@awak-app/simy-cli 0.7.41 → 0.7.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.41",
+  "version": "0.7.43",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.41";
+export const CLI_VERSION = "0.7.43";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -79,11 +79,12 @@ function applyProviderConsent(record, link) {
       revision: (record.run.revision || 0) + 1,
       ...(record.run.managed ? { managed: { ...record.run.managed, autoRecovery: false } } : {}) } } : {}) };
 }
-async function applyArchiveFence(root, record) {
+const readArchiveFence = async file => JSON.parse(await readFile(file, 'utf8')).archived !== false;
+async function applyArchiveFence(root, record, readFence = readArchiveFence) {
   if (!record) return record;
   const file = `${recordPath(root, record.provider, record.session)}.archive-fence`;
   let archived;
-  try { archived = JSON.parse(await readFile(file, 'utf8')).archived !== false; }
+  try { archived = await readFence(file); }
   catch (error) { if (error.code === 'ENOENT') return record; archived = true; }
   if (!archived) return record;
   return { ...record, providerArchived: true, autoContinue: false, tracked: false, monitor: false,
@@ -103,7 +104,7 @@ export async function recordProviderArchive(root, provider, session, archived, o
     await rename(temporary, file);
   } finally { await rm(temporary, { force: true }); await releaseStateLock(lock, token); }
 }
-async function currentProviderConsent(root, records) {
+async function currentProviderConsent(root, records, readFence = readArchiveFence) {
   const links = Object.fromEntries(await Promise.all(['codex', 'claude'].map(async provider => [provider, await providerLinkState(root, provider)])));
   let archiveNames;
   try { archiveNames = new Set((await readdir(root)).filter(name => name.endsWith('.archive-fence'))); }
@@ -111,7 +112,7 @@ async function currentProviderConsent(root, records) {
   return Promise.all(records.map(record => {
     const current = applyProviderConsent(record, links[record.provider] || {});
     if (archiveNames && !archiveNames.has(`${basename(recordPath(root, record.provider, record.session))}.archive-fence`)) return current;
-    return applyArchiveFence(root, current);
+    return applyArchiveFence(root, current, readFence);
   }));
 }
 export async function linkedProvider(root, provider) {
@@ -375,8 +376,50 @@ export function createRecordReader(root = rootDirectory(), { cacheEntries = RECO
       !Number.isSafeInteger(cacheBytes) || cacheBytes < 1 || cacheBytes > RECORD_CACHE_BYTES) throw new Error('Invalid record cache limits.');
   const cache = new Map();
   let inFlight = null, closed = false, retainedBytes = 0;
-  const discard = name => { retainedBytes -= cache.get(name)?.bytes || 0; cache.delete(name); };
+  const discard = name => {
+    const entry = cache.get(name);
+    retainedBytes -= (entry?.bytes || 0) + (entry?.fence?.bytes || 0);
+    cache.delete(name);
+  };
   const fingerprint = info => [info.dev, info.ino, info.size, info.mtimeNs, info.ctimeNs].join(':');
+  const forgetFence = (name, entry) => {
+    if (cache.get(name) === entry) retainedBytes -= entry.fence?.bytes || 0;
+    delete entry.fence;
+  };
+  // Display consumers share a record's bounded cache entry. Each lookup still
+  // checks fresh file metadata; execution/updateRecord use the uncached reader.
+  const readCachedFence = async file => {
+    const name = basename(file).slice(0, -'.archive-fence'.length), entry = cache.get(name);
+    if (!entry) return readArchiveFence(file);
+    let before;
+    try { before = await stat(file, { bigint: true }); }
+    catch { forgetFence(name, entry); return readArchiveFence(file); }
+    if (cache.get(name) !== entry) return readArchiveFence(file);
+    const key = fingerprint(before);
+    if (entry.fence?.key === key) return entry.fence.archived;
+    // Each caller validates metadata before sharing a content read. A later
+    // caller must not join an older read when an external writer replaced it.
+    if (entry.fenceRead?.key === key) return entry.fenceRead.promise;
+    forgetFence(name, entry);
+    const load = async () => {
+      const archived = await readArchiveFence(file);
+      let after;
+      try { after = await stat(file, { bigint: true }); } catch { return archived; }
+      // Never retain a raced value or grow a second byte/entry budget. Admit
+      // fences only from spare budget; eviction still removes whole entries.
+      if (cache.get(name) === entry && fingerprint(after) === key && after.size <= BigInt(cacheBytes)) {
+        forgetFence(name, entry);
+        const bytes = Number(after.size);
+        if (retainedBytes + bytes <= cacheBytes) {
+          entry.fence = { key, archived, bytes }; retainedBytes += bytes;
+        }
+      }
+      return archived;
+    };
+    const pending = load().finally(() => { if (entry.fenceRead?.promise === pending) delete entry.fenceRead; });
+    entry.fenceRead = { key, promise: pending };
+    return pending;
+  };
   const scan = async () => {
     const names = await recordNames(root), live = new Set(names.slice(0, cacheEntries));
     for (const name of cache.keys()) if (!live.has(name)) discard(name);
@@ -406,7 +449,7 @@ export function createRecordReader(root = rootDirectory(), { cacheEntries = RECO
       if (!inFlight) inFlight = scan().finally(() => { inFlight = null; });
       // Consumers can decorate/mutate their own snapshots without corrupting the
       // cached records or a simultaneous caller's view.
-      return currentProviderConsent(root, structuredClone(await inFlight));
+      return currentProviderConsent(root, structuredClone(await inFlight), readCachedFence);
     },
     async close() { closed = true; await inFlight?.catch(() => {}); cache.clear(); retainedBytes = 0; },
   };

