@awak-app/simy-cli 0.7.15 → 0.7.17

package/README.md

@@ -1,9 +1,39 @@
 # SIMY CLI
 
+### Experimental delegated approval and input bridge
+
+`simy delivery interactions proxy --policy-file /absolute/private/policy.json`
+
+For a new SIMY-owned task, use `simy delivery interactions run --spec-file /absolute/spec.json`.
+The spec requires a fresh persistent `stateDirectory`; consumed grants are retained.
+Scoped `answerFacts` support rephrased questions through the shared scene-reasoning module.
+Configured browser recovery invokes the shared four-step runtime, checks authorized
+connection alternatives, captures the exact target, and resumes the original thread.
+Unknown connection state remains unconfirmed; see the design for CDP configuration
+and the unverified desktop/browser integration boundaries.
+
+The proxy provides an app-server stdio bridge for a host that explicitly delegates matching
+command approvals and questions to SIMY. It replies on the original JSON-RPC
+connection, preserves user responses and cancellation, and distinguishes request
+resolution from operation completion. The policy requires exact thread scope,
+expiry, command/file bindings and use limits, or approved question/answer choices.
+It does not attach to an already-running Codex desktop approval dialog.
+See [the integration design](docs/stop-prevention/delegated-interaction-design.md)
+for configuration, tests and remaining host integration requirements.
+
 ローカルDelivery Loopの0.6.24候補を版固定で実行するには、[ローカル候補版のインストール・実行](docs/local-delivery-runtime.md)を参照してください。
 
 Local execution agent for SIMY Local Tasks and Agentic Loop runs.
 
+To supervise an explicitly requested current goal after a finished Codex run, use
+`simy delivery followup --provider codex --session SESSION_ID --previous-run-id RUN_ID --objective "Current goal and expected result"`.
+It queues read-only reconciliation for the existing persistent supervisor. A new
+goal archives the old run's evidence; the same ordinary `reported_done` goal keeps
+its run identity and budgets while adopting managed outcome verification. Explicit
+stops, opt-out, pending approvals and unknown effects remain in force. This command
+does not install or activate a supervisor, and ordinary prompts never replace a
+finished run automatically. See [runtime operation](docs/local-delivery-runtime.md).
+
 Action candidate search runs once for each authenticated live conversation context,
 and again when that context changes or **Refresh** is selected. Background binding
 renewal uses the lightweight binding endpoint instead of repeating candidate search.
@@ -104,9 +134,21 @@ For interrupted Agentic work, `GET /v1/agentic-loop/:id/recovery` provides a
 read-only objective and checkout fingerprint. Reconcile an uncertain side effect
 with `POST` to that endpoint (`action: reconcile`, authoritative
 `operation_status`, `observation`, `evidence_refs`) before resuming. A paused
-run retains the legacy metadata endpoint
-`POST /v1/agentic-loop/:id/continuation-ceilings` for compatibility. These fields
-no longer impose local limits and changing them never resets usage or resumes work. Both routes require the original authorized
+Agentic run retains `POST /v1/agentic-loop/:id/continuation-ceilings` for an
+explicit safety-ceiling extension under the progress policy. Token and retry
+budgets are notification thresholds: they do not interrupt or stop useful work.
+Agentic Loop checks a separate safety ceiling before each new provider call:
+15,000,000 weighted Provider tokens and 50 executor attempts by default, using
+existing `provider_token_ceiling` and `attempt_ceiling` settings when present.
+The final attempt may still be reviewed if token allowance remains. Active
+processes finish and their results are retained even if usage crosses the ceiling.
+A safety stop preserves run identity, output, usage and approval gates. Review
+remaining work, explicitly extend the relevant ceiling within the existing
+15M-token/100-attempt validation bounds, then request continuation of the same
+run. A notification-threshold increase alone cannot clear a safety stop; at the
+maximum ceiling, further automatic calls remain blocked. Extension itself never
+resets usage or resumes work. Local Task and managed Delivery behavior is not
+changed by this Agentic safety gate. Both routes require the original authorized
 account, organization and device throughout the request.
