@awak-app/simy-cli 0.7.46 → 0.7.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.46",
+  "version": "0.7.47",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -43,7 +43,7 @@
     "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js && npm run check:sqm",
     "check:workflow-observation-sender": "node --check ./src/workflow-observation-sender.js",
     "check:sqm": "node --check ./src/sqm/provider-plugin-repair.js && node --check ./src/sqm/provider-plugin-status.js && node --check ./src/sqm/advisory-guidance.js && node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/reliability.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./src/sqm/agent-skill.js && node --check ./src/sqm/workflow-onboarding.js && node --check ./src/sqm/workflow-update.js && node --check ./src/sqm/history-store.js && node --check ./src/sqm/review-worker.js && node --check ./scripts/sqm-complete-loop-e2e.js && node --check ./scripts/sqm-local-review-e2e.js",
-    "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/claude-delivery-fault-live-e2e.mjs && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js && node --check ./scripts/codex-plugin-runtime-e2e.js",
+    "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/claude-stream-acceptance.mjs && node --check ./scripts/claude-delivery-fault-live-e2e.mjs && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js && node --check ./scripts/codex-plugin-runtime-e2e.js",
     "check:syntax": "node --check ./src/purpose-local-proof.js && node --check ./src/device-signing-identity.js && node --check ./src/index.js && node --check ./src/install-update.js && node --check ./src/agent.js && node --check ./src/connection-discovery.js && node --check ./src/connection-diagnostics.js && node --check ./src/launch-authorization.js && node --check ./src/codex-plugins/simy/hooks/connection-reminder.mjs && node --check ./src/codex-plugins/simy/hooks/dev-work.mjs && node --check ./src/dev-work-events.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/login-shell-path.js && node --check ./src/hook-runtime.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/pr-preparation.js && node --check ./src/orchestrator/minimum-completion.js && node --check ./src/orchestrator/delivery/scripts/check-minimum-completion.mjs && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./src/coding-run-store.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js && node --check ./src/codex-plugins/simy/hooks/delivery-loop.mjs && node --check ./src/delivery-hooks/command.js && node --check ./src/delivery-hooks/desktop.js && node --check ./src/delivery-hooks/supervisor.js && node --check ./src/delivery-hooks/recovery.js && node --check ./src/delivery-hooks/supervisor-owner.js && node --check ./src/delivery-hooks/supervisor-watchdog.js && node --check ./src/delivery-hooks/supervisor-service.js && node --check ./scripts/supervisor-watchdog-live-e2e.js && node --check ./src/codex-plugins/simy/hooks/recovery-incident.mjs && node --check ./src/session-supervision/automatic-continuation.js && node --check ./src/session-supervision/stop-notifications.js",
     "check:package": "node ./scripts/check-package-contents.js",
     "build:macos-installer:dev": "bash packaging/build-macos-arm64.sh --unsigned-dev",

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.46";
+export const CLI_VERSION = "0.7.47";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/.mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "simy_native": {
+      "command": "./native/launch",
+      "args": ["./native/server.mjs"],
+      "cwd": ".",
+      "env_vars": ["CODEX_APP_TOOLS_PIPE_PATH", "CODEX_MCP_NODE_PATH", "CODEX_BROWSER_USE_NODE_PATH", "CODEX_ELECTRON_RESOURCES_PATH", "CODEX_CLI_PATH", "SIMY_HOME", "HOME", "PATH"],
+      "startup_timeout_sec": 10
+    }
+  }
+}

