@awak-app/simy-cli 0.5.7 → 0.5.8

package/README.md

@@ -11,9 +11,12 @@ simy --daemon
 
 When an interactive `simy --daemon` starts without managed SIMY workflows,
 the CLI asks once before installing the Codex plugin
-marketplace, Codex/Claude SQM skills, and PR hooks. Existing unrelated plugins
+marketplace and Codex/Claude opt-in SQM skills. Existing unrelated plugins
 and hooks are preserved. Use `--install-workflows` for explicit non-interactive
 installation or `--no-workflow-prompt` to start the daemon without asking.
+
+SQM checks apply when you explicitly select `@simy`, invoke the SQM skill, or ask to use SQM for the current task. Ordinary PR creation and `git push` do not opt in. Upgrading and restarting the daemon migrates the legacy global PR gate and shipped personal skills; unrelated hooks are preserved. Start a new coding session to reload skill instructions.
+
 After installation, restart Codex and find and install **SIMY** in **Plugins**
 before using `@simy` in a new task.
 
@@ -391,3 +394,12 @@ original snapshot. A scope revision change requires a fresh minimum check.
 Deploy this CLI and the web capability proxy before enabling the backend scope
 requirement. Older clients receive an explicit upgrade error, never an expanded
 organization-wide bundle.
+
+### Submit repaired local delivery evidence to SQM
+
+`simy sqm submit-evidence --file delivery.json --host https://app-dev.simy.one`
+submits an explicit bounded summary through your existing organization-bound device
+session. `--dry-run` previews the exact document without uploading it. See the
+[local evidence contract](src/codex-plugins/simy/skills/agentic-delivery-loop/references/local-sqm-evidence.md).
+The receipt identifies the source digest and analysis job; it is not a declaration
+that an incident or blocking rule has been published.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -498,7 +498,7 @@ export async function startAgent({
           const body = await readJson(req);
           if (body.confirmed !== true) {
             json(res, 400, {
-              error: "Explicit confirmation is required before installing the SIMY plugin, agent skills, and PR hooks.",
+              error: "Explicit confirmation is required before installing the SIMY plugin and opt-in agent skills.",
             });
             return;
           }

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.5.7";
+export const CLI_VERSION = "0.5.8";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/codex-plugins/simy/skills/agentic-delivery-loop/SKILL.md

@@ -128,6 +128,22 @@ history or claim `done`. Save the exact revision, environment, input, Run ID,
 timestamps, visible state, network evidence, and logs, then add a boundary
 regression before re-entering implementation.
 
+### Feed repaired delivery failures back into SQM
+
+When an observed failure was repaired, prepare one bounded `delivery.json` record
+per failure using [the local evidence contract](references/local-sqm-evidence.md).
+Record actual impact, distinct failing/fixed commit SHAs, and verification results.
+Keep the same evidence_id when retrying the same submission. Include known PR URLs
+so SQM can retrieve related evidence; a link alone does not establish identity.
+
+When the user's delivery scope authorizes sharing these summaries with their SQM
+organization, submit using `simy sqm submit-evidence --file delivery.json --host
+<the authorized origin>`. Otherwise retain the draft locally. Never attach whole
+transcripts, credentials, unrelated files, or automatically read paths named in
+logs. Record the returned source digest and job ID in the delivery receipt.
+Submission is not analysis completion or a published safeguard. Resource locking
+and validation ordering still require Delivery Loop execution controls.
+
 ### 8. Clean up and issue the receipt
 
 Remove scoped fixtures and prove the residual count is zero. Deliver a compact

package/src/codex-plugins/simy/skills/agentic-delivery-loop/references/local-sqm-evidence.md

@@ -0,0 +1,34 @@
+# Local delivery evidence
+
+This is a new SQM source, alongside GitHub and Slack. It is not an incident declaration
+and cannot set review status, severity, organization, or rule lifecycle.
+
+```json
+{
+  "schema_version": "1.0.0",
+  "evidence_id": "checkout-provider-failure-1",
+  "run_id": "delivery-run-42",
+  "repository": "owner/repository",
+  "title": "Checkout provider was missing",
+  "occurred_at": "2026-09-07T00:00:00Z",
+  "base_sha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "head_sha": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "failure": "What actually failed, with a bounded error excerpt.",
+  "impact": "What was prevented or affected; distinguish local from production.",
+  "fix": "What changed to repair the same failure.",
+  "verification": "What ran at head_sha and its observed result.",
+  "pr_urls": [],
+  "changed_paths": ["src/checkout.ts"],
+  "diff": "A relevant, sanitized diff excerpt (optional, at most 12000 characters)."
+}
+```
+
+Replace sample SHAs and statements with observed evidence. Summaries are limited to
+64 KiB total. `--dry-run` prints exactly the submitted document without making a
+request. `--host` selects an existing authenticated SIMY session; use the explicit
+dev origin when testing dev. SQM analysis must already be enabled for the organization.
+
+An identical record from the same user returns the same job. Changed evidence
+creates a new digest/job and retains the earlier revision. Keep the returned job ID
+for monitoring in SQM. Candidate checks still need independent review/evaluation;
+local success never proves deployment or production impact.

