@awak-app/simy-cli 0.5.21 → 0.5.22

package/src/sqm/claude-plugin.js

@@ -0,0 +1,122 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, readdir, rename, rm, lstat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SOURCE = fileURLToPath(new URL("../codex-plugins/simy/", import.meta.url));
+export const CLAUDE_MARKETPLACE = "simy-local";
+export const CLAUDE_PLUGIN_SELECTOR = `simy@${CLAUDE_MARKETPLACE}`;
+const AUTHOR = "Specialist Doctors Inc.";
+
+// Generate both providers from the maintained workflow source. Only provider
+// terminology, manifest schema, and hook environment names differ.
+export async function claudePluginFiles() {
+  const sourceManifest = JSON.parse(await readFile(path.join(SOURCE, ".codex-plugin/plugin.json"), "utf8"));
+  const files = new Map();
+  for (const entry of await readdir(path.join(SOURCE, "skills"), { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const relative = `skills/${entry.name}/SKILL.md`;
+    const content = await readFile(path.join(SOURCE, relative), "utf8");
+    files.set(relative, content.replaceAll("current Codex thread", "current Claude Code conversation"));
+  }
+  files.set("hooks/connection-reminder.mjs", await readFile(path.join(SOURCE, "hooks/connection-reminder.mjs"), "utf8"));
+  const hooks = JSON.parse(await readFile(path.join(SOURCE, "hooks/hooks.json"), "utf8"));
+  for (const groups of Object.values(hooks.hooks)) {
+    for (const group of groups) {
+      for (const hook of group.hooks) {
+        hook.command = hook.command.replace(/^node /, `${quoteRuntime(process.execPath)} `)
+          .replaceAll("process.env.PLUGIN_ROOT", "process.env.CLAUDE_PLUGIN_ROOT");
+      }
+    }
+  }
+  files.set("hooks/hooks.json", json(hooks));
+  const hash = createHash("sha256");
+  for (const [name, contents] of [...files].sort(([a], [b]) => a.localeCompare(b))) hash.update(name).update("\0").update(contents);
+  const manifest = {
+    name: "simy", version: `${sourceManifest.version.split("+")[0]}+claude.${hash.digest("hex").slice(0, 20)}`,
+    description: "SIMY quality checks, pull request review, and connection reminders for Claude Code.",
+    author: sourceManifest.author, repository: sourceManifest.repository,
+    license: sourceManifest.license, keywords: sourceManifest.keywords,
+  };
+  files.set(".claude-plugin/plugin.json", json(manifest));
+  return { files, manifest };
+}
+
+export async function inspectClaudePlugin({ home = homedir() } = {}) {
+  const root = marketplaceRoot(home);
+  const target = path.join(root, "plugins/simy");
+  const { files, manifest } = await claudePluginFiles();
+  let matches = true;
+  let exists = false;
+  for (const [name, contents] of files) {
+    const installed = await optionalRead(path.join(target, name));
+    if (name === ".claude-plugin/plugin.json") exists = installed !== null;
+    if (installed !== contents) matches = false;
+  }
+  const marketplacePath = path.join(root, ".claude-plugin/marketplace.json");
+  matches = matches && await optionalRead(marketplacePath) === json(marketplaceManifest());
+  return {
+    plugin_id: "simy", version: manifest.version, path: target,
+    marketplace_path: marketplacePath, marketplace_root: root, selector: CLAUDE_PLUGIN_SELECTOR,