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import {guidancePending} from '../native/guidance-intent.mjs';
 import { decideLoop, compactWorkHistory } from './loop-kernel.mjs';
 import { completionContractIdentity } from './purpose-completion-contract.mjs';
 import { captureDispatchProvenance } from './update-dispatch-identity.mjs';
@@ -1674,10 +1675,10 @@ export function externalReviewIsCurrent(managed,review,now) {
   const refs=[...(review.criteria||[]).filter(row=>row.passed),...(review.rules||[]).filter(row=>row.status==='satisfied'),...(review.workUnits||[])].flatMap(row=>row.evidenceRefs||[]).filter(link=>/^[a-f0-9]{64}$/.test(link.ref));
   // A flexible semantic verdict refers to its actual inspection, including
   // external observations even when no authored citation was supplied.
-  if (review.semanticInspection?.source === 'controller_actual_read_set') refs.push(...(review.semanticInspection.observationRefs || []).map(ref => ({ ref })));
+  if (['controller_actual_read_set', 'controller_conversation_answer'].includes(review.semanticInspection?.source)) refs.push(...(review.semanticInspection.observationRefs || []).map(ref => ({ ref })));
   const ledger=managed.purpose.evidence;
   const observations=[...(ledger?.observations||[]),...(ledger?.reviewObservationActionId===(review.decisionId||managed.decision.id) ? ledger.reviewObservations||[] : [])];
-  const inspected = new Set(review.semanticInspection?.source === 'controller_actual_read_set' ? review.semanticInspection.observationRefs || [] : []);
+  const inspected = new Set(['controller_actual_read_set', 'controller_conversation_answer'].includes(review.semanticInspection?.source) ? review.semanticInspection.observationRefs || [] : []);
   return refs.filter(link => inspected.has(link.ref) || observations.some(item => item.id === link.ref))
     .every(link=>observations.some(item=>item.id===link.ref && item.status==='observed' && currentPurposeObservation(item,now,review.observationWindow)));
 
@@ -1799,7 +1800,7 @@ export async function settlePurposeVerification({ root, provider, session, expec
       } else if (pending.length && pending.every(c => c.check.type === 'manual')) {
         run.state = 'verification_pending'; run.reason = 'Only explicitly human acceptance remains.'; state.phase = 'waiting';
         run.checkpoint = { status: 'completed', summary: review.summary }; managed.autoRecovery = false;
-      } else review = { ...review, passed: false, needsHuman: false, findings: ['Local acceptance changed during review; investigate and recheck.'] };
+      } else if (review.passed || review.needsHuman) review = { ...review, passed: false, needsHuman: false, findings: ['Local acceptance changed during review; investigate and recheck.'] };
     }
     state.review={...review,decisionId:managed.decision.id};
     if (!review.passed && !review.needsHuman && openFindings.some(item => item.observation)) {
@@ -2461,6 +2462,7 @@ function recordManagedOutcomeProgress(run, now, assessmentAvailable = true) {
 // Manual/legacy runs have no marker and retain their existing controls.
 export const ownerRenewalPending = record => ['awaiting_human', 'prepared', 'gate_committed'].includes(record?.run?.managed?.ownerRenewal?.status);
 export function automaticContinuationAllowed(record) {
+  if (guidancePending(record)) return false;
   if (ownerRenewalPending(record) || record?.run?.managed?.ownerRenewal?.needsReadOnlyReassessment === true) return false;
   if (record?.providerArchived === true || record?.run?.managed?.purpose && record.autoContinue === false) return false;
   const epoch = record?.run?.managed?.autoContinueEpoch;

