@awak-app/simy-cli 0.5.20 → 0.5.22

package/src/sqm/claude-plugin-update.js

@@ -0,0 +1,41 @@
+import { readFile, realpath } from "node:fs/promises";
+import path from "node:path";
+import { CLAUDE_MARKETPLACE, CLAUDE_PLUGIN_SELECTOR } from "./claude-plugin.js";
+
+export async function refreshClaudePlugin({ status, home, claudeHome, resolveExecutable, run }) {
+  if (!status.claude_plugin?.installed) return { outcome: "not_enabled" };
+  const executable = await resolveExecutable("claude");
+  if (!executable) return { outcome: "not_enabled" };
+  const options = { timeout: 10_000, maxBuffer: 1024 * 1024,
+    env: { ...process.env, HOME: home, CLAUDE_CONFIG_DIR: claudeHome } };
+  const list = async () => JSON.parse((await run(executable, ["plugin", "list", "--json"], options)).stdout);
+  const installed = (await list()).find((entry) => entry.id === CLAUDE_PLUGIN_SELECTOR && entry.scope === "user");
+  // Never install or re-enable a plugin on a background update, or modify a
+  // project/local/managed scope that SIMY did not install for this user.
+  if (!installed?.enabled) return { outcome: "not_enabled" };
+  const marketplaces = JSON.parse((await run(executable, ["plugin", "marketplace", "list", "--json"], options)).stdout);
+  const marketplace = marketplaces.find((entry) => entry.name === CLAUDE_MARKETPLACE);
+  if (marketplace?.source !== "directory" || !marketplace.path ||
+      await realpath(marketplace.path) !== await realpath(status.claude_plugin.marketplace_root)) {
+    throw new Error("Enabled SIMY Claude plugin points to a different marketplace; refresh skipped.");
+  }
+  const cacheCurrent = async (entry) => {
+    if (!entry?.installPath || entry.version !== status.claude_plugin.version) return false;
+    const cacheRoot = await realpath(path.join(claudeHome, "plugins/cache")).catch(() => null);
+    if (!cacheRoot) return false;
+    const installedPath = await realpath(entry.installPath).catch(() => null);
+    const relative = installedPath && path.relative(cacheRoot, installedPath);
+    if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return false;
+    try {
+      return JSON.parse(await readFile(path.join(installedPath, ".claude-plugin/plugin.json"), "utf8")).version === status.claude_plugin.version;
+    } catch (error) { if (error.code === "ENOENT" || error instanceof SyntaxError) return false; throw error; }
+  };
+  if (await cacheCurrent(installed)) return { outcome: "current" };
+  await run(executable, ["plugin", "marketplace", "update", CLAUDE_MARKETPLACE], options);
+  await run(executable, ["plugin", "update", CLAUDE_PLUGIN_SELECTOR, "--scope", "user"], options);
+  const refreshed = (await list()).find((entry) => entry.id === CLAUDE_PLUGIN_SELECTOR && entry.scope === "user");
+  if (!refreshed?.enabled || !await cacheCurrent(refreshed)) {
+    throw new Error("Claude Code did not confirm the updated SIMY plugin cache; will retry.");
+  }
+  return { outcome: "updated", version: status.claude_plugin.version };
+}

