@awak-app/simy-cli 0.5.7 → 0.5.10

package/src/sqm/agent-skill.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 export const SQM_AGENT_SKILL_ID = "simy-sqm-pr-check";
-export const SQM_AGENT_SKILL_VERSION = "2.0.0";
+export const SQM_AGENT_SKILL_VERSION = "3.0.0";
 export const SIMY_CODEX_PLUGIN_ID = "simy";
 export const SIMY_CODEX_PLUGIN_VERSION = "0.1.0";
 
@@ -15,41 +15,34 @@ const BUNDLED_CODEX_PLUGIN_ROOT = fileURLToPath(
 const MANAGED_PLUGIN_AUTHOR = "Specialist Doctors Inc.";
 const MANAGED_MARKETPLACE_SOURCE = `./plugins/${SIMY_CODEX_PLUGIN_ID}`;
 
+const LEGACY_SKILL_DIGEST = "c9ab46e855280196dbc93fd36ba849418e0c4e500dd6e4b7b03b2296e838df92";
+
 const SKILL_CONTENT = `---
 name: ${SQM_AGENT_SKILL_ID}
-description: Run SIMY Software Quality Monitor checks before creating or proposing a pull request. Use whenever preparing, opening, or updating a PR.
+description: Run SIMY Software Quality Monitor checks for PR work when the user explicitly invokes @simy, this skill, or asks to use SQM. Ordinary PR creation or git push alone does not activate this skill.
 ---
 
 # SIMY SQM PR check
 
-Before creating or proposing a pull request:
+Apply this workflow only when the user has explicitly selected \`@simy\`, invoked this skill, or requested SQM for the current task. A quoted mention, repository organization, installed plugin, or ordinary request to create a PR is not opt-in. Honor a later request to stop using SQM.
+
+Without opt-in, continue the requested work without running SQM or making it a prerequisite. You may briefly offer SQM if useful; do not delay the work waiting for an optional answer. Follow any independent repository checks required by the project.
+
+When opted in, before creating or proposing a pull request:
 
 1. Run \`simy sqm min-check\` from the repository root.
 2. Run \`simy sqm check --proof proof.json --signed-evidence proof.json.signed.json\`.
 3. Read \`proof.json\` and require \`outcome.status\` to be \`passed\`.
-4. If either command fails, SQM is unavailable, or the proof is not passed, stop. Report the exact blocker and do not create the PR.
+4. If either command fails, SQM is unavailable, or the proof is not passed, report the exact blocker. Do not claim SQM passed or silently bypass the requested check.
 5. Include the proof path and SQM outcome in the PR body when the check passes.
 
 Do not replace SQM with an LLM review, and do not claim the check passed without reading the generated proof.
 `;
 
-const HOOK_SCRIPT = `#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-
-let raw = "";
-for await (const chunk of process.stdin) raw += chunk;
-let payload = {};
-try { payload = raw ? JSON.parse(raw) : {}; } catch { process.exit(0); }
-const command = String(payload?.tool_input?.command || payload?.tool_input?.cmd || "");
-if (!/(^|[;&|]\\s*)gh\\s+pr\\s+create(?:\\s|$)/.test(command)) process.exit(0);
-
-for (const args of [["sqm", "min-check"], ["sqm", "check"]]) {
-  const result = spawnSync("simy", args, { cwd: process.cwd(), stdio: "inherit" });
-  if (result.error || result.status !== 0) {
-    console.error(result.error ? \`SIMY SQM PR gate failed: \${result.error.message}\` : \`SIMY SQM PR gate blocked the PR (exit \${result.status}).\`);
-    process.exit(2);
-  }
-}
+// Cached hook registrations in running sessions must also stop blocking PRs.
+const RETIRED_HOOK_SCRIPT = `#!/usr/bin/env node
+// Global SQM gate retired; the skill applies only after explicit task opt-in.
+process.exit(0);
 `;
 