 
 ## Provider reconnection and saved consent
@@ -139,6 +181,10 @@ login status, tasks, and updates separately. A Codex login check does not prove
 that a task can execute successfully; permissions and service availability are
 checked when work starts.
 
+When SIMY cannot verify a provider connection or plugin status, the connection
+panel shows **Checking connection status** and **Check again**. Check again
+refreshes the status without changing the saved connection setting.
+
 The sidebar's **Organization** selector is global across Sessions, Tasks and SQM
 and shows active memberships of the connected SIMY account. Switching is available
 while work is running and opens browser authorization for the selected organization.
@@ -227,11 +273,13 @@ npm install -g @awak-app/simy-cli
 simy --daemon
 ```
 
-When an interactive `simy --daemon` starts without managed SIMY workflows,
-the CLI asks once before installing the Codex and Claude Code plugin
-sources and Codex/Claude opt-in SQM skills. Existing unrelated plugins
-and hooks are preserved. Use `--install-workflows` for explicit non-interactive
-installation or `--no-workflow-prompt` to start the daemon without asking.
+When `simy --daemon` starts without managed SIMY workflows, the CLI automatically
+prepares the Codex and Claude Code plugin sources, including in non-interactive
+services. Background maintenance also prepares missing sources and refreshes
+existing enabled plugins. Unrelated plugins and hooks are preserved.
+`--install-workflows` remains available for explicit repair;
+`--no-workflow-prompt` skips initial preparation and background installation of
+missing sources. Provider plugin enablement and hook trust remain provider-owned.
 
 SQM checks apply when you explicitly select `@simy`, invoke the SQM skill, or ask to use SQM for the current task. Ordinary PR creation and `git push` do not opt in. Upgrading and restarting the daemon migrates the legacy global PR gate and shipped personal skills; unrelated hooks are preserved. Start a new coding session to reload skill instructions.
 
@@ -348,27 +396,23 @@ stops, failures and repeated attempts without new verified outcomes, with task
 identity, agent, reasons and outcome timestamps. Missing evidence is shown as
 unknown; open time is never counted as productive time. See [work activity](docs/work-activity.md).
 
-Codex work proceeds directly in the current conversation by default. The local
-`delivery-loop` and `agentic-delivery-loop` Codex skills are retired and are not
-redistributed by workflow updates. If the user explicitly requests SIMY Delivery
-Loop, use the CLI Agentic Loop rather than the retired local skill. Installation,
-hook trust and ordinary PR creation never authorize starting a loop or SQM.
-Internal lifecycle and workspace-lease libraries remain available for existing
-explicitly opted-in managed tasks; this packaging change does not start, trust,
-resume or reset any task. Quality and PR review skills remain available.
-Already open Codex sessions may cache the old skill until a new session starts.
-
-Claude Code retains its opt-in, hook-based Delivery Loop from an independent
-workflow source. Install the plugin, review and enable SIMY hooks with `/hooks`,
-then request `/simy:delivery-loop` for the task. Installing or updating the plugin
-never approves hook trust. See [hook delivery behavior and limits](docs/delivery-hooks.md).
+The CLI prepares and maintains provider plugin sources automatically. Once the
+user enables the SIMY plugin and permits its hooks, a nonempty prompt starts
+checkpoint tracking in an eligible Codex or Claude conversation. The local Codex
+`delivery-loop` and `agentic-delivery-loop` skills remain retired; prompt hook
+context supplies checkpoint instructions without reinstalling those skills.
+Existing tasks, stops, permission waits and provider/session opt-outs are preserved.
+Use `simy delivery auto off --provider codex` (or `claude`) for a project override.
+Completion in this standard flow is provider-reported, not independently verified.
+See [hook delivery behavior and limits](docs/delivery-hooks.md).
 The Connection tab checks each provider's actual SIMY plugin inventory and
 shows installed/enabled, installed/disabled, missing, or unavailable separately
 from app sign-in. Claude enablement is checked from the home folder; project
 settings can differ, and project-scoped installations are labeled explicitly.
 
 `--no-auto-update` or `SIMY_AUTO_UPDATE=0` disables these background updates too;
-`--no-workflow-prompt` only suppresses the initial installation prompt.
