@awak-app/simy-cli 0.2.3 → 0.3.3

package/README.md

@@ -1,6 +1,6 @@
 # SIMY CLI
 
-Local execution agent for SIMY Agentic Loop runs.
+Local execution agent for SIMY Local Tasks and Agentic Loop runs.
 
 For normal use, install SIMY globally and keep its background agent running:
 
@@ -44,6 +44,95 @@ the Provider command boundary, and permits exactly one Provider invocation. It
 does not create an Agentic Loop ledger, audit session, or retry lifecycle for
 that task.
 
+## Local Tasks
+
+CLI API contract v9 promotes non-coding work to a first-class **Local Task**
+runtime. A Local Task is separate from Agentic Loop: it runs one bounded Codex
+or Claude Code session without Git branches, pull requests, audits, or automatic
+Provider retries. Knowledge-work deliverables use an isolated task sandbox by
+default, so they do not require a repository.
+
+`POST /v1/local-tasks/start` accepts JSON or the same verified multipart
+attachment envelope used by Agentic Loop and requires a stable
+`Idempotency-Key`. Repeating the same request returns the original task; using
+the same key for different content returns
+`LOCAL_TASK_IDEMPOTENCY_CONFLICT`. `GET /v1/local-tasks/reconcile` with the same
+header recovers a task when the original response was lost. Only the key hash is
+persisted. Task state, verified inputs, and the event log stay under
+`~/.simy/tasks/<task-id>/`. Tasks that do not need a Git
+repository run in `~/simy/<task-id>/`, with generated files in its `outputs/`
+directory. The public snapshot exposes this user-facing workspace as
+`workspace_display_path` without exposing internal state paths. Set
+`SIMY_LOCAL_TASK_WORKSPACE_ROOT` to override the default workspace root.
+
+Local Tasks provide:
+
+- `GET /v1/local-tasks/<id>` for the current structured snapshot;
+- `GET /v1/local-tasks/reconcile` for request-key reconciliation;
+- `GET /v1/local-tasks/<id>/stream` for live Server-Sent Events;
+- `POST /v1/local-tasks/<id>/control` with `{"action":"stop"}`;
+- `GET /v1/local-tasks/<id>/artifacts/<artifact-id>` for a verified output;
+- one Provider invocation, a configurable Provider-token safety budget, and a
+  bounded runtime timeout;
+- restart-safe terminal persistence. An interrupted active task fails closed
+  after CLI restart and is never replayed automatically.
+
+Interactive Pipelines can use the same daemon worker for a `local_task` node.
+The CLI still invokes the selected Provider exactly once. Before the node is
+reported as successful, every output file is re-verified, uploaded through a
+task-bound short-lived URL, and committed only after SIMY rechecks its byte
+size and SHA-256 digest. Ordinary My AI Local Tasks keep their existing local
+verified-download behavior. Scheduled or unattended Pipeline runs are not
+allowed to select a desktop implicitly.
+
+Web and Backend may opt into `durable_local_task_steps` for a versioned
+multi-step Local Task. The daemon then claims and executes one closed-schema
+step at a time (maximum eight), with an independent Provider invocation
+boundary per step and aggregate step, token, and runtime budgets. The task
+workspace is stable for the turn while each lease attempt has its own local
+record. A step that crossed its Provider boundary is never replayed
+automatically.
+
+Plan initialization uses a two-phase claim. Web stores an authoritative
+`execution_spec.controlled_plan`; the CLI validates that its Provider,
+operation, permission, repository, approval target, and aggregate budgets
+cannot exceed the enclosing execution spec, then submits the exact plan for
+Backend persistence. The CLI never asks a Provider to infer or expand a plan.
+Older one-shot requests receive a deterministic one-step compatibility plan.
+
+Human approval and unknown Provider results are distinct non-executable
+dispositions. Neither holds a Provider process, heartbeat lease, or update
+work reservation. Only bounded summaries and verified artifact references from
+completed steps may enter the next step's context. Unknown plan fields,
+unscoped approvals, unsafe paths, and Provider-supplied risk metadata fail
+closed. The original `local_task_execution.v1` one-shot path remains available
+unchanged for clients that do not negotiate this feature.
+
+Contract 10 additionally advertises `bounded_local_task_subtasks`. Backend
+admits at most two Provider children at once from a closed `parallel_reads`
+plan with 2-4 source-bound candidates. When Crew declines or times out, the
+same v2 contract can admit one `serial_uploaded` read-only child for 2-4
+uploaded sources; this fallback never routes those uploads through the v1 CLI
+staging materializer. The CLI never prefetches beyond an available execution slot:
+each child starts only after a fenced server claim and an explicitly confirmed
+invocation boundary. Children inherit the parent Provider and model, run in
+separate read-only task sandboxes, receive only verified immutable SIMY uploads,
+and cannot use mutation tools or nested delegation. Downloaded bytes are checked
+against the claimed size and SHA-256 digest, then exposed through a mode `0400`
+file without revealing the storage URI to the Provider.
+
+Cancellation uses one pool-wide abort signal and prevents new claims. Unknown
+invocation or final-status boundaries are never replayed automatically. Sibling
+fan-in summaries remain explicitly untrusted data, and all lease, generation,
+budget, usage, and elapsed-time bigint fields cross the JSON boundary as
+canonical decimal strings. The contract 9 `durable_local_task_steps` path
+remains serial and unchanged.
+
+External side effects such as sending messages, submitting forms, uploading, or
+purchasing are outside this MVP. The router rejects them instead of silently
+granting broad permissions. The legacy `/v1/direct-execution/*` contract remains
+available for older Web clients.
+
 ## CLI updates
 
