@awak-app/simy-cli 0.5.7 → 0.5.10

package/src/codex-plugins/simy/skills/agentic-delivery-loop/references/state-and-receipts.md

@@ -9,11 +9,18 @@ Persist one controller-owned snapshot with at least:
 
 - `run_id`, `state`, monotonic `revision`, and terminal disposition;
 - immutable explicit conditions and their stable digest;
+- acceptance-source identities and digests, architecture boundaries, applicable
+  rule decisions, risk tier, requested/effective delivery levels, the safety
+  ceiling reason, and chat-confirmation receipt;
 - repository, base SHA, head SHA, companion SHAs, merge SHA, image digests, and
   deployed revision;
 - target environments, user journey, user/tenant fixture identities, and
   required artifacts;
 - applicable gates and their current status;
+- frozen acceptance charter digest, current matrix/table paths and digests,
+  superseded matrix snapshots, and the acceptance validator result for each gate;
+- verification-boundary changes, deferred-debt references, and applicable
+  outcome and guardrail measures;
 - attempt number, retry/time/cost budgets, and failure fingerprints;
 - append-only receipt IDs, evidence references, timestamps, and cleanup state.
 
@@ -29,6 +36,7 @@ Use the smallest applicable receipts rather than free-form completion claims:
 - `FailureReproductionReceipt`
 - `ImplementationReceipt`
 - `LocalVerificationReceipt`
+- `AcceptanceEvidenceReceipt` (matrix completeness, not overall completion)
 - `IndependentReviewReceipt`
 - `PRCIReceipt`
 - `IntegrationVerificationReceipt`
@@ -91,6 +99,7 @@ Evidence is revision-bound:
 | Change | Invalidate |
 |---|---|
 | Charter or explicit success conditions | All affected downstream gates |
+| Acceptance source, test oracle, assertion, or CI/security gate changes | The affected gate and all dependent downstream evidence |
 | Head SHA or generated source changes | Local, CI, integration, container, and live evidence |
 | Base SHA or companion revision changes | Integration and later evidence |
 | Container image digest changes | Container user journey and later runtime evidence |
@@ -125,6 +134,7 @@ For the full delivery mode:
 ```text
 done =
   reproduction_verified
+  && acceptance_evidence_complete
   && locally_verified
   && pr_ci_green
   && integration_verified
@@ -140,3 +150,8 @@ done =
 Remove only genuinely non-applicable terms and record why. If merge or deploy
 is outside current authority, stop at the highest proven pre-authority state.
 
+Acceptance evidence must cover every applicable criterion for the target gate,
+with current context and the required user/system layers. After each evaluated
+action, refresh the JSON matrix and its readable table; append a receipt for the
+update. Keep the frozen charter distinct from mutable results. A charter patch
+supersedes the old digest only after the controller verifies its authority.

package/src/codex-plugins/simy/skills/agentic-delivery-loop/scripts/check-acceptance.mjs

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+
+// Offline record validation only. The controller owns acceptance and provenance.
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open, readFile, realpath } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const layers = ["user", "system"];
+const hashPattern = /^[a-f0-9]{64}$/;
+const text = (value) => typeof value === "string" && value.trim().length > 0;
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+export const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+export const contextDigest = (context) => sha256(JSON.stringify(canonical(context)));
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (!object(value)) return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]));
+}
+
+function requireValue(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+function validateCharter(charter) {
+  requireValue(object(charter) && charter.schema_version === 1 && text(charter.run_id), "Invalid charter header");
+  requireValue(Array.isArray(charter.criteria) && charter.criteria.length > 0, "Charter requires criteria");
+  const ids = new Set();
+  for (const criterion of charter.criteria) {
+    requireValue(object(criterion) && text(criterion.id) && !ids.has(criterion.id), "Duplicate or invalid criterion ID");
+    ids.add(criterion.id);
+    requireValue(text(criterion.outcome) && text(criterion.acceptance_source), "Criterion needs outcome and independent acceptance source");
+    requireValue(object(criterion.layers), "Criterion needs verification layers");
+    let required = 0;
+    for (const layer of layers) {
+      const spec = criterion.layers[layer];
+      requireValue(object(spec), `Missing ${layer} layer specification`);
+      if (spec.applicability === "required") {
+        requireValue(text(spec.method), "Required layer needs a verification method");
+        required += 1;
+      } else {
+        requireValue(spec.applicability === "not_applicable" && text(spec.reason) && text(spec.source), "Non-applicability needs a reason and source in the charter");
+      }
+    }
+    requireValue(required > 0, "A criterion cannot waive both verification layers");
+  }
+}
+
+function validateContext(context, runId) {
+  requireValue(object(context) && context.run_id === runId, "Context run ID mismatch");
+  for (const field of ["stage", "environment", "fixture_id"]) {
+    requireValue(text(context[field]), `Context needs ${field}`);
+  }
+  requireValue(hashPattern.test(context.input_sha256), "Context needs input SHA-256");
+  requireValue(object(context.source_revisions) && Object.keys(context.source_revisions).length > 0, "Context needs repository revisions");
+  for (const [repository, revision] of Object.entries(context.source_revisions)) {
+    requireValue(text(repository) && typeof revision === "string" && /^[a-f0-9]{40}$/.test(revision), "Invalid repository revision");
+  }
+}
+
+async function checkArtifact(root, artifact) {
+  requireValue(object(artifact) && text(artifact.path) && hashPattern.test(artifact.sha256), "Invalid artifact reference");
+  // Explicit bundle-relative paths only; never fetch URLs or execute evidence.