+`--no-workflow-prompt` skips initial preparation and background installation of
+missing sources; existing sources still receive updates.
 
 This is the recommended installation because the CLI can safely install patch
 and minor releases, and the daemon restarts only when no Agentic Loop task is active. To run
@@ -884,62 +928,27 @@ organization-wide bundle.
 
 ### Minimum functional completion
 
-Every CLI coding-loop promotion now requires a current two-layer observation
-matrix: the requested operation and result, plus independently checked final
-postcondition and integration. See the [minimum completion contract](src/orchestrator/delivery/references/minimum-completion.md)
-for the executable format. Missing mappings, mismatching observations, changed
-artifacts or stale revisions block promotion even when the executor reports
-success. Independent review checks original-request coverage and the test oracle.
-
-Existing v2 run history is retained; resumed/rechecked runs need the new evidence.
-The same checker ships under `src/orchestrator/delivery/scripts/` in the CLI
-package, independent of Codex plugin installation. It does not establish deployment
-completion or intercept another host application's final response.
-
-### PR closure and user-outcome transfer
-
-The Web/CLI executor and independent auditor receive the same
-[PR closure procedure](src/orchestrator/delivery/references/pr-closure.md).
-It requires a revision-bound before/after table, reachable normal-user paths
-(including no-workflow fallback), independent review, explicit authority,
-pre-close freshness checks and post-close remote reconciliation. A file match or
-successor link is not proof of UX inheritance; administrative transfer, approved
-retirement and complete inheritance have distinct decisions. Unresolved yellow/red comparison rows require
-remediation PRs (or exact existing open equivalents), mapped by criterion ID,
-owner and acceptance checks. Uncreated plans or unresolved authority/product
-decisions block transfer completion; creating a PR does not make a row green.
-Closure is not a new delivery completion state. This is runtime instruction and review guidance,
-not a GitHub hook that mechanically intercepts every external close command.
+The coding loop checks the requested result and relevant tests, then repairs actual
+failures. It does not require observation matrices, screenshots, preparation forms,
+selection receipts or a second reviewer. Explicitly requested independent review
+remains supported. See [completion](src/orchestrator/delivery/references/minimum-completion.md).
+Legacy file validators remain available for callers that explicitly use their formats;
+they no longer gate ordinary execution or completion.
+
+### PR closure and continuation
+
+Use [PR closure guidance](src/orchestrator/delivery/references/pr-closure.md) to
+preserve authority, current remote identity and useful unfinished work. No comparison
+table or separate review is required. Closing a PR does not prove deployment.
+
+Continue useful authorized work through actual checks and repair. Missing documents
+or reference catalog changes do not invalidate a working outcome. User stops,
+permissions, budgets and unknown-effect reconciliation remain enforced. See the
+[state model](src/orchestrator/delivery/references/state-model.md).
 
 ### Submit repaired local delivery evidence to SQM
 
-The [integrated delivery state model](src/orchestrator/delivery/references/state-model.md)
-connects delivery milestones, repair/wait/resume branches and actual controller
-states. Both executor and auditor receive its path. It documents existing control
-and evidence duties; it adds no scheduler or transition-enforcement mechanism.
-
-The bundled Delivery Loop maintains an external acceptance checklist with separate
-user-journey and technical-invariant results. It refreshes the table after each
-evaluated action and marks evidence pending when the code or runtime context
-changes. A non-green table is a checkpoint, not completion: the executor must
-perform feasible authorized repairs, missing verification and bounded waits,
-then re-observe and update the same criteria until the requested endpoint passes.
-A genuine safety, authority, dependency or no-progress stop remains explicitly
-unfinished with affected IDs and a concrete resumption condition. No background
-monitor is implied. Both executor and independent auditor receive
-this continuation contract. The [acceptance evidence guide](src/orchestrator/delivery/references/acceptance-evidence.md)
-documents the offline validator shipped inside the CLI runtime. Its result establishes
-record completeness and artifact integrity, not overall delivery or deployment.
