessionStatus.sessions.find(matches) : null;
+    let candidate = preferObserved || reuseDiscovery ? sessionStatus.sessions.find(matches) : null;
     if (!candidate) {
       // Analysis joins an existing discovery instead of scheduling a second
       // full scan. Enrollment retains its fresh-discovery boundary.
@@ -650,6 +697,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       candidate = sessionStatus.sessions.find(matches);
     }
     if (!candidate) throw new Error('This conversation is unavailable; refresh its provider.');
+    candidate = projectSessionAutoContinue(candidate, await readRecord(deliveryRoot, command.provider, command.session));
     await authorizeProvider(command.provider, scope, link.epoch);
     const selected = { ...candidate };
     selectedScopes.set(selected, scope);
@@ -668,7 +716,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       phase = "save_disconnect";
       if (!connected) providerLinks = await writeProviderLink(root, provider, false);
       if (activeStatisticsRead?.key.startsWith(`${provider}:`)) activeStatisticsRead.controller.abort();
-      discoveryController?.abort();
+      discoveryController?.abort(); enrichmentController?.abort();
       sessionRefreshAgain = false;
       for (const item of sessionStatus.sessions.filter(item => item.provider === provider)) automaticContinuation?.revoke(provider, item.session);
       for (const key of explicitAnalyses) if (key.startsWith(`${provider}:`)) explicitAnalyses.delete(key);
@@ -697,7 +745,10 @@ export async function startDesktopHost({ input = process.stdin, output = process
     } finally { providerLinkBusy.delete(provider); await publish(); }
   };
   const makeAutomaticContinuation = () => createAutomaticContinuation({ root: join(root, 'delivery-hooks'),
-    getManager: () => analysisManager, selectCandidate: selectedSession,
+    getManager: () => analysisManager,
+    // Fresh exact context and enrollment still validate the provider below;
+    // unrelated history pagination is not an execution-readiness boundary.
+    selectCandidate: candidate => selectedSession(candidate, { reuseDiscovery: true }),
     readSetting: dependencies.readSessionAutoContinue,
     readContext: dependencies.readContinuationContext || readContinuationContext,
     enroll: guardedEnroll, beforeEnroll: candidate => authorizeProvider(candidate.provider, selectedScopes.get(candidate), selectedLinkEpochs.get(candidate)),
@@ -788,7 +839,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const packageInfo = dependencies.packageInfo || await readCliPackageInfo();
   diagnostics.write(`desktop starting version=${packageInfo.version} pid=${process.pid} role=${candidate ? "update-candidate" : "supervisor"}`);
   const makeAnalysisManager = () => (dependencies.createAnalysisManager || createContinuationAnalysisManager)({
-    root: join(root, 'session-analysis'), analyze: async (...args) => {
+    root: join(root, 'session-analysis'), waitNoticeAfterMs: dependencies.analysisWaitNoticeAfterMs, analyze: async (...args) => {
       const scope = await authorizeWork();
       const [candidate, options] = args;
       const link = await requireProviderLink({ root: deliveryRoot, provider: candidate.provider });
@@ -948,9 +999,12 @@ export async function startDesktopHost({ input = process.stdin, output = process
           ...(readbackOrder ? { readbackId: acceptanceReadbackId, readbackOrder } : {}) } };
       });
       await actionAssociations.decorate(status.deliveryHooks, projection);
-      const discovery = refreshSessions();
-      if (coordinator.acceptsNewWork()) automaticContinuation?.tick(discovery.sessions);
-      const sessions = discovery.sessions.map(candidate => automaticContinuation.project(analysisManager.project(candidate)));
+      const catalog = refreshSessions();
+      const discovery = { ...catalog, sessions: withCurrentSettings(catalog.sessions, records) };
+      if (coordinator.acceptsNewWork()) automaticContinuation?.tick(discovery.sessions.filter(candidate => Array.isArray(discovery.completeProviders) && discovery.completeProviders.includes(candidate.provider)));
+      let sessions = discovery.sessions.map(candidate => automaticContinuation.project(analysisManager.project(candidate)));
+      await analysisManager.observeContinuationWaits?.(sessions);
+      sessions = sessions.map(candidate => analysisManager.projectContinuationWait?.(candidate) || candidate);
       await actionAssociations.decorateSessions?.(sessions, projection);
       const stateRecordsBySession = new Map((projection?.records || records).filter(record => record.run).map(record => [`${record.provider}:${record.session}`, record]));
       const stateRunsBySession = new Map([...stateRecordsBySession].map(([key, record]) => [key, record.run]));
@@ -980,7 +1034,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
         const run = runsBySession.get(`${session.provider}:${session.session}`);
         if (run) run.actionDeadline = session.actionDeadline;
       }
-      status.sessionSupervision = { ...discovery, refreshing: Boolean(sessionRefresh), sessions: reconcileFamilyCompletion(sessions.map(candidate => ({ ...candidate,
+      status.sessionSupervision = { ...discovery, refreshing: Boolean(sessionRefresh), sessions: reconcileFamilyCompletion(sessions.map(candidate => projectSessionAutoContinue(candidate,