+    installed: matches, state: matches ? "installed" : exists ? "outdated" : "missing",
+  };
+}
+
+export async function installClaudePlugin({ home = homedir() } = {}) {
+  const root = marketplaceRoot(home);
+  const target = path.join(root, "plugins/simy");
+  // Never overwrite an unrelated user plugin, including a symlink.
+  let targetInfo = null;
+  try { targetInfo = await lstat(target); } catch (error) { if (error.code !== "ENOENT") throw error; }
+  if (targetInfo) {
+    if (!targetInfo.isDirectory()) throw new Error("SIMY Claude plugin target is not a managed directory.");
+    let manifest;
+    try { manifest = JSON.parse(await readFile(path.join(target, ".claude-plugin/plugin.json"), "utf8")); }
+    catch { throw new Error("SIMY Claude plugin target has no valid managed manifest."); }
+    if (manifest.name !== "simy" || manifest.author?.name !== AUTHOR) throw new Error("SIMY Claude plugin target is not managed by SIMY.");
+  }
+  const marketplacePath = path.join(root, ".claude-plugin/marketplace.json");
+  const existing = await optionalRead(marketplacePath);
+  if (existing !== null && existing !== json(marketplaceManifest())) {
+    throw new Error("SIMY Claude marketplace contains unmanaged changes; installation skipped.");
+  }
+  const { files } = await claudePluginFiles();
+  const stage = path.join(root, `plugins/.simy-${process.pid}.tmp`);
+  const backup = path.join(root, `plugins/.simy-${process.pid}.bak`);
+  await mkdir(path.dirname(stage), { recursive: true, mode: 0o700 });
+  await rm(stage, { recursive: true, force: true });
+  for (const [name, contents] of files) {
+    await mkdir(path.dirname(path.join(stage, name)), { recursive: true, mode: 0o700 });
+    await writeFile(path.join(stage, name), contents, { mode: 0o600 });
+  }
+  let backedUp = false;
+  try {
+    try { await rename(target, backup); backedUp = true; } catch (error) { if (error.code !== "ENOENT") throw error; }
+    await rename(stage, target);
+    await mkdir(path.dirname(marketplacePath), { recursive: true, mode: 0o700 });
+    await writeFile(`${marketplacePath}.tmp`, json(marketplaceManifest()), { mode: 0o600 });
+    await rename(`${marketplacePath}.tmp`, marketplacePath);
+    if (backedUp) await rm(backup, { recursive: true, force: true });
+  } catch (error) {
+    await rm(stage, { recursive: true, force: true });
+    if (backedUp) {
+      await rm(target, { recursive: true, force: true });
+      await rename(backup, target);
+    }
+    throw error;
+  }
+  return inspectClaudePlugin({ home });
+}
+
+function marketplaceRoot(home) { return path.join(home, ".simy/integrations/claude-marketplace"); }
+function marketplaceManifest() {
+  return { name: CLAUDE_MARKETPLACE, owner: { name: AUTHOR }, plugins: [{ name: "simy", source: "./plugins/simy" }] };
+}
+function json(value) { return `${JSON.stringify(value, null, 2)}\n`; }
+async function optionalRead(file) {
+  try { return await readFile(file, "utf8"); } catch (error) { if (error.code === "ENOENT") return null; throw error; }
+}
+function quoteRuntime(value) {
+  return process.platform === "win32" ? `"${value.replaceAll('"', '""')}"` : `'${value.replaceAll("'", "'\\''")}'`;
+}

