@awak-app/simy-cli 0.5.21 → 0.5.22

package/src/desktop-host.js

@@ -152,7 +152,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
           return;
         }
         if (action === "refresh" || action === "reconnect") {
-          await agent.refreshCodexStatus?.();
+          if (agent.refreshProviderStatus) await agent.refreshProviderStatus();
+          else await agent.refreshCodexStatus?.();
           await agent.refreshDesktopStatus();
         }
         else if (action === "login") {
@@ -166,7 +167,12 @@ export async function startDesktopHost({ input = process.stdin, output = process
         else if (action === "update") {
           if (updater.snapshot().state === "waiting_for_idle") await updater.maybeApply();
           else await updater.performAction();
-        } else if (action === "codex_login") await (dependencies.codexLogin || openCodexLogin)(root);
+        } else if (action === "codex_login" || action === "claude_login") {
+          const provider = action === "claude_login" ? "claude" : "codex";
+          const login = dependencies[`${provider}Login`];
+          if (login) await login(root);
+          else await openProviderLogin(provider, root);
+        }
         else if (action === "quit") {
           const status = await agent.getDesktopStatus();
           if (status.tasks.activeCount > 0 && command.force !== true) throw new Error("Tasks are still running. Confirm before quitting.");
@@ -192,22 +198,28 @@ function validCandidateStatus(status, version, webOrigin) {
     && Array.isArray(status.tasks.items) && typeof status.codex?.state === "string";
 }
 
-async function openCodexLogin(root) {
-  const codex = await inspectBackendExecutable("codex");
-  if (!codex.available || !codex.executable) throw new Error("Codex is not installed.");
-  if (process.platform === "win32") {
-    const child = spawn(join(process.env.SystemRoot || "C:\\Windows", "System32/WindowsPowerShell/v1.0/powershell.exe"),
-      ["-NoProfile", "-NoExit", "-Command", "& $env:SIMY_CODEX_LOGIN login"],
-      { detached: true, stdio: "ignore", windowsHide: false, env: { ...process.env, SIMY_CODEX_LOGIN: codex.executable } });
+export async function openProviderLogin(provider, root, {
+  inspectExecutable = inspectBackendExecutable, spawnImpl = spawn,
+  execFileImpl = promisify(execFile), platform = process.platform, env = process.env,
+} = {}) {
+  if (provider !== "codex" && provider !== "claude") throw new Error("Unsupported provider.");
+  const executable = await inspectExecutable(provider);
+  if (!executable.available || !executable.executable) throw new Error("Provider is not installed.");
+  const label = provider === "claude" ? "Claude Code" : "Codex";
+  const args = provider === "claude" ? ["auth", "login"] : ["login"];
+  if (platform === "win32") {
+    const child = spawnImpl(join(env.SystemRoot || "C:\\Windows", "System32/WindowsPowerShell/v1.0/powershell.exe"),
+      ["-NoProfile", "-NoExit", "-Command", `& $env:SIMY_PROVIDER_LOGIN ${args.join(" ")}`],
+      { detached: true, stdio: "ignore", windowsHide: false, env: { ...env, SIMY_PROVIDER_LOGIN: executable.executable } });
     await new Promise((resolve, reject) => { child.once("spawn", resolve); child.once("error", reject); });
     child.unref(); return;
   }
-  const directory = await mkdtemp(join(root, "codex-login-"));
-  const script = join(directory, "Sign in to Codex.command");
+  const directory = await mkdtemp(join(root, `${provider}-login-`));
+  const script = join(directory, `Sign in to ${label}.command`);
   const quote = (s) => `'${s.replaceAll("'", "'\\''")}'`;
-  await writeFile(script, `#!/bin/bash\nexport PATH="/opt/homebrew/bin:/usr/local/bin:$HOME/.local/bin:$PATH"\n${quote(codex.executable)} login\nresult=$?\nrm -f -- ${quote(script)}\nrmdir -- ${quote(directory)}\nexit "$result"\n`, { mode: 0o700 });
+  await writeFile(script, `#!/bin/bash\nexport PATH="/opt/homebrew/bin:/usr/local/bin:$HOME/.local/bin:$PATH"\n${quote(executable.executable)} ${args.join(" ")}\nresult=$?\nrm -f -- ${quote(script)}\nrmdir -- ${quote(directory)}\nexit "$result"\n`, { mode: 0o700 });
   await chmod(script, 0o700);
-  try { await promisify(execFile)("/usr/bin/open", ["-a", "Terminal", script], { timeout: 10_000 }); }
+  try { await execFileImpl("/usr/bin/open", ["-a", "Terminal", script], { timeout: 10_000 }); }
   catch (error) { await rm(directory, { recursive: true, force: true }); throw error; }
 }
 