-At the start of each new run, the loop recommends and confirms one of five
-[delivery levels](src/orchestrator/delivery/references/delivery-levels.md)
-in chat. Level 5 is highest assurance; level 1 is lightest. Every selection or
-recommendation shows all five levels (5 to 1), their content and verification scope,
-task-specific hour estimates, and the recommended level with its rationale.
-Estimates distinguish execution from external waits and state assumptions and
-uncertainty; there are no fixed durations by level. Risk-based floors preserve
-mandatory assurance. Historical selections retain their numbering version and
-meaning. These are executor/auditor instructions, not a new deterministic CLI
-selection validator; selecting a level grants no additional authority.
+Submission is optional and is not a condition for finishing a task.
 
 `simy sqm submit-evidence --file delivery.json --host https://app-dev.simy.one`
 submits an explicit bounded summary through your existing organization-bound device
@@ -950,29 +959,16 @@ that an incident or blocking rule has been published.
 
 ## Delivery Loop shared specification
 
-UX descriptions throughout the Web/CLI lifecycle follow the
-[behavioral-completeness standard](src/orchestrator/delivery/references/ux-specification.md).
-Observable interaction units explicitly cover intent/context, entry, perception,
-control, response, usable outcome, continuation, alternatives/recovery and evidence.
-Independent reconstruction, source coverage, causal continuity, branch closure,
-observability and traceability determine sufficient detail, not word counts or
-product-specific scenarios. Unknowns remain explicit; compact summaries link to
-the complete canonical specification. The same standard is supplied to the actual
-executor and independent auditor; it is not an additional automatic schema gate.
-
-The [Delivery Loop system specification](docs/systems/delivery-loop/README.md)
-explains its purpose, As-Is and proposed To-Be through twelve linked views. Keep
-these as shared team documents; each change updates affected views and checks
-cross-view consistency. The workflow requires independent design, implementation-to-
-To-Be and PR reviews, plus explicitly opted-in SQM before and after PR creation.
-The [workflow reference](src/orchestrator/delivery/references/shared-system-specifications.md)
-explains baseline updates, historical regression coverage and evidence limits.
+Use existing specifications when useful and update materially affected descriptions.
+No twelve-view specification, reconstruction review, traceability matrix or new
+review package is required. Check actual ease, clarity and accuracy using the
+[UX guidance](src/orchestrator/delivery/references/ux-specification.md).
 
 ## Purpose-driven automatic continuation
 
 The desktop **Continue automatically / 自動で続ける** switch enables purpose-driven
-search: hypotheses, research, experiments, minimal implementation and independent
-outcome review. Failed methods trigger replanning; review findings return to repair.
+search: research, experiments, minimal implementation and direct outcome checks.
+A separate review is used for semantic inspection or when explicitly requested. Failed methods trigger replanning; review findings return to repair.
 Independent authorized work can continue while a controller-tracked operation waits.
 The existing Codex auto-continue switch enables read-only diagnosis for uncertain or
 information-waiting conversations, then assessed work. No default time/turn cap is
@@ -1088,8 +1084,9 @@ that explicitly activated candidate when no live desktop owns the state director
 A live unknown/mismatched owner is preserved and reported. `runtime doctor` reports
 expected versus observed host identity, the all-state consistency monitor, and
 remaining task findings. `runtime legacy-hooks` routes only the exact shipped
-0.6.23/0.6.24 Codex hook entrypoints to the verified pin, retaining originals;
-customized hooks and trust settings remain unchanged. `runtime workflows` refreshes
+0.6.23/0.6.24 and commit 2052e787 Codex hook entrypoints to the verified pin.
+All exported helpers use that pin too; saved originals are never imported as
+a fallback. Customized hooks are reported as `customized_retained`. `runtime workflows` refreshes
 existing provider workflows without enabling them.
 
 `runtime doctor` also returns `taskReadiness` for every existing task: its original
@@ -1168,7 +1165,11 @@ unverified original model nor a different provider is substituted automatically.