 const TARGETS = {
@@ -65,8 +58,6 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
   const digest = sqmAgentSkillDigest();
   const codexPlugin = await inspectCodexPlugin({ home });
   const hookPath = managedHookPath(home);
-  const installedHookDigest = await fileDigest(hookPath);
-  const hookMatches = installedHookDigest === digestText(HOOK_SCRIPT);
   const platforms = {};
   for (const [platform, segments] of Object.entries(TARGETS)) {
     const target = path.join(home, ...segments);
@@ -77,14 +68,12 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
     platforms[platform] = {
       path: target,
       hook_path: platformHookConfigPath(platform, home),
-      installed: skillMatches && hookMatches && hookConfigured && platformExtraMatches,
+      installed: skillMatches && !hookConfigured && platformExtraMatches,
       state:
         installedDigest === null ||
-        !hookConfigured ||
-        installedHookDigest === null ||
         (platform === "codex" && codexPlugin.state === "missing")
           ? "missing"
-          : skillMatches && hookMatches && platformExtraMatches
+          : skillMatches && !hookConfigured && platformExtraMatches
             ? "installed"
             : "outdated",
       ...(platform === "codex" ? { plugin: codexPlugin } : {}),
@@ -94,7 +83,7 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
     skill_id: SQM_AGENT_SKILL_ID,
     version: SQM_AGENT_SKILL_VERSION,
     digest: `sha256:${digest}`,
-    enforcement: "pre_tool_use",
+    enforcement: "explicit_opt_in",
     codex_plugin: codexPlugin,
     installed: Object.values(platforms).every((entry) => entry.installed),
     platforms,
@@ -106,12 +95,10 @@ export async function installSqmAgentSkill({ home = homedir(), platforms = Objec
   if (!requested.length || requested.some((platform) => !Object.hasOwn(TARGETS, platform))) {
     throw new Error("platforms must contain codex and/or claude");
   }
-  const hookPath = managedHookPath(home);
   if (requested.includes("codex")) await installCodexPlugin({ home });
-  await atomicText(hookPath, HOOK_SCRIPT, 0o700);
+  await retireLegacySqmGate({ home });
   for (const platform of requested) {
     await atomicText(path.join(home, ...TARGETS[platform]), SKILL_CONTENT, 0o600);
-    await installManagedHook(platform, home, hookPath);
   }
   return inspectSqmAgentSkill({ home });
 }
@@ -252,60 +239,59 @@ function platformHookConfigPath(platform, home) {
     : path.join(home, ".claude", "settings.json");
 }
 
-function managedHookGroup(hookPath) {
-  return {
-    matcher: "Bash",
-    hooks: [
-      {
-        type: "command",
-        command: `node ${JSON.stringify(hookPath)}`,
-        statusMessage: "Running SIMY SQM PR gate",
-      },
-    ],
-  };
+// Only migrate the exact shipped legacy skill. Custom user instructions are retained.
+export async function retireLegacySqmGate({ home = homedir() } = {}) {
+  const hookPath = managedHookPath(home);
+  let changed = false;
+  for (const [platform, segments] of Object.entries(TARGETS)) {
+    const target = path.join(home, ...segments);
+    if (await fileDigest(target) === LEGACY_SKILL_DIGEST) {
+      await atomicText(target, SKILL_CONTENT, 0o600);
+      changed = true;
+    }
+    changed = await removeManagedHook(platform, home, hookPath) || changed;
+  }
+  const hookDigest = await fileDigest(hookPath);
+  if (hookDigest !== null && hookDigest !== digestText(RETIRED_HOOK_SCRIPT)) {
+    await atomicText(hookPath, RETIRED_HOOK_SCRIPT, 0o700);
+    changed = true;
+  }
+  return changed;
 }
 
