@awak-app/simy-cli 0.5.43 → 0.5.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.5.43",
+  "version": "0.5.45",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -37,12 +37,12 @@
     "test:e2e:console:real-provider": "node ./scripts/real-provider-console-e2e.js",
     "test:e2e:console:fullstack": "node ./scripts/fullstack-cli-smoke.js",
     "check": "npm run check:auto-update && node --check ./src/desktop-executor.js && node --check ./src/local-task.js && node --check ./scripts/desktop-executor-e2e.js && node --check ./scripts/pre-guardrail-e2e.js && node --check ./scripts/fixtures/fake-desktop-provider.js && npm run check:syntax && npm run check:session-supervision-syntax && npm run check:real-provider-syntax && npm test && npm run check:package",
-    "check:session-supervision-syntax": "node --check ./src/session-supervision/index.js && node --check ./src/session-supervision/codex-app-server.js && node --check ./src/session-supervision/claude-sessions.js && node --check ./src/session-supervision/original-session-target.js && node --check ./src/session-supervision/action-association.js && node --check ./src/session-supervision/action-association-host.js && node --check ./src/session-supervision/action-association-api.js && node --check ./src/codex-plugins/simy/hooks/action-association.mjs",
+    "check:session-supervision-syntax": "node --check ./src/session-supervision/index.js && node --check ./src/session-supervision/codex-app-server.js && node --check ./src/session-supervision/claude-sessions.js && node --check ./src/session-supervision/original-session-target.js && node --check ./src/session-supervision/action-association.js && node --check ./src/session-supervision/action-association-host.js && node --check ./src/session-supervision/action-association-api.js && node --check ./src/session-supervision/association-store.js && node --check ./src/session-supervision/action-deadline.js && node --check ./src/session-supervision/action-deadline-store.js && node --check ./src/codex-plugins/simy/hooks/action-association.mjs",
     "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js && npm run check:sqm",
     "check:workflow-observation-sender": "node --check ./src/workflow-observation-sender.js",
     "check:sqm": "node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/reliability.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./src/sqm/agent-skill.js && node --check ./src/sqm/workflow-onboarding.js && node --check ./src/sqm/workflow-update.js && node --check ./src/sqm/review-worker.js && node --check ./scripts/sqm-complete-loop-e2e.js && node --check ./scripts/sqm-local-review-e2e.js",
     "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js",
-    "check:syntax": "node --check ./src/index.js && node --check ./src/install-update.js && node --check ./src/agent.js && node --check ./src/connection-discovery.js && node --check ./src/codex-plugins/simy/hooks/connection-reminder.mjs && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/pr-preparation.js && node --check ./src/orchestrator/minimum-completion.js && node --check ./src/orchestrator/delivery/scripts/check-minimum-completion.mjs && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./src/coding-run-store.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js && node --check ./src/codex-plugins/simy/hooks/delivery-loop.mjs && node --check ./src/delivery-hooks/command.js && node --check ./src/delivery-hooks/desktop.js && node --check ./src/delivery-hooks/supervisor.js && node --check ./src/session-supervision/automatic-continuation.js",
+    "check:syntax": "node --check ./src/index.js && node --check ./src/install-update.js && node --check ./src/agent.js && node --check ./src/connection-discovery.js && node --check ./src/codex-plugins/simy/hooks/connection-reminder.mjs && node --check ./src/codex-plugins/simy/hooks/dev-work.mjs && node --check ./src/dev-work-events.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/pr-preparation.js && node --check ./src/orchestrator/minimum-completion.js && node --check ./src/orchestrator/delivery/scripts/check-minimum-completion.mjs && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./src/coding-run-store.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js && node --check ./src/codex-plugins/simy/hooks/delivery-loop.mjs && node --check ./src/delivery-hooks/command.js && node --check ./src/delivery-hooks/desktop.js && node --check ./src/delivery-hooks/supervisor.js && node --check ./src/session-supervision/automatic-continuation.js",
     "check:package": "node ./scripts/check-package-contents.js",
     "build:macos-installer:dev": "bash packaging/build-macos-arm64.sh --unsigned-dev",
     "build:macos-installer": "bash packaging/build-macos-arm64.sh --production",