package/src/sqm/claude-plugin.js

@@ -0,0 +1,122 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, readdir, rename, rm, lstat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SOURCE = fileURLToPath(new URL("../codex-plugins/simy/", import.meta.url));
+export const CLAUDE_MARKETPLACE = "simy-local";
+export const CLAUDE_PLUGIN_SELECTOR = `simy@${CLAUDE_MARKETPLACE}`;
+const AUTHOR = "Specialist Doctors Inc.";
+
+// Generate both providers from the maintained workflow source. Only provider
+// terminology, manifest schema, and hook environment names differ.
+export async function claudePluginFiles() {
+  const sourceManifest = JSON.parse(await readFile(path.join(SOURCE, ".codex-plugin/plugin.json"), "utf8"));
+  const files = new Map();
+  for (const entry of await readdir(path.join(SOURCE, "skills"), { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const relative = `skills/${entry.name}/SKILL.md`;
+    const content = await readFile(path.join(SOURCE, relative), "utf8");
+    files.set(relative, content.replaceAll("current Codex thread", "current Claude Code conversation"));
+  }
+  files.set("hooks/connection-reminder.mjs", await readFile(path.join(SOURCE, "hooks/connection-reminder.mjs"), "utf8"));
+  const hooks = JSON.parse(await readFile(path.join(SOURCE, "hooks/hooks.json"), "utf8"));
+  for (const groups of Object.values(hooks.hooks)) {
+    for (const group of groups) {
+      for (const hook of group.hooks) {
+        hook.command = hook.command.replace(/^node /, `${quoteRuntime(process.execPath)} `)
+          .replaceAll("process.env.PLUGIN_ROOT", "process.env.CLAUDE_PLUGIN_ROOT");
+      }
+    }
+  }
+  files.set("hooks/hooks.json", json(hooks));
+  const hash = createHash("sha256");
+  for (const [name, contents] of [...files].sort(([a], [b]) => a.localeCompare(b))) hash.update(name).update("\0").update(contents);
+  const manifest = {
+    name: "simy", version: `${sourceManifest.version.split("+")[0]}+claude.${hash.digest("hex").slice(0, 20)}`,
+    description: "SIMY quality checks, pull request review, and connection reminders for Claude Code.",
+    author: sourceManifest.author, repository: sourceManifest.repository,
+    license: sourceManifest.license, keywords: sourceManifest.keywords,
+  };
+  files.set(".claude-plugin/plugin.json", json(manifest));
+  return { files, manifest };
+}
+
+export async function inspectClaudePlugin({ home = homedir() } = {}) {
+  const root = marketplaceRoot(home);
+  const target = path.join(root, "plugins/simy");
+  const { files, manifest } = await claudePluginFiles();
+  let matches = true;
+  let exists = false;
+  for (const [name, contents] of files) {
+    const installed = await optionalRead(path.join(target, name));
+    if (name === ".claude-plugin/plugin.json") exists = installed !== null;
+    if (installed !== contents) matches = false;
+  }
+  const marketplacePath = path.join(root, ".claude-plugin/marketplace.json");
+  matches = matches && await optionalRead(marketplacePath) === json(marketplaceManifest());
+  return {
+    plugin_id: "simy", version: manifest.version, path: target,
+    marketplace_path: marketplacePath, marketplace_root: root, selector: CLAUDE_PLUGIN_SELECTOR,
+    installed: matches, state: matches ? "installed" : exists ? "outdated" : "missing",
+  };
+}
+
+export async function installClaudePlugin({ home = homedir() } = {}) {
+  const root = marketplaceRoot(home);
+  const target = path.join(root, "plugins/simy");
+  // Never overwrite an unrelated user plugin, including a symlink.
+  let targetInfo = null;
+  try { targetInfo = await lstat(target); } catch (error) { if (error.code !== "ENOENT") throw error; }
+  if (targetInfo) {
+    if (!targetInfo.isDirectory()) throw new Error("SIMY Claude plugin target is not a managed directory.");
+    let manifest;
+    try { manifest = JSON.parse(await readFile(path.join(target, ".claude-plugin/plugin.json"), "utf8")); }
+    catch { throw new Error("SIMY Claude plugin target has no valid managed manifest."); }
+    if (manifest.name !== "simy" || manifest.author?.name !== AUTHOR) throw new Error("SIMY Claude plugin target is not managed by SIMY.");
+  }
+  const marketplacePath = path.join(root, ".claude-plugin/marketplace.json");
+  const existing = await optionalRead(marketplacePath);
+  if (existing !== null && existing !== json(marketplaceManifest())) {
+    throw new Error("SIMY Claude marketplace contains unmanaged changes; installation skipped.");
+  }
+  const { files } = await claudePluginFiles();
+  const stage = path.join(root, `plugins/.simy-${process.pid}.tmp`);
+  const backup = path.join(root, `plugins/.simy-${process.pid}.bak`);
+  await mkdir(path.dirname(stage), { recursive: true, mode: 0o700 });
+  await rm(stage, { recursive: true, force: true });
+  for (const [name, contents] of files) {
+    await mkdir(path.dirname(path.join(stage, name)), { recursive: true, mode: 0o700 });
+    await writeFile(path.join(stage, name), contents, { mode: 0o600 });
+  }
+  let backedUp = false;
+  try {
+    try { await rename(target, backup); backedUp = true; } catch (error) { if (error.code !== "ENOENT") throw error; }
+    await rename(stage, target);
+    await mkdir(path.dirname(marketplacePath), { recursive: true, mode: 0o700 });
+    await writeFile(`${marketplacePath}.tmp`, json(marketplaceManifest()), { mode: 0o600 });
+    await rename(`${marketplacePath}.tmp`, marketplacePath);
+    if (backedUp) await rm(backup, { recursive: true, force: true });
+  } catch (error) {
+    await rm(stage, { recursive: true, force: true });
+    if (backedUp) {
+      await rm(target, { recursive: true, force: true });
+      await rename(backup, target);
+    }
+    throw error;
+  }
+  return inspectClaudePlugin({ home });
+}
+
+function marketplaceRoot(home) { return path.join(home, ".simy/integrations/claude-marketplace"); }
+function marketplaceManifest() {
+  return { name: CLAUDE_MARKETPLACE, owner: { name: AUTHOR }, plugins: [{ name: "simy", source: "./plugins/simy" }] };
+}
+function json(value) { return `${JSON.stringify(value, null, 2)}\n`; }
+async function optionalRead(file) {
+  try { return await readFile(file, "utf8"); } catch (error) { if (error.code === "ENOENT") return null; throw error; }
+}
+function quoteRuntime(value) {
+  return process.platform === "win32" ? `"${value.replaceAll('"', '""')}"` : `'${value.replaceAll("'", "'\\''")}'`;
+}