 
 ### Manually consult SIMY about a stopped task
 
-Ask “SIMY CLIに相談して” in Codex to use the `simy:diagnose` skill. Supply the original session/task ID when asking from another chat. A terminal can use the same entry even when the original conversation is unresponsive:
+Ask “SIMY CLIに相談して” or “原因を調べて” in Codex to use the `simy:diagnose` skill for diagnosis only. “直して続きを進めて” explicitly requests repair and continuation within existing permissions. The skill resolves the current conversation or an existing selected/original job reference; from another chat, select the original job or refer to its conversation. Only an ambiguous target requires clarification, and users normally do not need to type internal IDs.
+
+The skill calls `delivery consult --scope diagnose` or `delivery consult --scope repair_continue --request-id USER_TURN_ID`. It preserves the chosen `--host`. Explicit references override existing selection, which overrides the observed current conversation; a missing or mismatched reference never redirects to another job. Repair delegates to the installed repair adapter, preserving stop, permission, budget and duplicate-work protections. If that adapter is absent, `recovery_unavailable` means no recovery was executed. Repair success is not original-task completion. See [the shared contract](docs/conversation-recovery-contract.md).
+
+For terminal use and older CLIs, the read-only diagnosis command remains available even when the original conversation is unresponsive:
 
 ```sh
 ~/.simy/bin/simy delivery diagnose --provider codex --session ORIGINAL_SESSION --task-id ORIGINAL_TASK
@@ -1186,6 +1187,103 @@ Default issue selection is the first eight original acceptance criteria (or `obj
 
 Manual diagnosis and delivery reasoning share the scoped SQM knowledge loader. Partial environment overrides cannot mix a token, account, organization or endpoint with saved credentials; unavailable knowledge is reported without blocking the diagnosis. The brief response retains `knowledge.status`, `reason`, `suppliedCount`, and `bundleDigest`, separately from `knowledgeReferenceCount` and test execution (always zero for diagnosis). Truncated evidence is disclosed to both the analyst and the caller.
 
+### Local Task delivery to an authorized device folder
+
+A single-invocation, repository-write durable Local Task can include
+`execution_spec.local_destination`:
+
+```json
+{
+  "device_id": "paired-device-id",
+  "repository": "Organization/repository",
+  "relative_directory": "deliverables"
+}
+```
+
+The repository must match the execution workspace and resolve through the CLI's
+existing authorized repository inventory. Alternatively, an explicitly delegated
+native Codex task may specify `authorized_root` instead of `repository`. That
+absolute directory must be within the existing native session's verified cwd or
+`sandbox.writableRoots`; the native adapter reports these roots after verifying
+current account, model, workspace and existing permissions. No new grant is made.
+The directory must already exist. Read-only tasks and stepped execution do not
+support delivery. A folder outside existing native roots must be selected through
+the original provider's workspace permission flow; a repository scan alone does
+not authorize arbitrary folder writes.
+
+The worker verifies current output bytes, publishes each file without replacing
+existing files, and checks size, SHA-256 and path identity through local readback.
+An identical existing file is a safe replay; a different revision is preserved and
+delivery fails. Only verified local receipts are persisted in the private task
+snapshot; the original turn's result summary includes confirmed paths. A folder
+save is not a claim that an office application rendered or opened the file.
+
+Offline claims are left to the existing durable lease/reconnect path; no local
+success or alternate device fallback is synthesized. Stop/lease checks also apply
+before file publication. Multiple file delivery may be partial if a later file
+fails; the turn does not report success in that case. Existing local outputs are
+kept for reconciliation without rerunning an uncertain provider operation.
+
+Cloud inputs continue through the existing verified attachment store and outputs
+through the existing artifact contract. This contract does not advertise native
+browser/Photos automation: `browser_capability` remains unknown until an actual
+adapter is observed. It does not substitute a server browser for the owner's
+logged-in browser or grant authority to submit payment/card forms.
+
+The same destination is accepted on the existing native
+`POST /v1/local-tasks/start` body as `local_destination`. It is included in the
+request fingerprint, checked before the native turn, and saved before terminal
+success. Reconcile returns the same Local Task, original conversation identity
+and verified destination receipts. A changed destination under the same request
+key conflicts instead of running another native turn. Direct repository tasks
+use the same private, ignored output folder layout as durable repository tasks,
+so outputs stay inside existing native workspace permissions.