package/src/agent.js

@@ -35,6 +35,12 @@ import {
   writeSession,
 } from "./session-store.js";
 import { isRequestOriginAllowed, resolveWebOrigin } from "./web-origin.js";
+import {
+  DEV_WORK_EVENT_MAX_BYTES,
+  DevWorkEventError,
+  normalizeDevWorkEvent,
+  sendDevWorkEvent,
+} from "./dev-work-events.js";
 import {
   cleanupExpiredRuns,
   cleanupRunAttachments,
@@ -797,6 +803,53 @@ export async function startAgent({
         json(res, 200, refreshAvailableCapabilities());
         return;
       }
+      if (url.pathname === "/v1/dev-work-events") {
+        // Local-only: the SIMY plugin hook reports Git state from this machine.
+        // A browser (including SIMY Web) always sends Origin, so any Origin is
+        // refused; the hook posts without one.
+        if (req.headers.origin !== undefined) {
+          json(res, 403, { error: "dev-work events are accepted only from local hooks" });
+          return;
+        }
+        if (req.method !== "POST") {
+          json(res, 405, { error: "method not allowed" });
+          return;
+        }
+        if (!String(req.headers["content-type"] || "").toLowerCase().startsWith("application/json")) {
+          json(res, 415, { error: "JSON body required" });
+          return;
+        }
+        let event;
+        try {
+          event = normalizeDevWorkEvent(await readBoundedJson(req, DEV_WORK_EVENT_MAX_BYTES));
+        } catch (error) {
+          json(res, error instanceof DevWorkEventError ? error.status : 400, {
+            error: "Invalid dev-work event.",
+          });
+          return;
+        }
+        if (!isSessionValid(session, Date.now(), apiOrigin) || !session?.device_id) {
+          json(res, 401, { error: "Sign in to SIMY CLI to report dev-work." });
+          return;
+        }
+        try {
+          json(
+            res,
+            200,
+            await sendDevWorkEvent({
+              event,
+              session,
+              apiOrigin,
+              fetchImpl: dependencies.fetch || globalThis.fetch,
+            }),
+          );
+        } catch (error) {
+          json(res, error instanceof DevWorkEventError ? error.status : 502, {
+            error: error instanceof DevWorkEventError ? error.message : "dev-work event failed",
+          });
+        }
+        return;
+      }
       if (url.pathname === "/v1/integrations/sqm-agent") {
         if (!isSessionValid(session, Date.now(), apiOrigin) || !session?.device_id) {
           json(res, 401, { error: "Reconnect SIMY CLI before managing the SQM agent skill." });
@@ -2738,6 +2791,17 @@ async function readJson(req) {
   return raw ? JSON.parse(raw) : {};
 }
 
+async function readBoundedJson(req, maxBytes) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > maxBytes) throw new Error("body too large");
+    chunks.push(chunk);
+  }
+  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)));
+}
+
 async function readCodingLoopStart(req) {
   const contentType = String(req.headers["content-type"] || "");
   if (!contentType.toLowerCase().startsWith("multipart/form-data")) {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.5.43";
+export const CLI_VERSION = "0.5.45";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/codex-plugins/simy/hooks/README.md

@@ -30,3 +30,17 @@ Private state is under `SIMY_HOME/delivery-hooks` (default `~/.simy/delivery-hoo
 keyed by provider and session ID and bound to the canonical working directory.
 Historical hook observations do not prove hooks are still enabled. See the
 bundled delivery-loop skill for checkpoint commands and explicit recovery.
+
+## Project 実装状況 (dev-work) hook
+
+`dev-work.mjs` runs on Stop in both distributions. In a Git work tree with a
+named branch, a commit and an `origin` remote it reports `owner/name`, branch,
+HEAD, the open PR URL (via `gh pr view`, only when `gh` is installed) and the
+Project from `git config simy.project-id` to the local SIMY CLI agent over
+loopback (`POST /v1/dev-work-events`). The agent forwards it to SIMY Web as the
+signed-in device; the hook never reads or holds a SIMY credential. The provider
+session ID is sent only as a SHA-256 digest. An unchanged report for the same
+session is skipped locally (state under `PLUGIN_DATA/dev-work`). The hook never
+blocks: it has short timeouts, always exits 0 and writes only short error lines
+to stderr. Link a repository to a Project with
+`git config simy.project-id <project-uuid>`.