package/src/desktop-status.js

@@ -1,9 +1,9 @@
 import spawn from "cross-spawn";
 
-import { inspectBackendExecutable } from "./backend-executable.js";
+import { BACKEND_VERSION_POLICIES, inspectBackendExecutable } from "./backend-executable.js";
 import { isSessionValid } from "./session-store.js";
 
-const CODEX_STATUS_CACHE_MS = 30_000;
+const PROVIDER_STATUS_CACHE_MS = 30_000;
 const MAX_DETAIL_LENGTH = 240;
 const MAX_LABEL_LENGTH = 120;
 const MAX_STATUS_ITEMS = 50;
@@ -92,7 +92,7 @@ export function desktopTaskDetail(registries, key) {
   const task = registries[registryIndex]?.list?.().find((item) => item.id === match[2]);
   if (!task) return null;
   const attempt = task.snapshot?.attempts?.at(-1);
-  const request = task.request?.requirement || task.instruction || task.snapshot?.charter?.requirement;
+  const request = task.request?.requirement || task.display_instruction || task.instruction || task.snapshot?.charter?.requirement;
   const result = typeof task.result === "string" ? task.result : task.result?.summary || attempt?.summary;
   const links = [];
   const pr = safeDesktopLink(attempt?.pr_url);
@@ -119,9 +119,13 @@ function safeDesktopLink(value) {
   } catch { return null; }
 }
 
-export function createCodexStatusInspector({
-  cacheMs = CODEX_STATUS_CACHE_MS,
-  inspect = inspectCodexStatus,
+export function createCodexStatusInspector(options = {}) {
+  return createProviderStatusInspector("codex", options);
+}
+
+export function createProviderStatusInspector(provider, {
+  cacheMs = PROVIDER_STATUS_CACHE_MS,
+  inspect = (options) => inspectProviderStatus(provider, options),
   now = () => Date.now(),
   inspectOptions = {},
 } = {}) {
@@ -145,42 +149,49 @@ export function createCodexStatusInspector({
   };
 }
 
-export async function inspectCodexStatus({
+export function inspectCodexStatus(options = {}) {
+  return inspectProviderStatus("codex", options);
+}
+
+export async function inspectProviderStatus(provider, {
   inspectExecutable = inspectBackendExecutable,
   spawnImpl = spawn,
   timeoutMs = 2_000,
   now = () => new Date(),
 } = {}) {
+  const policy = BACKEND_VERSION_POLICIES[provider];
+  if (!policy) throw new Error("Unsupported provider.");
+  const label = policy.label;
   const checkedAt = isoNow(now);
   let executable;
   try {
-    executable = await inspectExecutable("codex", { spawnImpl, timeoutMs });
+    executable = await inspectExecutable(provider, { spawnImpl, timeoutMs });
   } catch {
-    return codexStatus("unknown", null, checkedAt, "Codex availability could not be checked.");
+    return providerStatus("unknown", null, checkedAt, `${label} availability could not be checked.`);
   }
   const version = executable?.installed_version ?? null;
   if (!executable?.available) {
-    return codexStatus("missing", version, checkedAt, "Codex is not installed or cannot be started.");
+    return providerStatus("missing", version, checkedAt, `${label} is not installed or cannot be started.`);
   }
   if (!executable.compatible) {
-    return codexStatus(
+    return providerStatus(
       executable.status === "outdated" ? "outdated" : "unknown",
       version,
       checkedAt,
       executable.status === "outdated"
-        ? `Codex ${version || "installed version"} is older than the supported minimum.`
-        : "The installed Codex version could not be verified.",
+        ? `${label} ${version || "installed version"} is older than the supported minimum.`
+        : `The installed ${label} version could not be verified.`,
     );
   }
 