package/src/codex-plugins/simy/native/app-tools.mjs

@@ -0,0 +1,45 @@
+import {spawn} from 'node:child_process';
+import {createInterface} from 'node:readline';
+const fail=code=>Object.assign(new Error(code),{code});
+export async function openAppTools({record,signal,node,server,pipe}) {
+ const p=spawn(node,[server],{env:{...process.env,CODEX_APP_TOOLS_PIPE_PATH:pipe},stdio:['pipe','pipe','ignore']});
+ let sequence=0,closed=false;const pending=new Map();const lines=createInterface({input:p.stdout});
+ const close=()=>{if(closed)return;closed=true;signal?.removeEventListener('abort',close);for(const q of pending.values())q.reject(fail(q.write?'native_submission_unknown':'native_tools_closed'));pending.clear();lines.close();p.stdin.end();p.kill('SIGTERM');};
+ p.on('error',close);p.on('exit',close);p.stdin.on('error',close);signal?.addEventListener('abort',close,{once:true});
+ lines.on('line',line=>{let d;try{d=JSON.parse(line);}catch{close();return;}const q=pending.get(d.id);if(!q)return;pending.delete(d.id);d.error?q.reject(fail(q.write?'native_submission_unknown':'native_tools_request_failed')):q.resolve(d.result);});
+ const rpc=(method,params,write=false)=>new Promise((resolve,reject)=>{
+  if(closed||signal?.aborted){reject(fail('native_tools_closed'));return;}const id=++sequence;
+  const timer=setTimeout(()=>{pending.delete(id);reject(fail(write?'native_submission_unknown':'native_tools_timeout'));},15000);
+  pending.set(id,{write,resolve:r=>{clearTimeout(timer);resolve(r)},reject:e=>{clearTimeout(timer);reject(e)}});
+  p.stdin.write(JSON.stringify({jsonrpc:'2.0',id,method,params})+'\n');
+ });
+ try{
+  await rpc('initialize',{protocolVersion:'2025-06-18',capabilities:{},clientInfo:{name:'simy-original-continuation',version:'1.0.0'}});
+  p.stdin.write(JSON.stringify({jsonrpc:'2.0',method:'notifications/initialized'})+'\n');
+  const list=await rpc('tools/list',{});const names=new Set(list.tools.map(t=>t.name));
+  if(!names.has('read_thread')||!names.has('send_message_to_thread'))throw fail('native_tools_unsupported');
+  const call=async(name,args,write=false)=>{
+   const result=await rpc('tools/call',{name,arguments:args,_meta:{'openai/threadId':record.session}},write);
+   if(result.isError)throw fail(write?'native_submission_unknown':result.content?.some(c=>c.type==='text'&&c.text.includes('exceeds the size limit'))?'native_tools_response_too_large':'native_tools_request_failed');
+   const text=result.content?.find(c=>c.type==='text')?.text;if(!text)throw fail(write?'native_submission_unknown':'native_tools_invalid_response');
+   return JSON.parse(text);
+  };
+  const read=async(cursor,includeOutputs=false)=>{
+   const r=await call('read_thread',{threadId:record.session,hostId:'local',turnLimit:1,includeOutputs,maxOutputCharsPerItem:16000,...(cursor?{cursor}:{})});
+   if(r.thread?.id!==record.session||r.thread?.hostId!=='local'||r.thread?.cwd!==record.cwd)throw fail('native_tools_owner_mismatch');return r;
+  };
+  return {transport:'codex_app_tools',close,
+   async request(method,params){
+    if(params.threadId!==record.session)throw fail('native_tools_target_mismatch');
+    const r=await read(params.cursor,method==='thread/turns/list');
+    if(method==='thread/read')return {thread:{...r.thread,status:{type:r.thread.status?.type==='active'?'active':r.thread.status?.type==='idle'?'idle':'unknown'}}};
+    if(method==='thread/turns/list')return {data:r.turns,nextCursor:r.page?.nextCursor};
+    throw fail('native_method_unsupported');
+   },
+   async submitOriginal({text,beforeSubmit}){
+    const r=await read();if(r.thread.status?.type!=='idle')throw fail('native_thread_busy');
+    await beforeSubmit();signal?.throwIfAborted();
+    return call('send_message_to_thread',{threadId:record.session,hostId:'local',prompt:text},true);
+   }};
+ }catch(e){close();throw e;}
+}

