@awak-app/simy-cli 0.3.3 → 0.5.0

package/src/index.js

@@ -2,6 +2,7 @@
 
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { createInterface } from "node:readline/promises";
 
 import { startAgent } from "./agent.js";
 import {
@@ -9,6 +10,8 @@ import {
   createCliAutoUpdater,
   readCliPackageInfo,
   restartDaemonProcess,
+  runCliUpdateGate,
+  shouldRetryIncompatibleCli,
   writeUpdateHandoffFromEnvironment,
 } from "./auto-update.js";
 import { openAuthorizationUrl } from "./browser.js";
@@ -20,12 +23,75 @@ import { DEFAULT_WEB_ORIGIN, resolveWebOrigin } from "./web-origin.js";
 
 const argv = process.argv.slice(2);
 const args = new Set(argv);
+const dispatchArgv = argv.filter((value) => value !== "--no-auto-update");
+const entryPath = fileURLToPath(import.meta.url);
+const packageInfo = await readCliPackageInfo();
+const updatesDisabled = args.has("--no-auto-update") || process.env.SIMY_AUTO_UPDATE === "0";
+
+if (dispatchArgv[0] === "update") {
+  const checkOnly = args.has("--check");
+  const result = await runCliUpdateGate({
+    argv,
+    packageInfo,
+    mode: checkOnly ? "check" : "update",
+    disabled: updatesDisabled,
+    allowMajor: args.has("--yes"),
+    confirmMajor: confirmMajorUpdate,
+  });
+  process.exitCode = ["check_failed", "install_failed"].includes(result.outcome) ? 1 : 0;
+} else {
+  const startupUpdate = await runCliUpdateGate({
+    argv,
+    packageInfo,
+    entryPath,
+    disabled: updatesDisabled,
+  });
+  if (startupUpdate.reexecuted) {
+    process.exitCode = startupUpdate.exitCode;
+  } else {
+    await runCommand();
+  }
+}
 
-if (args.has("--help") || args.has("-h")) {
-  console.log(`Usage:
+async function runCommand() {
+  if (dispatchArgv[0] === "sqm") {
+    try {
+      const { runSqmCommand } = await import("./sqm/command.js");
+      process.exitCode = await runSqmCommand(dispatchArgv.slice(1), { cliVersion: packageInfo.version });
+    } catch (error) {
+      if (shouldRetryIncompatibleCli(error)) {
+        const retried = await runCliUpdateGate({
+          argv,
+          packageInfo,
+          entryPath,
+          mode: "incompatible",
+          disabled: updatesDisabled,
+          allowMajor: args.has("--yes"),
+          confirmMajor: confirmMajorUpdate,
+          incompatibleRetry: true,
+        });
+        if (retried.reexecuted) {
+          process.exitCode = retried.exitCode;
+          return;
+        }
+        const required = error.minimumVersion ? ` (requires ${error.minimumVersion}+)` : "";
+        console.error(`SQM requires a newer SIMY CLI${required}, but automatic recovery did not install one.`);
+      }
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exitCode = 2;
+    }
+    return;
+  }
+
+  if (args.has("--help") || args.has("-h")) {
+    console.log(`Usage:
   simy            Start the local SIMY agent
   simy --daemon   Start it in the background
   simy --no-tui   Start the foreground HTTP agent without the interactive console
+  simy sqm min-check  Run the fast deterministic SQM diff preflight
+  simy sqm check      Run full scenarios, write proof.json, and sign the run
+  simy update --check Check the installed and latest stable CLI versions
+  simy update         Install an eligible stable CLI update
 
 Options:
   --daemon, --deamon  Run detached in the background
@@ -33,73 +99,92 @@ Options:
   --no-open           Do not open the browser when authorization is required
   --port <port>       Bind a specific localhost port
   --host <url>        Connect to a SIMY Web origin (default: ${DEFAULT_WEB_ORIGIN})
-  --no-auto-update    Disable the hourly CLI update check
+  --no-auto-update    Disable update checks and automatic installation
 