-  const probe = await runLoginStatus(executable.executable, { spawnImpl, timeoutMs });
+  const probe = await runLoginStatus(provider, executable.executable, { spawnImpl, timeoutMs });
   if (probe.kind === "signed_in") {
-    return codexStatus("ready", version, checkedAt, "Codex is installed and signed in.");
+    return providerStatus("ready", version, checkedAt, `${label} is installed and signed in.`);
   }
   if (probe.kind === "signed_out") {
-    return codexStatus("signed_out", version, checkedAt, "Codex is installed but signed out.");
+    return providerStatus("signed_out", version, checkedAt, `${label} is installed but signed out.`);
   }
-  return codexStatus("unknown", version, checkedAt, "Codex login status could not be verified.");
+  return providerStatus("unknown", version, checkedAt, `${label} login status could not be verified.`);
 }
 
 export function safeStatusDetail(cause) {
@@ -219,6 +230,7 @@ function taskStatusItem(task, registryIndex) {
     label: bounded(
       String(
         task?.request?.requirement ||
+          task?.display_instruction ||
           task?.instruction ||
           task?.snapshot?.charter?.requirement ||
           task?.id ||
@@ -242,10 +254,11 @@ function sessionUserLabel(session) {
   return null;
 }
 
-function runLoginStatus(command, { spawnImpl, timeoutMs }) {
+function runLoginStatus(provider, command, { spawnImpl, timeoutMs }) {
   return new Promise((resolve) => {
     let settled = false;
     let output = "";
+    let stdout = "";
     let timeout;
     let child;
     const finish = (kind) => {
@@ -255,7 +268,8 @@ function runLoginStatus(command, { spawnImpl, timeoutMs }) {
       resolve({ kind });
     };
     try {
-      child = spawnImpl(command, ["login", "status"], {
+      child = spawnImpl(command, provider === "claude" ? ["auth", "status", "--json"] : ["login", "status"], {
+        windowsHide: true,
         stdio: ["ignore", "pipe", "pipe"],
       });
     } catch {
@@ -266,7 +280,10 @@ function runLoginStatus(command, { spawnImpl, timeoutMs }) {
       if (output.length >= MAX_PROBE_OUTPUT) return;
       output += String(chunk).slice(0, MAX_PROBE_OUTPUT - output.length);
     };
-    child.stdout?.on?.("data", append);
+    child.stdout?.on?.("data", (chunk) => {
+      stdout += String(chunk).slice(0, Math.max(0, MAX_PROBE_OUTPUT - stdout.length));
+      append(chunk);
+    });
     child.stderr?.on?.("data", append);
     timeout = setTimeout(() => {
       child.kill?.("SIGTERM");
@@ -274,6 +291,15 @@ function runLoginStatus(command, { spawnImpl, timeoutMs }) {
     }, timeoutMs);
     child.on?.("error", () => finish("unknown"));
     child.on?.("close", (code) => {
+      if (provider === "claude") {
+        let status;
+        try { status = JSON.parse(stdout); } catch { finish("unknown"); return; }
+        // Only the documented boolean and successful exit establish readiness.
+        // Never publish email, organization, auth-method details or raw output.
+        finish(code === 0 && status?.loggedIn === true ? "signed_in"
+          : status?.loggedIn === false && (code === 0 || code === 1) ? "signed_out" : "unknown");
+        return;
+      }
       if (/not logged in|signed out|login required|please log in/i.test(output)) {
         finish("signed_out");
       } else if (code === 0 && /logged in|signed in/i.test(output)) {
@@ -285,7 +311,7 @@ function runLoginStatus(command, { spawnImpl, timeoutMs }) {
   });
 }
 