package/src/sqm/provider-command.js

@@ -0,0 +1,38 @@
+import spawn from "cross-spawn";
+
+// cross-spawn resolves npm .cmd shims on Windows without interpolating command
+// text. Keep updater commands bounded and preserve execFile-like test injection.
+export function runProviderCommand(command, args, { env, timeout = 10_000, maxBuffer = 1024 * 1024 } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { env, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      error ? reject(error) : resolve({ stdout, stderr });
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish(new Error("Provider plugin command timed out."));
+    }, timeout);
+    timer.unref?.();
+    const capture = (stream, append) => {
+      stream.setEncoding("utf8");
+      stream.on("data", (chunk) => {
+        if (settled) return;
+        append(chunk);
+        if (Buffer.byteLength(stdout) + Buffer.byteLength(stderr) > maxBuffer) {
+          child.kill("SIGTERM");
+          finish(new Error("Provider plugin command exceeded the output limit."));
+        }
+      });
+    };
+    capture(child.stdout, (chunk) => { stdout += chunk; });
+    capture(child.stderr, (chunk) => { stderr += chunk; });
+    child.on("error", finish);
+    child.on("close", (code) => finish(code === 0 ? null : new Error(`Provider plugin command exited with code ${code}.`)));
+  });
+}

package/src/sqm/review-worker.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import spawn from "cross-spawn";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -79,7 +79,8 @@ export function createSqmLocalReviewWorker({
   workerId = "sqm-local-review",
   leaseSeconds = DEFAULT_LEASE_SECONDS,
   heartbeatIntervalMs = Math.max(10_000, Math.floor(leaseSeconds * 500)),
-  runReview = runStructuredCodexReview,
+  getProvider = () => "codex",
+  runReview = (request, provider) => runStructuredProviderReview(provider, request),
   beginWork = () => () => {},
   onError = () => {},
 } = {}) {
@@ -88,34 +89,35 @@ export function createSqmLocalReviewWorker({
   let pollPromise = null;
   let closed = false;
 
-  const leaseBody = (claim) => ({
+  const leaseBody = (claim, provider) => ({
+    executor_provider: provider,
     worker_id: workerId,
     lease_seconds: leaseSeconds,
     job_id: claim.job_id,
     lease_token: claim.lease_token,
   });
 