 ${autoUpdateHelpText()}
 `);
-  process.exit(0);
-}
+    return;
+  }
 
-const daemon = args.has("--daemon") || args.has("--deamon");
-const interactive = !daemon && !args.has("--no-tui") && process.stdin.isTTY && process.stdout.isTTY;
-const port = readPort(argv);
-const packageInfo = await readCliPackageInfo();
-let webOrigin;
-try {
-  webOrigin = resolveWebOrigin(readOption(argv, "--host"));
-} catch (error) {
-  console.error(error instanceof Error ? error.message : String(error));
-  process.exit(2);
+  await runLocalAgent();
 }
 
-if (daemon && process.env.SIMY_DAEMON_CHILD !== "1") {
-  const child = spawn(process.execPath, [fileURLToPath(import.meta.url), ...process.argv.slice(2)], {
-    detached: true,
-    stdio: "ignore",
-    env: { ...process.env, SIMY_DAEMON_CHILD: "1" },
-  });
-  child.unref();
-  console.log("SIMY local agent started in the background.");
-  process.exit(0);
-}
+async function runLocalAgent() {
+  const daemon = args.has("--daemon") || args.has("--deamon");
+  const interactive = !daemon && !args.has("--no-tui") && process.stdin.isTTY && process.stdout.isTTY;
+  const port = readPort(argv);
+  let webOrigin;
+  try {
+    webOrigin = resolveWebOrigin(readOption(argv, "--host"));
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 2;
+    return;
+  }
 
-const updateManager = await createCliAutoUpdater({
-  daemon,
-  interactive,
-  requestedPort: port,
-  disabled: args.has("--no-auto-update") || process.env.SIMY_AUTO_UPDATE === "0",
-  dependencies: { packageInfo },
-});
-const agent = await startAgent({
-  requestedPort: port,
-  daemon,
-  webOrigin,
-  quiet: interactive,
-  updateManager,
-});
-const shutdownAgent = createAgentShutdown(agent);
-installAgentShutdownSignalHandlers({ shutdown: shutdownAgent });
-await writeUpdateHandoffFromEnvironment({ version: packageInfo.version, port: agent.port });
-updateManager.start({
-  registry: agent.registry,
-  restartDaemon: async (targetVersion) => {
-    await restartDaemonProcess({
-      entryPath: fileURLToPath(import.meta.url),
-      argv: process.argv.slice(2),
-      targetVersion,
+  if (daemon && process.env.SIMY_DAEMON_CHILD !== "1") {
+    const child = spawn(process.execPath, [fileURLToPath(import.meta.url), ...process.argv.slice(2)], {
+      detached: true,
+      stdio: "ignore",
+      env: { ...process.env, SIMY_DAEMON_CHILD: "1" },
     });
-    await shutdownAgent();
-  },
-});
-if (agent.loginUrl && !args.has("--no-open")) {
-  await openAuthorizationUrl(agent.loginUrl);
+    child.unref();
+    console.log("SIMY local agent started in the background.");
+    return;
+  }
+
+  const updateManager = await createCliAutoUpdater({
+    daemon,
+    interactive,
+    requestedPort: port,
+    disabled: args.has("--no-auto-update") || process.env.SIMY_AUTO_UPDATE === "0",
+    dependencies: { packageInfo },
+  });
+  const agent = await startAgent({
+    requestedPort: port,
+    daemon,
+    webOrigin,
+    quiet: interactive,
+    updateManager,
+  });
+  const shutdownAgent = createAgentShutdown(agent);
+  installAgentShutdownSignalHandlers({ shutdown: shutdownAgent });
+  await writeUpdateHandoffFromEnvironment({ version: packageInfo.version, port: agent.port });
+  updateManager.start({
+    registry: agent.registry,
+    restartDaemon: async (targetVersion) => {
+      await restartDaemonProcess({
+        entryPath: fileURLToPath(import.meta.url),
+        argv: process.argv.slice(2),
+        targetVersion,
+      });
+      await shutdownAgent();
+    },
+  });
+  if (agent.loginUrl && !args.has("--no-open")) {
+    await openAuthorizationUrl(agent.loginUrl);
+  }
+  if (interactive) {
+    const { runAgenticLoopConsole } = await import("./console/index.js");
+    try {
+      await runAgenticLoopConsole(agent);
+    } finally {
+      await shutdownAgent();
+    }
+  }
 }
-if (interactive) {
-  const { runAgenticLoopConsole } = await import("./console/index.js");
+
+async function confirmMajorUpdate({ currentVersion, latestVersion }) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    console.log(`Major update ${currentVersion} → ${latestVersion} requires confirmation. Re-run with \`simy update --yes\`.`);
+    return false;
+  }
+  const prompt = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    await runAgenticLoopConsole(agent);
+    const answer = await prompt.question(`Install major SIMY CLI update ${currentVersion} → ${latestVersion}? [y/N] `);
+    return /^(y|yes)$/i.test(answer.trim());
   } finally {
-    await shutdownAgent();
+    prompt.close();
   }
 }
 