-function codexStatus(state, version, checkedAt, detail) {
+function providerStatus(state, version, checkedAt, detail) {
   return { state, version, checkedAt, detail };
 }
 

package/src/direct-executor.js

@@ -74,6 +74,7 @@ export async function startDirectTask(
 
   return new Promise((resolve) => {
     let settled = false;
+    let terminalError = null;
     const rawStdout = [];
     const tokenRecords = [];
     const child = command.spawn(command.bin, command.args, {
@@ -96,6 +97,7 @@ export async function startDirectTask(
       backend: task.backend,
       stream: "stdout",
       onLine,
+      onTerminalError: (message) => { terminalError ||= message; },
       onUsage: (usage) => tokenRecords.push({ ...usage, phase: "direct", backend: task.backend }),
     });
     const stderrDecoder = createProviderStreamDecoder({
@@ -115,6 +117,7 @@ export async function startDirectTask(
       settled = true;
       stdoutDecoder.flush();
       stderrDecoder.flush();
+      error ||= terminalError;
       task.child = null;
       task.token_usage = { records: tokenRecords };
       task.status = error || exitCode !== 0 ? "failed" : "succeeded";

package/src/durable-local-task-steps-contract.js

@@ -116,7 +116,8 @@ export function buildControlledLocalTaskPlan(orchestration) {
 
   const payload = orchestration.request_payload;
   assertRecord(payload, "orchestration.request_payload");
-  if (payload.mode !== "local_task") {
+  // Current server payloads omit the retired interaction mode; reject conflicting legacy values.
+  if (payload.mode !== undefined && payload.mode !== "local_task") {
     fail("orchestration.request_payload.mode is unsupported.");
   }
   const instruction = requiredString(
@@ -252,6 +253,7 @@ export function normalizeDurableLocalTaskStepClaim(
       "lease_epoch",
       "lease_expires_at",
       "claim_replayed",
+      ...(Object.hasOwn(claim, "model") ? ["model"] : []),
     ]),
     "claim",
   );
@@ -261,6 +263,7 @@ export function normalizeDurableLocalTaskStepClaim(
   if (!SUPPORTED_DISPOSITIONS.has(claim.disposition)) {
     fail("Unsupported durable Local Task step disposition.");
   }
+  const model = claim.model == null ? null : requiredString(claim.model, "model", 160);
   const turnId = requiredUuid(claim.turn_id, "turn_id");
   const plan = normalizePlan(claim.plan);
   const currentStepId = requiredStepId(claim.current_step_id, "current_step_id");
@@ -299,6 +302,7 @@ export function normalizeDurableLocalTaskStepClaim(
       turnId,
       plan,
       step,
+      model,
       progress,
       previousStepContext,
       authorization: null,
@@ -355,6 +359,7 @@ export function normalizeDurableLocalTaskStepClaim(
     turnId,
     plan,
     step,
+    model,
     progress,
     previousStepContext,
     authorization,

package/src/durable-local-task-worker.js

@@ -753,7 +753,9 @@ export function createDurableLocalTaskWorker({
       task = createLocalTask({
         id: workspace.localTaskId,
         instruction: durableLocalTaskStepInstruction(normalized),
+        displayInstruction: normalized.step.instruction,
         backend: normalized.step.backend,
+        model: normalized.model,
         operation: normalized.step.operation,
         permissionMode: normalized.step.permission_mode,
         workspaceMode: normalized.step.workspace_mode,
@@ -1108,6 +1110,7 @@ export function createDurableLocalTaskWorker({
         id: workspace.localTaskId,
         instruction: normalized.instruction,
         backend: normalized.spec.backend,
+        model: normalized.spec.model ?? null,
         operation: normalized.spec.operation,
         permissionMode: normalized.spec.permission_mode,
         workspaceMode: normalized.spec.workspace_mode,
@@ -1661,7 +1664,8 @@ function normalizeClaim(claim, { leaseSeconds, nowMs = Date.now() } = {}) {
   }
   const payload = claim.request_payload;
   const spec = claim.execution_spec;
-  if (!payload || typeof payload !== "object" || payload.mode !== "local_task") {
+  if (!payload || typeof payload !== "object" ||
+      (payload.mode !== undefined && payload.mode !== "local_task")) {
     throw workerError("SIMY Web returned an invalid Local Task request.", "invalid_local_task_request");
   }
   const instruction = String(payload.input || "").trim();