+  const segments = artifact.path.split("/");
+  requireValue(!path.isAbsolute(artifact.path) && !artifact.path.includes("\\") &&
+    segments.every((part) => part && part !== "." && part !== ".." && !part.includes(":")), "Unsafe artifact path");
+  let target = root;
+  for (let index = 0; index < segments.length; index += 1) {
+    target = path.join(target, segments[index]);
+    const stat = await lstat(target);
+    requireValue(!stat.isSymbolicLink(), "Symbolic evidence paths are not allowed");
+    if (index < segments.length - 1) requireValue(stat.isDirectory(), "Invalid evidence directory");
+  }
+  const handle = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const stat = await handle.stat();
+    requireValue(stat.isFile() && stat.size > 0 && stat.size <= 16 * 1024 * 1024, "Artifact must be a nonempty regular file of at most 16 MiB");
+    requireValue(sha256(await handle.readFile()) === artifact.sha256, "Artifact digest mismatch");
+  } finally {
+    await handle.close();
+  }
+}
+
+const tableText = (value) => String(value ?? "").replaceAll("|", "\\|").replace(/[\r\n]+/g, " ");
+
+export function renderChecklist(report) {
+  const header = [
+    "| Criterion / outcome | Layer / method | Status | Observation | Evidence | Unmet reason / next action |",
+    "| --- | --- | --- | --- | --- | --- |",
+  ];
+  const rows = report.checks.map((row) => "| " + [
+    `${row.id}: ${row.outcome}`, `${row.layer}: ${row.method}`, row.status,
+    row.observation, row.evidence.join(", "), [row.reason, row.next_action].filter(Boolean).join(" / "),
+  ].map(tableText).join(" | ") + " |");
+  return [...header, ...rows, "", `Validator: ${report.status}`,
+    ...report.errors.map((error) => `- ${tableText(error)}`)].join("\n") + "\n";
+}
+
+export async function checkAcceptance({ charterBytes, matrix, expectedCharterSha256, expectedContextSha256, evidenceRoot }) {
+  requireValue(hashPattern.test(expectedCharterSha256) && hashPattern.test(expectedContextSha256), "Trusted charter and context SHA-256 values are required");
+  requireValue(sha256(charterBytes) === expectedCharterSha256, "Frozen charter digest mismatch");
+  const charter = JSON.parse(charterBytes.toString());
+  validateCharter(charter);
+  requireValue(object(matrix) && matrix.schema_version === 1, "Invalid matrix schema version");
+  requireValue(matrix.charter_sha256 === expectedCharterSha256, "Matrix charter digest mismatch");
+  validateContext(matrix.context, charter.run_id);
+  requireValue(contextDigest(matrix.context) === expectedContextSha256, "Current context digest mismatch");
+  requireValue(Array.isArray(matrix.results), "Matrix requires results");
+  const root = await realpath(evidenceRoot);
+  const report = { status: "evidence_incomplete", checks: [], errors: [] };
+  const results = new Map();
+  const expectedIds = new Set(charter.criteria.map((criterion) => criterion.id));
+  for (const row of matrix.results) {
+    requireValue(object(row) && expectedIds.has(row.id) && !results.has(row.id), "Duplicate or unknown result criterion");
+    requireValue(object(row.layers) && Object.keys(row.layers).every((key) => layers.includes(key)), "Invalid result layers");
+    results.set(row.id, row);
+  }
+  for (const criterion of charter.criteria) {
+    for (const layer of layers) {
+      const spec = criterion.layers[layer];
+      const cell = results.get(criterion.id)?.layers[layer];
+      const row = { id: criterion.id, outcome: criterion.outcome, layer, method: spec.method ?? spec.reason,
+        status: "pending", observation: "", evidence: [], reason: "", next_action: "" };
+      report.checks.push(row);