package/src/index.js

@@ -103,7 +103,7 @@ Options:
   --no-open           Do not open the browser when authorization is required
   --port <port>       Bind a specific localhost port
   --host <url>        Connect to a SIMY Web origin (default: ${DEFAULT_WEB_ORIGIN})
-  --install-workflows Install or update SIMY Codex/Claude skills and PR hooks
+  --install-workflows Install or update SIMY Codex/Claude opt-in SQM skills
   --no-workflow-prompt Skip the daemon startup workflow-installation prompt
   --no-auto-update    Disable update checks and automatic installation
 

package/src/sqm/agent-skill.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 export const SQM_AGENT_SKILL_ID = "simy-sqm-pr-check";
-export const SQM_AGENT_SKILL_VERSION = "2.0.0";
+export const SQM_AGENT_SKILL_VERSION = "3.0.0";
 export const SIMY_CODEX_PLUGIN_ID = "simy";
 export const SIMY_CODEX_PLUGIN_VERSION = "0.1.0";
 
@@ -15,41 +15,34 @@ const BUNDLED_CODEX_PLUGIN_ROOT = fileURLToPath(
 const MANAGED_PLUGIN_AUTHOR = "Specialist Doctors Inc.";
 const MANAGED_MARKETPLACE_SOURCE = `./plugins/${SIMY_CODEX_PLUGIN_ID}`;
 
+const LEGACY_SKILL_DIGEST = "c9ab46e855280196dbc93fd36ba849418e0c4e500dd6e4b7b03b2296e838df92";
+
 const SKILL_CONTENT = `---
 name: ${SQM_AGENT_SKILL_ID}
-description: Run SIMY Software Quality Monitor checks before creating or proposing a pull request. Use whenever preparing, opening, or updating a PR.
+description: Run SIMY Software Quality Monitor checks for PR work when the user explicitly invokes @simy, this skill, or asks to use SQM. Ordinary PR creation or git push alone does not activate this skill.
 ---
 
 # SIMY SQM PR check
 
-Before creating or proposing a pull request:
+Apply this workflow only when the user has explicitly selected \`@simy\`, invoked this skill, or requested SQM for the current task. A quoted mention, repository organization, installed plugin, or ordinary request to create a PR is not opt-in. Honor a later request to stop using SQM.
+
+Without opt-in, continue the requested work without running SQM or making it a prerequisite. You may briefly offer SQM if useful; do not delay the work waiting for an optional answer. Follow any independent repository checks required by the project.
+
+When opted in, before creating or proposing a pull request:
 
 1. Run \`simy sqm min-check\` from the repository root.
 2. Run \`simy sqm check --proof proof.json --signed-evidence proof.json.signed.json\`.
 3. Read \`proof.json\` and require \`outcome.status\` to be \`passed\`.
-4. If either command fails, SQM is unavailable, or the proof is not passed, stop. Report the exact blocker and do not create the PR.
+4. If either command fails, SQM is unavailable, or the proof is not passed, report the exact blocker. Do not claim SQM passed or silently bypass the requested check.
 5. Include the proof path and SQM outcome in the PR body when the check passes.
 