package/src/execution-capability-contract.js

@@ -6,6 +6,7 @@ export const EXECUTION_CAPABILITY_CONTRACT_VERSION = 1;
 export function buildExecutionCapabilityContract({
   backends = {},
   backendVersions = {},
+  providerStatuses,
   authenticated = false,
 } = {}) {
   const artifactTypes = supportedArtifactTypes();
@@ -17,6 +18,7 @@ export function buildExecutionCapabilityContract({
           inspection: backendVersions?.[provider],
           legacyAvailable: backends?.[provider] === true,
           authenticated,
+          authStatus: providerStatuses?.[provider],
           artifactTypes,
         }),
       ),
@@ -29,10 +31,19 @@ function localExecutionCapability({
   inspection,
   legacyAvailable,
   authenticated,
+  authStatus,
   artifactTypes,
 }) {
   const binary = normalizeInspection(provider, inspection, legacyAvailable);
-  const ready = authenticated && binary.compatible;
+  const providerAuth = authStatus?.state === "ready" ? "ready"
+    : authStatus?.state === "signed_out" ? "required"
+    : authStatus?.state === "missing" || authStatus?.state === "outdated" ? "unavailable" : "unknown";
+  // Old clients have no provider auth observation. Preserve their v1 contract;
+  // once the new status is supplied, unknown or signed-out cannot mean ready.
+  const ready = authenticated && binary.compatible && (!authStatus || providerAuth === "ready");
+  const reason = ready ? "ready" : !authenticated ? "device_session_required"
+    : !binary.compatible ? (binary.status === "outdated" || binary.status === "unknown_version" ? "provider_update_required" : "provider_missing")
+    : providerAuth === "required" ? "provider_login_required" : "provider_status_unknown";
   return {
     schema_version: EXECUTION_CAPABILITY_SCHEMA_VERSION,
     capability_contract_version: EXECUTION_CAPABILITY_CONTRACT_VERSION,
@@ -54,28 +65,14 @@ function localExecutionCapability({
     },
     authentication_readiness: {
       device_session: authenticated ? "ready" : "required",
-      // A version probe proves only that the binary is runnable. It does not
-      // prove the Provider account is authenticated.
-      provider: "unknown",
+      provider: providerAuth,
     },
-    readiness: {
-      ready,
-      reason: ready
-        ? "ready"
-        : !authenticated
-          ? "device_session_required"
-          : binary.status === "outdated" || binary.status === "unknown_version"
-            ? "provider_update_required"
-            : "provider_missing",
-    },
-    missing_capability_recovery_actions: ready
-      ? []
-      : [
-          {
-            action: binary.status === "missing" ? "install_provider" : "update_provider",
-            command: binary.update_command,
-          },
-        ],
+    readiness: { ready, reason },
+    missing_capability_recovery_actions: ready ? []
+      : reason === "provider_login_required" ? [{ action: "login_provider", command: provider === "claude" ? "claude auth login" : "codex login" }]
+      : reason === "provider_status_unknown" ? [{ action: "refresh_provider" }]
+      : reason === "device_session_required" ? [{ action: "connect_device" }]
+      : [{ action: binary.status === "missing" ? "install_provider" : "update_provider", command: binary.update_command }],
   };
 }
 

package/src/local-task.js

@@ -220,9 +220,18 @@ async function initializeLocalTaskGitRepository(workspacePath) {
   }
 }
 
