@awak-app/simy-cli 0.6.22 → 0.6.25

package/README.md

@@ -1,5 +1,7 @@
 # SIMY CLI
 
+ローカルDelivery Loopの0.6.24候補を版固定で実行するには、[ローカル候補版のインストール・実行](docs/local-delivery-runtime.md)を参照してください。
+
 Local execution agent for SIMY Local Tasks and Agentic Loop runs.
 
 Action candidate search runs once for each authenticated live conversation context,
@@ -236,6 +238,15 @@ SQM checks apply when you explicitly select `@simy`, invoke the SQM skill, or as
 After installation, restart Codex and find and install **SIMY** in **Plugins**
 before using `@simy` in a new task.
 
+If **Connect SIMY** fails while the CLI is already signed in, check the recovery
+message in connection settings. Finish or retry a pending SIMY update, or complete
+or cancel an organization selection. If SIMY remains paused, use **SIMY → Quit
+SIMY**, reopen it, and reconnect; closing the window alone does not restart the
+background host. Refresh connections and confirm the conversation list returns.
+Diagnostic `provider connection failed` entries distinguish `reason=update`,
+`organization_change`, and `shutdown` without including credentials or transcripts.
+Reconnection does not sign in to Codex CLI or restore revoked automatic continuation.
+
 The plugin also includes a non-blocking connection reminder. At task startup,
 resume, and prompt submission it reads the origin-scoped local discovery record
 and checks the loopback CLI health endpoint. It warns once per disconnected
@@ -593,6 +604,15 @@ preflight and returns the installed version, required version, and a recovery
 command to SIMY Web. Update Codex with
 `npm install -g @openai/codex@latest`; update Claude Code with `claude update`.
 
+Codex discovery compares installed CLI versions across PATH (including shadowed
+installs) and the known Codex/ChatGPT app bundles on macOS, selecting the newest
+compatible version. Equal versions retain discovery order. A compatible
+`SIMY_CODEX_BIN` override retains priority; a broken or unsupported override falls
+back to automatic discovery. Refresh the connection status after updating Codex;
+each new inspection checks installed versions again. SIMY does not download or
+replace Codex. The desktop connection status and Codex conversation reader both
+require `0.158.0` or later for the verified app-server writer-lock protocol.
+
 ## Your Desktop executor
 
 SIMY CLI is the `desktop` execution target, shown to users as **Your Desktop**.
@@ -909,6 +929,19 @@ To-Be and PR reviews, plus explicitly opted-in SQM before and after PR creation.
 The [workflow reference](src/orchestrator/delivery/references/shared-system-specifications.md)
 explains baseline updates, historical regression coverage and evidence limits.
 
+## Purpose-driven automatic continuation
+
+The desktop **Continue automatically / 自動で続ける** switch enables purpose-driven
+search: hypotheses, research, experiments, minimal implementation and independent
+outcome review. Failed methods trigger replanning; review findings return to repair.
+Independent authorized work can continue while a controller-tracked operation waits.
+The existing Codex auto-continue switch enables read-only diagnosis for uncertain or
+information-waiting conversations, then assessed work. No default time/turn cap is
+added; explicitly enrolled purpose budgets and user stops are preserved. Native
+provider approval waits still require the original provider boundary to settle.
+Workflow rules are reassessed throughout. Turning the switch off pauses work.
+Actual permissions, user stops and total budgets remain enforced. See the
+[contract and limitations](docs/purpose-driven-continuation.md).
 
