@awak-app/simy-cli 0.7.37 → 0.7.38

package/src/codex-plugins/simy/hooks/registered-requirement-checker.mjs

@@ -0,0 +1,201 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { cp, lstat, mkdir, open, readFile, realpath, rm, stat, writeFile } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve } from 'node:path';
+import { spawn } from 'node:child_process';
+import { normalizeRequirementContract } from './requirement-acceptance.mjs';
+import { workspaceIdentity } from './purpose-workspace.mjs';
+
+const handles = new WeakMap();
+const observers = new WeakSet();
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+const objectiveIdentity = objective => digest(typeof objective === 'string' ? objective.trim().slice(0, 4000) : '');
+const sha = value => /^[a-f0-9]{64}$/.test(value || '');
+const inside = (parent, path) => { const rel = relative(parent, path); return !rel || !rel.startsWith('..') && !isAbsolute(rel); };
+const identity = info => Object.fromEntries(['dev', 'ino', 'mode', 'size', 'mtimeMs', 'ctimeMs'].map(key => [key, info[key]]));
+const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const registrations = root => join(root, 'host-requirement-checkers');
+const registrationPath = (root, id) => join(registrations(root), `${id}.json`);
+
+async function readJSON(path, limit = 128 * 1024) {
+  if ((await stat(path)).size > limit) throw new Error('Checker document exceeds its bound.');
+  return JSON.parse(await readFile(path, 'utf8'));
+}
+async function pinFile(file, cwd) {
+  if (!isAbsolute(file?.path) || !sha(file.sha256)) throw new Error('Checker inputs require absolute paths and SHA-256 pins.');
+  const path = await realpath(file.path);
+  if (inside(cwd, path)) throw new Error('Checker inputs must be independent of the candidate workspace.');
+  const before = await lstat(path);
+  if (!before.isFile() || digest(await readFile(path)) !== file.sha256 || !same(identity(before), identity(await lstat(path))))
+    throw new Error('Pinned checker input changed.');
+  return { path, sha256: file.sha256, identity: identity(before) };
+}
+
+// Host-only enrollment capability. JSON read from managed-file/checkpoint cannot
+// recreate a WeakMap handle. This is not an OS sandbox against same-user Bash.
+export async function registerRequirementChecker({ root, provider, session, cwd, objective, publicRequest,
+  command, runtime, requirements, timeoutMs = 140_000, cancellationGraceMs = 1000 }) {
+  if (provider !== 'claude') throw new Error('Registered requirement execution currently supports the Claude live-hook channel only.');
+  cwd = await realpath(cwd);
+  root = resolve(root);
+  if (inside(cwd, root)) throw new Error('Host checker state must be outside the task workspace.');
+  await mkdir(registrations(root), { recursive: true });
+  root = await realpath(root);
+  if (inside(cwd, root)) throw new Error('Host checker state resolves inside the task workspace.');
+  if (typeof objective !== 'string' || !objective.trim() || typeof session !== 'string' || !session ||
+      !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 180_000 ||
+      !Number.isSafeInteger(cancellationGraceMs) || cancellationGraceMs < 1000 || cancellationGraceMs > 45_000 ||
+      !runtime || !sha(runtime.digest) || !['public-docker-v1', 'deterministic-fixture'].includes(runtime.profile) ||
+      !isAbsolute(command?.executable) || !Array.isArray(command.args) || command.args.some(arg => typeof arg !== 'string') ||
+      !Array.isArray(command.pins) || !command.pins.length || command.pins.length > 100)
+    throw new Error('Invalid host checker registration.');
+  const pins = await Promise.all(command.pins.map(file => pinFile(file, cwd)));
+  if (new Set(pins.map(pin => pin.path)).size !== pins.length) throw new Error('Duplicate checker input.');
+  const executable = await realpath(command.executable);
+  if (!pins.some(pin => pin.path === executable)) throw new Error('Checker executable must be pinned.');
+  const request = await pinFile(publicRequest, cwd);
+  const environment = command.env || {};
+  if (Object.entries(environment).some(([key, value]) => !/^[A-Z][A-Z0-9_]*$/.test(key) || typeof value !== 'string' ||
+      /^(NODE_OPTIONS|NODE_PATH|PYTHONPATH|PYTHONHOME|LD_|DYLD_)/.test(key))) throw new Error('Invalid fixed checker environment.');
+  const checker = { command: { executable, args: [...command.args], env: { ...environment } }, pins,
+    runtime: structuredClone(runtime), timeoutMs, cancellationGraceMs };
+  const contract = normalizeRequirementContract({ schemaVersion: 1, checkVersion: `registered-${digest(JSON.stringify(checker))}`, requirements });
+  const spec = { schemaVersion: 1, id: randomUUID(), provider, session, cwd, objectiveHash: objectiveIdentity(objective), publicRequest: request, checker, contract };
+  const bytes = JSON.stringify(spec), binding = { id: spec.id, digest: digest(bytes) };
+  await writeFile(registrationPath(root, spec.id), bytes, { flag: 'wx', mode: 0o600 });
+  await mkdir(join(registrations(root), 'executions'), { recursive: true });
+  const handle = Object.freeze({ contract: structuredClone(contract) });
+  handles.set(handle, { root, spec, binding });
+  return handle;
+}
+
+export async function bindRequirementChecker(handle, { root, provider, session, cwd, objective }) {
+  const registration = handles.get(handle);
+  if (!registration || registration.root !== await realpath(root) || registration.spec.provider !== provider ||
+      registration.spec.session !== session || registration.spec.cwd !== await realpath(cwd) ||
+      registration.spec.objectiveHash !== objectiveIdentity(objective)) throw new Error('A matching host enrollment capability is required.');
+  await loadRegistration(root, registration.binding, true);
+  return { requirementChecker: { ...registration.binding }, requirementContract: structuredClone(registration.spec.contract) };
+}
+
+async function loadRegistration(root, binding, full = false) {
+  if (!/^[a-f0-9-]{36}$/.test(binding?.id || '') || !sha(binding?.digest)) throw new Error('Invalid enrolled checker binding.');
+  const bytes = await readFile(registrationPath(root, binding.id), 'utf8');
+  if (Buffer.byteLength(bytes) > 128 * 1024 || digest(bytes) !== binding.digest) throw new Error('Host checker registration changed.');
+  const spec = JSON.parse(bytes);
+  for (const file of [...spec.checker.pins, spec.publicRequest]) {
+    if (!same(identity(await lstat(file.path)), file.identity) ||
+        full && digest(await readFile(file.path)) !== file.sha256) throw new Error('Pinned checker input changed.');
+  }
+  return spec;
+}
+
+// Stop only checks the enrollment and inexpensive source metadata. Actual
+// execution validates the complete pinned bytes both before and afterwards.
+export async function registeredCheckerCurrent(root, binding) {
+  try { await loadRegistration(root, binding); return true; } catch { return false; }
+}
+
+export function receiptFromCaseReport(contract, candidateHash, report, evidenceRef) {
+  const expected = contract.requirements.flatMap(row => row.assertionIds);
+  const cases = report?.cases;