package/src/desktop-catalog-frames.js

@@ -1,20 +1,69 @@
 import { isDeepStrictEqual } from 'node:util';
 
-function updateRows(previous, incoming, full, unchanged = false) {
+const catalogScope = status => JSON.stringify([status.webOrigin, status.auth?.userId, status.auth?.state,
+  status.access?.organizationId, status.access?.revision, status.access?.state]);
+
+function cloneStatusMetadata(status) {
+  const supervision = status?.sessionSupervision;
+  if (!Array.isArray(supervision?.sessions)) return structuredClone(status);
+  return structuredClone({ ...status, sessionSupervision: { ...supervision,
+    sessions: [], ...(Array.isArray(supervision.selectionCandidates) ? { selectionCandidates: [] } : {}) } });
+}
+
+// Only use with an already detached, read-only desktop snapshot. Metadata is
+// independent; callers must replace row arrays/rows rather than mutate them.
+export function copyOwnedDesktopStatus(status) {
+  const detached = cloneStatusMetadata(status), supervision = status?.sessionSupervision;
+  if (!Array.isArray(supervision?.sessions)) return detached;
+  detached.sessionSupervision.sessions = supervision.sessions;
+  if (Array.isArray(supervision.selectionCandidates)) detached.sessionSupervision.selectionCandidates = supervision.selectionCandidates;
+  return detached;
+}
+
+function updateRows(previous, incoming, full, { unchanged = false, immutableInput = false, copyOnWrite = false } = {}) {
   if (full || previous === null || previous.length !== incoming.length) {
-    const rows = structuredClone(incoming);
+    const rows = immutableInput ? incoming : structuredClone(incoming);
     return { rows, payload: { rows } };
   }
   if (unchanged) return { rows: previous, payload: { count: previous.length, changes: [] } };
   const changes = [];
+  let rows = previous;
   for (let index = 0; index < incoming.length; index++) {
     if (!isDeepStrictEqual(previous[index], incoming[index])) {
-      const row = structuredClone(incoming[index]);
-      previous[index] = row;
+      const row = immutableInput ? incoming[index] : structuredClone(incoming[index]);
+      if (!immutableInput) {
+        if (copyOnWrite && rows === previous) rows = previous.slice();
+        rows[index] = row;
+      }
       changes.push([index, row]);
     }
   }
-  return { rows: previous, payload: { count: previous.length, changes } };
+  return { rows: immutableInput ? incoming : rows, payload: { count: incoming.length, changes } };
+}
+
+// Detach mutable producer data once. Unchanged catalog rows may be shared only
+// between these owned read-only snapshots; changed rows get detached copies and
+// a new array. Older queued frames and durable writes must remain immutable.
+export function createDesktopStatusSnapshot() {
+  let rows = null, candidates = null, scope = null;
+  return status => {
+    const supervision = status?.sessionSupervision;
+    if (!Array.isArray(supervision?.sessions)) {
+      rows = candidates = scope = null;
+      return structuredClone(status);
+    }
+    const nextScope = catalogScope(status);
+    if (nextScope !== scope) { rows = candidates = null; scope = nextScope; }
+    const hasCandidates = Array.isArray(supervision.selectionCandidates);
+    const detached = cloneStatusMetadata(status);
+    rows = updateRows(rows, supervision.sessions, false, { copyOnWrite: true }).rows;
+    detached.sessionSupervision.sessions = rows;
+    if (hasCandidates) {
+      candidates = updateRows(candidates, supervision.selectionCandidates, false, { copyOnWrite: true }).rows;
+      detached.sessionSupervision.selectionCandidates = candidates;
+    } else candidates = null;
+    return detached;
+  };
 }
 