-  const processClaim = async (claim) => {
+  const processClaim = async (claim, provider) => {
     activeJobId = claim.job_id;
     let heartbeatTimer = null;
     const heartbeat = () => {
-      void api.request({ action: "heartbeat", ...leaseBody(claim) }).catch(onError);
+      void api.request({ action: "heartbeat", ...leaseBody(claim, provider) }).catch(onError);
     };
     heartbeatTimer = setInterval(heartbeat, heartbeatIntervalMs);
     heartbeatTimer.unref?.();
     try {
-      const analysis = await runReview(claim.request);
+      const analysis = await runReview(claim.request, provider);
       const advanced = await api.request({
         action: "advance",
-        ...leaseBody(claim),
+        ...leaseBody(claim, provider),
         analysis_output: analysis.output,
         executor_model: analysis.model,
       });
       if (advanced.completed) return advanced;
-      const adjudication = await runReview(advanced.request);
+      const adjudication = await runReview(advanced.request, provider);
       return api.request({
         action: "complete",
-        ...leaseBody(claim),
+        ...leaseBody(claim, provider),
         analysis_output: analysis.output,
         adjudication_output: adjudication.output,
         executor_model: adjudication.model || analysis.model,
@@ -132,16 +134,20 @@ export function createSqmLocalReviewWorker({
     },
     poll() {
       if (closed || pollPromise) return pollPromise || Promise.resolve(null);
+      const provider = getProvider();
+      if (provider == null) return Promise.resolve(null);
+      assertProvider(provider);
       const releaseWork = beginWork?.();
       if (!releaseWork) return Promise.resolve(null);
       pollPromise = (async () => {
         const claim = await api.request({
           action: "claim",
+          executor_provider: provider,
           worker_id: workerId,
           lease_seconds: leaseSeconds,
         });
         if (!claim?.claimed) return null;
-        return processClaim(claim);
+        return processClaim(claim, provider);
       })()
         .catch((error) => {
           onError(error);
@@ -160,19 +166,27 @@ export function createSqmLocalReviewWorker({
   };
 }
 
-export async function runStructuredCodexReview(
+export function runStructuredCodexReview(request, options) {
+  return runStructuredProviderReview("codex", request, options);
+}
+
+export async function runStructuredProviderReview(
+  provider,
   request,
   {
     spawnImpl = spawn,
     inspectExecutor = inspectDesktopExecutor,
     executionTimeoutMs = DEFAULT_EXECUTION_TIMEOUT_MS,
+    environment = process.env,
   } = {},
 ) {
+  assertProvider(provider);
   assertStructuredRequest(request);
-  const inspection = await inspectExecutor("codex");
+  const label = provider === "claude" ? "Claude Code" : "Codex";
+  const inspection = await inspectExecutor(provider);
   if (!inspection?.compatible || !inspection.executable) {
-    throw new SqmLocalReviewError("A compatible local Codex executable is required.", {
-      code: "codex_local_unavailable",
+    throw new SqmLocalReviewError(`A compatible local ${label} executable is required.`, {
+      code: `${provider}_local_unavailable`,
     });
   }
   const workDir = await mkdtemp(join(tmpdir(), "simy-sqm-review-"));
@@ -185,9 +199,15 @@ export async function runStructuredCodexReview(
       "Return only JSON that strictly matches the provided output schema.",
       request.prompt,
     ].join("\n\n");
-    await spawnCodex(
+    const stdout = await spawnReview(
       inspection.executable,
-      [
+      provider === "claude" ? [
+        "--print", "--output-format", "json",
+        "--json-schema", JSON.stringify(request.output_schema),
+        "--no-session-persistence", "--tools", "",
+        "--setting-sources", "", "--settings", '{"disableAllHooks":true}',
+        "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
+      ] : [
         "exec",
         "--skip-git-repo-check",
         "--sandbox",
@@ -202,63 +222,93 @@ export async function runStructuredCodexReview(
         "-",
       ],
       prompt,
-      { spawnImpl, executionTimeoutMs },
+      { spawnImpl, executionTimeoutMs, label, cwd: workDir, environment, provider },
     );
-    const output = JSON.parse(await readFile(outputPath, "utf8"));
+    const envelope = provider === "claude" ? JSON.parse(stdout) : null;
+    if (envelope?.is_error || (envelope && envelope.subtype !== "success")) {
+      throw new Error("Claude Code did not complete a structured review");
+    }
+    const output = provider === "claude"
+      ? envelope?.structured_output
+      : JSON.parse(await readFile(outputPath, "utf8"));
     if (!output || Array.isArray(output) || typeof output !== "object") {
-      throw new Error("Codex returned a non-object JSON value");
+      throw new Error(`${label} returned a non-object structured result`);
     }
     return {
       output,
-      model: `codex-local/${inspection.installed_version || "unknown"}`,
+      model: `${provider}-local/${inspection.installed_version || "unknown"}`,
     };
   } catch (error) {
     if (error instanceof SqmLocalReviewError) throw error;
-    throw new SqmLocalReviewError(`Local Codex review failed: ${errorMessage(error)}`, {
-      code: "codex_local_review_failed",
+    throw new SqmLocalReviewError(`Local ${label} review failed: ${errorMessage(error)}`, {
+      code: `${provider}_local_review_failed`,
     });
   } finally {
     await rm(workDir, { recursive: true, force: true });
   }
 }
 