package/src/local-task.js

@@ -3,15 +3,17 @@ import { createHash, randomUUID } from "node:crypto";
 import { EventEmitter, once } from "node:events";
 import {
   mkdir,
+  mkdtemp,
   lstat,
   readFile,
   readdir,
   realpath,
   rename,
+  rm,
   stat,
   writeFile,
 } from "node:fs/promises";
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 
@@ -426,17 +428,38 @@ export async function startLocalTask(
   // synchronous spawn boundary so a stopped task can never start Provider work.
   if (task.stop_requested || task.status !== "running") return task;
 
-  return new Promise((resolve) => {
+  const runtimeTempBase = process.platform === "darwin" ? "/tmp" : tmpdir();
+  const runtimeTempRoot = await mkdtemp(
+    path.join(runtimeTempBase, `simy-local-task-${task.id}-`),
+  );
+  allowCodexRuntimeTemp(command, runtimeTempRoot);
+
+  return new Promise((resolve, reject) => {
     let settled = false;
     let timeout = null;
     const rawStdout = [];
     const tokenRecords = [];
-    const child = command.spawn(command.bin, command.args, {
-      cwd: task.workspace_path,
-      env: { ...process.env, ...command.env },
-      stdio: ["ignore", "pipe", "pipe"],
-      detached: process.platform !== "win32",
-    });
+    let child;
+    try {
+      child = command.spawn(command.bin, command.args, {
+        cwd: task.workspace_path,
+        env: {
+          ...process.env,
+          TMPDIR: runtimeTempRoot,
+          TMP: runtimeTempRoot,
+          TEMP: runtimeTempRoot,
+          ...command.env,
+        },
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: process.platform !== "win32",
+      });
+    } catch (error) {
+      void rm(runtimeTempRoot, { recursive: true, force: true }).then(
+        () => reject(error),
+        () => reject(error),
+      );
+      return;
+    }
     task.child = child;
 
     const onLine = (line) => {
@@ -523,6 +546,7 @@ export async function startLocalTask(
       let artifacts = [];
       let scenarioAcceptance = null;
       try {
+        await rm(runtimeTempRoot, { recursive: true, force: true });
         artifacts = task.outputs_root
           ? await collectLocalTaskArtifacts(task.outputs_root, {
               localTaskId: task.id,
@@ -1085,6 +1109,25 @@ function providerTokenCount(record) {
   return Number(record?.total_tokens || 0);
 }
 