+  const complete = report?.schemaVersion === 1 && report.execution?.status === 'completed' && Array.isArray(cases) &&
+    cases.length === expected.length && new Set(cases.map(row => row?.id)).size === expected.length &&
+    cases.every(row => expected.includes(row?.id) && ['passed', 'failed'].includes(row.status));
+  return { schemaVersion: 1, contractHash: contract.contractHash, checkVersion: contract.checkVersion, candidateHash,
+    execution: { status: complete ? 'completed' : 'infrastructure_error', assertionCount: complete ? cases.length : 0 },
+    observations: complete ? contract.requirements.map(requirement => ({ requirementId: requirement.id,
+      status: cases.some(row => requirement.assertionIds.includes(row.id) && row.status === 'failed') ? 'failed' : 'verified',
+      assertionIds: requirement.assertionIds, evidenceRefs: [evidenceRef] })) : [] };
+}
+
+async function runProcess(spec, request, directory, signal) {
+  const stdout = await open(join(directory, 'stdout.log'), 'wx', 0o600);
+  const stderr = await open(join(directory, 'stderr.log'), 'wx', 0o600);
+  try {
+    signal.throwIfAborted();
+    const child = spawn(spec.command.executable, spec.command.args, {
+      cwd: directory, env: spec.command.env, stdio: ['pipe', stdout.fd, stderr.fd],
+    });
+    let killTimer;
+    const abort = () => { child.kill('SIGTERM'); killTimer ??= setTimeout(() => child.kill('SIGKILL'), spec.cancellationGraceMs ?? 1000); };
+    let inspecting = false;
+    const outputLimit = setInterval(async () => {
+      if (inspecting) return;
+      inspecting = true;
+      try { if ((await stdout.stat()).size + (await stderr.stat()).size > 8 * 1024 * 1024) abort(); }
+      catch { abort(); } finally { inspecting = false; }
+    }, 100);
+    const completion = new Promise(accept => {
+      let spawnError;
+      child.once('error', error => { spawnError = error; });
+      child.once('close', (code, terminationSignal) => accept({ code, signal: terminationSignal, ...(spawnError ? { error: spawnError.message } : {}) }));
+    });
+    signal.addEventListener('abort', abort, { once: true });
+    if (signal.aborted) abort();
+    child.stdin.on('error', () => {});
+    child.stdin.end(JSON.stringify(request));
+    try {
+      await writeFile(join(directory, 'process.json'), JSON.stringify({ pid: child.pid, launchedAt: new Date().toISOString() }), { flag: 'wx' });
+      return await completion;
+    } catch (error) { abort(); await completion; throw error;
+    } finally { clearTimeout(killTimer); clearInterval(outputLimit); signal.removeEventListener('abort', abort); }
+  } finally { await stdout.close(); await stderr.close(); }
+}
+
+export function registeredRequirementObserver({ root, binding, provider, session, runId, signal: outerSignal }) {
+  const observer = async ({ cwd, contract, candidateHash, signal = outerSignal }) => {
+    const spec = await loadRegistration(root, binding, true);
+    if (spec.provider !== provider || spec.session !== session || spec.cwd !== await realpath(cwd) ||
+        spec.contract.contractHash !== contract.contractHash) throw new Error('Registered checker target changed.');
+    const executions = join(registrations(root), 'executions', digest(JSON.stringify([binding, provider, session, runId, candidateHash])));
+    // Atomic one-use claim also covers a cold checkpoint subprocess. An unknown
+    // process is never replayed; a completed report has an explicit reuse link.
+    try { await mkdir(executions); }
+    catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      const result = await readJSON(join(executions, 'result.json'));
+      if (result.bindingDigest !== binding.digest || result.candidateHash !== candidateHash || result.status !== 'complete' || result.snapshotRemoved !== true)
+        throw new Error('Previous checker execution is unresolved; do not replay.');
+      const bytes = await readFile(join(executions, 'cases.json'));
+      if (digest(bytes) !== result.reportHash) throw new Error('Previous checker report changed.');
+      return receiptFromCaseReport(contract, candidateHash, JSON.parse(bytes), join(executions, 'result.json'));
+    }
+    await writeFile(join(executions, 'intent.json'), JSON.stringify({ binding, provider, session, runId, candidateHash,
+      createdAt: new Date().toISOString() }), { flag: 'wx' });
+    const controller = new AbortController();
+    const abort = () => controller.abort(signal.reason);
+    signal?.addEventListener('abort', abort, { once: true });
+    if (signal?.aborted) abort();
+    const timeout = setTimeout(() => controller.abort(new Error('Checker deadline exceeded.')), spec.checker.timeoutMs);
+    const snapshot = join(executions, 'candidate');
+    try {
+      const filter = path => !relative(cwd, path).split(/[\\/]/).some(part => ['.git', 'node_modules', '.npm-cache'].includes(part));
+      await cp(cwd, snapshot, { recursive: true, dereference: false, filter, preserveTimestamps: true });
+      if (await workspaceIdentity(snapshot, undefined, undefined, { signal: controller.signal }) !== candidateHash ||
+          await workspaceIdentity(cwd, root, undefined, { signal: controller.signal }) !== candidateHash) throw new Error('Candidate changed while freezing checker input.');
+      const process = await runProcess(spec.checker, { schemaVersion: 1, candidateHash, cwd: snapshot,
+        reportPath: join(executions, 'cases.json'), contract: spec.contract, runtime: spec.checker.runtime }, executions, controller.signal);
+      await loadRegistration(root, binding, true);
+      if (controller.signal.aborted || process.signal || process.error || ![0, 1].includes(process.code) ||
+          await workspaceIdentity(snapshot) !== candidateHash) throw new Error('Checker process or immutable input is unresolved.');
+      const report = await readJSON(join(executions, 'cases.json'));
+      const receipt = receiptFromCaseReport(contract, candidateHash, report, join(executions, 'result.json'));
+      if (receipt.execution.status !== 'completed' || process.code === 1 && !report.cases.some(row => row.status === 'failed')) throw new Error('Checker did not execute the complete required case set.');
+      await rm(snapshot, { recursive: true });
+      await writeFile(join(executions, 'result.json'), JSON.stringify({ status: 'complete', bindingDigest: binding.digest,
+        candidateHash, process, snapshotRemoved: true, reportHash: digest(await readFile(join(executions, 'cases.json'))) }), { flag: 'wx' });
+      return receipt;
+    } catch (error) {
+      await writeFile(join(executions, 'error.json'), JSON.stringify({ status: 'unresolved', message: error.message }), { flag: 'wx' });
+      throw error;
+    } finally {
+      clearTimeout(timeout); signal?.removeEventListener('abort', abort);
+      // Only our copied input, never the original workspace or Docker resources.
+      await rm(snapshot, { recursive: true, force: true });
+    }
+  };
+  observers.add(observer);
+  return observer;
+}
+
+export const isRegisteredRequirementObserver = observer => observers.has(observer);

