@awak-app/simy-cli 0.7.32 → 0.7.34

package/src/session-supervision/index.js

@@ -1,3 +1,4 @@
+import { discoverProgressively } from './progressive-discovery.js';
 import { sessionLoopOptions } from '../codex-plugins/simy/hooks/loop-kernel.mjs';
 import { sessionWorkState, compareSessionWork } from './work-state.js';
 import { normalizePullRequests } from './pull-requests.js';
@@ -7,8 +8,9 @@ import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/accepta
 import { purposeFailureMode } from '../codex-plugins/simy/hooks/purpose-search.mjs';
 import { realpath } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
-import { TERMINAL as TERMINAL_RUNS, advanceDeliveryControlRevision, deliveryDecisionRevision, associationBlocksFollowup, canUpgradeDelivery, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord, recordProviderArchive, ownerRenewalPending } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
-import { listCodexSessions, codexThreadMetadata, openCodexAppServer, readCodexSession, readCodexArchiveStates, CodexAppServerError } from './codex-app-server.js';
+import { isAbsolute } from 'node:path';
+import { TERMINAL as TERMINAL_RUNS, advanceDeliveryControlRevision, deliveryDecisionRevision, associationBlocksFollowup, canUpgradeDelivery, canExplicitlyResumeStopped, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord, recordProviderArchive, ownerRenewalPending } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { listCodexSessions, codexThreadMetadata, openCodexAppServer, readCodexSession, readCodexObservation, readCodexArchiveStates, CodexAppServerError } from './codex-app-server.js';
 import { listClaudeSessions, readClaudeSession } from './claude-sessions.js';
 import { loadPurposeRuleSet } from './purpose-instruction.js';
 import { originalSessionTarget } from './original-session-target.js';
@@ -30,6 +32,8 @@ export class AutoContinueUnavailableError extends Error {
 // Opt-in is independent of a busy provider turn. Dispatch still requires a
 // settled context and the original provider's execution boundary.
 function autoContinueAvailability(run, channel) {
+  if (run?.state === 'stopped' && channel.ready) return { canEnable: false, reasonCode: 'task_stopped',
+    reason: 'この会話は中断・停止中です。画面の「再開を依頼する」で、同じ目的と履歴を引き継いで続けられます。' };
   const issue = !channel.ready ? channel : run?.state === 'stopped'
     ? { code: 'task_stopped', reason: 'This task was stopped. Review the original conversation and explicitly request resumption before continuing.' } : run && !run.managed && !canUpgradeDelivery(run)
     ? { code: 'existing_loop', reason: 'This conversation already has a Delivery Loop. Use its existing controls.' }
@@ -100,6 +104,22 @@ function autoContinueState(record, isRunning, availability, readiness = null) {
     autoContinueReason: record.run ? 'Continuing the original task with progress and approval checks.' : isRunning ? 'Waiting for the original turn to finish.' : 'Checking settled requests for worthwhile remaining work.' };
 }
 
+// Local consent changes independently of provider history pagination. Reuse the
+// verified provider capabilities; a saved preference grants no new admission.
+export function projectSessionAutoContinue(candidate, record) {
+  if (!record || record.provider !== candidate.provider || record.session !== candidate.session ||
+      record.cwd !== candidate.cwd || candidate.hostId && candidate.hostId !== 'local') return candidate;
+  const availability = candidate.provider === 'codex' && record.admission?.source
+    ? autoContinueAvailability(record.run, codexContinuationChannel(record.admission.source, record.admission.model || candidate.model))
+    : candidate.autoContinueAvailability || { canEnable: candidate.capabilities?.canAutoContinue === true };
+  const enabled = candidate.archived !== true && record.providerArchived !== true && record.autoContinue === true;
+  const setting = enabled ? record : { ...record, autoContinue: false };
+  return { ...candidate, autoContinueAvailability: availability, autoContinue: enabled, autoContinueEpoch: enabled ? record.autoContinueEpoch : null,
+    tracked: typeof record.tracked === 'boolean' ? record.tracked : record.monitor === true, monitor: record.monitor === true,
+    ...autoContinueState(setting, candidate.isRunning,
+      availability, candidate.dispatchReadiness) };
+}
+
 function initialDiagnosisPlan(objective, contextBootstrap = false) {
   const action = { kind: 'read', scope: 'task', summary: contextBootstrap ? 'Understand the original user request and current progress without changing files' : 'Inspect the selected conversation and acceptance evidence without changing files' };
   return {
@@ -139,21 +159,41 @@ function navigationParent(item, record) {
       : record?.parentSession || item.parentSession;
 }
 
-export async function discoverSessions({ root, openClient = openCodexAppServer, listClaude = listClaudeSessions,
-  inspectProcess = processIdentity, now: requestedNow, signal, listCodexTitles = readCodexTitles, listCodexChildren = readCodexChildSessions, codexHome, connectedProviders = ['codex', 'claude'], includeArchived = false, includeSelectionCandidates = false } = {}) {
+export async function discoverSessions(options = {}) {
+  if (options.onProgress && !options.catalogSnapshot) return discoverProgressively({ ...options, discover: discoverSessionCatalog });