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -357,6 +357,10 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     if (previous.run) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
     const managedState = managedSpec(managed, session, provider, previous.process, admitted ? admission : null, now);
     if (autoContinueEpoch && managedState) managedState.autoContinueEpoch = autoContinueEpoch;
+    if (managedState && previous.associationTaskId) {
+      managedState.taskId = previous.associationTaskId;
+      if (previous.actionAssociation) managedState.actionAssociation = structuredClone(previous.actionAssociation);
+    }
     if (liveHookAdmission && managedState) managedState.liveHookOwner = { pid: liveHookAdmission.pid,
       identity: liveHookAdmission.identity, hookStartedAt: liveHookAdmission.hookStartedAt };
     const waiting = managedState?.decision?.outcome === 'wait';

package/src/codex-plugins/simy/hooks/dev-work.mjs

@@ -0,0 +1,270 @@
+#!/usr/bin/env node
+
+// P-05: report this coding session's Git state (repo, branch, HEAD, optional
+// PR and Project) to the local SIMY CLI agent, which forwards it to SIMY as
+// the signed-in device. Shipped with both the Codex and Claude Code plugins.
+//
+// The hook holds no SIMY credential and never blocks the coding session: every
+// step has a short timeout, failures are silent (a short stderr line at most,
+// never a secret), and it always exits 0. The raw provider session id is never
+// sent or stored; only a provider-scoped SHA-256 of it leaves this process.
+
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const MAX_INPUT_BYTES = 64 * 1024;
+const MAX_DISCOVERY_RECORDS = 16;
+const GIT_TIMEOUT_MS = 1_500;
+const GH_TIMEOUT_MS = 3_000;
+const POST_TIMEOUT_MS = 6_000;
+const HARD_DEADLINE_MS = 9_000;
+const SOURCES = { codex: "codex", claude: "claude_code" };
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const HEAD_SHA = /^[0-9a-f]{40}$/;
+const REPO = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
+const PR_URL =
+  /^https:\/\/github\.com\/[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}\/pull\/[0-9]{1,10}$/;
+
+function run(command, args, { cwd, timeout, env }) {
+  return new Promise((resolve) => {
+    try {
+      execFile(
+        command,
+        args,
+        { cwd, timeout, env, windowsHide: true, maxBuffer: 64 * 1024 },
+        (error, stdout) => resolve(error ? null : String(stdout).trim()),
+      );
+    } catch {
+      resolve(null);
+    }
+  });
+}
+
+/** owner/name from an origin remote URL (https, ssh or scp-like), or null. */
+export function repoFromRemote(remote) {
+  const value = String(remote || "").trim();
+  if (!value) return null;
+  let path;
+  const scp = value.match(/^[^@/\s]+@[^:/\s]+:(.+)$/);
+  if (scp) {
+    path = scp[1];
+  } else {
+    try {
+      const url = new URL(value);
+      if (!["https:", "http:", "ssh:", "git:"].includes(url.protocol)) return null;
+      path = url.pathname;
+    } catch {
+      return null;
+    }
+  }
+  const parts = path.replace(/\.git$/i, "").replace(/\/+$/, "").split("/").filter(Boolean);
+  if (parts.length < 2) return null;
+  const repo = `${parts.at(-2)}/${parts.at(-1)}`;
+  return REPO.test(repo) ? repo : null;
+}
+
+/**
+ * Collects the report for `cwd`, or null when it is not a Git work tree with a
+ * named branch, a commit, and an origin remote.
+ */
+export async function collectDevWorkEvent({
+  cwd,