-function spawnCodex(command, args, prompt, { spawnImpl, executionTimeoutMs }) {
+function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, label, cwd, environment, provider }) {
   return new Promise((resolve, reject) => {
     const child = spawnImpl(command, args, {
-      env: safeCodexEnvironment(process.env),
-      stdio: ["pipe", "ignore", "pipe"],
+      env: safeReviewEnvironment(environment, provider),
+      cwd,
+      windowsHide: true,
+      stdio: ["pipe", "pipe", "pipe"],
     });
+    let stdout = "";
     let stderr = "";
     let settled = false;
     const timer = setTimeout(() => {
       child.kill?.("SIGTERM");
-      finish(new Error(`Codex timed out after ${executionTimeoutMs}ms`));
+      finish(new Error(`${label} timed out after ${executionTimeoutMs}ms`));
     }, executionTimeoutMs);
     timer.unref?.();
     const finish = (error = null) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      error ? reject(error) : resolve();
+      error ? reject(error) : resolve(stdout);
     };
+    child.stdout?.setEncoding?.("utf8");
+    child.stdout?.on?.("data", (chunk) => {
+      if (settled) return;
+      stdout += chunk;
+      if (Buffer.byteLength(stdout, "utf8") > 2 * 1024 * 1024) {
+        child.kill?.("SIGTERM");
+        finish(new Error(`${label} structured output exceeded the size limit`));
+      }
+    });
+    child.stdin?.on?.("error", finish);
     child.stderr?.setEncoding?.("utf8");
     child.stderr?.on?.("data", (chunk) => {
       stderr = `${stderr}${chunk}`.slice(-4000);
     });
     child.on("error", finish);
     child.on("close", (code) => {
-      finish(code === 0 ? null : new Error(stderr.trim() || `Codex exited with code ${code}`));
+      finish(code === 0 ? null : new Error(stderr.trim() || `${label} exited with code ${code}`));
     });
     child.stdin?.end(prompt);
   });
 }
 
-function safeCodexEnvironment(environment) {
+function safeReviewEnvironment(environment, provider) {
   const allowed = [
-    "HOME", "PATH", "CODEX_HOME", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR",
+    "HOME", "PATH", "CODEX_HOME", "CLAUDE_CONFIG_DIR",
+    "SystemRoot", "SYSTEMROOT", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "TEMP", "TMP", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR",
     "SSL_CERT_FILE", "SSL_CERT_DIR", "HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY", "NO_PROXY",
   ];
-  return Object.fromEntries(allowed.filter((key) => environment[key]).map((key) => [key, environment[key]]));
+  // Credentials stay in the local provider process. Never send them to the
+  // control plane, and do not pass the other provider's credentials.
+  allowed.push(...(provider === "claude" ? [
+    "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "CLAUDE_CODE_OAUTH_TOKEN",
+    "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY",
+    "AWS_PROFILE", "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN",
+    "AWS_CONFIG_FILE", "AWS_SHARED_CREDENTIALS_FILE", "GOOGLE_APPLICATION_CREDENTIALS",
+    "ANTHROPIC_VERTEX_PROJECT_ID", "CLOUD_ML_REGION", "ANTHROPIC_FOUNDRY_API_KEY", "ANTHROPIC_FOUNDRY_RESOURCE",
+  ] : ["OPENAI_API_KEY", "OPENAI_BASE_URL"]));
+  const keys = new Set(allowed.map((key) => key.toLowerCase()));
+  return Object.fromEntries(Object.entries(environment).filter(([key, value]) => value && keys.has(key.toLowerCase())));
 }
 
 function assertStructuredRequest(request) {
@@ -277,3 +327,9 @@ function machineCode(value) {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
+
+function assertProvider(provider) {
+  if (provider !== "codex" && provider !== "claude") {
+    throw new TypeError("Unsupported SQM local review provider");
+  }
+}