+  return discoverSessionCatalog(options);
+}
+
+async function discoverSessionCatalog({ root, openClient = openCodexAppServer, listClaude = listClaudeSessions,
+  inspectProcess = processIdentity, now: requestedNow, signal, listCodexTitles = readCodexTitles, listCodexChildren = readCodexChildSessions, codexHome, connectedProviders = ['codex', 'claude'], includeArchived = false, includeSelectionCandidates = false, catalogSnapshot, recordSnapshot, archiveReconciliations = new Map(), readRecords = listRecords, onProgress } = {}) {
   const now = requestedNow ?? Date.now();
   const assertActive = () => { if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation discovery was cancelled.'); };
   assertActive();
   const connected = new Set(connectedProviders);
-  const records = (await listRecords(root)).filter(record => connected.has(record.provider));
+  const records = (recordSnapshot || await readRecords(root)).filter(record => connected.has(record.provider));
   const priorities = records.filter(retainedSession);
   let archivedCodex = [];
   let discovered = [], codexError = null, codexReasonCode = null, claude = [], claudeError = null;
   let archiveStates = new Map();
-  await Promise.all([
+  const progress = async snapshot => {
+    if (!onProgress || signal?.aborted) return;
+    const observed = new Set([...(snapshot.discovered || []), ...(snapshot.claude || []), ...(snapshot.archivedCodex || [])]
+      .map(item => `${item.provider}:${item.session}`));
+    const value = await discoverSessionCatalog({ root, inspectProcess, now: requestedNow, signal, connectedProviders, includeArchived, codexHome,
+      // Pages reuse this attempt's records. Do not rescan or project the entire
+      // retained corpus for every page; the complete catalog still includes it.
+      catalogSnapshot: snapshot, recordSnapshot: records.filter(record => observed.has(`${record.provider}:${record.session}`)), archiveReconciliations,
+      listCodexChildren: async () => [], listCodexTitles: async () => new Map() });
+    if (!signal?.aborted) await onProgress(value);
+  };
+  if (catalogSnapshot) {
+    discovered = catalogSnapshot.discovered || []; claude = catalogSnapshot.claude || []; archivedCodex = catalogSnapshot.archivedCodex || [];
+    for (const item of archivedCodex) archiveStates.set(item.session, true);
+  } else await Promise.all([
     (async () => {
       try { if (connected.has('codex')) discovered = await withClient(openClient, async client => {
         const active = await listCodexSessions({ client, all: true, signal, inspectState: true, codexHome,
+          onPage: async items => { discovered = [...items]; await progress({ discovered, archivedCodex }); },
           prioritySessions: priorities.filter(record => record.provider === 'codex').map(record => record.session) });
         if (includeArchived) {
           const observedArchives = new Map();
@@ -167,8 +207,12 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
             }
             return response;
           } };
-          try { await listCodexSessions({ client: archiveClient, all: true, signal, archived: true }); }
-          catch { /* Keep positive archive pages even if a later page fails. */ }
+          try { await listCodexSessions({ client: archiveClient, all: true, signal, archived: true,
+            onPage: async () => { archivedCodex = [...observedArchives.values()]; await progress({ discovered, archivedCodex }); } }); }
+          catch (error) {
+            codexError = 'Codex archive discovery incomplete. Refresh to retry.';
+            codexReasonCode = error?.code || 'session_metadata_unavailable';
+          }
           archivedCodex = [...observedArchives.values()];
         }
         const ids = new Set(active.map(item => item.session));
@@ -182,7 +226,7 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       }
     })(),
     (async () => {
-      try { if (connected.has('claude')) claude = await listClaude({ signal, all: true,
+      try { if (connected.has('claude')) claude = await listClaude({ signal, all: true, onProgress: items => { claude = items; return progress({ claude }); },
         prioritySessions: priorities.filter(record => record.provider === 'claude').map(record => record.session) }); }
       catch { claudeError = 'Claude conversation discovery unavailable.'; }
     })(),
@@ -195,11 +239,22 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
     const claudeItem = record.provider === 'claude' ? claude.find(item => item.session === record.session && item.cwd === record.cwd) : null;
     const archiveState = record.provider === 'codex' ? archiveStates.get(record.session) ?? (activeCodex.has(record.session) ? false : undefined) : claudeItem?.archived;
     if (typeof archiveState !== 'boolean') continue;
+    const key = `${record.provider}:${record.session}`;
+    const reconciled = archiveReconciliations.get(key);
+    if (reconciled?.archived === archiveState) {
+      records[index] = reconciled.record;
+      continue;
+    }
+    // Pages repeat an ever-growing prefix. Persist positive archive fencing
+    // before exposing it once, rather than repeatedly refreshing the same old
+    // observation and contending with hook writers on every page. This map is
+    // private to one scoped attempt; execution still reads fresh durable state.