+  provider,
+  sessionId,
+  env = process.env,
+  runImpl = run,
+}) {
+  const source = SOURCES[provider];
+  if (!source || typeof sessionId !== "string" || !sessionId.trim() || !cwd) return null;
+  const git = (args) => runImpl("git", args, { cwd, timeout: GIT_TIMEOUT_MS, env });
+  if ((await git(["rev-parse", "--is-inside-work-tree"])) !== "true") return null;
+  const [headSha, branch, remote, projectId] = await Promise.all([
+    git(["rev-parse", "--verify", "-q", "HEAD"]),
+    git(["symbolic-ref", "--short", "-q", "HEAD"]),
+    git(["remote", "get-url", "origin"]),
+    git(["config", "--get", "simy.project-id"]),
+  ]);
+  const repo = repoFromRemote(remote);
+  if (!headSha || !HEAD_SHA.test(headSha) || !branch || !repo) return null;
+  // Only repositories the owner linked to a Project (`git config simy.project-id`)
+  // are reported; other repositories' names and branches never leave the machine.
+  if (!projectId || !UUID.test(projectId)) return null;
+  return {
+    repo,
+    branch,
+    head_sha: headSha,
+    session_id: sha256(`${provider}:${sessionId.trim()}`),
+    source,
+    project_id: projectId.toLowerCase(),
+  };
+}
+
+/** Best effort: the open PR for the current branch via `gh`, if installed. */
+export async function pullRequestUrl({ cwd, repo, env = process.env, runImpl = run }) {
+  const url = await runImpl("gh", ["pr", "view", "--json", "url", "--jq", ".url"], {
+    cwd,
+    timeout: GH_TIMEOUT_MS,
+    env: { ...env, GH_PROMPT_DISABLED: "1", NO_COLOR: "1" },
+  });
+  if (!url || !PR_URL.test(url)) return null;
+  return url.toLowerCase().startsWith(`https://github.com/${repo.toLowerCase()}/pull/`) ? url : null;
+}
+
+export async function findAgentPort({ env = process.env, sessionRoot }) {
+  const explicit = normalizeOrigin(env.SIMY_WEB_ORIGIN || env.SIMY_API_ORIGIN);
+  if (env.SIMY_WEB_ORIGIN || env.SIMY_API_ORIGIN) {
+    return explicit ? readPort(sessionRoot, explicit) : null;
+  }
+  let entries;
+  try {
+    entries = (await readdir(join(sessionRoot, "connections")))
+      .filter((entry) => entry.endsWith(".json"))
+      .sort()
+      .slice(0, MAX_DISCOVERY_RECORDS);
+  } catch {
+    return null;
+  }
+  for (const entry of entries) {
+    try {
+      const record = JSON.parse(await readFile(join(sessionRoot, "connections", entry), "utf8"));
+      const origin = normalizeOrigin(record?.web_origin);
+      if (!origin || entry !== `${sha256(origin)}.json`) continue;
+      const port = await readPort(sessionRoot, origin);
+      if (port) return port;
+    } catch {
+      // Unreadable discovery records are skipped.
+    }
+  }
+  return null;
+}
+
+async function readPort(sessionRoot, origin) {
+  try {
+    const record = JSON.parse(
+      await readFile(join(sessionRoot, "connections", `${sha256(origin)}.json`), "utf8"),
+    );
+    return record?.schema_version === 1 &&
+      record?.web_origin === origin &&
+      Number.isInteger(record?.port) &&
+      record.port >= 1 &&
+      record.port <= 65_535
+      ? record.port
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function normalizeOrigin(raw) {
+  try {
+    const url = new URL(raw);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) return null;
+    if ((url.pathname && url.pathname !== "/") || url.search || url.hash) return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+
+export async function runDevWorkHook({
+  provider,
+  input = {},