+function allowCodexRuntimeTemp(command, runtimeTempRoot) {
+  if (
+    command.backend !== "codex" ||
+    command.execution_kind !== "direct" ||
+    command.verification === "explicit_command_override" ||
+    command.args[0] !== "exec" ||
+    command.args.length < 2
+  ) {
+    return;
+  }
+  const instruction = command.args.at(-1);
+  command.args = [
+    ...command.args.slice(0, -1),
+    "--add-dir",
+    runtimeTempRoot,
+    instruction,
+  ];
+}
+
 function providerLabel(backend) {
   return backend === "claude" ? "Claude Code" : "Codex";
 }

package/src/orchestrator/audit.js

@@ -13,7 +13,7 @@ import {
   normalizeVisualReview,
 } from "./completion-contract.js";
 
-export async function auditAttempt(charter, attempt, { previousAttempt = null } = {}) {
+export async function auditAttempt(charter, attempt, { previousAttempt = null, sqm = null } = {}) {
   const checks = [];
   const addCheck = (
     id,
@@ -219,6 +219,7 @@ export async function auditAttempt(charter, attempt, { previousAttempt = null }
       ? "Implementation evidence passed local verification."
       : "Implementation evidence failed local verification.",
     checks,
+    sqm: normalizeSqmAudit(sqm),
   };
 
   return {
@@ -257,6 +258,46 @@ export async function auditAttempt(charter, attempt, { previousAttempt = null }
     release_gate: null,
     work_log_signals: [],
     work_log_interventions: [],
+    sqm: normalizeSqmAudit(sqm),
+  };
+}
+
+function normalizeSqmAudit(sqm) {
+  if (!sqm) return null;
+  return {
+    status: sqm.status || "unavailable",
+    mode: "shadow",
+    bundle: sqm.bundle || null,
+    warnings: Array.isArray(sqm.warnings) ? sqm.warnings : [],
+    findings: (Array.isArray(sqm.findings) ? sqm.findings : []).map((finding) => ({
+      finding_id: finding.finding_id,
+      module_id: finding.module_id,
+      module_version: finding.module_version,
+      rule_id: finding.rule_id,
+      severity: finding.severity,
+      file: finding.file || null,
+      line: finding.line || null,
+      side: finding.side || null,
+      evidence_hash: finding.evidence_hash,
+      bundle_id: finding.bundle_id,
+      bundle_version: finding.bundle_version,
+      bundle_digest: finding.bundle_digest,
+    })),
+    min_check: sqm.min_check ? {
+      result_digest: sqm.min_check.result_digest || null,
+      status: sqm.min_check.status || null,
+      executed_at: sqm.min_check.executed_at || null,
+    } : null,
+    proof: sqm.proof ? {
+      proof_id: sqm.proof.proof_id || null,
+      digest: sqm.proof.integrity?.digest || null,
+      outcome: sqm.proof.outcome?.status || null,
+    } : null,
+    signed_evidence: sqm.signed_evidence ? {
+      evidence_id: sqm.signed_evidence.evidence_id || null,
+      key_id: sqm.signed_evidence.signer?.key_id || null,
+      algorithm: sqm.signed_evidence.integrity?.algorithm || null,
+    } : null,
   };
 }
 

package/src/orchestrator/completion-contract.js

@@ -79,8 +79,14 @@ export function completionEvidenceChecks(charter, attempt) {
   if (contract.version !== COMPLETION_CONTRACT_VERSION) return [];
 
   const uncertainty = normalizeUncertaintyVerification(attempt?.uncertainty_verification);
-  const criterionEvidence = normalizeCriterionEvidence(attempt?.criterion_evidence);
   const rows = acceptanceCriterionRows(charter);
+  const criterionEvidence = normalizeCriterionEvidence(attempt?.criterion_evidence);
+  const expectedCriterionIds = new Set(rows.map((row) => row.id));
+  const unexpectedCriterionIds = uniqueStrings(
+    criterionEvidence
+      .map((item) => item.criterion_id)
+      .filter((criterionId) => !expectedCriterionIds.has(criterionId)),
+  );
   const checks = [
     check(
       "top_uncertainty_recorded",
@@ -110,6 +116,14 @@ export function completionEvidenceChecks(charter, attempt) {
         ? "The executor marked the highest uncertainty resolved with observed evidence."
         : uncertainty.fallback || "The highest uncertainty remains unresolved.",
     ),
+    check(
+      "criterion_evidence_scope",
+      "Criterion evidence matches the charter acceptance criteria",
+      unexpectedCriterionIds.length === 0,
+      unexpectedCriterionIds.length === 0
+        ? "Every criterion evidence row references a chartered acceptance criterion."
+        : `Unexpected criterion evidence: ${unexpectedCriterionIds.join(", ")}.`,
+    ),
   ];
 