+    const remember = () => archiveReconciliations.set(key, { archived: archiveState, record: records[index] });
     const isArchived = archiveState;
     if (isArchived) await recordProviderArchive(root, record.provider, record.session, true, now);
-    if (isArchived && record.providerArchived === true) continue;
-    if (!isArchived && !(record.providerArchived === true && archiveState === false)) continue;
-    try { records[index] = await updateRecord(root, record.provider, record.session, current => {
+    if (isArchived && record.providerArchived === true) { remember(); continue; }
+    if (!isArchived && !(record.providerArchived === true && archiveState === false)) { remember(); continue; }
+    try { const updated = await updateRecord(root, record.provider, record.session, current => {
       if (!current) return current;
       current.providerArchived = isArchived;
       if (isArchived) {
@@ -212,11 +267,16 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       }
       return current;
     });
+      if (updated) records[index] = updated;
       if (!isArchived) await recordProviderArchive(root, record.provider, record.session, false, now);
+      remember();
     } catch {
       // Reconciliation can contend with a hook writer or an unreclaimable
       // legacy lock. Preserve stored state and retry on the next refresh;
       // one record must not discard either provider's entire catalog.
+      // A successfully persisted positive fence already revokes execution.
+      // Retry its JSON reconciliation on the next attempt, not each old prefix.
+      if (isArchived) remember();
     }
   }
   assertActive();
@@ -248,9 +308,11 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
     const archived = record.providerArchived === true || record.provider === 'codex' && archiveStates.get(record.session) === true;
     if (archived && !includeArchived) continue;
     const key = `${record.provider}:${record.session}`;
-    // A hook observation can belong to an AI-created worker. Only explicit
-    // supervision may restore a conversation absent from provider discovery.
-    if (!byKey.has(key) && (retainedSession(record) || includeArchived && record.listHidden === true || requiredAncestors.has(key) && (record.observedAt || record.admission?.validatedAt))) byKey.set(key, {
+    // A saved stop must remain visible when the provider catalog is unavailable.
+    // This restores navigation only: the stopped run and unavailable provider
+    // still prohibit continuation. Bare hook observations remain insufficient.
+    const savedStopDuringOutage = record.run?.state === 'stopped' && Boolean(record.provider === 'codex' ? codexError : claudeError);
+    if (!byKey.has(key) && (retainedSession(record) || savedStopDuringOutage || includeArchived && record.listHidden === true || requiredAncestors.has(key) && (record.observedAt || record.admission?.validatedAt))) byKey.set(key, {
       provider: record.provider, session: record.session, cwd: record.cwd, title: record.listMetadata?.title || '', createdAt: record.listMetadata?.createdAt ?? null, archived, source: record.admission?.source || 'hook',
       lastActivityAt: record.listMetadata?.lastActivityAt ?? record.observedAt ?? record.admission?.validatedAt ?? record.run?.updatedAt ?? null,
       observation: { source: record.admission?.source || `${record.provider}_hook`, observedAt: record.observedAt || record.admission?.validatedAt || null },
@@ -345,6 +407,8 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       ...(item.latestTurnId ? { latestTurnId: item.latestTurnId } : {}),
       ...(item.providerGoal !== undefined ? { providerGoal: item.providerGoal } : {}),
       ...(item.goalReadState ? { goalReadState: item.goalReadState } : {}),
+      // Consent can be saved while runtime checks are pending or failing.
+      controllerCanSetAutoContinue: !archived,
       tracked: typeof record?.tracked === 'boolean' ? record.tracked : record?.monitor === true,
       listPinned: record?.listPinned === true, listPinScopes: record?.listPinScopes || [],
       providerArchived: archived, localHidden: record?.listHidden === true,
@@ -416,12 +480,21 @@ function requireAutoContinueTask(record) {
 // existing task. Desktop switches send `initialContinuationPolicy`: a default
 // for first enrollment only, decided under the record lock so a stale catalog
 // can neither fail ON for an ordinary loop nor change its policy or budgets.