+function normalizeLocalTaskModel(model) {
+  if (model == null) return null;
+  if (typeof model !== "string" || !model.trim() || model.length > 200 || /[\r\n]/.test(model)) {
+    throw new Error("Local Task model must be a non-empty model identifier.");
+  }
+  return model.trim();
+}
+
 export function createLocalTask({
   id = createLocalTaskId(),
   instruction,
+  displayInstruction = null,
   backend,
   model = null,
   operation = "read",
@@ -257,8 +266,9 @@ export function createLocalTask({
     status: "queued",
     control_state: "queued",
     instruction: String(instruction || "").trim(),
+    ...(displayInstruction ? { display_instruction: String(displayInstruction).trim() } : {}),
     backend,
-    model: model === null ? null : String(model),
+    model: normalizeLocalTaskModel(model),
     operation,
     permission_mode: permissionMode,
     workspace_mode: workspaceMode,
@@ -306,6 +316,7 @@ export function hashLocalTaskIdempotencyKey(value) {
 export function createLocalTaskRequestFingerprint({
   instruction,
   backend,
+  model = null,
   operation,
   permissionMode,
   workspaceMode,
@@ -316,6 +327,7 @@ export function createLocalTaskRequestFingerprint({
   attachmentManifest,
   scenarioPack,
 }) {
+  const normalizedModel = normalizeLocalTaskModel(model);
   const manifest = Array.isArray(attachmentManifest)
     ? attachmentManifest
         .filter((item) => item && typeof item === "object")
@@ -329,6 +341,7 @@ export function createLocalTaskRequestFingerprint({
   const payload = {
     instruction: String(instruction || "").trim(),
     backend: String(backend || ""),
+    ...(normalizedModel ? { model: normalizedModel } : {}),
     operation: String(operation || ""),
     permission_mode: String(permissionMode || ""),
     workspace_mode: String(workspaceMode || ""),
@@ -499,6 +512,10 @@ export async function startLocalTask(
       stream: "stdout",
       onLine,
       onUsage,
+      onTerminalError: (message) => {
+        task.error ||= message;
+        task.reason_code ||= "provider_execution_failed";
+      },
     });
     const stderrDecoder = createProviderStreamDecoder({
       backend: task.backend,
@@ -663,7 +680,9 @@ export function localTaskSnapshot(task, { includeEvents = true, includeLocalPath
     status: task.status,
     control_state: task.control_state,
     instruction: task.instruction,
+    ...(task.display_instruction ? { display_instruction: task.display_instruction } : {}),
     backend: task.backend,
+    ...(task.model ? { model: task.model } : {}),
     operation: task.operation,
     permission_mode: task.permission_mode,
     workspace_mode: task.workspace_mode,

package/src/orchestrator/recovery.js

@@ -32,6 +32,15 @@ export function recoveryContractForEvent({ snapshot, state, message, detail = {}
 }
 
 export function recoveryContractForPreflight({ key, summary, details = {} }) {
+  if (key === "provider_auth") {
+    const loginRequired = details.status === "signed_out";
+    const actions = loginRequired ? [{
+      id: "login_provider", type: "run_command", label: "Sign in to the provider",
+      description: "Finish signing in, then check the connection again.",
+      command: details.provider === "claude" ? "claude auth login" : "codex login", payload: {},
+    }, checkAgainAction()] : [checkAgainAction()];
+    return preflightContract(loginRequired ? "provider_login_required" : "provider_status_unknown", summary, actions);
+  }
   const updateCommand = clean(details.update_command);
   if (key === "backend") {
     const reasonCode =

package/src/provider-stream.js

@@ -5,7 +5,7 @@ const STRUCTURED_MARKERS = ["SIMY_RESULT_JSON:", "SIMY_AUDIT_JSON:"];
 const CODEX_MCP_AUTH_WARNING =
   "[Codex] MCP warning: optional connector authorization expired; coding continues.";
 
-export function createProviderStreamDecoder({ backend, stream = "stdout", onLine, onUsage }) {
+export function createProviderStreamDecoder({ backend, stream = "stdout", onLine, onUsage, onTerminalError }) {
   let pending = "";
   let previous = "";
   let model = "";
@@ -22,6 +22,9 @@ export function createProviderStreamDecoder({ backend, stream = "stdout", onLine
       return;
     }
 
+    const terminalError = providerTerminalError(backend, event);
+    if (terminalError && onTerminalError) onTerminalError(terminalError);
+
     model = providerModel(backend, event) || model;
     const usage = extractProviderTokenUsage(backend, event, { model });
     if (usage && onUsage) onUsage(usage);
@@ -50,6 +53,20 @@ export function createProviderStreamDecoder({ backend, stream = "stdout", onLine
   };
 }
 