package/src/codex-plugins/simy/hooks/requirement-acceptance.mjs

@@ -0,0 +1,69 @@
+import { createHash } from 'node:crypto';
+
+const hash = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const identifier = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,119}$/.test(value);
+const strings = (values, maximum) => Array.isArray(values) && values.length > 0 && values.length <= maximum &&
+  values.every(identifier) && new Set(values).size === values.length;
+
+// This opt-in contract is frozen at enrollment. Receipts cannot redefine its
+// requirements or replace a broad behavior requirement with a literal PASS file.
+export function normalizeRequirementContract(input) {
+  if (input?.schemaVersion !== 1 || !identifier(input.checkVersion) || !Array.isArray(input.requirements) ||
+      !input.requirements.length || input.requirements.length > 20) throw new Error('Invalid behavior requirement contract.');
+  const requirements = input.requirements.map(row => {
+    if (!identifier(row?.id) || typeof row.description !== 'string' || !row.description.trim() || row.description.length > 500 ||
+        !strings(row.assertionIds, 100)) throw new Error('Each behavior requirement needs an ID, description and distinct assertions.');
+    return { id: row.id, description: row.description, assertionIds: [...row.assertionIds].sort() };
+  }).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  if (new Set(requirements.map(row => row.id)).size !== requirements.length) throw new Error('Duplicate behavior requirement.');
+  const assertionIds = requirements.flatMap(row => row.assertionIds);
+  if (new Set(assertionIds).size !== assertionIds.length) throw new Error('Behavior assertion IDs must be unique across requirements.');
+  const contract = { schemaVersion: 1, checkVersion: input.checkVersion, requirements };
+  const contractHash = hash(contract);
+  if (input.contractHash !== undefined && input.contractHash !== contractHash) throw new Error('Behavior contract digest changed.');
+  return { ...contract, contractHash };
+}
+
+export function assessRequirementReceipt(contractInput, receipt, candidateHash) {
+  const contract = normalizeRequirementContract(contractInput);
+  const unknown = detail => contract.requirements.map(row => ({ requirementId: row.id, status: 'unknown', detail }));
+  if (!receipt || receipt.schemaVersion !== 1 || receipt.contractHash !== contract.contractHash ||
+      receipt.checkVersion !== contract.checkVersion || receipt.candidateHash !== candidateHash ||
+      !/^[a-f0-9]{64}$/.test(candidateHash || '')) return unknown('Missing or stale independently bound behavior observation.');
+  if (receipt.execution?.status !== 'completed' || !Number.isSafeInteger(receipt.execution.assertionCount) ||
+      receipt.execution.assertionCount <= 0) return unknown('Behavior observation did not execute assertions; infrastructure is unresolved.');
+  if (!Array.isArray(receipt.observations) || receipt.observations.length > 20) return unknown('Invalid behavior observation rows.');
+  const ids = receipt.observations.map(row => row?.requirementId);
+  if (new Set(ids).size !== ids.length || ids.some(id => !contract.requirements.some(row => row.id === id)))
+    return unknown('Duplicate or unexpected behavior observation rows.');
+  let observedCount = 0;
+  const rows = contract.requirements.map(requirement => {
+    const row = receipt.observations.find(item => item.requirementId === requirement.id);
+    if (!row || !['verified', 'failed', 'unknown'].includes(row.status) || !strings(row.assertionIds, 100) ||
+        !Array.isArray(row.evidenceRefs) || !row.evidenceRefs.length || row.evidenceRefs.length > 20 ||
+        row.evidenceRefs.some(ref => typeof ref !== 'string' || !ref.trim() || ref.length > 1000) ||
+        row.assertionIds.some(id => !requirement.assertionIds.includes(id)))
+      return { requirementId: requirement.id, status: 'unknown', detail: 'Requirement has no usable assertion/evidence observation.' };
+    observedCount += row.assertionIds.length;
+    if (row.status === 'verified' && requirement.assertionIds.some(id => !row.assertionIds.includes(id)))
+      return { requirementId: requirement.id, status: 'unknown', detail: 'Only part of the required behavior was observed.' };
+    return { requirementId: requirement.id, status: row.status,
+      detail: row.status === 'failed' ? 'Executed behavior assertion failed.' : row.status === 'unknown' ?
+        'Behavior remains unresolved.' : 'All required behavior assertions were independently observed.' };
+  });
+  return receipt.execution.assertionCount < observedCount ? unknown('Assertion count does not bind the observed rows.') : rows;
+}
+
+export function pendingRequirements(managed) {
+  if (!managed?.requirementContract) return [];
+  let contract;
+  try { contract = normalizeRequirementContract(managed.requirementContract); }
+  catch { return [{ id: 'behavior-contract', description: 'Frozen behavior requirements', check: 'behavior', status: 'unknown', detail: 'Behavior contract changed; inspect enrollment.' }]; }
+  const observation = managed.requirementObservation;
+  const rows = observation?.source === 'host_requirement_observer' && observation.current === true
+    ? assessRequirementReceipt(contract, observation.receipt, observation.candidateHash)
+    : contract.requirements.map(row => ({ requirementId: row.id, status: 'unknown', detail: 'Current host behavior observation is missing.' }));
+  return rows.filter(row => row.status !== 'verified').map(row => ({ id: `behavior:${row.requirementId}`,
+    description: contract.requirements.find(item => item.id === row.requirementId).description,
+    check: 'behavior', status: row.status, detail: row.detail }));
+}

package/src/delivery-hooks/supervisor-watchdog.js

@@ -20,12 +20,13 @@ async function verifiedPin(root) {
   return { digest: pin.digest, release: pin.release };
 }
 export async function setSupervisorWatchdog({ root, enabled, webOrigin,
-  inspectPin = verifiedPin, now = Date.now(), expectedEpoch, target } = {}) {
+  inspectPin = verifiedPin, now = Date.now(), expectedEpoch, target,
+  identity = supervisorProcessIdentity } = {}) {
   if (target && !enabled) throw new Error('A recovery target requires explicit enable.');
   const binding = target ? await supervisorTarget(root, target) : null;
   const pin = enabled ? await inspectPin(root) : null;
   const lock = await acquireDesktopProcessLock(join(folder(root), 'control-lock'), {
-    alive: supervisorProcessAlive, identity: supervisorProcessIdentity });
+    alive: supervisorProcessAlive, identity });
   try {
   const previous = await readSupervisorState(controlPath(root));
   if (expectedEpoch !== undefined && previous?.epoch !== expectedEpoch) return previous;

