@awak-app/simy-cli 0.7.32 → 0.7.33

package/src/session-supervision/index.js

@@ -1,3 +1,4 @@
+import { discoverProgressively } from './progressive-discovery.js';
 import { sessionLoopOptions } from '../codex-plugins/simy/hooks/loop-kernel.mjs';
 import { sessionWorkState, compareSessionWork } from './work-state.js';
 import { normalizePullRequests } from './pull-requests.js';
@@ -7,8 +8,9 @@ import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/accepta
 import { purposeFailureMode } from '../codex-plugins/simy/hooks/purpose-search.mjs';
 import { realpath } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
-import { TERMINAL as TERMINAL_RUNS, advanceDeliveryControlRevision, deliveryDecisionRevision, associationBlocksFollowup, canUpgradeDelivery, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord, recordProviderArchive, ownerRenewalPending } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
-import { listCodexSessions, codexThreadMetadata, openCodexAppServer, readCodexSession, readCodexArchiveStates, CodexAppServerError } from './codex-app-server.js';
+import { isAbsolute } from 'node:path';
+import { TERMINAL as TERMINAL_RUNS, advanceDeliveryControlRevision, deliveryDecisionRevision, associationBlocksFollowup, canUpgradeDelivery, canExplicitlyResumeStopped, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord, recordProviderArchive, ownerRenewalPending } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { listCodexSessions, codexThreadMetadata, openCodexAppServer, readCodexSession, readCodexObservation, readCodexArchiveStates, CodexAppServerError } from './codex-app-server.js';
 import { listClaudeSessions, readClaudeSession } from './claude-sessions.js';
 import { loadPurposeRuleSet } from './purpose-instruction.js';
 import { originalSessionTarget } from './original-session-target.js';
@@ -30,6 +32,8 @@ export class AutoContinueUnavailableError extends Error {
 // Opt-in is independent of a busy provider turn. Dispatch still requires a
 // settled context and the original provider's execution boundary.
 function autoContinueAvailability(run, channel) {
+  if (run?.state === 'stopped' && channel.ready) return { canEnable: false, reasonCode: 'task_stopped',
+    reason: 'この会話は中断・停止中です。画面の「再開を依頼する」で、同じ目的と履歴を引き継いで続けられます。' };
   const issue = !channel.ready ? channel : run?.state === 'stopped'
     ? { code: 'task_stopped', reason: 'This task was stopped. Review the original conversation and explicitly request resumption before continuing.' } : run && !run.managed && !canUpgradeDelivery(run)
     ? { code: 'existing_loop', reason: 'This conversation already has a Delivery Loop. Use its existing controls.' }
@@ -100,6 +104,22 @@ function autoContinueState(record, isRunning, availability, readiness = null) {
     autoContinueReason: record.run ? 'Continuing the original task with progress and approval checks.' : isRunning ? 'Waiting for the original turn to finish.' : 'Checking settled requests for worthwhile remaining work.' };
 }
 
+// Local consent changes independently of provider history pagination. Reuse the
+// verified provider capabilities; a saved preference grants no new admission.
+export function projectSessionAutoContinue(candidate, record) {
+  if (!record || record.provider !== candidate.provider || record.session !== candidate.session ||
+      record.cwd !== candidate.cwd || candidate.hostId && candidate.hostId !== 'local') return candidate;
+  const availability = candidate.provider === 'codex' && record.admission?.source
+    ? autoContinueAvailability(record.run, codexContinuationChannel(record.admission.source, record.admission.model || candidate.model))
+    : candidate.autoContinueAvailability || { canEnable: candidate.capabilities?.canAutoContinue === true };
+  const enabled = candidate.archived !== true && record.providerArchived !== true && record.autoContinue === true;
+  const setting = enabled ? record : { ...record, autoContinue: false };
+  return { ...candidate, autoContinueAvailability: availability, autoContinue: enabled, autoContinueEpoch: enabled ? record.autoContinueEpoch : null,
+    tracked: typeof record.tracked === 'boolean' ? record.tracked : record.monitor === true, monitor: record.monitor === true,
+    ...autoContinueState(setting, candidate.isRunning,
+      availability, candidate.dispatchReadiness) };
+}
+
 function initialDiagnosisPlan(objective, contextBootstrap = false) {
   const action = { kind: 'read', scope: 'task', summary: contextBootstrap ? 'Understand the original user request and current progress without changing files' : 'Inspect the selected conversation and acceptance evidence without changing files' };
   return {
@@ -139,8 +159,13 @@ function navigationParent(item, record) {
       : record?.parentSession || item.parentSession;
 }
 