+      if (spec.applicability === "not_applicable") {
+        row.status = "not_applicable";
+        row.reason = `${spec.reason} (${spec.source})`;
+        continue;
+      }
+      if (!object(cell)) {
+        row.reason = "Missing result";
+        row.next_action = "Run the specified check and record evidence";
+      } else {
+        row.observation = text(cell.observation) ? cell.observation : "";
+        row.next_action = text(cell.next_action) ? cell.next_action : "";
+        row.evidence = Array.isArray(cell.evidence) ? cell.evidence.map((entry) => object(entry) && text(entry.path) ? entry.path : "invalid reference") : [];
+        if (!["passed", "failed", "pending"].includes(cell.status)) {
+          row.reason = "Invalid status (results cannot waive a required layer)";
+        } else if (cell.context_sha256 !== expectedContextSha256 || cell.charter_sha256 !== expectedCharterSha256) {
+          row.reason = "Stale result; reverify for the current charter and context";
+        } else if (cell.status !== "passed") {
+          row.status = cell.status;
+          row.reason = text(cell.reason) ? cell.reason : "Missing unmet reason";
+          if (!row.next_action) row.reason += "; missing next action";
+        } else {
+          try {
+            requireValue(text(cell.action) && text(cell.observation), "Passed result needs action and observation");
+            requireValue(text(cell.observed_at) && /^\d{4}-\d{2}-\d{2}T.*(?:Z|[+-]\d{2}:\d{2})$/.test(cell.observed_at) &&
+              Number.isFinite(Date.parse(cell.observed_at)) && Date.parse(cell.observed_at) <= Date.now(), "Invalid or future observation timestamp");
+            requireValue(Array.isArray(cell.evidence) && cell.evidence.length > 0, "Passed result needs evidence");
+            for (const artifact of cell.evidence) await checkArtifact(root, artifact);
+            row.status = "passed";
+          } catch {
+            row.reason = "Invalid, missing, empty, unsafe, or changed evidence; check action, observation, timestamp and artifact hashes";
+          }
+        }
+      }
+      if (row.status !== "passed") report.errors.push(`${criterion.id}/${layer}: ${row.reason}`);
+    }
+  }
+  if (!report.errors.length) report.status = "evidence_complete";
+  report.markdown = renderChecklist(report);
+  return report;
+}
+
+async function main(args) {
+  requireValue(args.length === 4 || (args.length === 5 && args[4] === "--markdown"),
+    "Usage: node check-acceptance.mjs <charter.json> <matrix.json> <trusted-charter-sha256> <current-context-sha256> [--markdown]");
+  const [charterPath, matrixPath, expectedCharterSha256, expectedContextSha256] = args;
+  const load = async (target) => {
+    const stat = await lstat(target);
+    requireValue(stat.isFile() && stat.size <= 1024 * 1024, "Input must be a regular JSON file of at most 1 MiB");
+    return readFile(target);
+  };
+  const report = await checkAcceptance({ charterBytes: await load(charterPath),
+    matrix: JSON.parse((await load(matrixPath)).toString()), expectedCharterSha256,
+    expectedContextSha256, evidenceRoot: path.dirname(path.resolve(matrixPath)) });
+  process.stdout.write(args[4] === "--markdown" ? report.markdown : JSON.stringify(report, null, 2) + "\n");
+  process.exitCode = report.status === "evidence_complete" ? 0 : 1;
+}
+
+const entryPath = process.argv[1] ? await realpath(process.argv[1]).catch(() => null) : null;
+if (entryPath === fileURLToPath(import.meta.url)) {
+  main(process.argv.slice(2)).catch(() => {
+    // Do not echo arbitrary JSON, filesystem contents, or sensitive input values.