+        stateRecordsBySession.get(`${candidate.provider}:${candidate.session}`))).map(candidate => analysisManager.projectContinuationWait?.(candidate) || candidate).map(candidate => ({ ...candidate,
         decisionRequest: sessionDecisionPresentation(candidate, runsBySession.get(`${candidate.provider}:${candidate.session}`)),
         workState: sessionWorkState(candidate, runsBySession.get(`${candidate.provider}:${candidate.session}`) || stateRunsBySession.get(`${candidate.provider}:${candidate.session}`), { provider: discovery.providers?.[candidate.provider] }) }))).map(candidate => ({ ...candidate, conversationPresentation: conversationPresentation(candidate,
           runsBySession.get(`${candidate.provider}:${candidate.session}`), { rawRecord: stateRecordsBySession.get(`${candidate.provider}:${candidate.session}`) }) })).sort(compareSessionWork) };
@@ -1020,6 +1075,15 @@ export async function startDesktopHost({ input = process.stdin, output = process
         // running frame cannot suppress a newly stopped conversation.
         stopNotifier.observe(records);
         emitStatus(status);
+        const notices = await analysisManager.takeContinuationWaitNotifications?.(sessions) || [];
+        const noticeAccess = await accessSnapshot();
+        if (!closed && !relay && desktopAccessReady(noticeAccess) && accessScope(noticeAccess) === requestedScope) {
+          for (const event of notices) {
+            const scoped = { ...event, scope: reportController.controllerScope };
+            await notificationJournal.append(scoped).catch(() => {});
+            emit(event);
+          }
+        }
       }
     }).finally(() => { publishing = null; if (publishAgain && !closed) { publishAgain = false; setImmediate(() => { void publish().catch(() => {}); }); } });
     return publishing;
@@ -1108,6 +1172,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
     updater.start({ registry: agent.registry, coordinator, isDesktopIdle: () => !unfinishedDesktopWork,
       restartDaemon: async (targetVersion, installation) => {
       if (!installation?.entryPath || !installation?.executablePath) throw new Error("Signed update runtime is unavailable.");
+      const updateIdentity = await agent.getDesktopStatus();
+      if (!await acceptStatusAccess(updateIdentity.access)) throw new Error("Updated desktop runtime identity changed during handoff.");
+      const expectedIdentityRevision = updateIdentityRevision;
       discoveryStopped = true;
       await stopDiscovery({ drain: true });
       // The candidate shares this cache. Stop inference before it starts so a
@@ -1122,7 +1189,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       try { child = (dependencies.spawn || spawn)(installation.executablePath,
         [join(dirname(installation.entryPath), "desktop-host.js")], {
           stdio: ["pipe", "pipe", "pipe"],
-          env: { ...env, SIMY_DESKTOP_SUPERVISOR_TOKEN: supervisorToken, ...(transferToken ? {SIMY_UPDATE_TRANSFER_TOKEN:transferToken} : {}) },
+          env: { ...updateConnectionEnvironment({ env, root, webOrigin }), SIMY_DESKTOP_SUPERVISOR_TOKEN: supervisorToken, ...(transferToken ? {SIMY_UPDATE_TRANSFER_TOKEN:transferToken} : {}) },
         }); } catch (error) {
           if(transferToken)await updateRuntime.reclaimFailedHandoff();
           actionAssociations = makeActionAssociations();
@@ -1149,6 +1216,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       });
       try {
         const first = await new Promise((accept, reject) => {
+          let validating = false;
           const limit = setTimeout(() => reject(new Error("Updated desktop runtime did not start in time.")), 30_000);
           const finish = (fn, value) => { clearTimeout(limit); fn(value); };
           child.once("error", () => finish(reject, new Error("Updated desktop runtime could not start.")));
@@ -1161,13 +1229,27 @@ export async function startDesktopHost({ input = process.stdin, output = process
             }
             let event; try { event = JSON.parse(line); } catch { return; }
             if (accepted) { emit(event); return; }
-            if (event.type === "status") {
-              if (!validCandidateStatus(event.status, targetVersion, webOrigin) || transferToken && (event.status.updateDetachment?.connectionState !== 'connected' || event.status.updateDetachment.operationId !== updateRuntime.snapshot(coordinator.snapshot()).operationId)) {
+            if (event.type === "status" && !validating) {
+              if (!validCandidateStatus(event.status, targetVersion, webOrigin) || !sameUpdateIdentity(updateIdentity, event.status) || transferToken && (event.status.updateDetachment?.connectionState !== 'connected' || event.status.updateDetachment.operationId !== updateRuntime.snapshot(coordinator.snapshot()).operationId)) {
                 finish(reject, new Error("Updated desktop runtime identity mismatch."));
-              } else { accepted = true; finish(accept, event); }
+              } else {
+                validating = true;
+                void (async () => {
+                  // Sign-in and organization changes use a separate command
+                  // queue; re-read after all candidate startup awaits.