package/src/codex-plugins/simy/native/bridge.mjs

@@ -0,0 +1,156 @@
+import {assertGuidanceIntent, guidancePending} from './guidance-intent.mjs';
+import {createServer, createConnection} from 'node:net';
+import {mkdir, stat, readFile, writeFile, rename, chmod, rm, readdir} from 'node:fs/promises';
+import {join} from 'node:path';
+import {randomUUID, createHash} from 'node:crypto';
+import {readRecord, updateRecord, automaticContinuationAllowed, hasPendingUserStop, managedBudgetReason} from '../hooks/delivery-loop.mjs';
+import {openAppTools} from './app-tools.mjs';
+
+const fail = code => Object.assign(new Error(code), {code});
+export const nativeIntentId = r => createHash('sha256').update(JSON.stringify([r.run.id, r.autoContinueEpoch, r.run.controlRevision, r.run.revision, r.run.managed.decision?.id])).digest('hex');
+const directory = root => join(root, 'native-app-bridge');
+// This is an app-launched transport, never a supervisor or a new task owner.
+// Every write requires an already persisted, exact original-task send intent.
+export async function startNativeBridge({root, node, server, pipe, openClient = openAppTools}) {
+  const pipeStat = await stat(pipe);
+  if (!pipeStat.isSocket() || pipeStat.uid !== process.getuid()) throw fail('native_tools_owner_mismatch');
+  const dir = directory(root), id = randomUUID(), token = randomUUID();
+  await mkdir(dir, {recursive: true, mode: 0o700});
+  const socket = join(dir, id + '.sock'), peers = new Set();
+  const listener = createServer(peer => {
+    peers.add(peer); peer.setEncoding('utf8'); peer.setTimeout(60000, () => peer.destroy());
+    let buffer = '', busy = false, authorizationReply = null;
+    peer.on('error', () => {}); peer.on('close', () => peers.delete(peer));
+    peer.on('data', chunk => {
+      buffer += chunk;
+      if (buffer.length > 1024 * 1024) {peer.destroy(); return;}
+      const end = buffer.indexOf('\n'); if (end < 0) return;
+      if (buffer.indexOf('\n', end + 1) !== -1) {peer.destroy(); return;}
+      const line = buffer.slice(0, end); buffer = buffer.slice(end + 1);
+      if (busy) {if (authorizationReply) authorizationReply(line); else peer.destroy(); return;}
+      busy = true;
+      void (async () => {
+        let client;
+        try {
+          const q = JSON.parse(line);
+          if (q.token !== token || !['thread/read', 'thread/turns/list', 'submit', 'submit_guidance'].includes(q.method)) throw fail('native_tools_bridge_denied');
+          // Old hosts cannot answer the final controller challenge. Fail closed
+          // rather than silently accepting their earlier authorization.
+          if (q.method === 'submit_guidance' && q.guidanceAuthorization !== 1) throw fail('native_guidance_unavailable');
+          const authorizeGuidance = () => new Promise((resolve, reject) => {
+            const challenge = randomUUID();
+            const finish = error => {
+              clearTimeout(timer); authorizationReply = null; peer.removeListener('close', lost);
+              error ? reject(error) : resolve();
+            };
+            const lost = () => finish(fail('native_guidance_changed'));
+            const timer = setTimeout(lost, 15000);
+            peer.once('close', lost);
+            authorizationReply = line => {
+              try {
+                const ack = JSON.parse(line);
+                if (ack.token !== token || ack.method !== 'authorize_guidance' || ack.challenge !== challenge ||
+                    ack.guidanceId !== q.guidanceId || ack.authorized !== true) throw fail('native_guidance_changed');
+                finish();
+              } catch {finish(fail('native_guidance_changed'));}
+            };
+            if (peer.destroyed) {lost(); return;}
+            peer.write(JSON.stringify({kind: 'guidance_authorization_required', guidanceId: q.guidanceId, challenge}) + '\n');
+          });
+          const r = await readRecord(join(root, 'delivery-hooks'), 'codex', q.session);
+          if (!r?.run?.managed || r.run.id !== q.runId || r.run.managed.taskId !== q.taskId || r.autoContinueEpoch !== q.epoch || !(q.guidanceId ? guidancePending(r) && r.run.managed.userGuidance.id === q.guidanceId : automaticContinuationAllowed(r))) throw fail('native_tools_attachment_changed');
+          client = await openClient({record: r, node, server, pipe});
+          const result = q.method === 'submit_guidance' ? await client.submitOriginal({text: q.text, beforeSubmit: async () => {
+            await updateRecord(join(root, 'delivery-hooks'), 'codex', q.session, async fresh => {
+              const intent = assertGuidanceIntent(fresh, q.guidanceId, q.text);
+              if (intent.phase !== 'submitting' || intent.bridgeAttemptedAt || hasPendingUserStop(join(root, 'delivery-hooks'), fresh) || managedBudgetReason(fresh.run)) throw fail('native_guidance_changed');
+              // Hold the exact intent lock while asking its original controller
+              // to recheck account/org/provider authority at the provider boundary.
+              await authorizeGuidance();
+              assertGuidanceIntent(fresh, q.guidanceId, q.text);
+              if (peer.destroyed || hasPendingUserStop(join(root, 'delivery-hooks'), fresh) || managedBudgetReason(fresh.run)) throw fail('native_guidance_changed');
+              intent.bridgeAttemptedAt = Date.now();
+              return fresh;
+            });
+          }}) : q.method === 'submit' ? await client.submitOriginal({text: q.text, beforeSubmit: async () => {
+            const fresh = await readRecord(join(root, 'delivery-hooks'), 'codex', q.session), m = fresh?.run?.managed, h = m?.nativeHandoff;
+            if (fresh?.run?.id !== q.runId || m?.taskId !== q.taskId || fresh.autoContinueEpoch !== q.epoch || !automaticContinuationAllowed(fresh) || hasPendingUserStop(join(root, 'delivery-hooks'), fresh) || fresh.run.stopReason || fresh.run.state !== 'recovery_required' || m.pendingApproval || m.resumeLease || m.liveWorkspaceLease || m.outcomeAudit?.lease || m.providerWarning || m.usageBlocked || m.maxTokens || m.understandingQuestion || m.purpose?.nativeBoundary || managedBudgetReason(fresh.run) || ['verifying', 'understanding', 'needs_clarification', 'action_association'].includes(m.phase) || m.executionUncertain || m.nativeWait || m.userQuestion || m.authenticationWait || m.dependencyWait || h?.id !== q.handoffId || h?.id !== nativeIntentId(fresh) || h.phase !== 'submitting' || h.text !== q.text) throw fail('native_tools_intent_changed');