-export async function discoverSessions({ root, openClient = openCodexAppServer, listClaude = listClaudeSessions,
-  inspectProcess = processIdentity, now: requestedNow, signal, listCodexTitles = readCodexTitles, listCodexChildren = readCodexChildSessions, codexHome, connectedProviders = ['codex', 'claude'], includeArchived = false, includeSelectionCandidates = false } = {}) {
+export async function discoverSessions(options = {}) {
+  if (options.onProgress && !options.catalogSnapshot) return discoverProgressively({ ...options, discover: discoverSessionCatalog });
+  return discoverSessionCatalog(options);
+}
+
+async function discoverSessionCatalog({ root, openClient = openCodexAppServer, listClaude = listClaudeSessions,
+  inspectProcess = processIdentity, now: requestedNow, signal, listCodexTitles = readCodexTitles, listCodexChildren = readCodexChildSessions, codexHome, connectedProviders = ['codex', 'claude'], includeArchived = false, includeSelectionCandidates = false, catalogSnapshot, onProgress } = {}) {
   const now = requestedNow ?? Date.now();
   const assertActive = () => { if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation discovery was cancelled.'); };
   assertActive();
@@ -150,10 +175,20 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   let archivedCodex = [];
   let discovered = [], codexError = null, codexReasonCode = null, claude = [], claudeError = null;
   let archiveStates = new Map();
-  await Promise.all([
+  const progress = async snapshot => {
+    if (!onProgress || signal?.aborted) return;
+    const value = await discoverSessionCatalog({ root, inspectProcess, now: requestedNow, signal, connectedProviders, includeArchived, codexHome,
+      catalogSnapshot: snapshot, listCodexChildren: async () => [], listCodexTitles: async () => new Map() });
+    if (!signal?.aborted) await onProgress(value);
+  };
+  if (catalogSnapshot) {
+    discovered = catalogSnapshot.discovered || []; claude = catalogSnapshot.claude || []; archivedCodex = catalogSnapshot.archivedCodex || [];
+    for (const item of archivedCodex) archiveStates.set(item.session, true);
+  } else await Promise.all([
     (async () => {
       try { if (connected.has('codex')) discovered = await withClient(openClient, async client => {
         const active = await listCodexSessions({ client, all: true, signal, inspectState: true, codexHome,
+          onPage: async items => { discovered = [...items]; await progress({ discovered, archivedCodex }); },
           prioritySessions: priorities.filter(record => record.provider === 'codex').map(record => record.session) });
         if (includeArchived) {
           const observedArchives = new Map();
@@ -167,8 +202,12 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
             }
             return response;
           } };
-          try { await listCodexSessions({ client: archiveClient, all: true, signal, archived: true }); }
-          catch { /* Keep positive archive pages even if a later page fails. */ }
+          try { await listCodexSessions({ client: archiveClient, all: true, signal, archived: true,
+            onPage: async () => { archivedCodex = [...observedArchives.values()]; await progress({ discovered, archivedCodex }); } }); }
+          catch (error) {
+            codexError = 'Codex archive discovery incomplete. Refresh to retry.';
+            codexReasonCode = error?.code || 'session_metadata_unavailable';
+          }
           archivedCodex = [...observedArchives.values()];
         }
         const ids = new Set(active.map(item => item.session));
@@ -182,7 +221,7 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       }
     })(),
     (async () => {
-      try { if (connected.has('claude')) claude = await listClaude({ signal, all: true,
+      try { if (connected.has('claude')) claude = await listClaude({ signal, all: true, onProgress: items => { claude = items; return progress({ claude }); },
         prioritySessions: priorities.filter(record => record.provider === 'claude').map(record => record.session) }); }
       catch { claudeError = 'Claude conversation discovery unavailable.'; }
     })(),
@@ -248,9 +287,11 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
     const archived = record.providerArchived === true || record.provider === 'codex' && archiveStates.get(record.session) === true;
     if (archived && !includeArchived) continue;
     const key = `${record.provider}:${record.session}`;
-    // A hook observation can belong to an AI-created worker. Only explicit
-    // supervision may restore a conversation absent from provider discovery.
-    if (!byKey.has(key) && (retainedSession(record) || includeArchived && record.listHidden === true || requiredAncestors.has(key) && (record.observedAt || record.admission?.validatedAt))) byKey.set(key, {
+    // A saved stop must remain visible when the provider catalog is unavailable.
+    // This restores navigation only: the stopped run and unavailable provider
+    // still prohibit continuation. Bare hook observations remain insufficient.
+    const savedStopDuringOutage = record.run?.state === 'stopped' && Boolean(record.provider === 'codex' ? codexError : claudeError);
+    if (!byKey.has(key) && (retainedSession(record) || savedStopDuringOutage || includeArchived && record.listHidden === true || requiredAncestors.has(key) && (record.observedAt || record.admission?.validatedAt))) byKey.set(key, {