+// Desktop consent is independent of execution readiness. The target is selected
+// by the host from its catalog, never accepted from a native command payload.
+export async function saveSessionAutoContinuePreference(options) {
+  return setSessionAutoContinue({ ...options, preferenceOnly: true });
+}
+
 export async function setSessionAutoContinue({ root, provider, session, enabled, continuationPolicy, initialContinuationPolicy, ...options }) {
   if (!['codex', 'claude'].includes(provider) || typeof enabled !== 'boolean') throw new Error('Unsupported automatic continuation request.');
   const link = enabled ? await requireProviderLink({ root, provider, expectedEpoch: options.expectedProviderEpoch }) : null;
   let discoveredAdmission;
-  const purposeRules = enabled && provider === 'codex' ? await loadPurposeRuleSet() : null;
-  if (enabled) {
+  const preferenceOnly = options.preferenceOnly === true;
+  const target = options.target;
+  const validTarget = target?.provider === provider && target?.session === session && typeof target.cwd === 'string' && isAbsolute(target.cwd);
+  const purposeRules = enabled && provider === 'codex' && !preferenceOnly ? await loadPurposeRuleSet() : null;
+  if (enabled && !preferenceOnly) {
     const record = await readRecord(root, provider, session);
     if (record?.providerArchived === true) throw Object.assign(new Error('Restore the original provider conversation before enabling automatic continuation.'), { code: 'session_archived' });
     requireAutoContinueTask(record);
@@ -445,6 +518,15 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
   }
   const updated = await updateRecord(root, provider, session, async previous => {
     if (enabled) await requireProviderLink({ root, provider, expectedEpoch: link.epoch });
+    if (enabled && preferenceOnly) {
+      if (previous && validTarget && previous.cwd !== target.cwd) throw Object.assign(new Error('Session workspace changed; refresh its metadata.'), { code: 'session_workspace_changed' });
+      if (!previous) {
+        if (!validTarget) throw Object.assign(new Error('Select a known conversation before saving its preference.'), { code: 'session_metadata_unavailable' });
+        // No filesystem/process/model probe and no provider call at save time.
+        previous = { schemaVersion: 1, provider, session, cwd: target.cwd, run: null };
+        if (hasAutoContinueAdmission({ ...previous, admission: options.admission }, provider, session)) previous.admission = { ...options.admission };
+      }
+    }
     if (enabled && discoveredAdmission) {
       if (previous && previous.cwd !== discoveredAdmission.cwd) throw Object.assign(new Error('Session workspace changed; refresh its metadata.'), { code: 'session_workspace_changed' });
       // An admission written while saving is authoritative. Never overwrite its
@@ -452,8 +534,8 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
       previous = previous?.admission ? previous : { ...(previous || { schemaVersion: 1, provider, session, cwd: discoveredAdmission.cwd, run: null }), admission: discoveredAdmission };
     }
     if (!previous) throw new Error('Refresh this conversation before changing automatic continuation.');
-    if (enabled && previous.providerArchived === true) throw new Error('Restore the original provider conversation before enabling automatic continuation.');
-    if (enabled) {
+    if (enabled && previous.providerArchived === true) throw Object.assign(new Error('Restore the original provider conversation before enabling automatic continuation.'), { code: 'session_archived' });
+    if (enabled && !preferenceOnly) {
       const channel = provider === 'claude' ? await liveClaudeChannel(previous,
         { session, cwd: previous.cwd, observation: { source: previous.admission?.source } }, options.inspectProcess || processIdentity)
         : codexContinuationChannel(previous.admission?.source, previous.admission?.model);
@@ -474,12 +556,14 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
     const next = { ...previous, ...(enabled && link.consentEpoch ? { providerConsentEpoch: link.consentEpoch } : {}), autoContinue: enabled, autoContinueEpoch: epoch,
       ...(enabled ? { tracked: true, monitor: true, autoContinueSettings: settings } : { tracked: false, monitor: false }) };
     // Adopt existing supervision without restarting it or renewing its budgets.