+          }}) : await client.request(q.method, {threadId: q.session, cursor: q.cursor});
+          peer.end(JSON.stringify({ok: true, result, guidanceAuthorization: 1}) + '\n');
+        } catch (error) {peer.end(JSON.stringify({ok: false, code: error.code || 'native_tools_request_failed'}) + '\n');}
+        finally {client?.close();}
+      })();
+    });
+  });
+  await new Promise((resolve, reject) => {listener.once('error', reject); listener.listen(socket, resolve);});
+  await chmod(socket, 0o600);
+  const target = join(dir, id + '.json'), temp = target + '.tmp';
+  await writeFile(temp, JSON.stringify({schema: 1, id, pid: process.pid, socket, token, startedAt: Date.now()}), {mode: 0o600});
+  await rename(temp, target);
+  return {id, async close() {
+    for (const peer of peers) peer.destroy();
+    await new Promise(resolve => listener.close(resolve));
+    await rm(socket, {force: true});
+    try {if (JSON.parse(await readFile(target, 'utf8')).id === id) await rm(target);} catch (e) {if (e.code !== 'ENOENT') throw e;}
+  }};
+}
+
+export async function openNativeBridge(options) {
+  let names;
+  try {names = (await readdir(directory(options.root))).filter(n => /^[0-9a-f-]{36}\.json$/.test(n)).sort();}
+  catch (e) {if (e.code === 'ENOENT') return null; throw e;}
+  if (!names.length) return null;
+  for (const name of names) {
+    let client;
+    try {
+      const a = JSON.parse(await readFile(join(directory(options.root), name), 'utf8'));
+      client = await openBridgeInstance(options, a);
+      await client.request('thread/read', {threadId: options.record.session});
+      return client;
+    } catch (e) {client?.close(); if (options.signal?.aborted) throw e;}
+  }
+  throw fail('native_tools_bridge_unavailable');
+}
+async function openBridgeInstance({root, record, signal, guidanceId: optionsGuidanceId}, a) {
+  if (a.schema !== 1 || typeof a.token !== 'string' || a.socket !== join(directory(root), a.id + '.sock')) throw fail('native_tools_bridge_invalid');
+  const s = await stat(a.socket).catch(() => {throw fail('native_tools_bridge_unavailable');});
+  if (!s.isSocket() || s.uid !== process.getuid() || (s.mode & 0o077)) throw fail('native_tools_owner_mismatch');
+  const peers = new Set(); let closed = false, guidanceAuthorization = false;
+  const call = (method, extra = {}, authorizeGuidance) => new Promise((resolve, reject) => {
+    if (closed || signal?.aborted) {reject(fail('native_tools_closed')); return;}
+    const peer = createConnection(a.socket); peers.add(peer); let buffer = '', sent = false, settled = false, challenged = false;
+    const finish = (error, result) => {if (settled) return; settled = true; clearTimeout(timer); peers.delete(peer); peer.destroy(); error ? reject(error) : resolve(result);};
+    const lost = () => finish(fail(sent && ['submit', 'submit_guidance'].includes(method) ? 'native_submission_unknown' : 'native_tools_bridge_unavailable'));
+    const timer = setTimeout(lost, 45000);
+    peer.setEncoding('utf8'); peer.on('error', lost); peer.on('close', lost);
+    peer.on('connect', () => {sent = true; peer.write(JSON.stringify({token: a.token, session: record.session, runId: record.run.id, taskId: record.run.managed.taskId, epoch: record.autoContinueEpoch, method, ...(method === 'submit_guidance' ? {guidanceAuthorization: 1} : {}), ...(optionsGuidanceId ? {guidanceId: optionsGuidanceId} : {}), ...extra}) + '\n');});
+    peer.on('data', chunk => {
+      buffer += chunk; if (buffer.length > 16 * 1024 * 1024) {lost(); return;}
+      const end = buffer.indexOf('\n'); if (end < 0) return;
+      const line = buffer.slice(0, end); buffer = buffer.slice(end + 1);
+      try {
+        const r = JSON.parse(line);
+        if (r.kind === 'guidance_authorization_required') {
+          if (method !== 'submit_guidance' || challenged || !authorizeGuidance || r.guidanceId !== optionsGuidanceId ||
+              typeof r.challenge !== 'string' || !/^[0-9a-f-]{36}$/i.test(r.challenge)) {lost(); return;}
+          challenged = true;
+          const acknowledge = authorized => {
+            if (!settled && !peer.destroyed) peer.write(JSON.stringify({token: a.token, method: 'authorize_guidance',
+              guidanceId: optionsGuidanceId, challenge: r.challenge, authorized}) + '\n');
+          };
+          Promise.resolve().then(authorizeGuidance).then(() => {signal?.throwIfAborted(); acknowledge(true);}, () => acknowledge(false)).catch(() => acknowledge(false));
+          return;
+        }
+        if (r.guidanceAuthorization === 1) guidanceAuthorization = true;
+        finish(r.ok ? null : fail(r.code), r.result);
+      } catch {lost();}
+    });
+  });
+  const close = () => {closed = true; signal?.removeEventListener('abort', close); for (const peer of peers) peer.destroy();};
+  signal?.addEventListener('abort', close, {once: true});
+  return {transport: 'codex_app_tools', close, get guidanceAuthorization() {return guidanceAuthorization;},
+    request(method, params) {if (params.threadId !== record.session) throw fail('native_tools_target_mismatch'); return call(method, {cursor: params.cursor});},
+    async submitGuidance({text, beforeSubmit}) {if (!optionsGuidanceId || !guidanceAuthorization) throw fail('native_guidance_unavailable'); await beforeSubmit(); signal?.throwIfAborted(); return call('submit_guidance', {text}, beforeSubmit);},
+    async submitOriginal({text, beforeSubmit}) {await beforeSubmit(); signal?.throwIfAborted(); const fresh = await readRecord(join(root, 'delivery-hooks'), 'codex', record.session); return call('submit', {text, handoffId: fresh?.run?.managed?.nativeHandoff?.id});},
+  };
+}