       provider: record.provider, session: record.session, cwd: record.cwd, title: record.listMetadata?.title || '', createdAt: record.listMetadata?.createdAt ?? null, archived, source: record.admission?.source || 'hook',
       lastActivityAt: record.listMetadata?.lastActivityAt ?? record.observedAt ?? record.admission?.validatedAt ?? record.run?.updatedAt ?? null,
       observation: { source: record.admission?.source || `${record.provider}_hook`, observedAt: record.observedAt || record.admission?.validatedAt || null },
@@ -345,6 +386,8 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       ...(item.latestTurnId ? { latestTurnId: item.latestTurnId } : {}),
       ...(item.providerGoal !== undefined ? { providerGoal: item.providerGoal } : {}),
       ...(item.goalReadState ? { goalReadState: item.goalReadState } : {}),
+      // Consent can be saved while runtime checks are pending or failing.
+      controllerCanSetAutoContinue: !archived,
       tracked: typeof record?.tracked === 'boolean' ? record.tracked : record?.monitor === true,
       listPinned: record?.listPinned === true, listPinScopes: record?.listPinScopes || [],
       providerArchived: archived, localHidden: record?.listHidden === true,
@@ -416,12 +459,21 @@ function requireAutoContinueTask(record) {
 // existing task. Desktop switches send `initialContinuationPolicy`: a default
 // for first enrollment only, decided under the record lock so a stale catalog
 // can neither fail ON for an ordinary loop nor change its policy or budgets.
+// Desktop consent is independent of execution readiness. The target is selected
+// by the host from its catalog, never accepted from a native command payload.
+export async function saveSessionAutoContinuePreference(options) {
+  return setSessionAutoContinue({ ...options, preferenceOnly: true });
+}
+
 export async function setSessionAutoContinue({ root, provider, session, enabled, continuationPolicy, initialContinuationPolicy, ...options }) {
   if (!['codex', 'claude'].includes(provider) || typeof enabled !== 'boolean') throw new Error('Unsupported automatic continuation request.');
   const link = enabled ? await requireProviderLink({ root, provider, expectedEpoch: options.expectedProviderEpoch }) : null;
   let discoveredAdmission;
-  const purposeRules = enabled && provider === 'codex' ? await loadPurposeRuleSet() : null;
-  if (enabled) {
+  const preferenceOnly = options.preferenceOnly === true;
+  const target = options.target;
+  const validTarget = target?.provider === provider && target?.session === session && typeof target.cwd === 'string' && isAbsolute(target.cwd);
+  const purposeRules = enabled && provider === 'codex' && !preferenceOnly ? await loadPurposeRuleSet() : null;
+  if (enabled && !preferenceOnly) {
     const record = await readRecord(root, provider, session);
     if (record?.providerArchived === true) throw Object.assign(new Error('Restore the original provider conversation before enabling automatic continuation.'), { code: 'session_archived' });
     requireAutoContinueTask(record);
@@ -445,6 +497,15 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
   }
   const updated = await updateRecord(root, provider, session, async previous => {
     if (enabled) await requireProviderLink({ root, provider, expectedEpoch: link.epoch });
+    if (enabled && preferenceOnly) {
+      if (previous && validTarget && previous.cwd !== target.cwd) throw Object.assign(new Error('Session workspace changed; refresh its metadata.'), { code: 'session_workspace_changed' });
+      if (!previous) {
+        if (!validTarget) throw Object.assign(new Error('Select a known conversation before saving its preference.'), { code: 'session_metadata_unavailable' });
+        // No filesystem/process/model probe and no provider call at save time.
+        previous = { schemaVersion: 1, provider, session, cwd: target.cwd, run: null };
+        if (hasAutoContinueAdmission({ ...previous, admission: options.admission }, provider, session)) previous.admission = { ...options.admission };
+      }
+    }
     if (enabled && discoveredAdmission) {
       if (previous && previous.cwd !== discoveredAdmission.cwd) throw Object.assign(new Error('Session workspace changed; refresh its metadata.'), { code: 'session_workspace_changed' });
       // An admission written while saving is authoritative. Never overwrite its
@@ -452,8 +513,8 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
       previous = previous?.admission ? previous : { ...(previous || { schemaVersion: 1, provider, session, cwd: discoveredAdmission.cwd, run: null }), admission: discoveredAdmission };
     }
     if (!previous) throw new Error('Refresh this conversation before changing automatic continuation.');
-    if (enabled && previous.providerArchived === true) throw new Error('Restore the original provider conversation before enabling automatic continuation.');
-    if (enabled) {
+    if (enabled && previous.providerArchived === true) throw Object.assign(new Error('Restore the original provider conversation before enabling automatic continuation.'), { code: 'session_archived' });
+    if (enabled && !preferenceOnly) {
       const channel = provider === 'claude' ? await liveClaudeChannel(previous,
         { session, cwd: previous.cwd, observation: { source: previous.admission?.source } }, options.inspectProcess || processIdentity)
         : codexContinuationChannel(previous.admission?.source, previous.admission?.model);