package/src/sqm/workflow-onboarding.js

@@ -58,8 +58,12 @@ export async function prepareDaemonWorkflows({
   try {
     const installed = await install();
     logger(
-      "SIMY workflows installed. Restart Codex, then find and install SIMY in Plugins before using @simy.",
+      "SIMY workflows installed. In Codex, restart, then find and install SIMY in Plugins. In Claude Code, add the SIMY marketplace and install simy@simy-local before using /simy:sqm-loop or /simy:pr-review.",
     );
+    if (installed.claude_plugin?.marketplace_root) {
+      logger(`Claude Code: claude plugin marketplace add ${JSON.stringify(installed.claude_plugin.marketplace_root)}`);
+      logger("Then: claude plugin install simy@simy-local");
+    }
     return { outcome: "installed", status: installed };
   } catch (error) {
     errorLogger(`SIMY workflow installation failed: ${message(error)}. The daemon will still start.`);
@@ -73,7 +77,7 @@ export async function confirmWorkflowInstallation({
 } = {}) {
   output.write(
     [
-      "SIMY can install or update its Codex plugin marketplace, Codex/Claude opt-in SQM skills.",
+      "SIMY can install or update its Codex and Claude Code plugin sources and opt-in SQM skills.",
       "Existing unrelated plugins and hooks will be preserved.",
       "",
     ].join("\n"),

package/src/sqm/workflow-update.js

@@ -1,13 +1,14 @@
-import { execFile } from "node:child_process";
 import { mkdir, readFile, realpath, rm, stat } from "node:fs/promises";
 import { homedir } from "node:os";
 import path from "node:path";
-import { promisify } from "node:util";
+
+import { runProviderCommand } from "./provider-command.js";
+import { refreshClaudePlugin } from "./claude-plugin-update.js";
 
 import { resolveBackendExecutable } from "../backend-executable.js";
 import { inspectSqmAgentSkill, installSqmAgentSkill, retireLegacySqmGate } from "./agent-skill.js";
 
-const execFileAsync = promisify(execFile);
+
 const CHECK_INTERVAL_MS = 60 * 60 * 1000;
 
 export function startWorkflowUpdates({ enabled, sync = syncInstalledWorkflows, intervalMs = CHECK_INTERVAL_MS,
@@ -32,8 +33,9 @@ export function startWorkflowUpdates({ enabled, sync = syncInstalledWorkflows, i
 
 export async function syncInstalledWorkflows({ home = homedir(),
   codexHome = process.env.CODEX_HOME || path.join(home, ".codex"),
+  claudeHome = process.env.CLAUDE_CONFIG_DIR || path.join(home, ".claude"),
   inspect = inspectSqmAgentSkill, install = installSqmAgentSkill,
-  resolveExecutable = resolveBackendExecutable, run = execFileAsync,
+  resolveExecutable = resolveBackendExecutable, run = runProviderCommand,
 } = {}) {
   // Multiple daemons may share the same installation. Serialize updates and recover
   // an abandoned lock after more than the bounded Codex command timeouts.
@@ -52,7 +54,27 @@ export async function syncInstalledWorkflows({ home = homedir(),
     const platforms = Object.entries(status.platforms)
       .filter(([, entry]) => entry.state === "outdated").map(([platform]) => platform);
     if (platforms.length) status = await install({ home, platforms });
-    if (!status.platforms.codex.installed) return { outcome: platforms.length || migrated ? "updated" : "unchanged" };
+    const results = {};
+    const failures = [];
+    for (const [provider, refresh] of [
+      ["codex", () => refreshCodexPlugin({ status, home, codexHome, resolveExecutable, run })],
+      ["claude", () => refreshClaudePlugin({ status, home, claudeHome, resolveExecutable, run })],
+    ]) {
+      try { results[provider] = await refresh(); }
+      catch (error) { failures.push(error); }
+    }
+    if (failures.length) throw new AggregateError(failures, failures.map((error) => error.message).join("; "));
+    if (results.claude.outcome === "updated") return { ...results.claude, providers: results };
+    if (results.codex.outcome !== "not_enabled") return results.codex;
+    return { outcome: platforms.length || migrated ? "updated" : results.claude.outcome === "current" ? "current" :
+      status.platforms.codex.installed || status.claude_plugin?.installed ? "not_enabled" : "unchanged" };
+  } finally {
+    await rm(lock, { recursive: true, force: true });
+  }
+}
+
+async function refreshCodexPlugin({ status, home, codexHome, resolveExecutable, run }) {
+    if (!status.platforms.codex.installed) return { outcome: "not_enabled" };
 