 ### Desktop SQM history
 
@@ -991,3 +1024,41 @@ Scope mismatch diagnostics identify the changed account, organization, device
 or Web host and tell the caller to restore the original identity. Launch and
 recovery operations do not switch identity automatically. The private
 `/v1/connection` endpoint rejects browser requests and never returns tokens.
+
+自律判断の改定方針と人間判断候補の一覧: [AI判断を基本にする改定](docs/ai-decision-policy.md)。LLMの文脈理解・推論・調査を基本にし、HC-01〜HC-102を判断の批判視点として適用します。
+
+### Local autonomous recovery (0.6.25)
+
+`simy delivery runtime install` pins a hash-verified snapshot. `runtime desktop-install`
+prepares a separately signed **SIMY Local** app from the installed native app; the
+public application and installer selection remain unchanged. After the previous
+app has finished its normal quit, `runtime desktop-activate` launches that candidate.
+`runtime watchdog-install` installs a per-user macOS observer that may relaunch only
+that explicitly activated candidate when no live desktop owns the state directory.
+A live unknown/mismatched owner is preserved and reported. `runtime doctor` reports
+expected versus observed host identity, the all-state consistency monitor, and
+remaining task findings. `runtime legacy-hooks` routes only the exact shipped
+0.6.23/0.6.24 Codex hook entrypoints to the verified pin, retaining originals;
+customized hooks and trust settings remain unchanged. `runtime workflows` refreshes
+existing provider workflows without enabling them.
+
+For existing opted-in Codex tasks, the controller verifies original session, cwd,
+model, provider link and consent epoch before an idempotent policy migration.
+Frozen goal, criteria, grants, budgets and failure history are retained. Observable
+legacy manual criteria receive a separate independent verification route; explicit
+human/customer acceptance remains manual. Known system no-progress pauses queue
+read-only diagnosis before any replay. OFF, archive, explicit pause/stop, rejection,
+unknown effects and original budgets remain boundaries.
+
+The consistency monitor scans every managed state separately from the execution
+queue. Its independent AI reads original user instructions/corrections and primary
+evidence in a distinct read-only Codex context. Durable findings/outbox receipts,
+retry backoff, separate lease, measured token usage and failed/stale heartbeats are
+recorded; an audit receipt does not complete a task. SQM evidence stays bound to its
+repository/commit/diff scope and does not prove the whole user outcome. Git output
+no longer uses a 10 MiB `execFile` buffer; the full diff is still retained in memory.
+
+Codex cold recovery and independent audit are supported. Claude retains its
+original live-hook boundary; cold recovery and detached independent audit are not
+implemented in this release and are exposed as a capability gap. Neither an
+unverified original model nor a different provider is substituted automatically.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.6.22",
+  "version": "0.6.25",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
   ],
   "scripts": {
     "start": "node ./src/index.js",
-    "test": "node --test",
+    "test": "node --test --test-concurrency=2",
     "test:e2e:console": "node ./scripts/console-e2e.js",
     "test:e2e:work-activity": "node ./scripts/work-activity-e2e.js",
     "test:e2e:sqm-complete-loop": "node ./scripts/sqm-complete-loop-e2e.js",
@@ -38,7 +38,7 @@
     "test:e2e:console:real-provider": "node ./scripts/real-provider-console-e2e.js",
     "test:e2e:console:fullstack": "node ./scripts/fullstack-cli-smoke.js",
     "check": "npm run check:auto-update && node --check ./src/desktop-executor.js && node --check ./src/local-task.js && node --check ./scripts/desktop-executor-e2e.js && node --check ./scripts/pre-guardrail-e2e.js && node --check ./scripts/fixtures/fake-desktop-provider.js && npm run check:syntax && npm run check:session-supervision-syntax && npm run check:real-provider-syntax && npm test && npm run check:package",
-    "check:session-supervision-syntax": "node --check ./src/session-supervision/index.js && node --check ./src/session-supervision/discovery-window.js && node --check ./src/session-supervision/codex-app-server.js && node --check ./src/session-supervision/claude-sessions.js && node --check ./src/session-supervision/original-session-target.js && node --check ./src/session-supervision/action-association.js && node --check ./src/session-supervision/action-association-host.js && node --check ./src/session-supervision/action-association-api.js && node --check ./src/session-supervision/association-store.js && node --check ./src/session-supervision/action-deadline.js && node --check ./src/session-supervision/action-deadline-store.js && node --check ./src/codex-plugins/simy/hooks/action-association.mjs",
+    "check:session-supervision-syntax": "node --check ./src/session-supervision/index.js && node --check ./src/session-supervision/discovery-window.js && node --check ./src/session-supervision/codex-app-server.js && node --check ./src/session-supervision/claude-sessions.js && node --check ./src/session-supervision/original-session-target.js && node --check ./src/session-supervision/action-association.js && node --check ./src/session-supervision/action-association-host.js && node --check ./src/session-supervision/action-association-api.js && node --check ./src/session-supervision/association-store.js && node --check ./src/session-supervision/action-deadline.js && node --check ./src/session-supervision/action-deadline-store.js && node --check ./src/codex-plugins/simy/hooks/action-association.mjs && node --check ./src/session-supervision/purpose-instruction.js && node --check ./src/session-supervision/purpose-recovery.js && node --check ./src/session-supervision/purpose-candidate.js && node --check ./src/codex-plugins/simy/hooks/purpose-cycle.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-rule-review.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-search.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-evidence.mjs && node --check ./src/session-supervision/purpose-observer.js && node --check ./src/session-supervision/purpose-verification.js && node --check ./src/codex-plugins/simy/hooks/purpose-workspace.mjs && node --check ./scripts/purpose-search-live-e2e.js",
     "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js && npm run check:sqm",
     "check:workflow-observation-sender": "node --check ./src/workflow-observation-sender.js",
     "check:sqm": "node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/reliability.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./src/sqm/agent-skill.js && node --check ./src/sqm/workflow-onboarding.js && node --check ./src/sqm/workflow-update.js && node --check ./src/sqm/history-store.js && node --check ./src/sqm/review-worker.js && node --check ./scripts/sqm-complete-loop-e2e.js && node --check ./scripts/sqm-local-review-e2e.js",