@@ -474,12 +535,14 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
     const next = { ...previous, ...(enabled && link.consentEpoch ? { providerConsentEpoch: link.consentEpoch } : {}), autoContinue: enabled, autoContinueEpoch: epoch,
       ...(enabled ? { tracked: true, monitor: true, autoContinueSettings: settings } : { tracked: false, monitor: false }) };
     // Adopt existing supervision without restarting it or renewing its budgets.
-    if (next.run?.managed) {
+    const preserveTerminal = preferenceOnly && (enabled || TERMINAL_RUNS.has(next.run?.state));
+    if (next.run?.managed && !preserveTerminal) {
       next.run.managed.autoContinueEpoch = epoch;
-      if (purposeRules && next.run.managed.resumeChannel === 'codex_app_server') {
-        next.run.managed.purpose = { ...next.run.managed.purpose, enabled: true, version: 2, decisionPolicy: 'llm-first-hc102',
+      if (enabled && next.run.managed.resumeChannel === 'codex_app_server') {
+        if (purposeRules) next.run.managed.purpose = { ...next.run.managed.purpose, enabled: true, version: 2, decisionPolicy: 'llm-first-hc102',
           failureBudgetMode: purposeFailureMode(next),
           ruleDigest: purposeRules.digest, ruleIds: purposeRules.rules.map(rule => rule.id) };
+        else if (next.run.managed.purpose) next.run.managed.purpose.enabled = true;
         if (next.run.state === 'paused' && next.run.reason === 'Automatic continuation paused by user.') { next.run.state = 'recovery_required'; next.run.recoveryCause = 'session_supervision'; next.run.managed.autoRecovery = true; }
         // OFF keeps the current native turn alive. Re-enabling during that
         // same turn restores future continuation without starting another turn.
@@ -489,7 +552,7 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
     }
     // The desktop preference is an explicit human control too: an old decision
     // card must not undo this switch, even when no provider checkpoint arrived.
-    if (next.run) advanceDeliveryControlRevision(next.run);
+    if (next.run && !preserveTerminal) advanceDeliveryControlRevision(next.run);
     return next;
   });
   // Consent is durable now. Provider reads and ordinary-loop promotion belong
@@ -636,19 +699,33 @@ export async function answerSession({ root, provider, session, taskId, expectedR
 // selection changed in Codex is configuration, not a different task or authority.
 export async function resumeSession({ openClient = openCodexAppServer, ...options }) {
   const record = await readRecord(options.root, options.provider, options.session);
-  if (options.provider !== 'codex' || record?.run?.managed?.resumeChannel !== 'codex_app_server')
+  const stoppedStandard = options.provider === 'codex' && !record?.run?.managed &&
+    canExplicitlyResumeStopped(record?.run, { standard: true });
+  if (options.provider !== 'codex' || !stoppedStandard && record?.run?.managed?.resumeChannel !== 'codex_app_server')
     return controlDelivery({ ...options, action: 'resume' });
-  if (record.run.managed.taskId !== options.taskId) throw new Error('Managed task identity changed; refresh its status.');
+  if (!stoppedStandard && record.run.managed.taskId !== options.taskId) throw new Error('Managed task identity changed; refresh its status.');
   const link = await requireProviderLink(options);
   const client = await openClient({ isolateConnectors: true });
   let metadata;
-  try { metadata = await readCodexSession(client, options.session); }
+  try {
+    metadata = await readCodexSession(client, options.session);
+    // thread/read may omit runtime status. Observe the latest native turn
+    // instead of treating the omitted field as either idle or an error.
+    if (stoppedStandard && metadata.isRunning === undefined) {
+      const observation = await readCodexObservation(client, options.session);
+      if (typeof observation.isRunning === 'boolean') metadata.isRunning = observation.isRunning;
+    }
+  }
   finally { await client.close(); }
   const cwd = await realpath(metadata.cwd);
-  if (cwd !== record.cwd || !metadata.model) throw new Error('Original Codex workspace or model is unavailable; inspect before resuming.');
+  if (cwd !== record.cwd || !metadata.model || stoppedStandard && (metadata.isRunning !== false || metadata.archived || metadata.observation?.source !== 'codex_app_server')) throw new Error('Original Codex workspace, idle observation or model is unavailable; inspect before resuming.');
+  const rules = stoppedStandard ? await loadPurposeRuleSet() : null;
   await requireProviderLink({ ...options, expectedEpoch: link.epoch });
   return controlDelivery({ ...options, action: 'resume',
     expectedRunId: options.expectedRunId ?? record.run.id,
     expectedRevision: options.expectedRevision ?? deliveryDecisionRevision(record.run),
-    resumeObservation: { session: metadata.session, cwd, model: metadata.model, source: 'codex_app_server', providerEpoch: link.epoch } });
+    resumeObservation: { session: metadata.session, cwd, model: metadata.model, source: 'codex_app_server', providerEpoch: link.epoch,
+      ...(stoppedStandard && metadata.nativeSandbox ? { nativeSandbox: metadata.nativeSandbox, nativeSandboxSource: metadata.nativeSandboxSource } : {}),
+      ...(rules ? { purpose: { enabled: true, version: 2, decisionPolicy: 'llm-first-hc102', failureBudgetMode: 'hard',
+        ruleDigest: rules.digest, ruleIds: rules.rules.map(rule => rule.id) } } : {}) } });
 }