     const marketplace = JSON.parse(await readFile(status.codex_plugin.marketplace_path, "utf8"));
     if (typeof marketplace.name !== "string" || !/^[A-Za-z0-9_-]+$/.test(marketplace.name)) {
@@ -85,7 +107,4 @@ export async function syncInstalledWorkflows({ home = homedir(),
       throw new Error("Codex did not confirm the updated SIMY plugin cache; will retry.");
     }
     return { outcome: "updated", version: status.codex_plugin.version };
-  } finally {
-    await rm(lock, { recursive: true, force: true });
-  }
 }

package/src/windows-bootstrap.js

@@ -1,5 +1,6 @@
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
+import { existsSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { maintainWindowsUpdate, selectedWindowsRoot } from './windows-update.js';
 const installation = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
@@ -18,8 +19,11 @@ try {
 if (updating) {
   if (!process.exitCode) console.log(`SIMY Windows installation ready: ${root}`);
 } else {
-  const child = spawn(path.join(root, 'runtime/node.exe'), [path.join(root, 'cli/src/index.js'), ...argv], {
-    stdio: 'inherit', env: { ...process.env, SIMY_AUTO_UPDATE: '0' },
+  const desktop = argv[0] === '--desktop';
+  if (desktop && !existsSync(path.join(root, 'simy-desktop.exe'))) root = installation;
+  const child = spawn(path.join(root, desktop ? 'simy-desktop.exe' : 'runtime/node.exe'),
+    desktop ? ['--selected'] : [path.join(root, 'cli/src/index.js'), ...argv], {
+    stdio: 'inherit', env: { ...process.env, ...(desktop ? {} : { SIMY_AUTO_UPDATE: '0' }) },
   });
   // Windows console signals are already delivered to both processes.
   process.on('SIGINT', () => {});

package/src/windows-desktop-updater.js

@@ -0,0 +1,39 @@
+import { EventEmitter } from 'node:events';
+import { WINDOWS_MANIFEST_URL, validateWindowsRelease, compareWindowsVersions } from './windows-update.js';
+import { openAuthorizationUrl } from './browser.js';
+
+// Windows selects verified immutable releases at startup. Never replace a live
+// desktop/agent during a task; the UI offers the installer for immediate upgrades.
+export function createWindowsDesktopUpdater({ version, fetchImpl = fetch, open = openAuthorizationUrl, disabled = false }) {
+  const events = new EventEmitter();
+  let timer, initial, release;
+  let state = { state: disabled ? 'disabled' : 'idle', current_version: version, automatic: false, install_mode: 'windows_installer',
+    message: 'Updates are applied when SIMY starts. Check now to download the latest installer.' };
+  const update = values => { state = { ...state, ...values }; events.emit('change'); };
+  let pending;
+  events.snapshot = () => structuredClone(state);
+  events.start = () => {
+    if (disabled || timer) return;
+    initial = setTimeout(() => void events.checkNow(), 15000); initial.unref?.();
+    timer = setInterval(() => void events.checkNow(), 3600000); timer.unref?.();
+  };
+  events.stop = () => { clearTimeout(initial); clearInterval(timer); timer = null; };
+  events.checkNow = () => pending ||= (async () => {
+    update({ state: 'checking', message: 'Checking for updates…' });
+    try {
+      const response = await fetchImpl(WINDOWS_MANIFEST_URL, { signal: AbortSignal.timeout(15000), redirect: 'error' });
+      if (!response.ok) throw new Error('Update service unavailable');
+      release = validateWindowsRelease(await response.json());
+      const newer = compareWindowsVersions(release.version, version) > 0;
+      update({ state: newer ? 'update_available' : 'up_to_date', target_version: newer ? release.version : null,
+        message: newer ? `SIMY ${release.version} is available. Install it after your tasks finish.` : 'SIMY is up to date.',
+        action: newer ? { url: release.artifacts[0].url } : null });
+    } catch { update({ state: 'failed', message: 'Could not check for updates. Try again.', action: null }); }
+    return events.snapshot();
+  })().finally(() => { pending = null; });
+  events.performAction = async () => { if (state.action?.url) await open(state.action.url); else await events.checkNow(); };
+  events.maybeApply = events.performAction;
+  events.beginWork = () => () => {};
+  events.acceptsNewWork = () => true;
+  return events;
+}