+                  const currentIdentity = await agent.getDesktopStatus();
+                  if (!await acceptStatusAccess(currentIdentity.access)) {
+                    finish(reject, new Error("Updated desktop runtime identity changed during handoff.")); return;
+                  }
+                  if (closed || child.exitCode !== null || expectedIdentityRevision !== updateIdentityRevision || !sameUpdateIdentity(updateIdentity, currentIdentity)) {
+                    finish(reject, new Error("Updated desktop runtime identity changed during handoff."));
+                  } else { accepted = true; finish(accept, event); }
+                })().catch(error => finish(reject, error));
+              }
             }
           });
         });
+        if (expectedIdentityRevision !== updateIdentityRevision || agent.getDesktopAccess && !sameAccess(updateIdentity.access, agent.getDesktopAccess())) throw new Error("Updated desktop runtime identity changed during handoff.");
         relay = child;
         await stopAgent();
         if (child.exitCode !== null || closed) throw new Error("Updated runtime stopped during handoff.");
@@ -1579,18 +1661,30 @@ export async function startDesktopHost({ input = process.stdin, output = process
           return;
         }
         if (action === 'session_get_status') {
-          await selectedSession(command);
-          await publish();
           await authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch);
-          const row = lastStatus?.sessionSupervision?.sessions?.find(item =>
+          const cached = lastStatus?.sessionSupervision?.sessions?.find(item =>
             item.provider === command.provider && item.session === command.session && (!item.hostId || item.hostId === 'local'));
-          if (!row) throw new Error('This conversation status is unavailable; refresh its provider.');
+          const record = await readRecord(deliveryRoot, command.provider, command.session);
+          const observed = sessionStatus.sessions.find(item => item.provider === command.provider && item.session === command.session);
+          if (!record && !observed) throw new Error('This conversation status is unavailable; refresh its provider.');
+          // Read one durable task without scheduling a complete provider scan
+          // or waiting for optional account-wide enrichment. Observation times
+          // remain original, so a cached running flag cannot become fresh.
+          const candidate = { ...(cached || { provider: command.provider, session: command.session, cwd: record?.cwd,
+            observation: { observedAt: record?.runtime?.observedAt }, isRunning: record?.runtime?.isRunning }), ...observed };
+          const row = { ...projectSessionAutoContinue(automaticContinuation.project(analysisManager.project(candidate)), record),
+            workState: sessionWorkState(candidate, record?.run, { provider: sessionStatus.providers?.[command.provider] }) };
+          const controls = await (dependencies.deliveryHookStatus || deliveryHookStatus)({ root: deliveryRoot, records: record ? [record] : [] });
+          const selectedRun = controls.runs?.find(run => run.provider === command.provider && run.session === command.session);
+          row.decisionRequest = sessionDecisionPresentation(row, selectedRun);
+          row.conversationPresentation = conversationPresentation(row, selectedRun, { rawRecord: record });
+          await authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch);
           // The same app projection carries observation time and next action;
           // saved consent and an active record cannot prove a provider send.