package/src/backend-executable.js

@@ -32,11 +32,30 @@ export async function inspectBackendExecutable(
   assertActive();
   const policy = versionPolicy(backend);
   const requiredVersion = minimumVersion || policy.minimumVersion;
+  const explicitCodex = backend === "codex"
+    ? (discoveryOptions.environment ?? process.env).SIMY_CODEX_BIN : null;
   candidates ??= [...backendCandidates(backend, discoveryOptions), ...await bundledClaudeCandidates(backend, discoveryOptions)];
+  candidates = [...new Set(candidates.filter(Boolean))];
   let fallback = null;
-  for (const candidate of [...new Set(candidates.filter(Boolean))]) {
+  // An intentional override retains priority. Broken or unsupported overrides
+  // still fall back to automatic discovery, as before.
+  if (explicitCodex && candidates.includes(explicitCodex)) {
+    const pinned = await inspectBackendExecutable(backend, {
+      candidates: [explicitCodex], spawnImpl, timeoutMs, signal, minimumVersion,
+      discoveryOptions: { ...discoveryOptions, environment: {} },
+    });
+    if (pinned.compatible) return pinned;
+    if (pinned.available) fallback = pinned;
+    candidates = candidates.filter(candidate => candidate !== explicitCodex);
+  }
+  // Comparing all Codex installs must not turn several slow wrappers into a
+  // serial startup delay. Keep concurrency bounded and results in source order.
+  const probes = backend === "codex"
+    ? await probeCandidates(candidates, { spawnImpl, timeoutMs, signal }, assertActive) : null;
+  let selected = null;
+  for (const [index, candidate] of candidates.entries()) {
     assertActive();
-    const probe = await probeExecutable(candidate, { spawnImpl, timeoutMs, signal });
+    const probe = probes ? probes[index] : await probeExecutable(candidate, { spawnImpl, timeoutMs, signal });
     assertActive();
     if (!probe.available) continue;
     const installedVersion = parseBackendVersion(probe.output);
@@ -52,12 +71,15 @@ export async function inspectBackendExecutable(
       update_command: policy.updateCommand,
     };
     // An executable that starts may still be too old for the requested feature.
-    // Preserve candidate priority among compatible installs, and retain the
-    // first runnable failure for actionable diagnostics if none qualifies.
-    if (compatible) return inspection;
+    // Claude retains its existing priority. Codex chooses the newest version;
+    // equal versions retain discovery order regardless of probe completion order.
+    if (compatible) {
+      if (backend !== "codex") return inspection;
+      if (!selected || compareCodexVersions(installedVersion, selected.installed_version) > 0) selected = inspection;
+    }
     fallback ??= inspection;
   }
-  return fallback || {
+  return selected || fallback || {
     backend,
     executable: null,
     available: false,
@@ -88,6 +110,8 @@ export function backendCandidates(backend, {
   return [
     environment.SIMY_CODEX_BIN,
     "codex",
+    ...codexPathCandidates(platform, environment),
+    ...(platform === "darwin" ? ["/opt/homebrew/bin/codex", "/usr/local/bin/codex"] : []),
     ...(platform === "darwin" ? ["/Applications", path.posix.join(home, "Applications")].flatMap(directory =>
       ["ChatGPT.app", "Codex.app"].flatMap(app => {
         const resources = path.posix.join(directory, app, "Contents", "Resources");
@@ -98,6 +122,48 @@ export function backendCandidates(backend, {
   ];
 }
 