-async function installManagedHook(platform, home, hookPath) {
+async function removeManagedHook(platform, home, hookPath) {
   const target = platformHookConfigPath(platform, home);
-  let config = {};
-  try {
-    config = JSON.parse(await readFile(target, "utf8"));
-  } catch (error) {
-    if (error?.code !== "ENOENT") {
-      throw new Error(`${target} must contain valid JSON before SIMY can merge the SQM hook.`);
+  const config = await readJsonFile(target, { missing: null, invalid: "throw" });
+  if (!config?.hooks) return false;
+  let changed = false;
+  for (const [event, groups] of Object.entries(config.hooks)) {
+    if (!Array.isArray(groups)) continue;
+    const kept = [];
+    for (const group of groups) {
+      if (!Array.isArray(group?.hooks)) { kept.push(group); continue; }
+      const remaining = group.hooks.filter((hook) => !isManagedHook(hook, hookPath));
+      if (remaining.length === group.hooks.length) kept.push(group);
+      else {
+        changed = true;
+        if (remaining.length) kept.push({ ...group, hooks: remaining });
+      }
     }
+    if (kept.length) config.hooks[event] = kept;
+    else if (groups.length) delete config.hooks[event];
   }
-  const hooks = config && typeof config === "object" && !Array.isArray(config)
-    ? { ...(config.hooks || {}) }
-    : {};
-  const existing = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
-  hooks.PreToolUse = [
-    ...existing.filter((group) => !groupContainsManagedHook(group)),
-    managedHookGroup(hookPath),
-  ];
-  await atomicText(target, `${JSON.stringify({ ...config, hooks }, null, 2)}\n`, 0o600);
+  if (changed) await atomicText(target, `${JSON.stringify(config, null, 2)}\n`, 0o600);
+  return changed;
 }
 
 async function hasManagedHook(platform, home, hookPath) {
-  try {
-    const config = JSON.parse(await readFile(platformHookConfigPath(platform, home), "utf8"));
-    return Array.isArray(config?.hooks?.PreToolUse) &&
-      config.hooks.PreToolUse.some((group) => groupContainsManagedHook(group, hookPath));
-  } catch (error) {
-    if (error?.code === "ENOENT" || error instanceof SyntaxError) return false;
-    throw error;
-  }
+  const config = await readJsonFile(platformHookConfigPath(platform, home), { missing: null, invalid: "throw" });
+  return Object.values(config?.hooks || {}).some((groups) => Array.isArray(groups) &&
+    groups.some((group) => Array.isArray(group?.hooks) && group.hooks.some((hook) => isManagedHook(hook, hookPath))));
 }
 
-function groupContainsManagedHook(group, expectedPath = null) {
-  if (!Array.isArray(group?.hooks)) return false;
-  return group.hooks.some((hook) => {
-    const command = typeof hook?.command === "string" ? hook.command : "";
-    return expectedPath
-      ? command === `node ${JSON.stringify(expectedPath)}`
-      : command.includes("/.simy/integrations/sqm-agent/pre-pr-hook.mjs") ||
-          command.includes("\\.simy\\integrations\\sqm-agent\\pre-pr-hook.mjs");
-  });
+function isManagedHook(hook, expectedPath) {
+  const command = typeof hook?.command === "string" ? hook.command : "";
+  return command === `node ${JSON.stringify(expectedPath)}`;
 }
 
 async function fileDigest(target) {

package/src/sqm/command.js

@@ -4,6 +4,7 @@ import path from "node:path";
 
 import { isSessionValid, readSession } from "../session-store.js";
 import { resolveWebOrigin } from "../web-origin.js";
+import { submitLocalEvidence } from "./local-evidence.js";
 import { uploadRunEvidence } from "./evidence-client.js";
 import { evaluateKnowledgeBundle } from "./checkers.js";
 import { runSqmCheck, runSqmMinCheck } from "./index.js";
@@ -15,6 +16,7 @@ export async function runSqmCommand(argv, { cliVersion }) {
     printHelp();
     return 0;
   }
+  if (argv[0] === "submit-evidence") return await submitLocalEvidence(argv);
   if (argv[0] === "lint") return await runLintCommand(argv);
   if (argv[0] === "replay") return await runReplayCommand(argv);
   if (!["min-check", "check"].includes(argv[0])) throw new Error("Usage: simy sqm <min-check|check|lint|replay> [options]");
@@ -95,6 +97,7 @@ function printHelp() {
   console.log(`Usage:
   simy sqm min-check [options]
   simy sqm check [options]
+  simy sqm submit-evidence --file <delivery.json> [--host <origin>] [--dry-run]
   simy sqm lint --bundle <path>
   simy sqm replay --bundle <path> --dataset <path>
 