           const { provider, session, title, autoContinue, autoContinueStatus, autoContinueReason,
-            binding, workState, dispatchReadiness, conversationPresentation } = row;
+            binding, workState, dispatchReadiness, conversationPresentation: presentation, decisionRequest } = row;
           emit({ type: 'result', id: command.id, ok: true, data: { provider, session, title,
-            autoContinue, autoContinueStatus, autoContinueReason, binding, workState, dispatchReadiness, conversationPresentation } });
+            autoContinue, autoContinueStatus, autoContinueReason, binding, workState, dispatchReadiness, conversationPresentation: presentation, decisionRequest } });
           return;
         }
         if (action === 'session_read_context') {
@@ -1666,7 +1760,11 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await agent.refreshDesktopAccess?.();
         } else if (action === 'desktop_sqm_settings') {
           const verified = await agent.refreshDesktopAccess?.();
-          await authorizeWork(commandScope);
+          // Navigation starts no work. Keep scope and entitlement checks while
+          // allowing users to inspect SQM during an update admission hold.
+          const currentAccess = await accessSnapshot();
+          requireDesktopAccess(currentAccess);
+          if (accessScope(currentAccess) !== commandScope) throw Object.assign(new Error('Desktop account or organization changed.'), { code: 'desktop_access_required' });
           if (!desktopAccessReady(verified) || verified.organizationId !== access.organizationId ||
               !validDesktopAccessPath(verified.settingsPath, verified.organizationSlug)) throw new Error('Organization settings are unavailable; refresh access first.');
           const url = new URL(`/org/${encodeURIComponent(verified.organizationSlug)}/quality-monitor`, webOrigin);
@@ -1807,23 +1905,27 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await actionAssociations.correct(command, analysisManager.project(candidate));
         } else if (action === "session_set_auto_continue") {
           if (typeof command.enabled !== 'boolean') throw new Error('Choose whether automatic continuation is enabled.');
-          let admission, providerEpoch;
+          let admission, target, providerEpoch;
           if (command.enabled) {
             const candidate = await selectedSession(command, { preferObserved: true });
             const canEnable = candidate.autoContinueAvailability?.canEnable ?? candidate.capabilities?.canAutoContinue;
-            if (canEnable !== true) {
+            if (candidate.controllerCanSetAutoContinue !== true && canEnable !== true) {
               throw new AutoContinueUnavailableError({ reason: candidate.autoContinueAvailability?.reason || candidate.reason,
                 reasonCode: candidate.autoContinueAvailability?.reasonCode || candidate.continuationReasonCode });
             }
             admission = candidate.continuationAdmission;
+            target = { provider: candidate.provider, session: candidate.session, cwd: candidate.cwd };
             providerEpoch = selectedLinkEpochs.get(candidate);
           }
           if (command.enabled) await authorizeWork(commandScope);
-          await (dependencies.setSessionAutoContinue || setSessionAutoContinue)({ root: join(root, 'delivery-hooks'),
-            provider: command.provider, session: command.session, enabled: command.enabled, initialContinuationPolicy: command.continuationPolicy, admission, expectedProviderEpoch: providerEpoch });
+          const saved = await (dependencies.setSessionAutoContinue || saveSessionAutoContinuePreference)({ root: join(root, 'delivery-hooks'),
+            provider: command.provider, session: command.session, enabled: command.enabled, initialContinuationPolicy: command.continuationPolicy, admission, target, expectedProviderEpoch: providerEpoch });
+          if (saved) sessionStatus = { ...sessionStatus,
+            sessions: sessionStatus.sessions.map(candidate => projectSessionAutoContinue(candidate, saved)) };
           if (!command.enabled) automaticContinuation.revoke(command.provider, command.session);
           // Acknowledge the durable preference before discovery or analysis.
           emit({ type: "result", id: command.id, ok: true });
+          void refreshCatalogAnalysis();
           refreshSessions(true);
           // Discovery's tracking transition schedules analysis. A second
           // forced request could invalidate a concurrent manual recommendation.

package/src/orchestrator/loop.js

@@ -121,10 +121,12 @@ async function runCodingLoopOwned({
         backend: snapshot.charter.backend, attempt_number: attemptNumber, instruction,
       });
       await publish(snapshot, "dispatching", onUpdate);
+      if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
       appendEvent(snapshot, "coding", `${snapshot.charter.backend} is executing locally.`, {
         backend: snapshot.charter.backend, attempt_number: attemptNumber, instruction,
       });
       await publish(snapshot, "coding", onUpdate);
+      if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
       const recordCompletion = async execution => {
         attempt = buildAttempt({ attemptNumber, charter: snapshot.charter, instruction, promptInterventions, execution });
         if (attempt.status !== "completed" || Array.isArray(attempt.raw_output) || !Object.keys(attempt.raw_output).length) return;