package/src/desktop-host.js

@@ -1,5 +1,7 @@
 import { createDesktopFrameWriter } from './desktop-frame-writer.js';
 import { boundedDiscovery } from './session-supervision/progressive-discovery.js';
+import { createCatalogRefreshPolicy } from './session-supervision/catalog-refresh.js';
+import { supervisedSession } from './session-supervision/discovery-window.js';
 import { createClaudeDesktopArchiveController } from './session-supervision/claude-desktop-archive.js';
 import { createClaudeDesktopNativeAdapter } from './session-supervision/claude-desktop-native.js';
 import { applyControllerExecutionContext } from './session-supervision/execution-context.js';
@@ -203,6 +205,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     status = { ...status, update: { ...status.update,
       auto_update_supported: updateSettings.auto_update_supported === true,
       auto_update_enabled: updateSettings.auto_update_enabled === true,
+      auto_update_unavailable_reason: updateSettings.auto_update_unavailable_reason || null,
       auto_update_busy: updateSettings.auto_update_busy === true } };
     if (env.SIMY_REMOTE_CHILD === "1") status = { ...status, remoteSessionProtocol: 1, remoteControl: { version: 2, actions: [...allowedActions] } };
     ownerTransport?.publish({ type: 'status', status: { ...status, remoteSessionProtocol: 1, remoteControl: { version: 2, actions: [...allowedActions] } } });
@@ -480,6 +483,13 @@ export async function startDesktopHost({ input = process.stdin, output = process
     })().finally(() => { emailSync = null; });
     await emailSync;
   };
+  const saveEmailDeliveryObservation = (controller, completion, observation) => controllerPreferences.change(controller.controllerScope, state => {
+    const identity = JSON.stringify([completion.host_id || 'local', completion.provider, completion.provider_session_id]);
+    const row = state.conversations[identity] ||= {};
+    row.emailDeliveries ||= {};
+    row.emailDeliveries[completion.task_id] = { ...observation, checkedAt: Date.now(), provider: completion.provider,
+      provider_session_id: completion.provider_session_id, host_id: completion.host_id || 'local' };
+  });
   const submitNativeDevelopmentReportCompletions = ({ completions, controller }) => {
     const { scope, deviceSession } = controller;
     if (!deviceSession?.token || !deviceSession?.api_base_url || !sameReportController(controller, nativeDevelopmentReportsController) || nativeDevelopmentReports.state !== "ready" || nativeDevelopmentReportsScope !== scope) return;
@@ -506,23 +516,31 @@ export async function startDesktopHost({ input = process.stdin, output = process
         if (receipt && nativeDevelopmentReportsGeneration === generation && accessScope(currentAccess) === scope) {
           if (receipt.status === 'pending') nativeCompletionRetryAt.set(key, Date.now() + 30_000);
           else { nativeCompletionSuccess.add(key); nativeCompletionRetryAt.delete(key); }
-          const receiptScope = controller.controllerScope;
-          await controllerPreferences.change(receiptScope, state => {
-            const identity = JSON.stringify([hostId, completion.provider, completion.provider_session_id]);
-            const row = state.conversations[identity] ||= {};
-            row.emailDeliveries ||= {};
-            row.emailDeliveries[completion.task_id] = { ...receipt, checkedAt: Date.now(), provider: completion.provider, provider_session_id: completion.provider_session_id, host_id: hostId };
-          });
+          await saveEmailDeliveryObservation(controller, completion, receipt);
           await requireReportController(controller);
           if (!closed) void publish().catch(() => {});
         }
         return receipt;
-      }).catch(error => {
+      }).catch(async error => {
         if (nativeDevelopmentReportsGeneration === generation && accessScope(currentAccess) === scope) {
           // These are immutable authorization/contract rejections. A new
           // enrollment revision or scope produces a fresh rejection identity.
-          if ([400, 403, 409].includes(error?.status)) nativeCompletionRejected.add(rejectionKey);
+          const rejected = [400, 403, 409].includes(error?.status);
+          if (rejected) nativeCompletionRejected.add(rejectionKey);
           else nativeCompletionRetryAt.set(key, Date.now() + 30_000);
+          // ON is consent, not a delivery receipt. Surface a failed submission
+          // without exposing backend errors, credentials or completion proofs.
+          // The next confirmed server receipt replaces this local observation.
+          try {
+            await requireReportController(controller);
+            if (closed || nativeDevelopmentReportsGeneration !== generation || accessScope(currentAccess) !== scope) return null;
+            await saveEmailDeliveryObservation(controller, completion, {
+              task_id: completion.task_id, enrollment_revision: completion.enrollment_revision,
+              status: rejected ? 'rejected' : 'retrying',
+            });
+            await requireReportController(controller);
+            if (!closed) void publish().catch(() => {});
+          } catch { /* A changed controller must not receive an old failure. */ }
         }
         return null;
       }).finally(() => nativeCompletionInFlight.delete(key));
@@ -568,6 +586,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   let commands;
   let sessionStatus = { sessions: [], providers: { codex: { discovery: "loading", reason: null }, claude: { discovery: "loading", reason: null } }, refreshedAt: null, initialLoading: true };