 // One encoder per ordered output stream. Call only when a frame actually enters
@@ -30,11 +79,10 @@ export function createDesktopCatalogEncoder({ immutableInput = false } = {}) {
     }
     const status = frame.status;
     const incoming = status.sessionSupervision.sessions;
-    const identity = JSON.stringify([status.webOrigin, status.auth?.userId, status.auth?.state, status.access?.organizationId,
-      status.access?.revision, status.access?.state]);
+    const identity = catalogScope(status);
     const previous = revision++;
     const full = rows === null || scope !== identity || rows.length !== incoming.length;
-    const snapshot = updateRows(rows, incoming, full, immutableInput && sourceRows === incoming);
+    const snapshot = updateRows(rows, incoming, full, { immutableInput, unchanged: immutableInput && sourceRows === incoming });
     rows = snapshot.rows; sourceRows = incoming; scope = identity;
     const catalog = { version: 1, revision, scope, ...(full ? {} : { baseRevision: previous }), ...snapshot.payload };
     const { sessions, ...metadata } = status.sessionSupervision;
@@ -42,7 +90,8 @@ export function createDesktopCatalogEncoder({ immutableInput = false } = {}) {
     if (Array.isArray(metadata.selectionCandidates)) {
       // This is another complete directory, used by the conversation picker.
       // Do not silently retransmit it as supposedly small status metadata.
-      const snapshot = updateRows(candidates, metadata.selectionCandidates, full, immutableInput && sourceCandidates === metadata.selectionCandidates);
+      const snapshot = updateRows(candidates, metadata.selectionCandidates, full,
+        { immutableInput, unchanged: immutableInput && sourceCandidates === metadata.selectionCandidates });
       candidates = snapshot.rows; sourceCandidates = metadata.selectionCandidates; catalog.selectionCandidates = snapshot.payload;
       const { selectionCandidates, ...small } = metadata;
       supervision = small;

