@awak-app/simy-cli 0.1.0 → 0.1.1

package/README.md

@@ -7,13 +7,19 @@ npx @awak-app/simy-cli
 npm install -g @awak-app/simy-cli
 simy
 simy --daemon
+simy --host https://simy.example.com
 ```
 
+The published CLI connects to `https://app.simy.one` by default. Use `--host`
+with an absolute SIMY Web origin for another deployment. Non-loopback hosts
+must use HTTPS. `SIMY_WEB_ORIGIN` and the legacy `SIMY_API_ORIGIN` remain
+available for automation, but the command-line flag takes precedence.
+
 The CLI starts a loopback HTTP agent on a random available port, keeps a
-48-hour local session, and owns the coding-loop state machine when the SIMY
-web UI sends a backend-issued launch challenge. It builds the requirement
-charter, runs Codex or Claude Code, audits structured completion evidence, and
-re-instructs the executor within the configured attempt budget.
+48-hour, origin-scoped local session, and owns the coding-loop state machine
+when the SIMY web UI sends a backend-issued launch challenge. It builds the
+requirement charter, runs Codex or Claude Code, audits structured completion
+evidence, and re-instructs the executor within the configured attempt budget.
 
 Structured run snapshots and process events are persisted remotely. Executor
 instructions and the latest bounded log lines are redacted at both the CLI and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Local SIMY coding-loop agent for Codex and Claude Code.",
   "type": "module",
   "bin": {
@@ -14,7 +14,7 @@
     "start": "node ./src/index.js",
     "test": "node --test",
     "check": "npm run check:syntax && npm test && npm run check:package",
-    "check:syntax": "node --check ./src/index.js && node --check ./src/agent.js && node --check ./src/session-store.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./scripts/check-package-contents.js",
+    "check:syntax": "node --check ./src/index.js && node --check ./src/agent.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./scripts/check-package-contents.js",
     "check:package": "node ./scripts/check-package-contents.js"
   },
   "engines": {

package/src/agent.js

@@ -16,19 +16,26 @@ import {
   sessionPath,
   writeSession,
 } from "./session-store.js";
+import { isRequestOriginAllowed, resolveWebOrigin } from "./web-origin.js";
 
-const DEFAULT_WEB_ORIGIN = "http://localhost:3000";
-const ALLOWED_ORIGIN_RE = /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$|^https:\/\/app\.simy\.one$/;
-
-export async function startAgent({ requestedPort = 0, daemon = false } = {}) {
-  const apiOrigin = process.env.SIMY_API_ORIGIN || DEFAULT_WEB_ORIGIN;
+export async function startAgent({
+  requestedPort = 0,
+  daemon = false,
+  webOrigin = null,
+  sessionRoot,
+} = {}) {
+  const apiOrigin = resolveWebOrigin(webOrigin);
   const registry = new LocalRunRegistry();
   const authNonce = randomBytes(16).toString("base64url");
-  let session = await readSession();
+  let session = await readSession(apiOrigin, sessionRoot);
 
   const server = createServer(async (req, res) => {
     try {
-      applyCors(req, res);
+      if (!isRequestOriginAllowed(req.headers.origin, apiOrigin)) {
+        json(res, 403, { error: "request origin does not match the configured SIMY Web host" });
+        return;
+      }
+      applyCors(req, res, apiOrigin);
       if (req.method === "OPTIONS") {
         res.writeHead(204).end();
         return;
@@ -39,7 +46,8 @@ export async function startAgent({ requestedPort = 0, daemon = false } = {}) {
         json(res, 200, {
           ok: true,
           daemon,
-          session_valid: isSessionValid(session),
+          web_origin: apiOrigin,
+          session_valid: isSessionValid(session, Date.now(), apiOrigin),
           session_expires_at: session?.expires_at ?? null,
         });
         return;
@@ -54,24 +62,28 @@ export async function startAgent({ requestedPort = 0, daemon = false } = {}) {
           json(res, 401, { error: "invalid nonce" });
           return;
         }
+        if (body.api_origin !== apiOrigin) {
+          json(res, 403, { error: "authorization origin does not match the configured host" });
+          return;
+        }
         session = {
           token: String(body.token || ""),
           device_id: typeof body.device_id === "string" ? body.device_id : null,
-          api_origin: typeof body.api_origin === "string" ? body.api_origin : apiOrigin,
+          api_origin: apiOrigin,
           expires_at: typeof body.expires_at === "string" ? body.expires_at : expiresAtFromNow(),