package/src/session-supervision/owner-transport.js

@@ -1,8 +1,10 @@
+import { createDesktopFrameWriter } from '../desktop-frame-writer.js';
 import { createServer, createConnection } from 'node:net';
 import { chmod, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
 import { createInterface } from 'node:readline';
+import { normalizeWebOrigin } from '../web-origin.js';
 
 export const ownerSocketPath = (root, platform = process.platform) => platform === 'win32'
   ? '\\\\.\\pipe\\simy-controller-' + createHash('sha256').update(root).digest('hex').slice(0, 32)
@@ -11,19 +13,22 @@ const socketPath = ownerSocketPath;
 // The socket and nonce are accessible only to the local OS account. Application
 // account/provider checks still run in the owner's ordinary command handler.
 export async function createOwnerTransport({ root, nonce, allowedActions, dispatch, allowControllerArchive = false }) {
-  const peers = new Set(), requests = new Map();
+  const writers = new WeakMap();
+  const peers = new Set(), subscribers = new Set(), requests = new Map();
   let latest;
   const send = (peer, frame) => {
     if (peer.destroyed) return;
-    if (peer.writableLength > 8 * 1024 * 1024) { peer.destroy(); return; }
-    peer.write(JSON.stringify(frame) + '\n');
+    if (frame.type !== 'status' && peer.writableLength > 8 * 1024 * 1024) { peer.destroy(); return; }
+    writers.get(peer).write(JSON.stringify(frame) + '\n', frame.type === 'status');
   };
   const server = createServer(peer => {
     peer.setEncoding('utf8');
+    const writer = createDesktopFrameWriter(peer);
+    writers.set(peer, writer);
     let authenticated = false, controllerArchive = false, buffer = '';
     const timeout = setTimeout(() => peer.destroy(), 5000);
     peer.on('error', () => {});
-    peer.on('close', () => { clearTimeout(timeout); peers.delete(peer); for (const [id, item] of requests) if (item.peer === peer) requests.delete(id); });
+    peer.on('close', () => { writer.close(); clearTimeout(timeout); peers.delete(peer); subscribers.delete(peer); for (const [id, item] of requests) if (item.peer === peer) requests.delete(id); });
     peer.on('data', chunk => {
       buffer += chunk.toString();
       if (buffer.length > 16384) { peer.destroy(); return; }
@@ -35,7 +40,12 @@ export async function createOwnerTransport({ root, nonce, allowedActions, dispat
         if (!authenticated) {
           if (command.nonce !== nonce) { peer.destroy(); return; }
           authenticated = true; controllerArchive = allowControllerArchive && command.client === 'archive-controller'; clearTimeout(timeout); peers.add(peer);
-          if (latest) send(peer, latest);
+          // One-shot controls need their result, not multi-megabyte broadcasts
+          // that can fill the write queue before the result is sent.
+          if (command.subscribeStatus !== false) {
+            subscribers.add(peer);
+            if (latest) send(peer, latest);
+          }
           continue;
         }
         if (!allowedActions.has(command.action) || typeof command.id !== 'string' || command.id.length > 128 || command.hostId && command.hostId !== 'local' && !(controllerArchive && ['session_archive', 'session_restore', 'session_provider_setup'].includes(command.action))) {
@@ -59,7 +69,7 @@ export async function createOwnerTransport({ root, nonce, allowedActions, dispat
         const item = requests.get(frame.id);
         if (item) { requests.delete(frame.id); send(item.peer, { ...frame, id: item.id }); }
       } else if (frame.type === 'status' || frame.type === 'notify' && (!frame.hostId || frame.hostId === 'local')) {
-        for (const peer of peers) send(peer, frame);
+        for (const peer of subscribers) send(peer, frame);
       }
     },
     async close() { for (const peer of peers) peer.destroy(); await new Promise(resolve => server.close(resolve)); },
@@ -68,7 +78,7 @@ export async function createOwnerTransport({ root, nonce, allowedActions, dispat
 
 // Returns false only when no compatible owner endpoint exists. Never starts a
 // second owner, kills a process, or converts a disconnect into an execution retry.
-export async function relayToOwner({ root, input = process.stdin, output = process.stdout }) {
+export async function relayToOwner({ root, webOrigin, input = process.stdin, output = process.stdout }) {
   let owner;
   try { owner = JSON.parse(await readFile(join(root, 'desktop-app.lock', 'owner.json'), 'utf8')); }
   catch (error) { if (error.code === 'ENOENT') return false; throw error; }
@@ -79,6 +89,11 @@ export async function relayToOwner({ root, input = process.stdin, output = proce
     peer.once('error', error => { clearTimeout(timer); if (['ENOENT','ECONNREFUSED'].includes(error.code)) resolve(false); else reject(error); });
   });
   if (!connected) return false;
+  try {
+    if (typeof owner?.nonce !== 'string' || !owner.nonce) throw new Error('Remote owner identity is unavailable.');
+    if (webOrigin && (!owner.webOrigin || normalizeWebOrigin(owner.webOrigin) !== normalizeWebOrigin(webOrigin)))
+      throw Object.assign(new Error('The existing SIMY owner belongs to another Web address. Keep its tasks and reconnect using its saved environment.'), { code: 'remote_owner_origin_mismatch' });
+  } catch (error) { peer.destroy(); throw error; }
   peer.write(JSON.stringify({ nonce: owner.nonce }) + '\n');
   peer.pipe(output, { end: false });
   const lines = createInterface({ input, crlfDelay: Infinity });
@@ -128,7 +143,7 @@ async function requestOwnerCommand({ root, command, signal, timeoutMs, client })
     peer.on('connect', () => {
       if (signal?.aborted) { abort(); return; }
       sent = true;
-      peer.write(JSON.stringify({ nonce: owner.nonce, ...(client ? { client } : {}) }) + '\n' + JSON.stringify(command) + '\n');
+      peer.write(JSON.stringify({ nonce: owner.nonce, subscribeStatus: false, ...(client ? { client } : {}) }) + '\n' + JSON.stringify(command) + '\n');
     });
     peer.on('error', error => finish(sent ? unknown() : connectionFailure(error)));
     peer.on('close', () => finish(Object.assign(new Error('SIMY disconnected before confirming the result. Refresh before retrying.'), { code: 'remote_operation_unknown' })));