+// Tool failures can be recovered by the provider. Only terminal turn/result
+// envelopes override a successful operating-system exit code.
+export function providerTerminalError(backend, event) {
+  if (!event || typeof event !== "object") return null;
+  if (backend === "claude" && event.type === "result" &&
+      (event.is_error === true || String(event.subtype || "").startsWith("error"))) {
+    return cleanLine(event.result || (Array.isArray(event.errors) ? event.errors.join("; ") : "") || event.subtype || "Claude Code execution failed");
+  }
+  if (backend === "codex" && event.type === "turn.failed") {
+    return cleanLine(errorMessage(event));
+  }
+  return null;
+}
+
 export function extractProviderTokenUsage(backend, event, { model = "" } = {}) {
   if (!event || typeof event !== "object") return null;
   if (backend === "claude") {
@@ -124,7 +141,8 @@ function formatClaudeEvent(event) {
     return formatClaudeToolResults(prefix, event.message?.content);
   }
   if (event.type === "result") {
-    if (event.is_error) return [`${prefix} error: ${cleanLine(event.result || event.subtype)}`];
+    const terminalError = providerTerminalError("claude", event);
+    if (terminalError) return [`${prefix} error: ${terminalError}`];
     const turns = Number.isInteger(event.num_turns) ? ` | ${event.num_turns} turn(s)` : "";
     const duration = Number.isFinite(event.duration_ms)
       ? ` | ${(event.duration_ms / 1_000).toFixed(1)}s`

package/src/runner.js

@@ -701,6 +701,7 @@ async function executeProcessAttempt({
 
   return new Promise((resolve) => {
     let settled = false;
+    let terminalError = null;
     const child = command.spawn(command.bin, command.args, {
       cwd: repositoryPath,
       env: { ...process.env, ...command.env },
@@ -713,6 +714,7 @@ async function executeProcessAttempt({
       backend,
       stream: "stdout",
       onLine: (line) => emitOutput(run, line, { backend }),
+      onTerminalError: (message) => { terminalError ||= message; },
       onUsage: (usage) =>
         tokenUsageRecords.push({
           ...usage,
@@ -752,8 +754,8 @@ async function executeProcessAttempt({
           : (value) => parseStructuredMarker(value, marker);
       const result = parse(assistantText);
       resolve({
-        exitCode,
-        error,
+        exitCode: terminalError && exitCode === 0 ? 1 : exitCode,
+        error: error || terminalError,
         result: Object.keys(result).length > 0 ? result : parse(rawStdout),
         tokenUsage:
           tokenUsageRecords.length > 0 ? { records: tokenUsageRecords } : {},

package/src/sqm/agent-skill.js

@@ -4,6 +4,8 @@ import { homedir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { inspectClaudePlugin, installClaudePlugin } from "./claude-plugin.js";
+
 export const SQM_AGENT_SKILL_ID = "simy-sqm-pr-check";
 export const SQM_AGENT_SKILL_VERSION = "3.0.0";
 export const SIMY_CODEX_PLUGIN_ID = "simy";
@@ -57,6 +59,7 @@ export function sqmAgentSkillDigest() {
 export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
   const digest = sqmAgentSkillDigest();
   const codexPlugin = await inspectCodexPlugin({ home });
+  const claudePlugin = await inspectClaudePlugin({ home });
   const hookPath = managedHookPath(home);
   const platforms = {};
   for (const [platform, segments] of Object.entries(TARGETS)) {
@@ -64,7 +67,8 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
     const installedDigest = await fileDigest(target);
     const skillMatches = installedDigest === digest;
     const hookConfigured = await hasManagedHook(platform, home, hookPath);
-    const platformExtraMatches = platform !== "codex" || codexPlugin.installed;
+    const plugin = platform === "codex" ? codexPlugin : claudePlugin;
+    const platformExtraMatches = plugin.installed;
     platforms[platform] = {
       path: target,
       hook_path: platformHookConfigPath(platform, home),
@@ -76,7 +80,7 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
           : skillMatches && !hookConfigured && platformExtraMatches
             ? "installed"
             : "outdated",
-      ...(platform === "codex" ? { plugin: codexPlugin } : {}),
+      plugin,
     };
   }
   return {
@@ -85,6 +89,7 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
     digest: `sha256:${digest}`,
     enforcement: "explicit_opt_in",
     codex_plugin: codexPlugin,
+    claude_plugin: claudePlugin,
     installed: Object.values(platforms).every((entry) => entry.installed),
     platforms,
   };
@@ -96,6 +101,7 @@ export async function installSqmAgentSkill({ home = homedir(), platforms = Objec
     throw new Error("platforms must contain codex and/or claude");
   }
   if (requested.includes("codex")) await installCodexPlugin({ home });
+  if (requested.includes("claude")) await installClaudePlugin({ home });
   await retireLegacySqmGate({ home });
   for (const platform of requested) {
     await atomicText(path.join(home, ...TARGETS[platform]), SKILL_CONTENT, 0o600);