 The CLI checks the npm registry at startup and once per hour while it is

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.2.3",
-  "description": "Local SIMY Agentic Loop executor for Codex and Claude Code.",
+  "version": "0.3.3",
+  "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
     "simy": "src/index.js"
@@ -14,6 +14,9 @@
     "start": "node ./src/index.js",
     "test": "node --test",
     "test:e2e:console": "node ./scripts/console-e2e.js",
+    "test:e2e:console:narrow": "CLI_E2E_COLUMNS=78 CLI_E2E_ROWS=40 node ./scripts/console-e2e.js",
+    "test:e2e:console:no-color": "CLI_E2E_NO_COLOR=1 node ./scripts/console-e2e.js",
+    "test:e2e:console:recovery": "node ./scripts/console-recovery-e2e.js",
     "test:e2e:auto-update": "node ./scripts/auto-update-e2e.js",
     "test:e2e:audit-gate": "node ./scripts/audit-gate-e2e.js",
     "test:e2e:retry-circuit": "node ./scripts/retry-circuit-e2e.js",
@@ -26,13 +29,15 @@
     "test:e2e:budgets": "node ./scripts/budget-enforcement-e2e.js",
     "test:e2e:desktop-executor": "node ./scripts/desktop-executor-e2e.js",
     "test:e2e:pre-guardrail": "node ./scripts/pre-guardrail-e2e.js",
+    "test:e2e:local-task-default-workspace": "node ./scripts/local-task-default-workspace-e2e.js",
+    "test:e2e:local-task-idempotency": "node ./scripts/local-task-idempotency-e2e.js",
     "test:e2e:completion-contract": "node ./scripts/completion-contract-e2e.js",
     "test:e2e:console:real-provider": "node ./scripts/real-provider-console-e2e.js",
     "test:e2e:console:fullstack": "node ./scripts/fullstack-cli-smoke.js",
-    "check": "npm run check:auto-update && node --check ./src/desktop-executor.js && node --check ./scripts/desktop-executor-e2e.js && node --check ./scripts/pre-guardrail-e2e.js && node --check ./scripts/fixtures/fake-desktop-provider.js && npm run check:syntax && npm run check:real-provider-syntax && npm test && npm run check:package",
+    "check": "npm run check:auto-update && node --check ./src/desktop-executor.js && node --check ./src/local-task.js && node --check ./scripts/desktop-executor-e2e.js && node --check ./scripts/pre-guardrail-e2e.js && node --check ./scripts/fixtures/fake-desktop-provider.js && npm run check:syntax && npm run check:real-provider-syntax && npm test && npm run check:package",
     "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js",
     "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js",
-    "check:syntax": "node --check ./src/index.js && node --check ./src/agent.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js",
+    "check:syntax": "node --check ./src/index.js && node --check ./src/agent.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js",
     "check:package": "node ./scripts/check-package-contents.js"
   },
   "engines": {
@@ -52,6 +57,8 @@
   },
   "dependencies": {
     "ink": "^6.8.0",
+    "pdf-lib": "^1.17.1",
+    "pngjs": "^7.0.0",
     "react": "^19.2.0"
   },
   "devDependencies": {