         };
-        await writeSession(session);
+        await writeSession(apiOrigin, session, sessionRoot);
         json(res, 200, { ok: true, expires_at: session.expires_at });
         return;
       }
       if (req.method === "POST" && url.pathname === "/v1/coding-loop/start") {
-        if (!isSessionValid(session)) {
+        if (!isSessionValid(session, Date.now(), apiOrigin)) {
           json(res, 401, { error: "simy session expired; run simy again" });
           return;
         }
         const body = await readJson(req);
         const verified = await verifyLaunchChallenge({
-          apiOrigin: session.api_origin || apiOrigin,
+          apiOrigin,
           token: session.token,
           runId: String(body.run_id || ""),
           challenge: String(body.challenge || ""),
@@ -125,7 +137,7 @@ export async function startAgent({ requestedPort = 0, daemon = false } = {}) {
             proposal_id: typeof body.proposal_id === "string" ? body.proposal_id : null,
           },
           session,
-          apiOrigin: session.api_origin || apiOrigin,
+          apiOrigin,
         });
         registry.create(run);
         void startLocalCodingRun(run);
@@ -165,13 +177,14 @@ export async function startAgent({ requestedPort = 0, daemon = false } = {}) {
   const address = server.address();
   const port = typeof address === "object" && address ? address.port : requestedPort;
   console.log(`SIMY local agent listening on http://127.0.0.1:${port}`);
+  console.log(`SIMY Web host: ${apiOrigin}`);
 
-  if (!isSessionValid(session)) {
+  if (!isSessionValid(session, Date.now(), apiOrigin)) {
     const loginUrl = new URL("/local-cli/connect", apiOrigin);
     loginUrl.searchParams.set("port", String(port));
     loginUrl.searchParams.set("nonce", authNonce);
     console.log(`Sign in to SIMY: ${loginUrl.toString()}`);
-    console.log(`Session file: ${sessionPath()}`);
+    console.log(`Session file: ${sessionPath(apiOrigin, sessionRoot)}`);
   }
 
   return { server, port };
@@ -248,11 +261,14 @@ function streamRun(res, run) {
   res.on("close", () => run.emitter.off("event", listener));
 }
 
-function applyCors(req, res) {
+function applyCors(req, res, webOrigin) {
   const origin = req.headers.origin;
-  if (origin && ALLOWED_ORIGIN_RE.test(origin)) {
-    res.setHeader("Access-Control-Allow-Origin", origin);
+  if (origin === webOrigin) {
+    res.setHeader("Access-Control-Allow-Origin", webOrigin);
     res.setHeader("Vary", "Origin");
+    if (req.headers["access-control-request-private-network"] === "true") {
+      res.setHeader("Access-Control-Allow-Private-Network", "true");
+    }
   }
   res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");

package/src/index.js

@@ -4,8 +4,10 @@ import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 import { startAgent } from "./agent.js";
+import { DEFAULT_WEB_ORIGIN, resolveWebOrigin } from "./web-origin.js";
 
-const args = new Set(process.argv.slice(2));
+const argv = process.argv.slice(2);
+const args = new Set(argv);
 
 if (args.has("--help") || args.has("-h")) {
   console.log(`Usage:
@@ -15,12 +17,20 @@ if (args.has("--help") || args.has("-h")) {
 Options:
   --daemon, --deamon  Run detached in the background
   --port <port>       Bind a specific localhost port
+  --host <url>        Connect to a SIMY Web origin (default: ${DEFAULT_WEB_ORIGIN})
 `);
   process.exit(0);
 }
 
 const daemon = args.has("--daemon") || args.has("--deamon");
-const port = readPort(process.argv.slice(2));
+const port = readPort(argv);
+let webOrigin;
+try {
+  webOrigin = resolveWebOrigin(readOption(argv, "--host"));
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(2);
+}
 
 if (daemon && process.env.SIMY_DAEMON_CHILD !== "1") {
   const child = spawn(process.execPath, [fileURLToPath(import.meta.url), ...process.argv.slice(2)], {
@@ -33,7 +43,7 @@ if (daemon && process.env.SIMY_DAEMON_CHILD !== "1") {
   process.exit(0);
 }
 
-await startAgent({ requestedPort: port, daemon });
+await startAgent({ requestedPort: port, daemon, webOrigin });
 
 function readPort(argv) {
   const index = argv.indexOf("--port");
@@ -45,3 +55,13 @@ function readPort(argv) {
   }
   return value;
 }
+
+function readOption(argv, name) {
+  const index = argv.indexOf(name);
+  if (index === -1) return null;
+  const value = argv[index + 1];
+  if (!value || value.startsWith("--")) {
+    throw new Error(`${name} requires a value`);
+  }
+  return value;
+}

package/src/session-store.js