package/src/sqm/local-evidence.js

@@ -0,0 +1,28 @@
+import { readFile } from "node:fs/promises";
+import { isSessionValid, readSession } from "../session-store.js";
+import { resolveWebOrigin } from "../web-origin.js";
+import { webApiUrl } from "../web-api.js";
+
+/** Submission is explicit; no transcript scanning or implicit file attachment. */
+export async function submitLocalEvidence(argv, { fetchImpl = globalThis.fetch, readSessionImpl = readSession } = {}) {
+  const option = (name) => { const i = argv.indexOf(name); return i < 0 ? undefined : argv[i + 1]; };
+  const file = option("--file");
+  if (!file || file.startsWith("--")) throw new Error("Usage: simy sqm submit-evidence --file <delivery.json> [--host <origin>] [--dry-run]");
+  const raw = await readFile(file);
+  if (raw.length > 64 * 1024) throw new Error("Local delivery evidence exceeds 64 KiB; submit a bounded summary.");
+  const evidence = JSON.parse(raw.toString("utf8"));
+  if (!evidence || Array.isArray(evidence) || evidence.schema_version !== "1.0.0") throw new Error("Expected local delivery evidence schema_version 1.0.0");
+  if (argv.includes("--dry-run")) { console.log(JSON.stringify({ submitted: false, evidence }, null, 2)); return 0; }
+  const origin = resolveWebOrigin(option("--host"));
+  const session = await readSessionImpl(origin);
+  if (!isSessionValid(session, Date.now(), origin)) throw new Error(`Sign in first: simy --host ${origin}`);
+  const response = await fetchImpl(webApiUrl("sqm/local-evidence", { webOrigin: origin, apiBaseUrl: session.api_base_url }), {
+    method: "POST", headers: { authorization: `Bearer ${session.token}`, "content-type": "application/json" },
+    body: JSON.stringify(evidence), signal: AbortSignal.timeout(30_000),
+  });
+  const result = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(`SQM submission failed (${response.status}): ${result?.error?.message || result?.error || "Unavailable"}`);
+  if (!result?.source_id || !Array.isArray(result.jobs) || !result.jobs.length) throw new Error("SQM returned no analysis job receipt");
+  console.log(JSON.stringify(result, null, 2));
+  return 0;
+}

package/src/sqm/workflow-onboarding.js

@@ -73,7 +73,7 @@ export async function confirmWorkflowInstallation({
 } = {}) {
   output.write(
     [
-      "SIMY can install or update its Codex plugin marketplace, Codex/Claude SQM skills, and PR hooks.",
+      "SIMY can install or update its Codex plugin marketplace, Codex/Claude opt-in SQM skills.",
       "Existing unrelated plugins and hooks will be preserved.",
       "",
     ].join("\n"),

package/src/sqm/workflow-update.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { promisify } from "node:util";
 
 import { resolveBackendExecutable } from "../backend-executable.js";
-import { inspectSqmAgentSkill, installSqmAgentSkill } from "./agent-skill.js";
+import { inspectSqmAgentSkill, installSqmAgentSkill, retireLegacySqmGate } from "./agent-skill.js";
 
 const execFileAsync = promisify(execFile);
 const CHECK_INTERVAL_MS = 60 * 60 * 1000;
@@ -47,11 +47,12 @@ export async function syncInstalledWorkflows({ home = homedir(),
     throw error;
   }
   try {
+    const migrated = await retireLegacySqmGate({ home });
     let status = await inspect({ home });
     const platforms = Object.entries(status.platforms)
       .filter(([, entry]) => entry.state === "outdated").map(([platform]) => platform);
     if (platforms.length) status = await install({ home, platforms });
-    if (!status.platforms.codex.installed) return { outcome: platforms.length ? "updated" : "unchanged" };
+    if (!status.platforms.codex.installed) return { outcome: platforms.length || migrated ? "updated" : "unchanged" };
 
     const marketplace = JSON.parse(await readFile(status.codex_plugin.marketplace_path, "utf8"));
     if (typeof marketplace.name !== "string" || !/^[A-Za-z0-9_-]+$/.test(marketplace.name)) {