package/src/desktop-host.js

@@ -1,5 +1,5 @@
 import { createDesktopFrameWriter } from './desktop-frame-writer.js';
-import { createDesktopCatalogEncoder } from './desktop-catalog-frames.js';
+import { createDesktopCatalogEncoder, createDesktopStatusSnapshot, copyOwnedDesktopStatus } from './desktop-catalog-frames.js';
 import { boundedDiscovery } from './session-supervision/progressive-discovery.js';
 import { createCatalogRefreshPolicy } from './session-supervision/catalog-refresh.js';
 import { supervisedSession } from './session-supervision/discovery-window.js';
@@ -197,6 +197,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   // deltas later, after backpressure coalescing. Registries may mutate objects,
   // so the comparison snapshot must remain detached from producer references.
   let encodedStatus = null, lastStatus = null, lastStatusFrame = null, updateProgress = null;
+  const snapshotStatus = createDesktopStatusSnapshot();
   let projectCatalogFrame = status => status;
   let resolveFirstStatus;
   const firstStatus = new Promise(resolve => { resolveFirstStatus = resolve; });
@@ -206,6 +207,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   let acceptanceReadbackSequence = 0;
   let remoteHosts;
   const emitStatus = status => {
+    let catalogObservation;
     status = projectCatalogFrame(status);
     status = { ...status, windowUpdate: { version: 1, preservesWork: Boolean(ownerTransport), prepared: windowUpdatePrepared } };
     const updateSettings = updater?.snapshot?.() || {};
@@ -219,26 +221,38 @@ export async function startDesktopHost({ input = process.stdin, output = process
     if (remoteHosts) {
       void remoteHosts.update({ ...status, providerLinks }).catch(() => {});
       status = remoteHosts.project(status, { providerLinks });
-      for (const candidate of status.sessionSupervision?.sessions || []) {
-        if (!candidate.hostId || candidate.hostId === 'local') continue;
-        const key = teamThreadKey(agent?.getTeamThreadsScope?.() || {}, candidate);
+      const supervision = status.sessionSupervision;
+      if (supervision?.sessions?.some(candidate => candidate.hostId && candidate.hostId !== 'local')) {
+        const scope = agent?.getTeamThreadsScope?.() || {};
         const sharing = teamThreads?.snapshot();
-        candidate.teamSharing = { threadKey: key, enabled: sharing?.own?.some(row => row.threadKey === key && row.enabled) === true, pendingStop: sharing?.pendingStops?.includes(key) === true };
+        // An unusable/scoped-out remote manager may return the borrowed input.
+        // Decorate new rows rather than modifying an older published snapshot.
+        status = { ...status, sessionSupervision: { ...supervision, sessions: supervision.sessions.map(candidate => {
+          if (!candidate.hostId || candidate.hostId === 'local') return candidate;
+          const key = teamThreadKey(scope, candidate);
+          return { ...candidate, teamSharing: { threadKey: key,
+            enabled: sharing?.own?.some(row => row.threadKey === key && row.enabled) === true,
+            pendingStop: sharing?.pendingStops?.includes(key) === true } };
+        }) } };
       }
     }
     if (preferenceScope && desktopAccessReady(status.access) && status.sessionSupervision?.sessions) {
       const catalogScope = preferenceScope;
       status = { ...status, sessionSupervision: { ...status.sessionSupervision, sessions: status.sessionSupervision.sessions.filter(row => controllerPreferences.get(catalogScope, row).deleted !== true).map(row => { const saved = controllerPreferences.get(catalogScope, row); return { ...row, controllerPreferences: saved, ...(saved.pinned === undefined ? {} : { listPinned: saved.pinned, listPinScopes: saved.pinScopes }), ...(saved.hidden === undefined ? {} : { localHidden: saved.hidden }) }; }) } };
-      const catalog = { observedAt: Date.now(), sessions: status.sessionSupervision.sessions, hosts: status.remoteHosts?.items || [], providerLinks };
-      void controllerPreferences.replaceCatalog(catalogScope, catalog).catch(() => {});
+      catalogObservation = { scope: catalogScope, observedAt: Date.now() };
     }
     if (updateProgress) status = { ...status, update: { ...status.update, ...updateProgress } };
     const { sampledAt, ...content } = status;
     if (!lastStatus || !isDeepStrictEqual(content, lastStatus)) {
       if (!catalogEncoder) encodedStatus = JSON.stringify(content).slice(1, -1);
-      lastStatus = structuredClone(content);
+      lastStatus = snapshotStatus(content);
     }
     const ownedStatus = { ...lastStatus, ...(sampledAt === undefined ? {} : { sampledAt }) };
+    if (catalogObservation) {
+      const catalog = { observedAt: catalogObservation.observedAt, sessions: ownedStatus.sessionSupervision.sessions,
+        hosts: ownedStatus.remoteHosts?.items || [], providerLinks: structuredClone(providerLinks) };
+      void controllerPreferences.replaceCatalog(catalogObservation.scope, catalog, { immutableInput: true }).catch(() => {});
+    }
     lastStatusFrame = ownedStatus;
     ownerTransport?.publishDesktop?.({ type: 'status', status: ownedStatus });
     const observation = sampledAt === undefined ? '' : `"sampledAt":${JSON.stringify(sampledAt)}${encodedStatus ? ',' : ''}`;
@@ -993,7 +1007,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       // a full projection may have advanced it while those reads were waiting.
       const sameScope = desktopAccessReady(currentAccess) &&
         accessScope(lastStatus?.access) === accessScope(currentAccess);
-      const cached = sameScope && lastStatus && controllerScope(lastStatus) === controllerScope(status) ? structuredClone(lastStatus) : null;
+      const cached = sameScope && lastStatus && controllerScope(lastStatus) === controllerScope(status) ? copyOwnedDesktopStatus(lastStatus) : null;
       // A heartbeat is a complete frame: retain optional scoped fields until
       // their replacement is ready, while fresh access/provider data wins.
       if (cached) status = { ...cached, ...status };