package/src/codex-plugins/simy/native/guidance-intent.mjs

@@ -0,0 +1,30 @@
+import {createHash} from 'node:crypto';
+
+export const guidancePending = record => ['prepared', 'submitting', 'submitted', 'unknown'].includes(record?.run?.managed?.userGuidance?.phase);
+export const guidanceDigest = text => createHash('sha256').update(text).digest('hex');
+export function guidanceTarget(record) {
+  return {provider: record?.provider, session: record?.session, cwd: record?.cwd,
+    runId: record?.run?.id, taskId: record?.run?.managed?.taskId, epoch: record?.autoContinueEpoch,
+    revision: (record?.run?.revision || 0) + (record?.run?.controlRevision || 0)};
+}
+export function guidanceAllowed(record, {pendingId} = {}) {
+  const m = record?.run?.managed;
+  return record?.provider === 'codex' && record.autoContinue === true && !!record.autoContinueEpoch &&
+    !record.providerArchived && !record.parentSession && record.run?.state === 'recovery_required' && !record.run.stopReason &&
+    m?.purpose?.enabled === true && m.resumeChannel === 'codex_app_server' && (!m.autoContinueEpoch || m.autoContinueEpoch === record.autoContinueEpoch) &&
+    !m.pendingApproval && !m.userQuestion && !m.understandingQuestion && !m.nativeWait && !m.dependencyWait && !m.authenticationWait &&
+    !m.resumeLease && !m.liveWorkspaceLease && !m.outcomeAudit?.lease && !m.executionUncertain && !m.providerWarning &&
+    !m.usageBlocked && !m.maxTokens && !m.purpose?.nativeBoundary &&
+    !['verifying', 'understanding', 'needs_clarification', 'action_association'].includes(m.phase) &&
+    (!m.nativeHandoff || ['finished', 'cancelled'].includes(m.nativeHandoff.phase)) &&
+    (!guidancePending(record) || pendingId === m.userGuidance.id);
+}
+export function assertGuidanceIntent(record, id, text) {
+  const intent = record?.run?.managed?.userGuidance;
+  if (!intent || intent.id !== id || !guidanceAllowed(record, {pendingId: id}) ||
+      JSON.stringify(intent.target) !== JSON.stringify(guidanceTarget(record)) ||
+      intent.text !== text || intent.digest !== guidanceDigest(text)) {
+    throw Object.assign(new Error('The original guidance target or send intent changed.'), {code: 'native_guidance_changed'});
+  }
+  return intent;
+}