   let sessionRefresh = null, sessionRefreshedAt = 0, sessionRefreshAgain = false, discoveryController = null, discoveryStopped = false;
+  const catalogRefresh = createCatalogRefreshPolicy();
   let catalogRevision = 0;
   let enrichmentController = null, sessionEnrichment = null;
   let catalogAnalysisJob = null, catalogAnalysisAgain = false;
@@ -585,7 +604,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
         const records = await recordReader.list();
         if (closed || relay || discoveryStopped || manager !== analysisManager ||
             !desktopAccessReady(currentAccess) || accessScope(currentAccess) !== scope || !coordinator.acceptsNewWork()) return;
-        await manager.update(analysisSessions(withCurrentSettings(sessionStatus.sessions, records)));
+        await manager.update(analysisSessions(withCurrentSettings(sessionStatus.sessions, records)), {
+          priorityKeys: new Set(records.filter(supervisedSession).map(record => `${record.provider}:${record.session}`)),
+        });
       }
     }).catch(() => {}).finally(() => {
       catalogAnalysisJob = null;
@@ -640,12 +661,14 @@ export async function startDesktopHost({ input = process.stdin, output = process
     unfinishedDesktopWork = false;
   })();
   const observePullRequests = dependencies.observePullRequests || createPullRequestObserver();
-  const refreshSessions = (force = false) => {
+  const refreshSessions = (force = false, { history = false } = {}) => {
+    if (history) catalogRefresh.invalidate();
     if (discoveryStopped && !closed && !relay) return sessionStatus;
     if (closed || relay || !desktopAccessReady(currentAccess)) return { sessions: [], providers: {}, refreshedAt: null };
     if (force && sessionRefresh) sessionRefreshAgain = true;
     if (!sessionRefresh && (force || Date.now() - sessionRefreshedAt >= 15_000)) {
       const requestedScope = accessScope(currentAccess);
+      const refresh = catalogRefresh.begin(JSON.stringify([requestedScope, providerLinks]));
       const controller = discoveryController = new AbortController();
       const attempt = { id: randomUUID(), requestedAt: Date.now(), state: 'pending' };
       sessionStatus = { ...sessionStatus, discoveryAttempt: attempt };
@@ -659,7 +682,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
         }
         const complete = new Set(value.completeProviders || (value.historyLoading === undefined ? PROVIDER_LINKS : []));
         const merge = (previous, incoming) => {
-          const rows = new Map(previous.filter(item => !complete.has(item.provider)).map(item => [`${item.provider}:${item.session}`, item]));
+          const rows = new Map(previous.filter(item => refresh.recentOnly || !complete.has(item.provider)).map(item => [`${item.provider}:${item.session}`, item]));
           for (const item of incoming || []) rows.set(`${item.provider}:${item.session}`, item);
           return [...rows.values()];
         };
@@ -674,7 +697,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       const firstPageTimeoutMs = dependencies.discoveryTimeoutMs ?? 30_000;
       const historyTimeoutMs = dependencies.historyDiscoveryTimeoutMs ?? dependencies.discoveryTimeoutMs ?? 300_000;
       sessionRefresh = boundedDiscovery((signal, startHistory) => (dependencies.discoverSessions || discoverSessions)({
-        root: deliveryRoot, signal, onDrain: trackDiscoveryDrain, includeArchived: true, includeSelectionCandidates: true,
+        root: deliveryRoot, signal, onDrain: trackDiscoveryDrain, includeArchived: true, includeSelectionCandidates: true, recentOnly: refresh.recentOnly,
         readRecords: () => recordReader.list(),
         connectedProviders: PROVIDER_LINKS.filter(provider => providerLinks[provider].connected),
         timeoutMs: firstPageTimeoutMs, historyTimeoutMs,
@@ -685,6 +708,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await applyCatalog(value);
           if (closed || relay || controller.signal.aborted) return;
           const failed = Object.values(value.providers || {}).some(provider => provider.discovery === 'unavailable');
+          refresh.complete(!failed);
           sessionStatus = { ...sessionStatus, historyLoading: false,
             discoveryAttempt: { ...attempt, state: failed ? 'failed' : 'succeeded', completedAt: Date.now() } };
           // Publish before PR/network observation and queue maintenance. Neither
@@ -1507,7 +1531,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
         if(['detach_update','update_reconnect'].includes(action)) {
           const access=await accessSnapshot(); requireDesktopAccess(access);
           updateRuntime.validate(command,coordinator.snapshot(),updater?.snapshot?.());
-          if(action==='detach_update')await updater.maybeApply({detach:true});
+          if(action==='detach_update')await updater.maybeApply({detach:true,manual:true});
           else await reconnectWithHistoryRecovery({root,coordinator,eligible:()=>updateRuntime.historyRecoveryEligible()});
           emit({type:'result',id:command.id,ok:coordinator.snapshot().state==='connected' && (action!=='detach_update' || updater.snapshot().state==='updated')});
           await publish();return;
@@ -1578,7 +1602,11 @@ export async function startDesktopHost({ input = process.stdin, output = process
         if (['detach_update', 'update_reconnect'].includes(action)) requireDesktopAccess(access);
         else if (!recoveryControl && desktopAccessReady(access) && !desktopActionAllowed({ state: 'unavailable' }, command)) await authorizeWork();
 