package/src/sqm/provider-command.js

@@ -0,0 +1,38 @@
+import spawn from "cross-spawn";
+
+// cross-spawn resolves npm .cmd shims on Windows without interpolating command
+// text. Keep updater commands bounded and preserve execFile-like test injection.
+export function runProviderCommand(command, args, { env, timeout = 10_000, maxBuffer = 1024 * 1024 } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { env, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      error ? reject(error) : resolve({ stdout, stderr });
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish(new Error("Provider plugin command timed out."));
+    }, timeout);
+    timer.unref?.();
+    const capture = (stream, append) => {
+      stream.setEncoding("utf8");
+      stream.on("data", (chunk) => {
+        if (settled) return;
+        append(chunk);
+        if (Buffer.byteLength(stdout) + Buffer.byteLength(stderr) > maxBuffer) {
+          child.kill("SIGTERM");
+          finish(new Error("Provider plugin command exceeded the output limit."));
+        }
+      });
+    };
+    capture(child.stdout, (chunk) => { stdout += chunk; });
+    capture(child.stderr, (chunk) => { stderr += chunk; });
+    child.on("error", finish);
+    child.on("close", (code) => finish(code === 0 ? null : new Error(`Provider plugin command exited with code ${code}.`)));
+  });
+}

package/src/sqm/review-worker.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import spawn from "cross-spawn";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -79,7 +79,8 @@ export function createSqmLocalReviewWorker({
   workerId = "sqm-local-review",
   leaseSeconds = DEFAULT_LEASE_SECONDS,
   heartbeatIntervalMs = Math.max(10_000, Math.floor(leaseSeconds * 500)),
-  runReview = runStructuredCodexReview,
+  getProvider = () => "codex",
+  runReview = (request, provider) => runStructuredProviderReview(provider, request),
   beginWork = () => () => {},
   onError = () => {},
 } = {}) {
@@ -88,34 +89,35 @@ export function createSqmLocalReviewWorker({
   let pollPromise = null;
   let closed = false;
 
-  const leaseBody = (claim) => ({
+  const leaseBody = (claim, provider) => ({
+    executor_provider: provider,
     worker_id: workerId,
     lease_seconds: leaseSeconds,
     job_id: claim.job_id,
     lease_token: claim.lease_token,
   });
 
-  const processClaim = async (claim) => {
+  const processClaim = async (claim, provider) => {
     activeJobId = claim.job_id;
     let heartbeatTimer = null;
     const heartbeat = () => {
-      void api.request({ action: "heartbeat", ...leaseBody(claim) }).catch(onError);
+      void api.request({ action: "heartbeat", ...leaseBody(claim, provider) }).catch(onError);
     };
     heartbeatTimer = setInterval(heartbeat, heartbeatIntervalMs);
     heartbeatTimer.unref?.();
     try {
-      const analysis = await runReview(claim.request);
+      const analysis = await runReview(claim.request, provider);
       const advanced = await api.request({
         action: "advance",
-        ...leaseBody(claim),
+        ...leaseBody(claim, provider),
         analysis_output: analysis.output,
         executor_model: analysis.model,
       });
       if (advanced.completed) return advanced;
-      const adjudication = await runReview(advanced.request);
+      const adjudication = await runReview(advanced.request, provider);
       return api.request({
         action: "complete",
-        ...leaseBody(claim),
+        ...leaseBody(claim, provider),
         analysis_output: analysis.output,
         adjudication_output: adjudication.output,
         executor_model: adjudication.model || analysis.model,
@@ -132,16 +134,20 @@ export function createSqmLocalReviewWorker({
     },
     poll() {
       if (closed || pollPromise) return pollPromise || Promise.resolve(null);
+      const provider = getProvider();
+      if (provider == null) return Promise.resolve(null);
+      assertProvider(provider);
       const releaseWork = beginWork?.();
       if (!releaseWork) return Promise.resolve(null);
       pollPromise = (async () => {
         const claim = await api.request({
           action: "claim",
+          executor_provider: provider,
           worker_id: workerId,
           lease_seconds: leaseSeconds,
         });
         if (!claim?.claimed) return null;
-        return processClaim(claim);
+        return processClaim(claim, provider);
       })()
         .catch((error) => {
           onError(error);
@@ -160,19 +166,27 @@ export function createSqmLocalReviewWorker({
   };
 }
 