package/src/codex-plugins/simy/native/launch

@@ -0,0 +1,36 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -lt 1 ]; then
+  printf '%s\n' 'Codex app tools could not start: missing MCP server path.' >&2
+  exit 64
+fi
+
+PATH="${PATH:-/usr/bin:/bin}:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
+export PATH
+
+cache_root=${XDG_CACHE_HOME:-${HOME:-}/.cache}
+codex_resources=
+case "${CODEX_CLI_PATH:-}" in
+  */*) codex_resources=${CODEX_CLI_PATH%/*} ;;
+esac
+for candidate in \
+  "${CODEX_MCP_NODE_PATH:-}" \
+  "${CODEX_BROWSER_USE_NODE_PATH:-}" \
+  "${CODEX_ELECTRON_RESOURCES_PATH:-}/cua_node/bin/node" \
+  "$codex_resources/cua_node/bin/node" \
+  "$cache_root/codex-runtimes/codex-primary-runtime/dependencies/node/bin/node"
+do
+  if [ -n "$candidate" ] && [ -x "$candidate" ]; then
+    exec "$candidate" "$@"
+  fi
+done
+
+if node_path=$(command -v node 2>/dev/null); then
+  case "$node_path" in
+    /*) exec "$node_path" "$@" ;;
+  esac
+fi
+
+printf '%s\n' 'Codex app tools could not find a Node runtime. Reinstall or update Codex.' >&2
+exit 127

package/src/codex-plugins/simy/native/server.mjs

@@ -0,0 +1,26 @@
+import {createInterface} from 'node:readline';
+import {homedir} from 'node:os';
+import {join, dirname} from 'node:path';
+import {startNativeBridge} from './bridge.mjs';
+
+// Codex launches this ordinary stdio MCP server with its own Node runtime and
+// fresh app-tools pipe. No saved pipe, daemon launch or app modification needed.
+let bridge, reason = 'native_tools_attachment_missing';
+try {
+  const resources = process.env.CODEX_ELECTRON_RESOURCES_PATH || dirname(dirname(dirname(process.execPath)));
+  bridge = await startNativeBridge({root: process.env.SIMY_HOME || join(homedir(), '.simy'), node: process.execPath,
+    server: join(resources, 'plugins/openai-bundled/plugins/codex-app-tools/server.mjs'), pipe: process.env.CODEX_APP_TOOLS_PIPE_PATH});
+} catch (e) {reason = e.code || reason;}
+const lines = createInterface({input: process.stdin});
+for await (const line of lines) {
+  let q; try {q = JSON.parse(line);} catch {continue;}
+  if (q.id === undefined) continue;
+  let result;
+  if (q.method === 'initialize') result = {protocolVersion: q.params.protocolVersion, capabilities: {tools: {}}, serverInfo: {name: 'simy-native-continuation', version: '1.0.0'}};
+  else if (q.method === 'tools/list') result = {tools: [{name: 'native_connection_status', description: 'Read SIMY native Codex transport availability. Connection availability is not execution or completion proof.', inputSchema: {type: 'object', properties: {}, additionalProperties: false}, annotations: {readOnlyHint: true}}]};
+  else if (q.method === 'tools/call' && q.params?.name === 'native_connection_status') result = {content: [{type: 'text', text: JSON.stringify({connected: !!bridge, reason: bridge ? 'app_launched_transport' : reason})}]};
+  else if (q.method === 'ping') result = {};
+  else {process.stdout.write(JSON.stringify({jsonrpc: '2.0', id: q.id, error: {code: -32601, message: 'Method not found'}}) + '\n'); continue;}
+  process.stdout.write(JSON.stringify({jsonrpc: '2.0', id: q.id, result}) + '\n');
+}
+await bridge?.close();