   for (const row of rows) {

package/src/orchestrator/loop.js

@@ -14,6 +14,7 @@ export async function runCodingLoop({
   executeAttempt,
   executeIndependentAudit,
   collectEvidence,
+  checkSqm = null,
   onUpdate,
   humanGuidance = "",
   resume = false,
@@ -127,6 +128,7 @@ export async function runCodingLoop({
     });
     await publish(snapshot, "collecting_evidence", onUpdate);
     attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+    attempt.sqm = await safeSqm(checkSqm, attempt);
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
 
     appendEvent(snapshot, "auditing", `Verifying local evidence for attempt ${attemptNumber}.`, {
@@ -140,7 +142,10 @@ export async function runCodingLoop({
         attempt.observed_evidence?.github?.available === true,
     });
     await publish(snapshot, "auditing", onUpdate);
-    attempt.audit = await auditAttempt(snapshot.charter, attempt, { previousAttempt });
+    attempt.audit = await auditAttempt(snapshot.charter, attempt, {
+      previousAttempt,
+      sqm: attempt.sqm,
+    });
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
     attempt.implementation_gate = attempt.audit.implementation_gate;
     snapshot.attempts.push(attempt);
@@ -212,8 +217,12 @@ export async function runCodingLoop({
 
     // Re-collect after the read-only auditor to catch any mutated HEAD or working tree.
     attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+    attempt.sqm = await safeSqm(checkSqm, attempt, attempt.sqm);
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
-    attempt.audit = await auditAttempt(snapshot.charter, attempt, { previousAttempt });
+    attempt.audit = await auditAttempt(snapshot.charter, attempt, {
+      previousAttempt,
+      sqm: attempt.sqm,
+    });
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
     attempt.implementation_gate = attempt.audit.implementation_gate;
 
@@ -267,7 +276,7 @@ async function stopCodingLoop(snapshot, onUpdate) {
   return snapshot;
 }
 
-export async function recheckPrReadiness({ snapshot, collectEvidence, onUpdate }) {
+export async function recheckPrReadiness({ snapshot, collectEvidence, checkSqm = null, onUpdate }) {
   const attempt = snapshot.attempts.at(-1);
   if (!attempt || !attempt.audit?.passed || !attempt.independent_audit?.passed) return snapshot;
   appendEvent(snapshot, "checking_pr", "Refreshing GitHub review and CI evidence.", {
@@ -275,8 +284,10 @@ export async function recheckPrReadiness({ snapshot, collectEvidence, onUpdate }
   });
   await publish(snapshot, "checking_pr", onUpdate);
   attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+  attempt.sqm = await safeSqm(checkSqm, attempt, attempt.sqm, "full");
   attempt.audit = await auditAttempt(snapshot.charter, attempt, {
     previousAttempt: snapshot.attempts.at(-2) ?? null,
+    sqm: attempt.sqm,
   });
   snapshot.implementation_gate_passed = attempt.audit.passed;
   attempt.pr_readiness = evaluatePrReadiness(snapshot.charter, attempt);
@@ -352,6 +363,21 @@ async function safeEvidence(collector, attempt) {
   }
 }
 