-export async function runStructuredCodexReview(
+export function runStructuredCodexReview(request, options) {
+  return runStructuredProviderReview("codex", request, options);
+}
+
+export async function runStructuredProviderReview(
+  provider,
   request,
   {
     spawnImpl = spawn,
     inspectExecutor = inspectDesktopExecutor,
     executionTimeoutMs = DEFAULT_EXECUTION_TIMEOUT_MS,
+    environment = process.env,
   } = {},
 ) {
+  assertProvider(provider);
   assertStructuredRequest(request);
-  const inspection = await inspectExecutor("codex");
+  const label = provider === "claude" ? "Claude Code" : "Codex";
+  const inspection = await inspectExecutor(provider);
   if (!inspection?.compatible || !inspection.executable) {
-    throw new SqmLocalReviewError("A compatible local Codex executable is required.", {
-      code: "codex_local_unavailable",
+    throw new SqmLocalReviewError(`A compatible local ${label} executable is required.`, {
+      code: `${provider}_local_unavailable`,
     });
   }
   const workDir = await mkdtemp(join(tmpdir(), "simy-sqm-review-"));
@@ -185,9 +199,15 @@ export async function runStructuredCodexReview(
       "Return only JSON that strictly matches the provided output schema.",
       request.prompt,
     ].join("\n\n");
-    await spawnCodex(
+    const stdout = await spawnReview(
       inspection.executable,
-      [
+      provider === "claude" ? [
+        "--print", "--output-format", "json",
+        "--json-schema", JSON.stringify(request.output_schema),
+        "--no-session-persistence", "--tools", "",
+        "--setting-sources", "", "--settings", '{"disableAllHooks":true}',
+        "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
+      ] : [
         "exec",
         "--skip-git-repo-check",
         "--sandbox",
@@ -202,63 +222,93 @@ export async function runStructuredCodexReview(
         "-",
       ],
       prompt,
-      { spawnImpl, executionTimeoutMs },
+      { spawnImpl, executionTimeoutMs, label, cwd: workDir, environment, provider },
     );
-    const output = JSON.parse(await readFile(outputPath, "utf8"));
+    const envelope = provider === "claude" ? JSON.parse(stdout) : null;
+    if (envelope?.is_error || (envelope && envelope.subtype !== "success")) {
+      throw new Error("Claude Code did not complete a structured review");
+    }
+    const output = provider === "claude"
+      ? envelope?.structured_output
+      : JSON.parse(await readFile(outputPath, "utf8"));
     if (!output || Array.isArray(output) || typeof output !== "object") {
-      throw new Error("Codex returned a non-object JSON value");
+      throw new Error(`${label} returned a non-object structured result`);
     }
     return {
       output,
-      model: `codex-local/${inspection.installed_version || "unknown"}`,
+      model: `${provider}-local/${inspection.installed_version || "unknown"}`,
     };
   } catch (error) {
     if (error instanceof SqmLocalReviewError) throw error;
-    throw new SqmLocalReviewError(`Local Codex review failed: ${errorMessage(error)}`, {
-      code: "codex_local_review_failed",
+    throw new SqmLocalReviewError(`Local ${label} review failed: ${errorMessage(error)}`, {
+      code: `${provider}_local_review_failed`,
     });
   } finally {
     await rm(workDir, { recursive: true, force: true });
   }
 }
 
-function spawnCodex(command, args, prompt, { spawnImpl, executionTimeoutMs }) {
+function spawnReview(command, args, prompt, { spawnImpl, executionTimeoutMs, label, cwd, environment, provider }) {
   return new Promise((resolve, reject) => {
     const child = spawnImpl(command, args, {
-      env: safeCodexEnvironment(process.env),
-      stdio: ["pipe", "ignore", "pipe"],
+      env: safeReviewEnvironment(environment, provider),
+      cwd,
+      windowsHide: true,
+      stdio: ["pipe", "pipe", "pipe"],
     });
+    let stdout = "";
     let stderr = "";
     let settled = false;
     const timer = setTimeout(() => {
       child.kill?.("SIGTERM");
-      finish(new Error(`Codex timed out after ${executionTimeoutMs}ms`));
+      finish(new Error(`${label} timed out after ${executionTimeoutMs}ms`));
     }, executionTimeoutMs);
     timer.unref?.();
     const finish = (error = null) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      error ? reject(error) : resolve();
+      error ? reject(error) : resolve(stdout);
     };
+    child.stdout?.setEncoding?.("utf8");
+    child.stdout?.on?.("data", (chunk) => {
+      if (settled) return;
+      stdout += chunk;
+      if (Buffer.byteLength(stdout, "utf8") > 2 * 1024 * 1024) {
+        child.kill?.("SIGTERM");
+        finish(new Error(`${label} structured output exceeded the size limit`));
+      }
+    });
+    child.stdin?.on?.("error", finish);
     child.stderr?.setEncoding?.("utf8");
     child.stderr?.on?.("data", (chunk) => {
       stderr = `${stderr}${chunk}`.slice(-4000);
     });
     child.on("error", finish);
     child.on("close", (code) => {
-      finish(code === 0 ? null : new Error(stderr.trim() || `Codex exited with code ${code}`));
+      finish(code === 0 ? null : new Error(stderr.trim() || `${label} exited with code ${code}`));
     });
     child.stdin?.end(prompt);
   });
 }
 