+    process.stderr.write("Acceptance input invalid. Check JSON schema, paths, frozen charter and current context digests. Usage: node check-acceptance.mjs <charter.json> <matrix.json> <trusted-charter-sha256> <current-context-sha256> [--markdown]\n");
+    process.exitCode = 2;
+  });
+}

package/src/console/app.js

@@ -137,6 +137,23 @@ export function AgenticLoopConsole({ agent, onQuit = () => {} }) {
       }
       return;
     }
+    if (command.type === "update") {
+      setBusy(true);
+      try {
+        const result = await agent.updates?.performAction?.();
+        setNotice(
+          result?.opened
+            ? "Opened the SIMY Apple Silicon installer download page."
+            : `Open the installer download manually: ${cliUpdate?.action?.url || agent.webOrigin}`,
+        );
+      } catch (error) {
+        setNotice(error instanceof Error ? error.message : String(error));
+      } finally {
+        setBusy(false);
+        if (!selectedRun) setInputMode(true);
+      }
+      return;
+    }
     if (command.type === "configure") {
       setDraft((current) => updateDraft(current, command));
       setNotice(configurationNotice(command));
@@ -897,10 +914,12 @@ function ActionBar({
                 wrap: "wrap",
                 children: `UPDATE  ${cliUpdate.message || "SIMY CLI update status changed."}`,
               }),
-              cliUpdate.action?.command
+              cliUpdate.action?.command || cliUpdate.action?.url
                 ? jsx(Text, {
                     wrap: "wrap",
-                    children: `Next  ${cliUpdate.action.command}`,
+                    children: cliUpdate.action?.url
+                      ? `Next  /update or open ${cliUpdate.action.url}`
+                      : `Next  ${cliUpdate.action.command}`,
                   })
                 : null,
             ],

package/src/console/commands.js

@@ -15,6 +15,7 @@ const HELP_LINES = [
   "/pause                Pause the active executor process",
   "/resume               Resume a paused executor process",
   "/stop                 Stop the selected run",
+  "/update               Open the available installer download",
 ];
 
 export function parseConsoleCommand(value) {
@@ -66,6 +67,8 @@ export function parseConsoleCommand(value) {
       return { type: "resume" };
     case "/stop":
       return { type: "stop" };
+    case "/update":
+      return { type: "update" };
     case "/help":
       return { type: "help" };
     default:

package/src/desktop-host.js

@@ -0,0 +1,220 @@
+import { spawn, execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { startAgent } from "./agent.js";
+import { createCliAutoUpdater, readCliPackageInfo } from "./auto-update.js";
+import { createAgentShutdown } from "./shutdown.js";
+import { resolveWebOrigin } from "./web-origin.js";
+import { openAuthorizationUrl } from "./browser.js";
+import { inspectBackendExecutable } from "./backend-executable.js";
+import { startWorkflowUpdates } from "./sqm/workflow-update.js";
+import {
+  acquireDesktopProcessLock,
+  assertNoLegacyCliDaemon,
+  PROCESS_CONFLICT_CODE,
+  PROCESS_CONFLICT_MESSAGE,
+  validateDesktopSupervisor,
+} from "./desktop-process-lock.js";
+
+const silentLogger = { log() {}, error() {} };
+
+export async function startDesktopHost({ input = process.stdin, output = process.stdout, env = process.env,
+  dependencies = {}, exit = (code) => { process.exitCode = code; } } = {}) {
+  const emit = (event) => output.write(`${JSON.stringify(event)}\n`);
+  const root = env.SIMY_HOME?.trim() || join(homedir(), ".simy");
+  const webOrigin = resolveWebOrigin(null, env);
+  const candidate = Boolean(env.SIMY_DESKTOP_SUPERVISOR_TOKEN);
+  if (candidate && !await validateDesktopSupervisor(root, env.SIMY_DESKTOP_SUPERVISOR_TOKEN)) {
+    throw new Error("Desktop update supervisor is no longer running.");
+  }
+  const lock = candidate ? null : await acquireDesktopProcessLock(root, { webOrigin });
+  const supervisorToken = lock?.nonce || env.SIMY_DESKTOP_SUPERVISOR_TOKEN;
+  let agent, updater, stopWorkflows = async () => {}, timer, closed = false, relay = null, publishing = null;
+  let shuttingDown = null;
+  let commands;
+  const packageInfo = dependencies.packageInfo || await readCliPackageInfo();
+  const publish = () => {
+    if (closed || relay || !agent) return Promise.resolve();
+    if (publishing) return publishing;