+async function safeSqm(checker, attempt, previous = null, phase = "min") {
+  if (!checker) return previous;
+  try {
+    return await checker(attempt, { phase });
+  } catch (error) {
+    return {
+      status: "unavailable",
+      mode: "shadow",
+      bundle: null,
+      findings: [],
+      warnings: [error instanceof Error ? error.message : "SQM shadow check failed."],
+    };
+  }
+}
+
 function unavailableEvidence(error) {
   return {
     collected_at: new Date().toISOString(),

package/src/runner.js

@@ -40,6 +40,8 @@ import {
 import { LocalRunRegistry } from "./run-registry.js";
 import { webApiHeaders, webApiUrl } from "./web-api.js";
 import { normalizeGitHubRemote } from "./workspace-context.js";
+import { CLI_VERSION } from "./cli-contract.js";
+import { createSqmChecker } from "./sqm/index.js";
 
 const execFileAsync = promisify(execFile);
 const MAX_LOCAL_LOG_LINES = 1_000;
@@ -543,6 +545,20 @@ async function runLocalCodingRun(
         attempt,
         repositoryPath,
       }));
+  const sqmChecker =
+    run.sqmChecker ||
+    createSqmChecker({
+      cwd: repositoryPath,
+      baseBranch: run.snapshot.charter.base_branch,
+      cliVersion: CLI_VERSION,
+      token: run.session?.token,
+      endpoint: sqmBundleEndpoint(run.session),
+      evidenceEndpoint: sqmEvidenceEndpoint(run.session),
+      accountId: run.session?.account_id || run.session?.auth_user_id || run.session?.device_id,
+      organizationId: run.session?.organization_id || run.session?.org_id,
+      deviceId: run.session?.device_id,
+    });
+  run.sqmChecker = sqmChecker;
 
   try {
     await runCodingLoop({
@@ -550,6 +566,7 @@ async function runLocalCodingRun(
       executeAttempt: executor,
       executeIndependentAudit: independentAuditor,
       collectEvidence: evidenceCollector,
+      checkSqm: sqmChecker,
       humanGuidance,
       resume,
       shouldStop: () => run.stopRequested,
@@ -601,9 +618,24 @@ export async function recheckLocalCodingRun(run, { collectEvidence } = {}) {
         attempt,
         repositoryPath,
       }));
+  const sqmChecker =
+    run.sqmChecker ||
+    createSqmChecker({
+      cwd: repositoryPath,
+      baseBranch: run.snapshot.charter.base_branch,
+      cliVersion: CLI_VERSION,
+      token: run.session?.token,
+      endpoint: sqmBundleEndpoint(run.session),
+      evidenceEndpoint: sqmEvidenceEndpoint(run.session),
+      accountId: run.session?.account_id || run.session?.auth_user_id || run.session?.device_id,
+      organizationId: run.session?.organization_id || run.session?.org_id,
+      deviceId: run.session?.device_id,
+    });
+  run.sqmChecker = sqmChecker;
   await recheckPrReadiness({
     snapshot: run.snapshot,
     collectEvidence: evidenceCollector,
+    checkSqm: sqmChecker,
     onUpdate: async (snapshot) => {
       run.snapshot = snapshot;
       await updateRun(run, snapshot.state);
@@ -612,6 +644,18 @@ export async function recheckLocalCodingRun(run, { collectEvidence } = {}) {
   return run.snapshot;
 }
 
+function sqmBundleEndpoint(session) {
+  if (process.env.SIMY_SQM_BUNDLE_URL?.trim()) return process.env.SIMY_SQM_BUNDLE_URL.trim();
+  if (!session?.api_base_url) return undefined;
+  return new URL("sqm/knowledge-bundle", session.api_base_url).href;
+}
+
+function sqmEvidenceEndpoint(session) {
+  if (process.env.SIMY_SQM_EVIDENCE_URL?.trim()) return process.env.SIMY_SQM_EVIDENCE_URL.trim();
+  if (!session?.api_base_url) return undefined;
+  return new URL("sqm/run-evidence", session.api_base_url).href;
+}
+
 async function executeProcessAttempt({
   backend,
   instruction,