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+  runImpl = run,
+}) {
+  const cwd = typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd();
+  const sessionId = input.session_id || input.sessionId || env.CODEX_THREAD_ID;
+  const event = await collectDevWorkEvent({ cwd, provider, sessionId, env, runImpl });
+  if (!event) return { sent: false, reason: "not_applicable" };
+
+  const sessionRoot = env.SIMY_HOME?.trim() || join(homedir(), ".simy");
+  const pluginData =
+    env.PLUGIN_DATA?.trim() || env.CLAUDE_PLUGIN_DATA?.trim() || join(sessionRoot, "plugin-data", "simy");
+  // The upstream observation is keyed by (Project, repo, HEAD, session): a
+  // resend of the same state changes nothing, so skip it (and `gh`) locally.
+  const fingerprint = sha256(JSON.stringify([event.session_id, event.repo, event.head_sha, event.project_id ?? null]));
+  const statePath = join(pluginData, "dev-work", `${event.session_id}.json`);
+  if ((await readState(statePath))?.fingerprint === fingerprint) {
+    return { sent: false, reason: "unchanged" };
+  }
+  const port = await findAgentPort({ env, sessionRoot });
+  if (!port) return { sent: false, reason: "agent_unavailable" };
+  const prUrl = await pullRequestUrl({ cwd, repo: event.repo, env, runImpl });
+  if (prUrl) event.pr_url = prUrl;
+
+  const response = await fetchImpl(`http://127.0.0.1:${port}/v1/dev-work-events`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(event),
+    redirect: "error",
+    signal: AbortSignal.timeout(POST_TIMEOUT_MS),
+  });
+  await response.body?.cancel?.().catch(() => {});
+  if (!response.ok) return { sent: false, reason: `http_${response.status}` };
+  await writeState(statePath, { fingerprint }).catch(() => {});
+  return { sent: true };
+}
+
+async function readState(target) {
+  try {
+    return JSON.parse(await readFile(target, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+async function writeState(target, state) {
+  await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+  const temporary = `${target}.${process.pid}.tmp`;
+  await writeFile(temporary, `${JSON.stringify(state)}\n`, { encoding: "utf8", mode: 0o600 });
+  await rename(temporary, target);
+}
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+async function readHookInput(stream = process.stdin) {
+  let raw = "";
+  for await (const chunk of stream) {
+    raw += String(chunk);
+    if (Buffer.byteLength(raw) > MAX_INPUT_BYTES) return {};
+  }
+  try {
+    const parsed = JSON.parse(raw || "{}");
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+export async function main(provider = "codex") {
+  // Never outlive the provider's hook budget, whatever a child process does.
+  const deadline = setTimeout(() => process.exit(0), HARD_DEADLINE_MS);
+  deadline.unref?.();
+  try {
+    const result = await runDevWorkHook({ provider, input: await readHookInput() });
+    // Signed out (401) and a disabled Web gateway (404) are expected states.
+    if (
+      !result.sent &&
+      result.reason.startsWith("http_") &&
+      !["http_401", "http_404"].includes(result.reason)
+    ) {
+      process.stderr.write(`SIMY dev-work report was not recorded (${result.reason}).\n`);
+    }
+  } catch {
+    process.stderr.write("SIMY dev-work report failed.\n");
+  } finally {
+    clearTimeout(deadline);
+  }
+  process.exitCode = 0;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await main(process.argv[2] === "claude" ? "claude" : "codex");
+}