-    if (next.run?.managed) {
+    const preserveTerminal = preferenceOnly && (enabled || TERMINAL_RUNS.has(next.run?.state));
+    if (next.run?.managed && !preserveTerminal) {
       next.run.managed.autoContinueEpoch = epoch;
-      if (purposeRules && next.run.managed.resumeChannel === 'codex_app_server') {
-        next.run.managed.purpose = { ...next.run.managed.purpose, enabled: true, version: 2, decisionPolicy: 'llm-first-hc102',
+      if (enabled && next.run.managed.resumeChannel === 'codex_app_server') {
+        if (purposeRules) next.run.managed.purpose = { ...next.run.managed.purpose, enabled: true, version: 2, decisionPolicy: 'llm-first-hc102',
           failureBudgetMode: purposeFailureMode(next),
           ruleDigest: purposeRules.digest, ruleIds: purposeRules.rules.map(rule => rule.id) };
+        else if (next.run.managed.purpose) next.run.managed.purpose.enabled = true;
         if (next.run.state === 'paused' && next.run.reason === 'Automatic continuation paused by user.') { next.run.state = 'recovery_required'; next.run.recoveryCause = 'session_supervision'; next.run.managed.autoRecovery = true; }
         // OFF keeps the current native turn alive. Re-enabling during that
         // same turn restores future continuation without starting another turn.
@@ -489,7 +573,7 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
     }
     // The desktop preference is an explicit human control too: an old decision
     // card must not undo this switch, even when no provider checkpoint arrived.
-    if (next.run) advanceDeliveryControlRevision(next.run);
+    if (next.run && !preserveTerminal) advanceDeliveryControlRevision(next.run);
     return next;
   });
   // Consent is durable now. Provider reads and ordinary-loop promotion belong
@@ -636,19 +720,33 @@ export async function answerSession({ root, provider, session, taskId, expectedR
 // selection changed in Codex is configuration, not a different task or authority.
 export async function resumeSession({ openClient = openCodexAppServer, ...options }) {
   const record = await readRecord(options.root, options.provider, options.session);
-  if (options.provider !== 'codex' || record?.run?.managed?.resumeChannel !== 'codex_app_server')
+  const stoppedStandard = options.provider === 'codex' && !record?.run?.managed &&
+    canExplicitlyResumeStopped(record?.run, { standard: true });
+  if (options.provider !== 'codex' || !stoppedStandard && record?.run?.managed?.resumeChannel !== 'codex_app_server')
     return controlDelivery({ ...options, action: 'resume' });
-  if (record.run.managed.taskId !== options.taskId) throw new Error('Managed task identity changed; refresh its status.');
+  if (!stoppedStandard && record.run.managed.taskId !== options.taskId) throw new Error('Managed task identity changed; refresh its status.');
   const link = await requireProviderLink(options);
   const client = await openClient({ isolateConnectors: true });
   let metadata;
-  try { metadata = await readCodexSession(client, options.session); }
+  try {
+    metadata = await readCodexSession(client, options.session);
+    // thread/read may omit runtime status. Observe the latest native turn
+    // instead of treating the omitted field as either idle or an error.
+    if (stoppedStandard && metadata.isRunning === undefined) {
+      const observation = await readCodexObservation(client, options.session);
+      if (typeof observation.isRunning === 'boolean') metadata.isRunning = observation.isRunning;
+    }
+  }
   finally { await client.close(); }
   const cwd = await realpath(metadata.cwd);
-  if (cwd !== record.cwd || !metadata.model) throw new Error('Original Codex workspace or model is unavailable; inspect before resuming.');
+  if (cwd !== record.cwd || !metadata.model || stoppedStandard && (metadata.isRunning !== false || metadata.archived || metadata.observation?.source !== 'codex_app_server')) throw new Error('Original Codex workspace, idle observation or model is unavailable; inspect before resuming.');
+  const rules = stoppedStandard ? await loadPurposeRuleSet() : null;
   await requireProviderLink({ ...options, expectedEpoch: link.epoch });
   return controlDelivery({ ...options, action: 'resume',
     expectedRunId: options.expectedRunId ?? record.run.id,
     expectedRevision: options.expectedRevision ?? deliveryDecisionRevision(record.run),
-    resumeObservation: { session: metadata.session, cwd, model: metadata.model, source: 'codex_app_server', providerEpoch: link.epoch } });
+    resumeObservation: { session: metadata.session, cwd, model: metadata.model, source: 'codex_app_server', providerEpoch: link.epoch,
+      ...(stoppedStandard && metadata.nativeSandbox ? { nativeSandbox: metadata.nativeSandbox, nativeSandboxSource: metadata.nativeSandboxSource } : {}),
+      ...(rules ? { purpose: { enabled: true, version: 2, decisionPolicy: 'llm-first-hc102', failureBudgetMode: 'hard',
+        ruleDigest: rules.digest, ruleIds: rules.rules.map(rule => rule.id) } } : {}) } });
 }

package/src/session-supervision/owner-transport.js

@@ -1,8 +1,10 @@
+import { createDesktopFrameWriter } from '../desktop-frame-writer.js';
 import { createServer, createConnection } from 'node:net';
 import { chmod, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
 import { createInterface } from 'node:readline';
+import { normalizeWebOrigin } from '../web-origin.js';
 
 export const ownerSocketPath = (root, platform = process.platform) => platform === 'win32'
   ? '\\\\.\\pipe\\simy-controller-' + createHash('sha256').update(root).digest('hex').slice(0, 32)
@@ -11,19 +13,22 @@ const socketPath = ownerSocketPath;
 // The socket and nonce are accessible only to the local OS account. Application
 // account/provider checks still run in the owner's ordinary command handler.