package/src/session-supervision/progressive-discovery.js

@@ -0,0 +1,66 @@
+// A deadline releases the caller even when an adapter ignores cancellation.
+// The adapter still receives an abort signal; late values never reach the UI.
+export async function boundedDiscovery(work, { signal, timeoutMs = 30_000, onDrain } = {}) {
+  const controller = new AbortController();
+  let timer, rejectStop;
+  const stopped = new Promise((_, reject) => { rejectStop = reject; });
+  const cancel = () => {
+    const error = signal?.reason || Object.assign(new Error('Conversation discovery cancelled.'), { code: 'cancelled' });
+    controller.abort(error); rejectStop(error);
+  };
+  signal?.addEventListener('abort', cancel, { once: true });
+  timer = setTimeout(() => {
+    const error = Object.assign(new Error('Conversation discovery timed out. Refresh to retry.'), { code: 'discovery_timeout' });
+    controller.abort(error); rejectStop(error);
+  }, timeoutMs);
+  try {
+    if (signal?.aborted) cancel();
+    const operation = Promise.resolve().then(() => {
+      controller.signal.throwIfAborted(); return work(controller.signal);
+    });
+    onDrain?.(operation.then(() => {}, () => {}));
+    return await Promise.race([stopped, operation]);
+  } finally {
+    clearTimeout(timer); signal?.removeEventListener('abort', cancel);
+    // Revoke callbacks retained by an adapter after its result settled.
+    if (!controller.signal.aborted) controller.abort();
+  }
+}
+
+export async function discoverProgressively({ discover, onProgress, signal, timeoutMs = 30_000,
+  connectedProviders = ['codex', 'claude'], onDrain, ...options }) {
+  const values = new Map(), complete = new Set(), settled = new Set();
+  let notifications = Promise.resolve();
+  const snapshot = () => ({
+    sessions: [...values.values()].flatMap(value => value.sessions || []),
+    selectionCandidates: [...values.values()].flatMap(value => value.selectionCandidates || []),
+    providers: Object.fromEntries(['codex', 'claude'].map(provider => [provider,
+      values.get(provider)?.providers?.[provider] || { discovery: connectedProviders.includes(provider) ? 'loading' : 'disconnected', reason: null }])),
+    completeProviders: [...complete], historyLoading: settled.size < connectedProviders.length,
+    refreshedAt: Date.now(),
+  });
+  const notify = () => {
+    const value = snapshot();
+    notifications = notifications.then(() => { signal?.throwIfAborted(); return onProgress(value); });
+    return notifications;
+  };
+  await Promise.all(connectedProviders.map(async provider => {
+    try {
+      const value = await boundedDiscovery(childSignal => discover({ ...options, signal: childSignal,
+        connectedProviders: [provider], onProgress: async value => {
+          childSignal.throwIfAborted(); values.set(provider, value); await notify();
+        } }), { signal, timeoutMs, onDrain });
+      signal?.throwIfAborted();
+      values.set(provider, value);
+      if (['ready', 'local_index'].includes(value.providers?.[provider]?.discovery)) complete.add(provider);
+    } catch (error) {
+      if (signal?.aborted) throw error;
+      const previous = values.get(provider) || { sessions: [] };
+      values.set(provider, { ...previous, providers: { [provider]: { discovery: 'unavailable',
+        reasonCode: error.code || 'discovery_failed', reason: error.message } } });
+    }
+    settled.add(provider); await notify();
+  }));
+  await notifications;
+  return snapshot();
+}

package/src/session-supervision/remote-entry.js

@@ -6,17 +6,20 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { adoptInstalledRuntime, pinnedWorkflowSource } from '../delivery-hooks/local-runtime.js';
+import { attachRemoteService } from './remote-service.js';
+import { resolveWebOrigin } from '../web-origin.js';
 process.env.SIMY_REMOTE_CHILD = '1';
 process.env.SIMY_AUTO_UPDATE = '0';
 const root = process.env.SIMY_HOME?.trim() || join(homedir(), '.simy');
+const webOrigin = resolveWebOrigin();
 try {
-  if (await relayToOwner({ root })) process.exit(0);
+  if (await relayToOwner({ root, webOrigin })) process.exit(0);
   await adoptInstalledRuntime({ root });
   const selected = await pinnedWorkflowSource({ root });
   const host = await import(selected ? pathToFileURL(join(selected, 'src/desktop-host.js')).href : '../desktop-host.js');
   if (host.remoteSessionProtocol !== 1) throw new Error('Update the remote SIMY runtime.');
-  host.startDesktopEntry();
-} catch {
-  process.stdout.write(JSON.stringify({ type: 'error', message: 'Remote SIMY could not start. Update its runtime and check its existing desktop connection.' }) + '\n');
+  await attachRemoteService({ root, webOrigin });
+} catch (error) {
+  process.stdout.write(JSON.stringify({ type: 'error', ...(error.code === 'remote_owner_origin_mismatch' ? { code: error.code } : {}), message: 'Remote SIMY could not start. Update its runtime and check its existing desktop connection.' }) + '\n');
   process.exitCode = 1;
 }

package/src/session-supervision/remote-host-recovery.js

@@ -0,0 +1,21 @@
+// A live transport and an executable AI provider are separate observations.
+// Never use cached private provider status to diagnose a disconnected host.
+export function remoteHostRecovery({ state, enabled = true, status, ready = false, fresh = false, errorCode } = {}) {
+  if (enabled === false) return { code: 'disconnected', action: 'connect' };
+  if (errorCode === 'update_required') return { code: 'update_required', action: 'settings' };
+  if (errorCode === 'simy_auth_required') return { code: 'simy_auth_required', action: 'login' };
+  if (errorCode === 'access_required') return { code: 'access_required', action: 'login' };
+  if (state === 'connecting') return { code: 'connecting', action: null };
+  if (!fresh || !status || state === 'unavailable') return { code: 'transport_unavailable', action: 'reconnect' };
+  if (status.auth?.state !== 'signed_in') return { code: 'simy_auth_required', action: 'login' };
+  if (!ready || status.access?.state !== 'ready') return { code: 'access_required', action: 'login' };
+  for (const provider of ['codex', 'claude']) {
+    // Only providers explicitly connected by this host's user need recovery.
+    if (status.providerLinks?.[provider]?.connected !== true) continue;
+    const observed = status.providers?.[provider] || status[provider];
+    if (['missing', 'outdated'].includes(observed?.state)) return { code: 'provider_setup_required', action: 'settings', provider };
+    if (observed?.state === 'signed_out') return { code: 'provider_login_required', action: 'settings', provider };
+    if (observed?.state !== 'ready') return { code: 'provider_unverified', action: 'refresh', provider };
+  }
+  return { code: 'ready', action: null };
+}