package/src/sqm/claude-plugin-update.js

@@ -0,0 +1,41 @@
+import { readFile, realpath } from "node:fs/promises";
+import path from "node:path";
+import { CLAUDE_MARKETPLACE, CLAUDE_PLUGIN_SELECTOR } from "./claude-plugin.js";
+
+export async function refreshClaudePlugin({ status, home, claudeHome, resolveExecutable, run }) {
+  if (!status.claude_plugin?.installed) return { outcome: "not_enabled" };
+  const executable = await resolveExecutable("claude");
+  if (!executable) return { outcome: "not_enabled" };
+  const options = { timeout: 10_000, maxBuffer: 1024 * 1024,
+    env: { ...process.env, HOME: home, CLAUDE_CONFIG_DIR: claudeHome } };
+  const list = async () => JSON.parse((await run(executable, ["plugin", "list", "--json"], options)).stdout);
+  const installed = (await list()).find((entry) => entry.id === CLAUDE_PLUGIN_SELECTOR && entry.scope === "user");
+  // Never install or re-enable a plugin on a background update, or modify a
+  // project/local/managed scope that SIMY did not install for this user.
+  if (!installed?.enabled) return { outcome: "not_enabled" };
+  const marketplaces = JSON.parse((await run(executable, ["plugin", "marketplace", "list", "--json"], options)).stdout);
+  const marketplace = marketplaces.find((entry) => entry.name === CLAUDE_MARKETPLACE);
+  if (marketplace?.source !== "directory" || !marketplace.path ||
+      await realpath(marketplace.path) !== await realpath(status.claude_plugin.marketplace_root)) {
+    throw new Error("Enabled SIMY Claude plugin points to a different marketplace; refresh skipped.");
+  }
+  const cacheCurrent = async (entry) => {
+    if (!entry?.installPath || entry.version !== status.claude_plugin.version) return false;
+    const cacheRoot = await realpath(path.join(claudeHome, "plugins/cache")).catch(() => null);
+    if (!cacheRoot) return false;
+    const installedPath = await realpath(entry.installPath).catch(() => null);
+    const relative = installedPath && path.relative(cacheRoot, installedPath);
+    if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return false;
+    try {
+      return JSON.parse(await readFile(path.join(installedPath, ".claude-plugin/plugin.json"), "utf8")).version === status.claude_plugin.version;
+    } catch (error) { if (error.code === "ENOENT" || error instanceof SyntaxError) return false; throw error; }
+  };
+  if (await cacheCurrent(installed)) return { outcome: "current" };
+  await run(executable, ["plugin", "marketplace", "update", CLAUDE_MARKETPLACE], options);
+  await run(executable, ["plugin", "update", CLAUDE_PLUGIN_SELECTOR, "--scope", "user"], options);
+  const refreshed = (await list()).find((entry) => entry.id === CLAUDE_PLUGIN_SELECTOR && entry.scope === "user");
+  if (!refreshed?.enabled || !await cacheCurrent(refreshed)) {
+    throw new Error("Claude Code did not confirm the updated SIMY plugin cache; will retry.");
+  }
+  return { outcome: "updated", version: status.claude_plugin.version };
+}