package/src/windows-processes.js

@@ -0,0 +1,37 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import path from 'node:path';
+const run = promisify(execFile);
+export async function windowsProcessStart(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) throw new Error('Invalid process');
+  const { stdout } = await powershell('(Get-Process -Id ([int]$env:SIMY_INSPECT_PID) -ErrorAction Stop).StartTime.ToUniversalTime().ToString("o")', { SIMY_INSPECT_PID: String(pid) });
+  return stdout.trim();
+}
+export async function windowsUserProcesses() {
+  const { stdout } = await powershell(`$ErrorActionPreference='Stop';$sid=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value;$rows=@(Get-CimInstance Win32_Process -Filter "Name='node.exe' OR Name='nodejs.exe'" | ForEach-Object {$owner=Invoke-CimMethod -InputObject $_ -MethodName GetOwnerSid;if($owner.Sid -eq $sid){@{pid=$_.ProcessId;command=$_.CommandLine}}});ConvertTo-Json -InputObject $rows -Compress`);
+  return JSON.parse(stdout || '[]').map(row => ({ pid: Number(row.pid), args: splitWindowsArguments(row.command || '') }));
+}
+function powershell(script, env = {}) {
+  return run(path.join(process.env.SystemRoot || 'C:\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe'),
+    ['-NoProfile', '-NonInteractive', '-Command', script], { timeout: 15000, windowsHide: true, maxBuffer: 2*1024*1024, env: { ...process.env, ...env } });
+}
+// CommandLineToArgvW backslash/quote rules; never shell-unescape Windows paths.
+export function splitWindowsArguments(command) {
+  const result = []; let i = 0;
+  while (i < command.length) {
+    while (/\s/.test(command[i] || '') && i < command.length) i++;
+    if (i === command.length) break;
+    let value = '', quoted = false;
+    while (i < command.length && (quoted || !/\s/.test(command[i]))) {
+      let slashes = 0;
+      while (command[i] === '\\') { slashes++; i++; }
+      if (command[i] === '"') {
+        value += '\\'.repeat(Math.floor(slashes / 2));
+        if (slashes % 2) value += '"'; else quoted = !quoted;
+        i++;
+      } else { value += '\\'.repeat(slashes); if (i < command.length) value += command[i++]; }
+    }
+    result.push(value);
+  }
+  return result;
+}

package/src/windows-update.js

@@ -83,7 +83,7 @@ async function verifyWindowsCandidate(candidate, marker) {
   if (marker?.signed) {
     if (!/^[A-Fa-f0-9]{40}$/.test(marker.thumbprint || '')) throw new Error('Missing trusted signer');
     // Paths are passed through environment values, never inserted into shell source.
-    await exec(powershell(), ['-NoProfile', '-NonInteractive', '-Command', "$ErrorActionPreference='Stop';foreach($file in @('simy.exe','runtime/node.exe')){$s=Get-AuthenticodeSignature (Join-Path $env:SIMY_CANDIDATE $file);if($s.Status -ne 'Valid'){throw 'Invalid signature'};if($file -eq 'simy.exe' -and $s.SignerCertificate.Thumbprint -ne $env:SIMY_SIGNER){throw 'Unexpected signer'}}"], { env: { ...process.env, SIMY_CANDIDATE: candidate, SIMY_SIGNER: marker.thumbprint }, timeout: 30_000, windowsHide: true });
+    await exec(powershell(), ['-NoProfile', '-NonInteractive', '-Command', "$ErrorActionPreference='Stop';foreach($file in @('simy.exe','simy-desktop.exe','runtime/node.exe')){$s=Get-AuthenticodeSignature (Join-Path $env:SIMY_CANDIDATE $file);if($s.Status -ne 'Valid'){throw 'Invalid signature'};if($file -ne 'runtime/node.exe' -and $s.SignerCertificate.Thumbprint -ne $env:SIMY_SIGNER){throw 'Unexpected signer'}}"], { env: { ...process.env, SIMY_CANDIDATE: candidate, SIMY_SIGNER: marker.thumbprint }, timeout: 30_000, windowsHide: true });
   }
   const probeHome = path.join(candidate, '.update-probe');
   try {