package/src/desktop-process-lock.js

@@ -1,4 +1,4 @@
-import { mkdir, readFile, realpath, rm, writeFile, stat } from "node:fs/promises";
+import { mkdir, readFile, realpath, rename, rm, writeFile, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { windowsProcessStart, windowsUserProcesses } from "./windows-processes.js";
 import { randomBytes } from "node:crypto";
@@ -52,12 +52,18 @@ export async function acquireDesktopProcessLock(root, { pid = process.pid, alive
     return acquireDesktopProcessLock(root, { pid, alive, identity, graceMs, webOrigin });
   }
   const nonce = randomBytes(32).toString("hex");
-  await writeFile(ownerFile, JSON.stringify({
-    pid,
-    nonce,
-    startedAt: await identity(pid),
-    webOrigin: normalizedOriginOrNull(webOrigin),
-  }), { mode: 0o600 });
+  const temporary = join(directory, `owner.${nonce}.tmp`);
+  // Relays can poll while the owner is starting. Publish complete metadata in
+  // one rename so they never parse the empty/partial file created by writeFile.
+  try {
+    await writeFile(temporary, JSON.stringify({
+      pid,
+      nonce,
+      startedAt: await identity(pid),
+      webOrigin: normalizedOriginOrNull(webOrigin),
+    }), { mode: 0o600 });
+    await rename(temporary, ownerFile);
+  } finally { await rm(temporary, { force: true }); }
   return {
     nonce,
     async release() {

package/src/session-supervision/controller-store.js

@@ -41,11 +41,13 @@ export function createControllerStore(root) {
       await persist(scope, next); return result;
     });
   }
-  function replaceCatalog(scope, catalog) {
+  function replaceCatalog(scope, catalog, { immutableInput = false } = {}) {
     // Own the incoming snapshot immediately, but do not clone the previous
     // multi-MiB catalog just to replace it. Preference writes still serialize
     // on the same queue and commit only after their atomic write succeeds.
-    const snapshot = structuredClone(catalog);
+    // Only the desktop's detached read-only snapshots may be borrowed. Generic
+    // callers retain immediate mutation isolation, including while queued.
+    const snapshot = immutableInput ? catalog : structuredClone(catalog);
     return enqueue(async () => {
       const settings = { ...await load(scope) };
       delete settings.catalog;