package/src/session-supervision/remote-hosts.js

@@ -7,6 +7,7 @@ import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { compareSessionWork } from './work-state.js';
 import { manualAcceptanceCommand, matchesManualAcceptanceControls, manualAcceptanceContinuation } from './manual-acceptance-command.js';
+import { remoteHostRecovery } from './remote-host-recovery.js';
 
 const MAX_FRAME = 8 * 1024 * 1024;
 const MAX_HOSTS = 8;
@@ -83,9 +84,10 @@ export function createRemoteHostManager({ root, store, spawnImpl = spawn, onChan
   let preferenceScope = null;
   let scope = null, local = null, closed = false, settingsError = null, writes = Promise.resolve(), generation = 0;
   const changed = () => { if (!closed) onChange(); };
-  function disconnect(connection, reason = 'Remote connection closed.') {
+  function disconnect(connection, reason = 'Remote connection closed.', errorCode = 'transport_unavailable') {
     const child = connection.child;
     connection.child = null; connection.ready = false; connection.reason = reason; connection.state = 'unavailable'; connection.retryAt = now() + retryMs;
+    connection.errorCode = errorCode;
     clearTimeout(connection.handshake);
     for (const job of connection.pending.values()) { clearTimeout(job.timer); job.reject(error('Remote operation result is unknown. Check the original conversation before retrying.', 'remote_operation_unknown')); }
     connection.pending.clear();
@@ -106,7 +108,8 @@ export function createRemoteHostManager({ root, store, spawnImpl = spawn, onChan
     const id = `${connection.id}:${frame.id}`;
     return preferences.change(expectedScope, state => {
       if (state.events[id] || closed || preferenceScope !== expectedScope || !connection.ready) return;
-      onNotify({ ...stamp(event, connection), hostId: connection.id, id });
+      onNotify({ ...stamp(event, connection), hostId: connection.id, id,
+        ...(event.continuationWaitId ? { sessionIdentity: `${event.provider}|${event.session}|${connection.id}` } : {}) });
       state.events[id] = now();
     });
   }
@@ -139,7 +142,7 @@ export function createRemoteHostManager({ root, store, spawnImpl = spawn, onChan
   }
   function connect(connection) {
     if (closed || connection.enabled === false || connection.child || now() < connection.retryAt) return;
-    connection.state = 'connecting'; connection.reason = null;
+    connection.state = 'connecting'; connection.reason = null; connection.errorCode = null;
     let child;
     try { child = spawnImpl('ssh', remoteSshArgs(connection.alias, REMOTE_HOST_COMMAND), { stdio: ['pipe', 'pipe', 'pipe'], shell: false }); }
     catch { disconnect(connection, 'Could not start SSH.'); return; }
@@ -175,10 +178,11 @@ export function createRemoteHostManager({ root, store, spawnImpl = spawn, onChan
           connection.capabilities = Array.isArray(status?.remoteControl?.actions)
             ? status.remoteControl.actions.filter(action => typeof action === 'string' && allowedActions.has(action))
             : status?.remoteControl === undefined && status?.remoteSessionProtocol === 1 ? [...legacyActions] : [];
-          if (status?.remoteSessionProtocol !== 1) { disconnect(connection, 'Update SIMY on the remote host to use remote sessions.'); changed(); return; }
+          if (status?.remoteSessionProtocol !== 1) { disconnect(connection, 'Update SIMY on the remote host to use remote sessions.', 'update_required'); changed(); return; }
           if (!usable(status) || status.auth.userId !== local?.auth?.userId || status.access.organizationId !== local?.access?.organizationId) {
             clearTimeout(connection.handshake);
             connection.ready = false; connection.state = 'access_required'; connection.reason = 'Use Remote connections in this CLI to sign in to this host.';
+            connection.errorCode = status?.auth?.state !== 'signed_in' ? 'simy_auth_required' : 'access_required';
             connection.status = null;
             for (const [id, job] of connection.pending) if (!job.setup) { clearTimeout(job.timer); job.reject(error(connection.reason, 'remote_operation_unknown')); connection.pending.delete(id); }
           } else if (!Array.isArray(status.sessionSupervision?.sessions) || !Array.isArray(status.deliveryHooks?.runs)) {
@@ -186,6 +190,7 @@ export function createRemoteHostManager({ root, store, spawnImpl = spawn, onChan
           } else {
             clearTimeout(connection.handshake);
             connection.status = status; connection.ready = true; connection.state = 'ready'; connection.reason = null; connection.receivedAt = now();
+            connection.errorCode = null;
             if (status.controllerEventsVersion === 1) void pullEvents(connection).catch(() => {});
             else for (const event of status.controllerEvents || []) void receiveNotification(connection, event)?.catch(() => {});
             const expectedScope = preferenceScope;
@@ -210,7 +215,7 @@ export function createRemoteHostManager({ root, store, spawnImpl = spawn, onChan
         } else if (frame.type === 'notify' && connection.ready && local && typeof frame.id === 'string' && ['finished','failed','paused','needs_decision'].includes(frame.kind)) {
           void receiveNotification(connection, frame)?.catch(() => {});
         } else if (frame.type === 'error') {
-          disconnect(connection, remoteOperationFailure(frame.code).message); changed(); return;