 Do not replace SQM with an LLM review, and do not claim the check passed without reading the generated proof.
 `;
 
-const HOOK_SCRIPT = `#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-
-let raw = "";
-for await (const chunk of process.stdin) raw += chunk;
-let payload = {};
-try { payload = raw ? JSON.parse(raw) : {}; } catch { process.exit(0); }
-const command = String(payload?.tool_input?.command || payload?.tool_input?.cmd || "");
-if (!/(^|[;&|]\\s*)gh\\s+pr\\s+create(?:\\s|$)/.test(command)) process.exit(0);
-
-for (const args of [["sqm", "min-check"], ["sqm", "check"]]) {
-  const result = spawnSync("simy", args, { cwd: process.cwd(), stdio: "inherit" });
-  if (result.error || result.status !== 0) {
-    console.error(result.error ? \`SIMY SQM PR gate failed: \${result.error.message}\` : \`SIMY SQM PR gate blocked the PR (exit \${result.status}).\`);
-    process.exit(2);
-  }
-}
+// Cached hook registrations in running sessions must also stop blocking PRs.
+const RETIRED_HOOK_SCRIPT = `#!/usr/bin/env node
+// Global SQM gate retired; the skill applies only after explicit task opt-in.
+process.exit(0);
 `;
 
 const TARGETS = {
@@ -65,8 +58,6 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
   const digest = sqmAgentSkillDigest();
   const codexPlugin = await inspectCodexPlugin({ home });
   const hookPath = managedHookPath(home);
-  const installedHookDigest = await fileDigest(hookPath);
-  const hookMatches = installedHookDigest === digestText(HOOK_SCRIPT);
   const platforms = {};
   for (const [platform, segments] of Object.entries(TARGETS)) {
     const target = path.join(home, ...segments);
@@ -77,14 +68,12 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
     platforms[platform] = {
       path: target,
       hook_path: platformHookConfigPath(platform, home),
-      installed: skillMatches && hookMatches && hookConfigured && platformExtraMatches,
+      installed: skillMatches && !hookConfigured && platformExtraMatches,
       state:
         installedDigest === null ||
-        !hookConfigured ||
-        installedHookDigest === null ||
         (platform === "codex" && codexPlugin.state === "missing")
           ? "missing"
-          : skillMatches && hookMatches && platformExtraMatches
+          : skillMatches && !hookConfigured && platformExtraMatches
             ? "installed"
             : "outdated",
       ...(platform === "codex" ? { plugin: codexPlugin } : {}),
@@ -94,7 +83,7 @@ export async function inspectSqmAgentSkill({ home = homedir() } = {}) {
     skill_id: SQM_AGENT_SKILL_ID,
     version: SQM_AGENT_SKILL_VERSION,
     digest: `sha256:${digest}`,
-    enforcement: "pre_tool_use",
+    enforcement: "explicit_opt_in",
     codex_plugin: codexPlugin,
     installed: Object.values(platforms).every((entry) => entry.installed),
     platforms,
@@ -106,12 +95,10 @@ export async function installSqmAgentSkill({ home = homedir(), platforms = Objec
   if (!requested.length || requested.some((platform) => !Object.hasOwn(TARGETS, platform))) {
     throw new Error("platforms must contain codex and/or claude");
   }
-  const hookPath = managedHookPath(home);
   if (requested.includes("codex")) await installCodexPlugin({ home });
-  await atomicText(hookPath, HOOK_SCRIPT, 0o700);
+  await retireLegacySqmGate({ home });
   for (const platform of requested) {
     await atomicText(path.join(home, ...TARGETS[platform]), SKILL_CONTENT, 0o600);
-    await installManagedHook(platform, home, hookPath);
   }
   return inspectSqmAgentSkill({ home });
 }
@@ -252,60 +239,59 @@ function platformHookConfigPath(platform, home) {
     : path.join(home, ".claude", "settings.json");
 }
 
-function managedHookGroup(hookPath) {
-  return {
-    matcher: "Bash",
-    hooks: [
-      {
-        type: "command",
-        command: `node ${JSON.stringify(hookPath)}`,
-        statusMessage: "Running SIMY SQM PR gate",
-      },
-    ],
-  };
+// Only migrate the exact shipped legacy skill. Custom user instructions are retained.
+export async function retireLegacySqmGate({ home = homedir() } = {}) {
+  const hookPath = managedHookPath(home);
+  let changed = false;
+  for (const [platform, segments] of Object.entries(TARGETS)) {
+    const target = path.join(home, ...segments);
+    if (await fileDigest(target) === LEGACY_SKILL_DIGEST) {
+      await atomicText(target, SKILL_CONTENT, 0o600);
+      changed = true;
+    }
+    changed = await removeManagedHook(platform, home, hookPath) || changed;
+  }
+  const hookDigest = await fileDigest(hookPath);
+  if (hookDigest !== null && hookDigest !== digestText(RETIRED_HOOK_SCRIPT)) {
+    await atomicText(hookPath, RETIRED_HOOK_SCRIPT, 0o700);
+    changed = true;
+  }
+  return changed;
 }
 