-function safeCodexEnvironment(environment) {
+function safeReviewEnvironment(environment, provider) {
   const allowed = [
-    "HOME", "PATH", "CODEX_HOME", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR",
+    "HOME", "PATH", "CODEX_HOME", "CLAUDE_CONFIG_DIR",
+    "SystemRoot", "SYSTEMROOT", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "TEMP", "TMP", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR",
     "SSL_CERT_FILE", "SSL_CERT_DIR", "HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY", "NO_PROXY",
   ];
-  return Object.fromEntries(allowed.filter((key) => environment[key]).map((key) => [key, environment[key]]));
+  // Credentials stay in the local provider process. Never send them to the
+  // control plane, and do not pass the other provider's credentials.
+  allowed.push(...(provider === "claude" ? [
+    "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "CLAUDE_CODE_OAUTH_TOKEN",
+    "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY",
+    "AWS_PROFILE", "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN",
+    "AWS_CONFIG_FILE", "AWS_SHARED_CREDENTIALS_FILE", "GOOGLE_APPLICATION_CREDENTIALS",
+    "ANTHROPIC_VERTEX_PROJECT_ID", "CLOUD_ML_REGION", "ANTHROPIC_FOUNDRY_API_KEY", "ANTHROPIC_FOUNDRY_RESOURCE",
+  ] : ["OPENAI_API_KEY", "OPENAI_BASE_URL"]));
+  const keys = new Set(allowed.map((key) => key.toLowerCase()));
+  return Object.fromEntries(Object.entries(environment).filter(([key, value]) => value && keys.has(key.toLowerCase())));
 }
 
 function assertStructuredRequest(request) {
@@ -277,3 +327,9 @@ function machineCode(value) {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
+
+function assertProvider(provider) {
+  if (provider !== "codex" && provider !== "claude") {
+    throw new TypeError("Unsupported SQM local review provider");
+  }
+}

package/src/sqm/workflow-onboarding.js

@@ -58,8 +58,12 @@ export async function prepareDaemonWorkflows({
   try {
     const installed = await install();
     logger(
-      "SIMY workflows installed. Restart Codex, then find and install SIMY in Plugins before using @simy.",
+      "SIMY workflows installed. In Codex, restart, then find and install SIMY in Plugins. In Claude Code, add the SIMY marketplace and install simy@simy-local before using /simy:sqm-loop or /simy:pr-review.",
     );
+    if (installed.claude_plugin?.marketplace_root) {
+      logger(`Claude Code: claude plugin marketplace add ${JSON.stringify(installed.claude_plugin.marketplace_root)}`);
+      logger("Then: claude plugin install simy@simy-local");
+    }
     return { outcome: "installed", status: installed };
   } catch (error) {
     errorLogger(`SIMY workflow installation failed: ${message(error)}. The daemon will still start.`);
@@ -73,7 +77,7 @@ export async function confirmWorkflowInstallation({
 } = {}) {
   output.write(
     [
-      "SIMY can install or update its Codex plugin marketplace, Codex/Claude opt-in SQM skills.",
+      "SIMY can install or update its Codex and Claude Code plugin sources and opt-in SQM skills.",
       "Existing unrelated plugins and hooks will be preserved.",
       "",
     ].join("\n"),