+          disconnect(connection, remoteOperationFailure(frame.code).message, frame.code === 'remote_owner_origin_mismatch' ? 'access_required' : 'transport_unavailable'); changed(); return;
         } else if (frame.type === 'task_detail') {
           const pending = connection.pending.get(frame.id);
           pending?.onDetail?.({ ...frame, id: pending.id, taskKey: pending.taskKey });
@@ -252,7 +257,7 @@ export function createRemoteHostManager({ root, store, spawnImpl = spawn, onChan
       c.label = host.label; c.enabled = host.enabled !== false;
       if (!c.enabled) {
         if (c.child) disconnect(c);
-        c.ready = false; c.status = null; c.state = 'disconnected'; c.reason = null;
+        c.ready = false; c.status = null; c.state = 'disconnected'; c.reason = null; c.errorCode = null;
         continue;
       }
       if (c.state === 'disconnected') c.retryAt = 0;
@@ -339,8 +344,22 @@ export function createRemoteHostManager({ root, store, spawnImpl = spawn, onChan
       if (!c) return;
       c.enabled = enabled;
       if (!enabled) { disconnect(c); c.status = null; c.state = 'disconnected'; c.reason = null; }
-      else { c.retryAt = 0; if (c.state === 'disconnected') c.state = 'connecting'; }
+      else {
+        // Explicit Connect also retries a stale or unauthorized live transport.
+        // Resetting backoff alone cannot replace a child that is still present.
+        // Keep healthy connections and an in-flight handshake intact.
+        if (c.child && c.state !== 'connecting' && (!c.ready || now() - c.receivedAt > 45_000)) disconnect(c);
+        c.retryAt = 0;
+        if (!c.child) c.state = 'connecting';
+      }
     });
+    const c = connections.get(host.id);
+    if (enabled && c?.child && c.capabilities?.includes('refresh')) {
+      // Explicit Connect/Check again must request a new host observation even
+      // when SSH is healthy. Keep its owner and in-flight mutation receipts:
+      // refreshing providers is read-only and must never replay execution.
+      c.child.stdin.write(JSON.stringify({ id: randomUUID(), action: 'refresh' }) + '\n');
+    }
   }
   async function forward(command, status) {
     if (closed || !usable(status) || scopeOf(status) !== scope) throw error('SIMY account changed. Refresh before using the remote host.', 'remote_host_access');
@@ -478,7 +497,8 @@ export function createRemoteHostManager({ root, store, spawnImpl = spawn, onChan
       const remoteActiveCount = hosts.filter(c => c.ready).reduce((n,c) => n + (c.status?.[key]?.activeCount || 0), 0);
       return { ...status[key], items: [...localItems, ...rows], localActiveCount: Math.max(0, (status[key]?.activeCount || 0) - priorRemote), activeCount: Math.max(0, (status[key]?.activeCount || 0) - priorRemote) + remoteActiveCount, remoteActiveCount, unknownHosts: hosts.filter(c => !c.ready).map(c => c.id) };
     }
-    return { ...status, remoteHosts: { error: settingsError, items: hosts.map(c => ({ id: c.id, alias: c.alias, label: c.label, enabled: c.enabled !== false, state: c.ready && now() - c.receivedAt > 45_000 ? 'unavailable' : c.state, transportId: c.ready ? c.transportId : null, reason: c.reason })) },
+    return { ...status, remoteHosts: { error: settingsError, items: hosts.map(c => ({ id: c.id, alias: c.alias, label: c.label, enabled: c.enabled !== false, state: c.ready && now() - c.receivedAt > 45_000 ? 'unavailable' : c.state, transportId: c.ready ? c.transportId : null, reason: c.reason,
+      recovery: remoteHostRecovery({ state: c.state, enabled: c.enabled, status: c.status, ready: c.ready, fresh: now() - c.receivedAt <= 45_000, errorCode: c.errorCode }) })) },
       tasks: aggregate('tasks', tasks), sqmTasks: aggregate('sqmTasks', sqmTasks),
       sessionSupervision: { ...status.sessionSupervision, selectionCandidates: [...(status.sessionSupervision?.selectionCandidates || []).filter(row => !row.hostId || row.hostId === 'local'), ...selectionCandidates], sessions: [...(status.sessionSupervision?.sessions || []).filter(row => !row.hostId || row.hostId === 'local'), ...sessions].sort(compareSessionWork) },
       deliveryHooks: { ...status.deliveryHooks, runs: [...(status.deliveryHooks?.runs || []).filter(row => !row.hostId || row.hostId === 'local'), ...runs] } };

package/src/session-supervision/remote-owner-entry.js

@@ -0,0 +1,20 @@
+// Separate from the SSH entry so reconnects only attach and never replace work.
+import { PassThrough, Writable } from 'node:stream';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { adoptInstalledRuntime, pinnedWorkflowSource } from '../delivery-hooks/local-runtime.js';
+
+process.env.SIMY_REMOTE_CHILD = '1';
+process.env.SIMY_AUTO_UPDATE = '0';
+const root = process.env.SIMY_HOME?.trim() || join(homedir(), '.simy');
+try {
+  await adoptInstalledRuntime({ root });
+  const selected = await pinnedWorkflowSource({ root });
+  const host = await import(selected ? pathToFileURL(join(selected, 'src/desktop-host.js')).href : '../desktop-host.js');
+  if (host.remoteSessionProtocol !== 1) throw new Error('Update the remote SIMY runtime.');
+  host.startDesktopEntry({ input: new PassThrough(), output: new Writable({ write(_chunk, _encoding, done) { done(); } }) });
+} catch (error) {
+  process.stderr.write(`Remote SIMY owner could not start: ${error.message}\n`);
+  process.exitCode = 1;
+}