+function codexPathCandidates(platform, environment) {
+  const paths = platform === "win32" ? path.win32 : path.posix;
+  const names = platform === "win32" ? ["codex.exe", "codex.cmd", "codex.bat", "codex"] : ["codex"];
+  return (environment.PATH ?? environment.Path ?? "").split(paths.delimiter)
+    .map(directory => directory.replace(/^"(.*)"$/, "$1"))
+    .filter(directory => paths.isAbsolute(directory))
+    .flatMap(directory => names.map(name => paths.join(directory, name)))
+    .filter(candidate => { try { return statSync(candidate).isFile(); } catch { return false; } });
+}
+
+async function probeCandidates(candidates, options, assertActive) {
+  let next = 0;
+  const probes = new Array(candidates.length);
+  await Promise.all(Array.from({ length: Math.min(4, candidates.length) }, async () => {
+    while (next < candidates.length) {
+      // Drain every owned probe before reporting cancellation to callers.
+      if (options.signal?.aborted) break;
+      const index = next++;
+      probes[index] = await probeExecutable(candidates[index], options);
+    }
+  }));
+  assertActive();
+  return probes;
+}
+
+function compareCodexVersions(left, right) {
+  const core = compareVersions(left, right);
+  if (core) return core;
+  const prerelease = version => version.includes("-") ? version.slice(version.indexOf("-") + 1).split(".") : null;
+  const a = prerelease(left), b = prerelease(right);
+  if (!a || !b) return Number(!a) - Number(!b);
+  for (let index = 0; index < Math.max(a.length, b.length); index++) {
+    if (a[index] === b[index]) continue;
+    if (a[index] === undefined || b[index] === undefined) return a[index] === undefined ? -1 : 1;
+    const numericA = /^\d+$/.test(a[index]), numericB = /^\d+$/.test(b[index]);
+    if (numericA && numericB) return Number(a[index]) - Number(b[index]);
+    if (numericA !== numericB) return numericA ? -1 : 1;
+    return a[index] < b[index] ? -1 : 1;
+  }
+  return 0;
+}
+
 // Claude Desktop can install below <version>/<content hash>/claude.app while
 // an older PATH wrapper still points at <version>/claude.app. Discover only the
 // known app layout; never recursively execute arbitrary files from user folders.
@@ -167,7 +233,9 @@ function probeExecutable(command, { spawnImpl, timeoutMs, signal }) {
     let settled = false, terminating = false;
     let timeout, force, limit;
     let output = Buffer.alloc(0);
-    const child = spawnImpl(command, ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
+    let child;
+    try { child = spawnImpl(command, ["--version"], { stdio: ["ignore", "pipe", "pipe"] }); }
+    catch { resolve({ available: false, output: "" }); return; }
     const capture = chunk => {
       // Version probes need a tiny prefix. Drain noisy executables without
       // retaining unbounded stdout/stderr in the desktop background process.

package/src/cli-contract.js

@@ -13,9 +13,16 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.6.22";
+export const CLI_VERSION = "0.6.25";
 export const CLI_API_CONTRACT_VERSION = 10;
 
+export function narrativeImageCapabilityMetadata() {
+  return {
+    schema_version: "fp_narrative_image.v1",
+    receipt_schema_version: "fp_native_image_receipt.v1",
+  };
+}
+
 export function withCliContract(
   capabilities = {},
   installMode = null,
@@ -25,6 +32,7 @@ export function withCliContract(
     ...capabilities,
     cli_version: CLI_VERSION,
     api_contract_version: CLI_API_CONTRACT_VERSION,
+    fp_narrative_image: narrativeImageCapabilityMetadata(),
     local_task_file_capabilities: localTaskFileCapabilityMetadata(),
     local_task_scenario_packs: localTaskScenarioPackMetadata(),
     bounded_local_task_subtasks:

package/src/codex-plugins/simy/hooks/acceptance-policy.mjs

@@ -0,0 +1,5 @@
+// Frozen manual acceptance is an explicit enrollment boundary. Its description
+// or an old auto-continue switch cannot authorize a different verifier.
+export function effectiveAcceptanceCriteria(managed) {
+  return managed?.acceptanceCriteria || [];
+}