package/src/sqm/workflow-update.js

@@ -1,13 +1,14 @@
-import { execFile } from "node:child_process";
 import { mkdir, readFile, realpath, rm, stat } from "node:fs/promises";
 import { homedir } from "node:os";
 import path from "node:path";
-import { promisify } from "node:util";
+
+import { runProviderCommand } from "./provider-command.js";
+import { refreshClaudePlugin } from "./claude-plugin-update.js";
 
 import { resolveBackendExecutable } from "../backend-executable.js";
 import { inspectSqmAgentSkill, installSqmAgentSkill, retireLegacySqmGate } from "./agent-skill.js";
 
-const execFileAsync = promisify(execFile);
+
 const CHECK_INTERVAL_MS = 60 * 60 * 1000;
 
 export function startWorkflowUpdates({ enabled, sync = syncInstalledWorkflows, intervalMs = CHECK_INTERVAL_MS,
@@ -32,8 +33,9 @@ export function startWorkflowUpdates({ enabled, sync = syncInstalledWorkflows, i
 
 export async function syncInstalledWorkflows({ home = homedir(),
   codexHome = process.env.CODEX_HOME || path.join(home, ".codex"),
+  claudeHome = process.env.CLAUDE_CONFIG_DIR || path.join(home, ".claude"),
   inspect = inspectSqmAgentSkill, install = installSqmAgentSkill,
-  resolveExecutable = resolveBackendExecutable, run = execFileAsync,
+  resolveExecutable = resolveBackendExecutable, run = runProviderCommand,
 } = {}) {
   // Multiple daemons may share the same installation. Serialize updates and recover
   // an abandoned lock after more than the bounded Codex command timeouts.
@@ -52,7 +54,27 @@ export async function syncInstalledWorkflows({ home = homedir(),
     const platforms = Object.entries(status.platforms)
       .filter(([, entry]) => entry.state === "outdated").map(([platform]) => platform);
     if (platforms.length) status = await install({ home, platforms });
-    if (!status.platforms.codex.installed) return { outcome: platforms.length || migrated ? "updated" : "unchanged" };
+    const results = {};
+    const failures = [];
+    for (const [provider, refresh] of [
+      ["codex", () => refreshCodexPlugin({ status, home, codexHome, resolveExecutable, run })],
+      ["claude", () => refreshClaudePlugin({ status, home, claudeHome, resolveExecutable, run })],
+    ]) {
+      try { results[provider] = await refresh(); }
+      catch (error) { failures.push(error); }
+    }
+    if (failures.length) throw new AggregateError(failures, failures.map((error) => error.message).join("; "));
+    if (results.claude.outcome === "updated") return { ...results.claude, providers: results };
+    if (results.codex.outcome !== "not_enabled") return results.codex;
+    return { outcome: platforms.length || migrated ? "updated" : results.claude.outcome === "current" ? "current" :
+      status.platforms.codex.installed || status.claude_plugin?.installed ? "not_enabled" : "unchanged" };
+  } finally {
+    await rm(lock, { recursive: true, force: true });
+  }
+}
+
+async function refreshCodexPlugin({ status, home, codexHome, resolveExecutable, run }) {
+    if (!status.platforms.codex.installed) return { outcome: "not_enabled" };
 
     const marketplace = JSON.parse(await readFile(status.codex_plugin.marketplace_path, "utf8"));
     if (typeof marketplace.name !== "string" || !/^[A-Za-z0-9_-]+$/.test(marketplace.name)) {
@@ -85,7 +107,4 @@ export async function syncInstalledWorkflows({ home = homedir(),
       throw new Error("Codex did not confirm the updated SIMY plugin cache; will retry.");
     }
     return { outcome: "updated", version: status.codex_plugin.version };
-  } finally {
-    await rm(lock, { recursive: true, force: true });
-  }
 }