-        if (!coordinator.acceptsNewWork() && !recoveryControl && !["refresh", "reconnect", "task_detail", "check_update", "quit", "delivery_stop", "delivery_pause", "delivery_reject"].includes(action)) {
+        // Signing back into the same SIMY environment is a prerequisite for
+        // recovery, not permission to resume work. Keep organization changes
+        // and execution fenced until the original checkpoint is reconciled.
+        const recoveryAuthorization = ["login", "authorization_open", "authorization_copy", "organization_cancel"].includes(action);
+        if (!coordinator.acceptsNewWork() && !recoveryControl && !recoveryAuthorization && !["refresh", "reconnect", "task_detail", "check_update", "quit", "delivery_stop", "delivery_pause", "delivery_reject"].includes(action)) {
           throw new Error("The update connection requires recovery.");
         }
         if (['team_threads_refresh','team_thread_open','team_thread_share'].includes(action)) {
@@ -1890,7 +1918,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           else if (desktopAccessReady(access)) await agent.refreshCodexStatus?.();
           await agent.refreshDesktopStatus();
           await refreshPlugins();
-          refreshSessions(true);
+          refreshSessions(true, { history: true });
           if (desktopAccessReady(currentAccess) && coordinator.acceptsNewWork()) void actionAssociations.tick().then(publish).catch(() => {});
         }
         else if (action === "organizations_refresh") await agent.refreshOrganizations();
@@ -2227,7 +2255,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
               } finally { clearInterval(watchdog); }
 