 export async function createOwnerTransport({ root, nonce, allowedActions, dispatch, allowControllerArchive = false }) {
-  const peers = new Set(), requests = new Map();
+  const writers = new WeakMap();
+  const peers = new Set(), subscribers = new Set(), requests = new Map();
   let latest;
   const send = (peer, frame) => {
     if (peer.destroyed) return;
-    if (peer.writableLength > 8 * 1024 * 1024) { peer.destroy(); return; }
-    peer.write(JSON.stringify(frame) + '\n');
+    if (frame.type !== 'status' && peer.writableLength > 8 * 1024 * 1024) { peer.destroy(); return; }
+    writers.get(peer).write(JSON.stringify(frame) + '\n', frame.type === 'status');
   };
   const server = createServer(peer => {
     peer.setEncoding('utf8');
+    const writer = createDesktopFrameWriter(peer);
+    writers.set(peer, writer);
     let authenticated = false, controllerArchive = false, buffer = '';
     const timeout = setTimeout(() => peer.destroy(), 5000);
     peer.on('error', () => {});
-    peer.on('close', () => { clearTimeout(timeout); peers.delete(peer); for (const [id, item] of requests) if (item.peer === peer) requests.delete(id); });
+    peer.on('close', () => { writer.close(); clearTimeout(timeout); peers.delete(peer); subscribers.delete(peer); for (const [id, item] of requests) if (item.peer === peer) requests.delete(id); });
     peer.on('data', chunk => {
       buffer += chunk.toString();
       if (buffer.length > 16384) { peer.destroy(); return; }
@@ -35,7 +40,12 @@ export async function createOwnerTransport({ root, nonce, allowedActions, dispat
         if (!authenticated) {
           if (command.nonce !== nonce) { peer.destroy(); return; }
           authenticated = true; controllerArchive = allowControllerArchive && command.client === 'archive-controller'; clearTimeout(timeout); peers.add(peer);
-          if (latest) send(peer, latest);
+          // One-shot controls need their result, not multi-megabyte broadcasts
+          // that can fill the write queue before the result is sent.
+          if (command.subscribeStatus !== false) {
+            subscribers.add(peer);
+            if (latest) send(peer, latest);
+          }
           continue;
         }
         if (!allowedActions.has(command.action) || typeof command.id !== 'string' || command.id.length > 128 || command.hostId && command.hostId !== 'local' && !(controllerArchive && ['session_archive', 'session_restore', 'session_provider_setup'].includes(command.action))) {
@@ -59,7 +69,7 @@ export async function createOwnerTransport({ root, nonce, allowedActions, dispat
         const item = requests.get(frame.id);
         if (item) { requests.delete(frame.id); send(item.peer, { ...frame, id: item.id }); }
       } else if (frame.type === 'status' || frame.type === 'notify' && (!frame.hostId || frame.hostId === 'local')) {
-        for (const peer of peers) send(peer, frame);
+        for (const peer of subscribers) send(peer, frame);
       }
     },
     async close() { for (const peer of peers) peer.destroy(); await new Promise(resolve => server.close(resolve)); },
@@ -68,7 +78,7 @@ export async function createOwnerTransport({ root, nonce, allowedActions, dispat
 
 // Returns false only when no compatible owner endpoint exists. Never starts a
 // second owner, kills a process, or converts a disconnect into an execution retry.