-async function installManagedHook(platform, home, hookPath) {
+async function removeManagedHook(platform, home, hookPath) {
   const target = platformHookConfigPath(platform, home);
-  let config = {};
-  try {
-    config = JSON.parse(await readFile(target, "utf8"));
-  } catch (error) {
-    if (error?.code !== "ENOENT") {
-      throw new Error(`${target} must contain valid JSON before SIMY can merge the SQM hook.`);
+  const config = await readJsonFile(target, { missing: null, invalid: "throw" });
+  if (!config?.hooks) return false;
+  let changed = false;
+  for (const [event, groups] of Object.entries(config.hooks)) {
+    if (!Array.isArray(groups)) continue;
+    const kept = [];
+    for (const group of groups) {
+      if (!Array.isArray(group?.hooks)) { kept.push(group); continue; }
+      const remaining = group.hooks.filter((hook) => !isManagedHook(hook, hookPath));
+      if (remaining.length === group.hooks.length) kept.push(group);
+      else {
+        changed = true;
+        if (remaining.length) kept.push({ ...group, hooks: remaining });
+      }
     }
+    if (kept.length) config.hooks[event] = kept;
+    else if (groups.length) delete config.hooks[event];
   }
-  const hooks = config && typeof config === "object" && !Array.isArray(config)
-    ? { ...(config.hooks || {}) }
-    : {};
-  const existing = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
-  hooks.PreToolUse = [
-    ...existing.filter((group) => !groupContainsManagedHook(group)),
-    managedHookGroup(hookPath),
-  ];
-  await atomicText(target, `${JSON.stringify({ ...config, hooks }, null, 2)}\n`, 0o600);
+  if (changed) await atomicText(target, `${JSON.stringify(config, null, 2)}\n`, 0o600);
+  return changed;
 }
 
 async function hasManagedHook(platform, home, hookPath) {
-  try {
-    const config = JSON.parse(await readFile(platformHookConfigPath(platform, home), "utf8"));
-    return Array.isArray(config?.hooks?.PreToolUse) &&
-      config.hooks.PreToolUse.some((group) => groupContainsManagedHook(group, hookPath));
-  } catch (error) {
-    if (error?.code === "ENOENT" || error instanceof SyntaxError) return false;
-    throw error;
-  }
+  const config = await readJsonFile(platformHookConfigPath(platform, home), { missing: null, invalid: "throw" });
+  return Object.values(config?.hooks || {}).some((groups) => Array.isArray(groups) &&
+    groups.some((group) => Array.isArray(group?.hooks) && group.hooks.some((hook) => isManagedHook(hook, hookPath))));
 }
 
-function groupContainsManagedHook(group, expectedPath = null) {
-  if (!Array.isArray(group?.hooks)) return false;
-  return group.hooks.some((hook) => {
-    const command = typeof hook?.command === "string" ? hook.command : "";
-    return expectedPath
-      ? command === `node ${JSON.stringify(expectedPath)}`
-      : command.includes("/.simy/integrations/sqm-agent/pre-pr-hook.mjs") ||
-          command.includes("\\.simy\\integrations\\sqm-agent\\pre-pr-hook.mjs");
-  });
+function isManagedHook(hook, expectedPath) {
+  const command = typeof hook?.command === "string" ? hook.command : "";
+  return command === `node ${JSON.stringify(expectedPath)}`;
 }
 
 async function fileDigest(target) {

package/src/sqm/command.js

@@ -4,6 +4,7 @@ import path from "node:path";
 
 import { isSessionValid, readSession } from "../session-store.js";
 import { resolveWebOrigin } from "../web-origin.js";
+import { submitLocalEvidence } from "./local-evidence.js";
 import { uploadRunEvidence } from "./evidence-client.js";
 import { evaluateKnowledgeBundle } from "./checkers.js";
 import { runSqmCheck, runSqmMinCheck } from "./index.js";
@@ -15,6 +16,7 @@ export async function runSqmCommand(argv, { cliVersion }) {
     printHelp();
     return 0;
   }
+  if (argv[0] === "submit-evidence") return await submitLocalEvidence(argv);
   if (argv[0] === "lint") return await runLintCommand(argv);
   if (argv[0] === "replay") return await runReplayCommand(argv);
   if (!["min-check", "check"].includes(argv[0])) throw new Error("Usage: simy sqm <min-check|check|lint|replay> [options]");
@@ -95,6 +97,7 @@ function printHelp() {
   console.log(`Usage:
   simy sqm min-check [options]
   simy sqm check [options]
+  simy sqm submit-evidence --file <delivery.json> [--host <origin>] [--dry-run]
   simy sqm lint --bundle <path>
   simy sqm replay --bundle <path> --dataset <path>
 