package/src/codex-plugins/simy/hooks/hooks.json

@@ -50,6 +50,15 @@
             "timeout": 3
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node --input-type=module -e \"import { pathToFileURL } from 'node:url'; import { join } from 'node:path'; const hook = await import(pathToFileURL(join(process.env.PLUGIN_ROOT, 'hooks', 'dev-work.mjs')).href); await hook.main('codex');\"",
+            "timeout": 10
+          }
+        ]
       }
     ],
     "SessionEnd": [

package/src/desktop-host.js

@@ -1,3 +1,4 @@
+import { createActionDeadlineService } from './session-supervision/action-deadline.js';
 import { deliveryHookStatus, openHookSetup } from "./delivery-hooks/desktop.js";
 import { controlDelivery, verifyDelivery } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
 import { createManagedSupervisor } from "./delivery-hooks/supervisor.js";
@@ -48,8 +49,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const lock = candidate ? null : await acquireDesktopProcessLock(root, { webOrigin });
   const supervisorToken = lock?.nonce || env.SIMY_DESKTOP_SUPERVISOR_TOKEN;
   let agent, updater, analysisManager, automaticContinuation, stopWorkflows = async () => {}, timer, closed = false, relay = null, publishing = null, publishAgain = false;
-  const makeActionAssociations = () => (dependencies.createActionAssociationHost || createActionAssociationHost)({ root: join(root, "delivery-hooks"), sessionRoot: root, webOrigin });
+  const makeActionAssociations = () => (dependencies.createActionAssociationHost || createActionAssociationHost)({ root: join(root, "delivery-hooks"), sessionRoot: root, webOrigin, onChange: () => { if (!closed) setImmediate(() => { void publish().catch(() => {}); }); } });
   let actionAssociations = makeActionAssociations();
+  const deadlines = createActionDeadlineService({ root: join(root, "action-deadlines") });
   const managedSupervisor = (dependencies.createManagedSupervisor || createManagedSupervisor)({ root: join(root, "delivery-hooks"),
     beforeClaim: record => actionAssociations.prepareCached?.(record) || record });
   let shuttingDown = null;
@@ -105,7 +107,16 @@ export async function startDesktopHost({ input = process.stdin, output = process
       await actionAssociations.decorate(status.deliveryHooks);
       const discovery = refreshSessions();
       automaticContinuation?.tick(discovery.sessions);
-      status.sessionSupervision = { ...discovery, sessions: discovery.sessions.map(candidate => automaticContinuation.project(analysisManager.project(candidate))) };
+      const sessions = discovery.sessions.map(candidate => automaticContinuation.project(analysisManager.project(candidate)));
+      await actionAssociations.decorateSessions?.(sessions);
+      for (const session of sessions) {
+        const context = await actionAssociations.deadlineContext?.(session);
+        if (context) session.actionDeadline = await deadlines.reconcile(context);
+        else session.actionDeadline = { status: 'unavailable', online: false, reminder: null };
+        const run = status.deliveryHooks.runs?.find(item => item.provider === session.provider && item.session === session.session);
+        if (run) run.actionDeadline = session.actionDeadline;
+      }
+      status.sessionSupervision = { ...discovery, sessions };
       if (!closed && !relay) emit({ type: "status", status });
     }).finally(() => { publishing = null; if (publishAgain && !closed) { publishAgain = false; setImmediate(() => { void publish().catch(() => {}); }); } });
     return publishing;
@@ -301,7 +312,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await verifyDelivery({ root: join(root, "delivery-hooks"), provider: command.provider, session: command.session,
             taskId: command.taskId, criterionId: command.criterionId });
         } else if (["session_action_select", "session_action_unlink", "session_action_refresh"].includes(action)) {
-          await actionAssociations.correct(command);
+          const candidate = await selectedSession(command);
+          await actionAssociations.correct(command, analysisManager.project(candidate));
         } else if (action === "session_set_auto_continue") {
           if (typeof command.enabled !== 'boolean') throw new Error('Choose whether automatic continuation is enabled.');
           if (command.enabled) {
@@ -316,6 +328,17 @@ export async function startDesktopHost({ input = process.stdin, output = process
             const fresh = await selectedSession(command);
             if (fresh.capabilities?.canAnalyze === true) await analysisManager.request(fresh);
           }
+        } else if (action === "session_deadline_decide") {
+          if (command.cancel === true) { emit({ type: "result", id: command.id, ok: true }); return; }
+          const candidate = await selectedSession(command);
+          await actionAssociations.correct({ ...command, action: 'session_action_refresh' }, analysisManager.project(candidate));
+          const projected = analysisManager.project(candidate);
+          await actionAssociations.decorateSessions?.([projected]);
+          const context = await actionAssociations.deadlineContext?.(projected);
+          if (!context || context.taskId !== command.taskId) throw new Error('Refresh this conversation before deciding its deadline.');
+          await deadlines.reconcile(context);
+          const result = await deadlines.decide(context, { ...command, requestId: command.requestId || command.decisionId });
+          if (result.status === 'conflict') throw Object.assign(new Error('Deadline changed; refresh before deciding.'), { code: 'conflict' });
         } else if (action === "session_track" || action === "session_untrack") {
           const candidate = await selectedSession(command);
           if (candidate.capabilities?.canMonitor !== true) throw new Error('Tracking is unavailable for this conversation.');