+    publishing = Promise.resolve(agent.getDesktopStatus()).then((status) => {
+      if (!closed && !relay) emit({ type: "status", status });
+    }).finally(() => { publishing = null; });
+    return publishing;
+  };
+  const stopAgent = async () => {
+    clearInterval(timer);
+    await stopWorkflows();
+    if (agent) await createAgentShutdown(agent)();
+  };
+  const close = () => shuttingDown ||= (async () => {
+    closed = true;
+    commands?.close();
+    input.pause?.();
+    if (relay) {
+      relay.stdin.end();
+      await new Promise((done) => {
+        const limit = setTimeout(() => { relay.kill("SIGTERM"); done(); }, 10_000);
+        relay.once("exit", () => { clearTimeout(limit); done(); });
+        if (relay.exitCode !== null) { clearTimeout(limit); done(); }
+      });
+    } else await stopAgent();
+    await lock?.release();
+  })();
+
+  try {
+    if (!candidate) {
+      await (dependencies.assertNoLegacyDaemon || assertNoLegacyCliDaemon)(webOrigin);
+    }
+    updater = await (dependencies.createUpdater || createCliAutoUpdater)({
+      daemon: true, interactive: true, webOrigin,
+      disabled: env.SIMY_AUTO_UPDATE === "0",
+      dependencies: { packageInfo, logger() {} },
+    });
+    agent = await (dependencies.startAgent || startAgent)({
+      daemon: true, webOrigin, sessionRoot: root, quiet: true, updateManager: updater,
+    });
+    stopWorkflows = (dependencies.startWorkflowUpdates || startWorkflowUpdates)({ enabled: env.SIMY_AUTO_UPDATE !== "0" });
+    updater.on?.("change", () => { void publish().catch(() => {}); });
+    updater.start({ registry: agent.registry, restartDaemon: async (targetVersion, installation) => {
+      if (!installation?.entryPath || !installation?.executablePath) throw new Error("Signed update runtime is unavailable.");
+      const child = (dependencies.spawn || spawn)(installation.executablePath,
+        [join(dirname(installation.entryPath), "desktop-host.js")], {
+          stdio: ["pipe", "pipe", "ignore"],
+          env: { ...env, SIMY_DESKTOP_SUPERVISOR_TOKEN: supervisorToken },
+        });
+      const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
+      let accepted = false;
+      child.stdin.on("error", () => {
+        if (relay === child && !closed) {
+          emit({ type: "error", message: "SIMY update connection ended. Reconnect to start the service again." });
+          void close().then(() => exit(1));
+        }
+      });
+      child.on("exit", () => {
+        if (relay === child && !closed) {
+          emit({ type: "error", message: "SIMY stopped. Reconnect to start it again." });
+          void close().then(() => exit(1));
+        }
+      });
+      try {
+        const first = await new Promise((accept, reject) => {
+          const limit = setTimeout(() => reject(new Error("Updated desktop runtime did not start in time.")), 30_000);
+          const finish = (fn, value) => { clearTimeout(limit); fn(value); };
+          child.once("error", () => finish(reject, new Error("Updated desktop runtime could not start.")));
+          child.once("exit", () => { if (!accepted) finish(reject, new Error("Updated desktop runtime exited before verification.")); });
+          lines.on("line", (line) => {
+            if (line.length > 131072) return;
+            let event; try { event = JSON.parse(line); } catch { return; }
+            if (accepted) { emit(event); return; }
+            if (event.type === "status") {
+              if (!validCandidateStatus(event.status, targetVersion, webOrigin)) {
+                finish(reject, new Error("Updated desktop runtime identity mismatch."));
+              } else { accepted = true; finish(accept, event); }
+            }
+          });
+        });
+        relay = child;
+        await stopAgent();
+        if (child.exitCode !== null || closed) throw new Error("Updated runtime stopped during handoff.");
+        emit(first);
+      } catch (error) {
+        lines.close(); child.kill("SIGTERM"); throw error;
+      }
+    } });
+    await publish();
+    timer = setInterval(() => { void publish().catch(() => emit({ type: "error", message: "SIMY status could not be refreshed." })); }, 3_000);
+  } catch (error) { await close(); throw error; }
+
+  let queue = Promise.resolve();
+  commands = createInterface({ input, crlfDelay: Infinity });
+  commands.on("line", (line) => {
+    if (closed) return;
+    if (line.length > 4096) return;