@@ -1,21 +1,55 @@
+import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 
-const SESSION_PATH = join(homedir(), ".simy", "session.json");
+import { normalizeWebOrigin } from "./web-origin.js";
+
 const SESSION_TTL_MS = 48 * 60 * 60 * 1000;
 
-export function sessionPath() {
-  return SESSION_PATH;
+export function sessionPath(webOrigin, sessionRoot = defaultSessionRoot()) {
+  const origin = normalizeWebOrigin(webOrigin);
+  const originHash = createHash("sha256").update(origin).digest("hex");
+  return join(sessionRoot, "sessions", `${originHash}.json`);
 }
 
 export function expiresAtFromNow(now = Date.now()) {
   return new Date(now + SESSION_TTL_MS).toISOString();
 }
 
-export async function readSession() {
+export async function readSession(webOrigin, sessionRoot = defaultSessionRoot()) {
+  const origin = normalizeWebOrigin(webOrigin);
+  const scoped = await readSessionFile(sessionPath(origin, sessionRoot));
+  if (sessionMatchesOrigin(scoped, origin)) return scoped;
+
+  const legacy = await readSessionFile(join(sessionRoot, "session.json"));
+  return sessionMatchesOrigin(legacy, origin) ? legacy : null;
+}
+
+export function isSessionValid(session, now = Date.now(), webOrigin = null) {
+  if (!session?.expires_at) return false;
+  if (webOrigin && !sessionMatchesOrigin(session, normalizeWebOrigin(webOrigin))) return false;
+  const expiresAt = Date.parse(session.expires_at);
+  return Number.isFinite(expiresAt) && expiresAt > now;
+}
+
+export async function writeSession(webOrigin, session, sessionRoot = defaultSessionRoot()) {
+  const origin = normalizeWebOrigin(webOrigin);
+  const targetPath = sessionPath(origin, sessionRoot);
+  await mkdir(dirname(targetPath), { recursive: true, mode: 0o700 });
+  await writeFile(targetPath, `${JSON.stringify({ ...session, api_origin: origin }, null, 2)}\n`, {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+}
+
+function defaultSessionRoot() {
+  return process.env.SIMY_HOME?.trim() || join(homedir(), ".simy");
+}
+
+async function readSessionFile(path) {
   try {
-    const raw = await readFile(SESSION_PATH, "utf8");
+    const raw = await readFile(path, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object") return null;
     if (typeof parsed.token !== "string" || typeof parsed.expires_at !== "string") return null;
@@ -26,16 +60,11 @@ export async function readSession() {
   }
 }
 
-export function isSessionValid(session, now = Date.now()) {
-  if (!session?.expires_at) return false;
-  const expiresAt = Date.parse(session.expires_at);
-  return Number.isFinite(expiresAt) && expiresAt > now;
-}
-
-export async function writeSession(session) {
-  await mkdir(dirname(SESSION_PATH), { recursive: true, mode: 0o700 });
-  await writeFile(SESSION_PATH, `${JSON.stringify(session, null, 2)}\n`, {
-    encoding: "utf8",
-    mode: 0o600,
-  });
+function sessionMatchesOrigin(session, origin) {
+  if (typeof session?.api_origin !== "string") return false;
+  try {
+    return normalizeWebOrigin(session.api_origin) === origin;
+  } catch {
+    return false;
+  }
 }

package/src/web-origin.js

@@ -0,0 +1,46 @@
+export const DEFAULT_WEB_ORIGIN = "https://app.simy.one";
+
+export function resolveWebOrigin(host, env = process.env) {
+  return normalizeWebOrigin(
+    host || env.SIMY_WEB_ORIGIN || env.SIMY_API_ORIGIN || DEFAULT_WEB_ORIGIN,
+  );
+}
+
+export function normalizeWebOrigin(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error("SIMY Web host must be an absolute http(s) URL.");
+  }
+
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    throw new Error("SIMY Web host must be an absolute http(s) URL.");
+  }
+
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new Error("SIMY Web host must use http or https.");
+  }
+  if (url.username || url.password) {
+    throw new Error("SIMY Web host must not contain credentials.");
+  }
+  if ((url.pathname && url.pathname !== "/") || url.search || url.hash) {
+    throw new Error("SIMY Web host must contain only an origin, without a path or query.");
+  }
+
+  const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+  if (url.protocol === "http:" && !loopbackHosts.has(url.hostname)) {
+    throw new Error("SIMY Web host must use https unless it is a loopback address.");
+  }
+
+  return url.origin;
+}
+
+export function isRequestOriginAllowed(requestOrigin, webOrigin) {
+  if (!requestOrigin) return true;
+  try {
+    return normalizeWebOrigin(requestOrigin) === webOrigin;
+  } catch {
+    return false;
+  }
+}