package/src/dev-work-events.js

@@ -0,0 +1,103 @@
+import { webApiHeaders, webApiUrl } from "./web-api.js";
+
+/**
+ * P-05: forwards a local coding session's Git state (reported by the SIMY
+ * plugin hook) to SIMY Web as the signed-in device, so the Project 実装状況
+ * tab can show it. The hook never holds a SIMY credential; this agent adds the
+ * device bearer. The Web gateway derives the owner scope from that bearer.
+ */
+// Trailing slash: SIMY Web redirects slashless API paths (308), and this
+// sender refuses redirects so the device token is only sent to this exact URL.
+export const PROJECT_DEV_WORK_EVENTS_PATH = "project-dev-work-events/";
+export const DEV_WORK_EVENT_MAX_BYTES = 4096;
+const REQUEST_TIMEOUT_MS = 5_000;
+
+const REQUIRED_KEYS = ["repo", "branch", "head_sha", "session_id", "source"];
+const OPTIONAL_KEYS = ["pr_url", "project_id"];
+const ALLOWED_KEYS = new Set([...REQUIRED_KEYS, ...OPTIONAL_KEYS]);
+const SOURCES = new Set(["claude_code", "codex", "other"]);
+const REPO = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
+const HEAD_SHA = /^[0-9a-f]{7,40}$/;
+// Same conservative `git check-ref-format` subset as the Web gateway.
+const BRANCH = /^(?!-)(?!\/)(?!.*\.\.)(?!.*@\{)(?!.*\/$)(?!.*\.lock$)[^\x00-\x20\x7f~^:?*[\\]{1,255}$/;
+const SESSION_ID = /^[A-Za-z0-9._:-]{1,128}$/;
+const PR_URL =
+  /^https:\/\/github\.com\/[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}\/pull\/[0-9]{1,10}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+export class DevWorkEventError extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+}
+
+/** Returns the exact report to forward, or throws a 400 DevWorkEventError. */
+export function normalizeDevWorkEvent(value) {
+  const invalid = () => new DevWorkEventError("Invalid dev-work event.", 400);
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid();
+  if (!Object.keys(value).every((key) => ALLOWED_KEYS.has(key))) throw invalid();
+  if (!REQUIRED_KEYS.every((key) => typeof value[key] === "string")) throw invalid();
+  const event = {};
+  for (const key of REQUIRED_KEYS) event[key] = value[key];
+  for (const key of OPTIONAL_KEYS) {
+    if (value[key] === undefined || value[key] === null) continue;
+    if (typeof value[key] !== "string") throw invalid();
+    event[key] = value[key];
+  }
+  if (
+    !REPO.test(event.repo) ||
+    !BRANCH.test(event.branch) ||
+    !HEAD_SHA.test(event.head_sha) ||
+    !SESSION_ID.test(event.session_id) ||
+    !SOURCES.has(event.source) ||
+    (event.pr_url !== undefined && !PR_URL.test(event.pr_url)) ||
+    (event.project_id !== undefined && !UUID.test(event.project_id))
+  ) {
+    throw invalid();
+  }
+  if (event.project_id !== undefined) event.project_id = event.project_id.toLowerCase();
+  return event;
+}
+
+/**
+ * Posts one normalized report to Web. Resolves with the minimal receipt; a
+ * disabled gateway (404) or any refusal rejects with a status the local
+ * endpoint relays, without Web's message body.
+ */
+export async function sendDevWorkEvent({ event, session, apiOrigin, fetchImpl = globalThis.fetch }) {
+  let response;
+  try {
+    response = await fetchImpl(
+      webApiUrl(PROJECT_DEV_WORK_EVENTS_PATH, {
+        webOrigin: apiOrigin,
+        apiBaseUrl: session.api_base_url,
+      }),
+      {
+        method: "POST",
+        headers: webApiHeaders({ token: session.token }, { "Content-Type": "application/json" }),
+        body: JSON.stringify(event),
+        redirect: "error",
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      },
+    );
+  } catch {
+    throw new DevWorkEventError("SIMY Web could not be reached.", 502);
+  }
+  if (!response.ok) {
+    await response.body?.cancel?.().catch(() => {});
+    const status = [401, 403, 404, 409, 422, 503].includes(response.status) ? response.status : 502;
+    throw new DevWorkEventError("SIMY Web did not record the dev-work event.", status);
+  }
+  const receipt = await response.json().catch(() => null);
+  if (
+    !receipt ||
+    typeof receipt.job_id !== "string" ||
+    !UUID.test(receipt.job_id) ||
+    typeof receipt.created !== "boolean" ||
+    receipt.project_id !== (event.project_id ?? null)
+  ) {
+    throw new DevWorkEventError("SIMY Web returned an invalid dev-work receipt.", 502);
+  }
+  return { job_id: receipt.job_id, created: receipt.created, project_id: receipt.project_id };
+}