               await recordProviderArchive(deliveryRoot, 'claude', command.session, archived, Date.now());
-              refreshSessions(true);
+              refreshSessions(true, { history: true });
               emit({ type: 'result', id: command.id, ok: true, data });
               void publish().catch(() => {});
               return;
@@ -2245,7 +2273,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
               listHidden: archived,
             }));
           }
-          refreshSessions(true);
+          // Archive/restore can move an old conversation outside both recent
+          // pages. Explicit organization must be visible immediately.
+          refreshSessions(true, { history: true });
         } else if (action === "session_track" || action === "session_untrack") {
           const candidate = await selectedSession(command);
           if (candidate.capabilities?.canMonitor !== true) throw new Error('Tracking is unavailable for this conversation.');

package/src/session-supervision/acceptance-reads.js

@@ -6,7 +6,8 @@ import { evidenceExcerpt } from '../codex-plugins/simy/hooks/purpose-evidence.mj
 
 // Read only original file predicates in the authorized task directory. These
 // are current independent controller reads, not worker claims or authored proof.
-export async function captureAcceptanceReads(cwd, criteria, { signal } = {}) {
+export async function captureAcceptanceReads(cwd, criteria, { signal, excerptLimit = 4000, publicTaskSourcePaths = [] } = {}) {
+  if (!Number.isSafeInteger(excerptLimit) || excerptLimit < 1 || excerptLimit > 32768) throw new Error('Acceptance excerpt bound is invalid.');
   const root = await realpath(cwd), rows = [], seen = new Set(); let retained = 0;
   for (const criterion of criteria) {
     signal?.throwIfAborted();
@@ -22,8 +23,16 @@ export async function captureAcceptanceReads(cwd, criteria, { signal } = {}) {
       if (bytesRead > 32768) continue;
       const body = data.subarray(0, bytesRead); retained += bytesRead;
       const digest = createHash('sha256').update(body).digest('hex');
+      // Host-only, explicit source-read permission for a native task reviewer.
+      // The same original Claude already has Read access to these public-task
+      // source paths. Business identifiers such as Token are source, not a
+      // credential claim. Generic artifact reads retain their redaction policy.
+      const sourceRead = publicTaskSourcePaths.some(file => resolve(root, file) === path);
+      const sourceText = bytesRead ? body.toString('utf8') : JSON.stringify({ byteLength: 0, content: '' });
+      const observation = sourceRead ? { text: sourceText.slice(0, excerptLimit), truncated: sourceText.length > excerptLimit,
+        redacted: false, policy: 'host_authorized_public_task_source' } : evidenceExcerpt(sourceText, excerptLimit);
       rows.push({ id: `file:${target}`, source: 'controller_file_read', status: 'observed', at: Date.now(), digest,
-        recipe: { type: 'file_read', path: target }, observation: evidenceExcerpt(bytesRead ? body.toString('utf8') : JSON.stringify({ byteLength: 0, content: '' }), 4000) });
+        recipe: { type: 'file_read', path: target }, observation });
     } catch { signal?.throwIfAborted(); /* Missing/large/unreadable files stay unverified; tool investigation remains available. */ }
     finally { await handle?.close(); }
   }

package/src/session-supervision/analysis-manager.js

@@ -4,6 +4,7 @@ import { lstat, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { join } from 'node:path';
 import { analyzeContinuation, CONTINUATION_ANALYSIS_VERSION } from './continuation-analysis.js';
 import { providerGoalEvidence } from './conversation-context.js';
+import { liveSessionWindow, supervisedSession } from './discovery-window.js';
 
 const BACKFILL_LIMIT = 10;
 const MAX_CACHE_ENTRIES = 2000;
@@ -276,11 +277,17 @@ export async function createContinuationAnalysisManager({ root, analyze = analyz
       });
       startDrain();
     },
-    async update(sessions) {
+    async update(sessions, { priorityKeys = new Set() } = {}) {
       await exclusive(async () => {
         if (closed || suspended) return;
+        // The complete catalog remains navigable. Historical metadata outside
+        // this window must not churn the bounded cache or schedule paid work.
+        // Preserve queued/manual jobs and explicitly supervised conversations;
+        // removal, changed authority and OFF still use the incoming snapshot.
+        const window = liveSessionWindow(sessions, { priority: candidate => priorityKeys.has(keyOf(candidate)) || supervisedSession(candidate) ||
+          jobs.has(keyOf(candidate)) || ['queued', 'analyzing'].includes(entries.get(keyOf(candidate))?.result?.state) });
         candidates.clear();
-        for (const candidate of sessions) candidates.set(keyOf(candidate), observedCandidate(candidate));
+        for (const candidate of window) candidates.set(keyOf(candidate), observedCandidate(candidate));
         const sorted = [...candidates.values()].sort((a, b) => activityOf(b) - activityOf(a) || keyOf(a).localeCompare(keyOf(b)));
         const backfill = document.initialized ? new Set() : new Set(sorted.slice(0, BACKFILL_LIMIT).map(keyOf));
         let dirty = !document.initialized;