package/src/sqm/local-evidence.js

@@ -0,0 +1,28 @@
+import { readFile } from "node:fs/promises";
+import { isSessionValid, readSession } from "../session-store.js";
+import { resolveWebOrigin } from "../web-origin.js";
+import { webApiUrl } from "../web-api.js";
+
+/** Submission is explicit; no transcript scanning or implicit file attachment. */
+export async function submitLocalEvidence(argv, { fetchImpl = globalThis.fetch, readSessionImpl = readSession } = {}) {
+  const option = (name) => { const i = argv.indexOf(name); return i < 0 ? undefined : argv[i + 1]; };
+  const file = option("--file");
+  if (!file || file.startsWith("--")) throw new Error("Usage: simy sqm submit-evidence --file <delivery.json> [--host <origin>] [--dry-run]");
+  const raw = await readFile(file);
+  if (raw.length > 64 * 1024) throw new Error("Local delivery evidence exceeds 64 KiB; submit a bounded summary.");
+  const evidence = JSON.parse(raw.toString("utf8"));
+  if (!evidence || Array.isArray(evidence) || evidence.schema_version !== "1.0.0") throw new Error("Expected local delivery evidence schema_version 1.0.0");
+  if (argv.includes("--dry-run")) { console.log(JSON.stringify({ submitted: false, evidence }, null, 2)); return 0; }
+  const origin = resolveWebOrigin(option("--host"));
+  const session = await readSessionImpl(origin);
+  if (!isSessionValid(session, Date.now(), origin)) throw new Error(`Sign in first: simy --host ${origin}`);
+  const response = await fetchImpl(webApiUrl("sqm/local-evidence", { webOrigin: origin, apiBaseUrl: session.api_base_url }), {
+    method: "POST", headers: { authorization: `Bearer ${session.token}`, "content-type": "application/json" },
+    body: JSON.stringify(evidence), signal: AbortSignal.timeout(30_000),
+  });
+  const result = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(`SQM submission failed (${response.status}): ${result?.error?.message || result?.error || "Unavailable"}`);
+  if (!result?.source_id || !Array.isArray(result.jobs) || !result.jobs.length) throw new Error("SQM returned no analysis job receipt");
+  console.log(JSON.stringify(result, null, 2));
+  return 0;
+}

package/src/sqm/workflow-onboarding.js

@@ -73,7 +73,7 @@ export async function confirmWorkflowInstallation({
 } = {}) {
   output.write(
     [
-      "SIMY can install or update its Codex plugin marketplace, Codex/Claude SQM skills, and PR hooks.",
+      "SIMY can install or update its Codex plugin marketplace, Codex/Claude opt-in SQM skills.",
       "Existing unrelated plugins and hooks will be preserved.",
       "",
     ].join("\n"),

package/src/sqm/workflow-update.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { promisify } from "node:util";
 
 import { resolveBackendExecutable } from "../backend-executable.js";
-import { inspectSqmAgentSkill, installSqmAgentSkill } from "./agent-skill.js";
+import { inspectSqmAgentSkill, installSqmAgentSkill, retireLegacySqmGate } from "./agent-skill.js";
 
 const execFileAsync = promisify(execFile);
 const CHECK_INTERVAL_MS = 60 * 60 * 1000;
@@ -47,11 +47,12 @@ export async function syncInstalledWorkflows({ home = homedir(),
     throw error;
   }
   try {
+    const migrated = await retireLegacySqmGate({ home });
     let status = await inspect({ home });
     const platforms = Object.entries(status.platforms)
       .filter(([, entry]) => entry.state === "outdated").map(([platform]) => platform);
     if (platforms.length) status = await install({ home, platforms });
-    if (!status.platforms.codex.installed) return { outcome: platforms.length ? "updated" : "unchanged" };
+    if (!status.platforms.codex.installed) return { outcome: platforms.length || migrated ? "updated" : "unchanged" };
 
     const marketplace = JSON.parse(await readFile(status.codex_plugin.marketplace_path, "utf8"));
     if (typeof marketplace.name !== "string" || !/^[A-Za-z0-9_-]+$/.test(marketplace.name)) {