package/src/codex-plugins/simy/native/submission-receipt.mjs

@@ -0,0 +1,9 @@
+// Exact tool output, original sender, complete text and XML escaping are all
+// required. A quoted message or worker assertion is never a send receipt.
+export function matchesNativeDelegation(turn, session, text) {
+  const escaped = text.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+  const expected = `<codex_delegation>\n  <source_thread_id>${session}</source_thread_id>\n  <input>${escaped}</input>\n</codex_delegation>`;
+  return turn.items?.some(item => item.type === 'functionCallOutput' && item.namespace === 'codex_app' &&
+    item.name === 'send_message_to_thread' && !item.output?.truncated &&
+    (typeof item.output === 'string' ? item.output : item.output?.text) === expected) === true;
+}

package/src/delivery-hooks/supervisor.js

@@ -1,3 +1,4 @@
+import {assertNativeObservationScope} from '../session-supervision/native-turn-observer.js';
 import { captureDispatchProvenance } from '../update-detachment/provenance.js';
 import { captureDispatchOwner, assertTaskAdmission, dispatchWithFence, queueDispatchReceipt, confirmDispatch, flushDispatchIntake, rootFromDelivery, observeDispatchEvent } from '../update-detachment/dispatch-gate.js';
 import { bindCompletionArtifacts } from '../session-supervision/completion-artifacts.js';
@@ -29,7 +30,7 @@ import { createTaskPool } from '../codex-plugins/simy/hooks/loop-kernel.mjs';
 const MAX_OUTPUT = 64 * 1024;
 const SAFE_PROVIDER_CODES = new Set(['authentication_required', 'identity', 'permission_narrowed', 'permission_restore', 'turn_failed', 'checkpoint',
   'closed', 'timeout', 'unsupported', 'unavailable', 'manual_provider_action', 'checkpoint_rejected', 'provider_approval', 'provider_question', 'usage_unavailable',
-  'state_busy', 'dispatch_detached', 'owner_fenced', 'task_admission_blocked', 'task_admission_identity_required',
+  'state_busy', 'review_context_changed', 'review_history_changed', 'cancelled', 'dispatch_detached', 'owner_fenced', 'task_admission_blocked', 'task_admission_identity_required',
   'task_identity_conflict', 'attempt_already_recorded', 'identity_unavailable']);
 function safeProviderCode(code) { return SAFE_PROVIDER_CODES.has(code) ? code : 'provider_error'; }
 function providerFailureReason(code) {
@@ -39,6 +40,7 @@ function providerFailureReason(code) {
   if (code === 'checkpoint' || code === 'checkpoint_rejected') return 'Codex returned an invalid managed checkpoint; inspect its plan before resuming.';
   if (code === 'turn_failed') return 'The Codex turn did not complete; inspect the original conversation.';
   if (code === 'state_busy') return 'The local dispatch state is busy; reconcile its lock before another attempt.';
+  if (code === 'review_context_changed' || code === 'review_history_changed') return 'The reviewed conversation or captured results changed. Preserve the prior verdict and inspect the latest settled result before another independent review.';
   if (['dispatch_detached', 'owner_fenced', 'task_admission_blocked', 'task_admission_identity_required', 'task_identity_conflict', 'identity_unavailable'].includes(code)) return `Local dispatch admission requires reconciliation (${code}); preserve the existing task and provider authority.`;
   return 'Codex recovery process failed; inspect its checkpoint and original session before the next bounded recovery.';
 }
@@ -416,8 +418,14 @@ export async function tickManagedTasks({ root, webOrigin, now = Date.now(), exec
             });
           },
           onEvidence: async evidence => {
-            await persistReceipt(current => {
+            await persistReceipt(async current => {
               if (current?.run?.managed?.resumeLease?.id !== leaseId || current.run.managed.decision?.id !== evidence.actionId) throw new Error('Evidence capture lease changed.');
+              if ((evidence.observations || []).some(item => item.kind === 'codex_native_history')) {
+                await authorizeClaim();
+                assertNativeObservationScope(evidence, current, root);
+                for (const item of evidence.observations.filter(item => item.kind === 'codex_native_history'))
+                  await requireProviderLink({root, provider: current.provider, expectedEpoch: item.providerEpoch});
+              }
               if(evidence.workerContext)current.run.managed.executionAttempt.workerContext=structuredClone(evidence.workerContext);
               if (searchEnabled(current.run.managed)) retainControllerEvidence(current.run.managed, evidence, currentTime());
               return current;