package/src/session-supervision/catalog-refresh.js

@@ -0,0 +1,16 @@
+// History is a navigation index, not a real-time subscription. Keep ordinary
+// status/preference refreshes cheap; an explicit Refresh still reloads history.
+export function createCatalogRefreshPolicy({ now = Date.now, intervalMs = 300_000 } = {}) {
+  let completed = null, scope = null, revision = 0;
+  return {
+    invalidate() { completed = null; revision++; },
+    begin(nextScope) {
+      if (scope !== nextScope) { scope = nextScope; completed = null; revision++; }
+      const generation = revision;
+      const recentOnly = completed !== null && now() - completed < intervalMs;
+      return { recentOnly, complete(success) {
+        if (!recentOnly && success && generation === revision) completed = now();
+      } };
+    },
+  };
+}

package/src/session-supervision/claude-native-agent-contract.js

@@ -0,0 +1,62 @@
+import { isDeepStrictEqual } from 'node:util';
+
+// Observed foreground-only Agent contract. Omission is never evidence of
+// foreground execution when the provider exposes background or unknown options.
+const FOREGROUND_SCHEMA = {
+  $schema: 'https://json-schema.org/draft/2020-12/schema', type: 'object',
+  properties: { description: { type: 'string' }, prompt: { type: 'string' },
+    subagent_type: { type: 'string' }, isolation: { type: 'string', enum: ['worktree', 'remote'] } },
+  required: ['description', 'prompt'], additionalProperties: false,
+};
+const withoutDescriptions = value => Array.isArray(value) ? value.map(withoutDescriptions) :
+  value && typeof value === 'object' ? Object.fromEntries(Object.entries(value)
+    .filter(([key, item]) => key !== 'description' || typeof item !== 'string')
+    .map(([key, item]) => [key, withoutDescriptions(item)])) : value;
+
+export function isForegroundOnlyAgentSchema(schema) {
+  return isDeepStrictEqual(withoutDescriptions(schema), FOREGROUND_SCHEMA);
+}
+
+export function isForegroundNativeReviewInput(toolName, args, observedSchema = null) {
+  if (!['Agent', 'Task'].includes(toolName) || !args || typeof args !== 'object' || Array.isArray(args) ||
+      typeof args.prompt !== 'string' || typeof args.subagent_type !== 'string' ||
+      Object.keys(args).some(key => !['description', 'prompt', 'subagent_type', 'run_in_background'].includes(key)) ||
+      Object.hasOwn(args, 'description') && typeof args.description !== 'string') return false;
+  if (Object.hasOwn(args, 'run_in_background')) return args.run_in_background === false;
+  // The observed Agent schema cannot establish an omitted flag for legacy Task.
+  return toolName === 'Agent' && typeof args.description === 'string' && isForegroundOnlyAgentSchema(observedSchema);
+}
+
+// Callers supply rows read from the exact owned, stable parent transcript,
+// never a worker-provided schema. A schema first seen after the call proves nothing.
+export function foregroundAgentContract(rows, candidate, beforeIndex = rows.length) {
+  const collector = createForegroundAgentContractCollector(candidate);
+  for (const row of rows.slice(0, beforeIndex)) collector.add(row);
+  return collector.finish();
+}
+
+// Keep the prior schema and version agreement without retaining transcript
+// bodies. A snapshot taken before a call cannot be authorized by a later shape.
+export function createForegroundAgentContractCollector(candidate) {
+  let shape = null, shapes = 0, version, mixedVersions = false;
+  return {
+    add(row) {
+      if (row.type === 'api-request-shape') { shapes++; if (shapes === 1) shape = row; }
+      if (row.version !== undefined) {
+        mixedVersions ||= version !== undefined && version !== row.version;
+        version = row.version;
+      }
+    },
+    finish() {
+      const row = shape;
+      if (shapes !== 1 || mixedVersions || version !== row.version || row.sessionId !== candidate.session || row.isSidechain === true ||
+          row.cwd !== undefined && row.cwd !== candidate.cwd ||
+          !/^[a-f0-9]{64}$/.test(row.shapeHash || '') || !/^\d+\.\d+\.\d+$/.test(row.version || '') ||
+          !Array.isArray(row.shape?.tools)) return null;
+      const agents = row.shape.tools.filter(tool => tool.name === 'Agent');
+      if (agents.length !== 1 || !isForegroundOnlyAgentSchema(agents[0].input_schema)) return null;
+      return { schema: agents[0].input_schema, shapeHash: row.shapeHash,
+        session: candidate.session, cwd: candidate.cwd, version: row.version ?? null };
+    },
+  };
+}