+    let command; try { command = JSON.parse(line); } catch { return; }
+    if (typeof command.id !== "string" || command.id.length > 128) return;
+    if (relay) {
+      if (!relay.stdin.destroyed && relay.exitCode === null) relay.stdin.write(`${JSON.stringify(command)}\n`);
+      return;
+    }
+    queue = queue.then(async () => {
+      try {
+        const action = command.action;
+        if (action === "refresh" || action === "reconnect") {
+          await agent.refreshCodexStatus?.();
+          await agent.refreshDesktopStatus();
+        }
+        else if (action === "login") {
+          const url = await agent.requestDesktopLogin();
+          if (url) {
+            if (new URL(url).origin !== webOrigin) throw new Error("Invalid login origin.");
+            const result = await (dependencies.openLogin || openAuthorizationUrl)(url, { logger: silentLogger });
+            if (!result.opened) throw new Error("Could not open the login page.");
+          }
+        } else if (action === "check_update") await updater.checkNow();
+        else if (action === "update") {
+          if (updater.snapshot().state === "waiting_for_idle") await updater.maybeApply();
+          else await updater.performAction();
+        } else if (action === "codex_login") await (dependencies.codexLogin || openCodexLogin)(root);
+        else if (action === "quit") {
+          const status = await agent.getDesktopStatus();
+          if (status.tasks.activeCount > 0 && command.force !== true) throw new Error("Tasks are still running. Confirm before quitting.");
+          emit({ type: "result", id: command.id, ok: true });
+          await close(); exit(0); return;
+        } else throw new Error("Unsupported desktop action.");
+        emit({ type: "result", id: command.id, ok: true });
+        await publish();
+      } catch {
+        emit({ type: "result", id: command.id, ok: false, message: "Action could not finish. Refresh the status and try again; active tasks must finish before quitting." });
+      }
+    }).catch(() => {});
+  });
+  commands.on("close", () => { if (!closed) void close().then(() => exit(0)); });
+  return { close, publish, agent };
+}
+
+function validCandidateStatus(status, version, webOrigin) {
+  return status?.schemaVersion === 1 && status.version === version && status.webOrigin === webOrigin
+    && ["signed_out", "signed_in", "expired"].includes(status.auth?.state)
+    && ["connecting", "online", "offline", "unauthorized", "unknown"].includes(status.connection?.state)
+    && Number.isSafeInteger(status.tasks?.activeCount) && status.tasks.activeCount >= 0
+    && Array.isArray(status.tasks.items) && typeof status.codex?.state === "string";
+}
+
+async function openCodexLogin(root) {
+  const codex = await inspectBackendExecutable("codex");
+  if (!codex.available || !codex.executable) throw new Error("Codex is not installed.");
+  const directory = await mkdtemp(join(root, "codex-login-"));
+  const script = join(directory, "Sign in to Codex.command");
+  const quote = (s) => `'${s.replaceAll("'", "'\\''")}'`;
+  await writeFile(script, `#!/bin/bash\nexport PATH="/opt/homebrew/bin:/usr/local/bin:$HOME/.local/bin:$PATH"\n${quote(codex.executable)} login\nresult=$?\nrm -f -- ${quote(script)}\nrmdir -- ${quote(directory)}\nexit "$result"\n`, { mode: 0o700 });
+  await chmod(script, 0o700);
+  try { await promisify(execFile)("/usr/bin/open", ["-a", "Terminal", script], { timeout: 10_000 }); }
+  catch (error) { await rm(directory, { recursive: true, force: true }); throw error; }
+}
+
+export function isDesktopHostEntry(entry = process.argv[1]) {
+  try { return Boolean(entry) && realpathSync(entry) === fileURLToPath(import.meta.url); }
+  catch { return false; }
+}
+
+if (isDesktopHostEntry()) {
+  let host;
+  const stop = () => { void host?.close().finally(() => process.exit(0)); };
+  process.once("SIGTERM", stop); process.once("SIGINT", stop);
+  startDesktopHost().then((value) => { host = value; }).catch((error) => {
+    const conflict = error?.code === PROCESS_CONFLICT_CODE;
+    process.stdout.write(`${JSON.stringify({
+      type: "error",
+      ...(conflict ? { code: PROCESS_CONFLICT_CODE } : {}),
+      message: conflict
+        ? PROCESS_CONFLICT_MESSAGE
+        : "SIMY could not start. Check whether another SIMY window is already running, then reconnect.",
+    })}\n`);
+    process.exitCode = 1;
+  });
+}