-export async function relayToOwner({ root, input = process.stdin, output = process.stdout }) {
+export async function relayToOwner({ root, webOrigin, input = process.stdin, output = process.stdout }) {
   let owner;
   try { owner = JSON.parse(await readFile(join(root, 'desktop-app.lock', 'owner.json'), 'utf8')); }
   catch (error) { if (error.code === 'ENOENT') return false; throw error; }
@@ -79,6 +89,11 @@ export async function relayToOwner({ root, input = process.stdin, output = proce
     peer.once('error', error => { clearTimeout(timer); if (['ENOENT','ECONNREFUSED'].includes(error.code)) resolve(false); else reject(error); });
   });
   if (!connected) return false;
+  try {
+    if (typeof owner?.nonce !== 'string' || !owner.nonce) throw new Error('Remote owner identity is unavailable.');
+    if (webOrigin && (!owner.webOrigin || normalizeWebOrigin(owner.webOrigin) !== normalizeWebOrigin(webOrigin)))
+      throw Object.assign(new Error('The existing SIMY owner belongs to another Web address. Keep its tasks and reconnect using its saved environment.'), { code: 'remote_owner_origin_mismatch' });
+  } catch (error) { peer.destroy(); throw error; }
   peer.write(JSON.stringify({ nonce: owner.nonce }) + '\n');
   peer.pipe(output, { end: false });
   const lines = createInterface({ input, crlfDelay: Infinity });
@@ -128,7 +143,7 @@ async function requestOwnerCommand({ root, command, signal, timeoutMs, client })
     peer.on('connect', () => {
       if (signal?.aborted) { abort(); return; }
       sent = true;
-      peer.write(JSON.stringify({ nonce: owner.nonce, ...(client ? { client } : {}) }) + '\n' + JSON.stringify(command) + '\n');
+      peer.write(JSON.stringify({ nonce: owner.nonce, subscribeStatus: false, ...(client ? { client } : {}) }) + '\n' + JSON.stringify(command) + '\n');
     });
     peer.on('error', error => finish(sent ? unknown() : connectionFailure(error)));
     peer.on('close', () => finish(Object.assign(new Error('SIMY disconnected before confirming the result. Refresh before retrying.'), { code: 'remote_operation_unknown' })));

package/src/session-supervision/progressive-discovery.js

@@ -0,0 +1,79 @@
+// A deadline releases the caller even when an adapter ignores cancellation.
+// The adapter still receives an abort signal; late values never reach the UI.
+export async function boundedDiscovery(work, { signal, timeoutMs = 30_000, historyTimeoutMs = timeoutMs, onDrain } = {}) {
+  const controller = new AbortController();
+  const startedAt = Date.now();
+  let historyStarted = false;
+  let timer, rejectStop;
+  const stopped = new Promise((_, reject) => { rejectStop = reject; });
+  const cancel = () => {
+    const error = signal?.reason || Object.assign(new Error('Conversation discovery cancelled.'), { code: 'cancelled' });
+    controller.abort(error); rejectStop(error);
+  };
+  signal?.addEventListener('abort', cancel, { once: true });
+  const expire = () => {
+    const error = Object.assign(new Error('Conversation discovery timed out. Refresh to retry.'), { code: 'discovery_timeout' });
+    controller.abort(error); rejectStop(error);
+  };
+  timer = setTimeout(expire, timeoutMs);
+  const startHistory = () => {
+    if (historyStarted || controller.signal.aborted) return;
+    historyStarted = true;
+    clearTimeout(timer);
+    // The background budget is measured from the original request. Repeated
+    // pages cannot postpone the absolute deadline indefinitely.
+    timer = setTimeout(expire, Math.max(0, startedAt + Math.max(timeoutMs, historyTimeoutMs) - Date.now()));
+  };
+  try {
+    if (signal?.aborted) cancel();
+    const operation = Promise.resolve().then(() => {
+      controller.signal.throwIfAborted(); return work(controller.signal, startHistory);
+    });
+    onDrain?.(operation.then(() => {}, () => {}));
+    return await Promise.race([stopped, operation]);
+  } finally {
+    clearTimeout(timer); signal?.removeEventListener('abort', cancel);
+    // Revoke callbacks retained by an adapter after its result settled.
+    if (!controller.signal.aborted) controller.abort();
+  }
+}
+
+export async function discoverProgressively({ discover, onProgress, signal, timeoutMs = 30_000, historyTimeoutMs = timeoutMs,
+  connectedProviders = ['codex', 'claude'], onDrain, ...options }) {
+  const values = new Map(), complete = new Set(), settled = new Set();
+  let notifications = Promise.resolve();
+  const snapshot = () => ({
+    sessions: [...values.values()].flatMap(value => value.sessions || []),
+    selectionCandidates: [...values.values()].flatMap(value => value.selectionCandidates || []),
+    providers: Object.fromEntries(['codex', 'claude'].map(provider => [provider,
+      values.get(provider)?.providers?.[provider] || { discovery: connectedProviders.includes(provider) ? 'loading' : 'disconnected', reason: null }])),
+    completeProviders: [...complete], historyLoading: settled.size < connectedProviders.length,
+    refreshedAt: Date.now(),
+  });
+  const notify = () => {
+    const value = snapshot();
+    notifications = notifications.then(() => { signal?.throwIfAborted(); return onProgress(value); });
+    return notifications;
+  };
+  await Promise.all(connectedProviders.map(async provider => {
+    try {
+      const value = await boundedDiscovery((childSignal, startHistory) => discover({ ...options, signal: childSignal,
+        connectedProviders: [provider], onProgress: async value => {
+          childSignal.throwIfAborted();
+          if (value.sessions?.length) startHistory();
+          values.set(provider, value); await notify();
+        } }), { signal, timeoutMs, historyTimeoutMs, onDrain });
+      signal?.throwIfAborted();
+      values.set(provider, value);
+      if (['ready', 'local_index'].includes(value.providers?.[provider]?.discovery)) complete.add(provider);
+    } catch (error) {
+      if (signal?.aborted) throw error;
+      const previous = values.get(provider) || { sessions: [] };
+      values.set(provider, { ...previous, providers: { [provider]: { discovery: 'unavailable',
+        reasonCode: error.code || 'discovery_failed', reason: error.message } } });
+    }
+    settled.add(provider); await notify();
+  }));
+  await notifications;
+  return snapshot();
+}

package/src/session-supervision/remote-entry.js

@@ -6,17 +6,20 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { adoptInstalledRuntime, pinnedWorkflowSource } from '../delivery-hooks/local-runtime.js';
+import { attachRemoteService } from './remote-service.js';
+import { resolveWebOrigin } from '../web-origin.js';
 process.env.SIMY_REMOTE_CHILD = '1';
 process.env.SIMY_AUTO_UPDATE = '0';
 const root = process.env.SIMY_HOME?.trim() || join(homedir(), '.simy');
+const webOrigin = resolveWebOrigin();
 try {
-  if (await relayToOwner({ root })) process.exit(0);
+  if (await relayToOwner({ root, webOrigin })) process.exit(0);
   await adoptInstalledRuntime({ root });
   const selected = await pinnedWorkflowSource({ root });
   const host = await import(selected ? pathToFileURL(join(selected, 'src/desktop-host.js')).href : '../desktop-host.js');
   if (host.remoteSessionProtocol !== 1) throw new Error('Update the remote SIMY runtime.');
-  host.startDesktopEntry();
-} catch {
-  process.stdout.write(JSON.stringify({ type: 'error', message: 'Remote SIMY could not start. Update its runtime and check its existing desktop connection.' }) + '\n');
+  await attachRemoteService({ root, webOrigin });
+} catch (error) {
+  process.stdout.write(JSON.stringify({ type: 'error', ...(error.code === 'remote_owner_origin_mismatch' ? { code: error.code } : {}), message: 'Remote SIMY could not start. Update its runtime and check its existing desktop connection.' }) + '\n');
   process.exitCode = 1;
 }

package/src/session-supervision/remote-host-recovery.js

@@ -0,0 +1,21 @@
+// A live transport and an executable AI provider are separate observations.
+// Never use cached private provider status to diagnose a disconnected host.
+export function remoteHostRecovery({ state, enabled = true, status, ready = false, fresh = false, errorCode } = {}) {
+  if (enabled === false) return { code: 'disconnected', action: 'connect' };
+  if (errorCode === 'update_required') return { code: 'update_required', action: 'settings' };
+  if (errorCode === 'simy_auth_required') return { code: 'simy_auth_required', action: 'login' };
+  if (errorCode === 'access_required') return { code: 'access_required', action: 'login' };
+  if (state === 'connecting') return { code: 'connecting', action: null };
+  if (!fresh || !status || state === 'unavailable') return { code: 'transport_unavailable', action: 'reconnect' };
+  if (status.auth?.state !== 'signed_in') return { code: 'simy_auth_required', action: 'login' };
+  if (!ready || status.access?.state !== 'ready') return { code: 'access_required', action: 'login' };
+  for (const provider of ['codex', 'claude']) {
+    // Only providers explicitly connected by this host's user need recovery.
+    if (status.providerLinks?.[provider]?.connected !== true) continue;
+    const observed = status.providers?.[provider] || status[provider];
+    if (['missing', 'outdated'].includes(observed?.state)) return { code: 'provider_setup_required', action: 'settings', provider };
+    if (observed?.state === 'signed_out') return { code: 'provider_login_required', action: 'settings', provider };
+    if (observed?.state !== 'ready') return { code: 'provider_unverified', action: 'refresh', provider };
+  }
+  return { code: 'ready', action: null };
+}