+
+Optional `local_photo_source: {device_id, asset_ids}` is a bounded PhotoKit
+metadata source for 1–20 explicitly selected asset identifiers. The local adapter
+requires existing Swift developer tooling (and never launches its installer),
+checks current Photos authorization, never requests permission or enumerates
+the library, and returns only selected IDs, dimensions, date and location. It
+does not export images or claim visual photo recognition. Missing authorization
+or unavailable selected IDs holds the work before provider invocation; users can
+supply the photo through the existing attachment flow. No native Photos or
+browser capability is inferred for a generic model. PhotoKit source reference:
+[PHPhotoLibrary](https://developer.apple.com/documentation/photos/phphotolibrary).
+
+Owner-browser execution uses Crew's existing `browser_action` capability and
+paired Chrome extension queue, independently of CLI/native model execution.
+P10's companion browser change adds explicit `device_id` and an optional
+`interaction_scope: "observe_only"` that permits only observation primitives in
+an existing tab. It cannot type into card fields, click or submit. Its original
+queue task/device/deadline and result are retained across offline re-entry.
+
+When the result gateway is offline after file delivery, the existing private task
+snapshot retains the exact terminal receipt. The same paired device retries only
+that receipt on reconnect/restart, preserving the original turn and files. It
+does not claim a new task or re-invoke the provider. A fenced lease remains
+unconfirmed and never becomes permission to replay the work.
+
+
+For a paired native Codex write, `workspace_mode: task_sandbox` remains artifact
+management metadata. It does not move the selected native conversation. After
+current account/model/cwd/sandbox and lease checks, the CLI places the execution's
+private output directory under that verified native cwd at
+`.simy/local-tasks/<execution-id>/outputs` and rebuilds the provider instruction.
+Both generation and final destination therefore stay inside existing native
+write permissions. No new sandbox root or cwd override is sent to the provider.
+Readonly native tasks and Claude's ordinary permission flow do not acquire this
+Codex-specific writable-root capability.
+
+Web/Backend admission must preserve the optional destination and selected Photos
+request in the existing canonical native execution spec and request hash, pinned
+to the same selected paired device. These fields express intent; no `verified`
+flag, path in model context, previous receipt or old native root is a grant.
+Every new execution rechecks current device/account/link/session/lease and actual
+native roots or PhotoKit authorization. Follow-up preserves the chosen profile;
+a changed destination requires a fresh explicit admission, never a rewrite of an
+already-used request key. Revisions use the explicitly requested new artifact
+name; another revision already present at the same path is preserved and held.
+
 Provider diagnostics distinguish `authentication`, `connection`, and `connection_ready`.
 If both login and SIMY connection are missing, `actions` lists both remedies in one
 report. Connection readiness does not certify model access or task completion.
@@ -1219,3 +1317,32 @@ Search covers the current recent window (up to 200 active conversations and,
 with `--include-archived`, up to 200 archived conversations); older entries outside
 that window are not searched. This view respects the saved
 Codex provider connection setting and never enables automatic continuation.
+
+The existing per-provider heartbeat now includes `device_io` with
+`schema_version: local_device_io.v1`. It distinguishes Codex verified native-cwd
+staging/root delivery, Claude's provider permission flow, and selected Photos
+metadata requiring existing macOS authorization. It contains no paths or grants;
+normal provider/device readiness and runtime reauthorization still apply.
+The ordinary worker also sends `X-SIMY-Device-IO: local_device_io.v1` with its
+existing native protocol header. Web/gateway should preserve this marker and
+Backend should require it at claim/invocation when a destination/Photos profile
+is requested, so an old worker cannot silently ignore those required outputs.
+
+### Delivery entry routes
+
+Crew owns `sessionLoopOptions` in the distributed loop kernel. Codex enrollment,
+Continue, follow-up, desktop controls and automatic continuation use purpose v2
+by default; old false/v1 enrollment flags cannot select the retired mode.
+Explicit strict/balanced policies and human acceptance criteria remain binding.
+Compatible saved tasks migrate without replacing identity, history or budget.
+
+`~/.simy/bin/simy` is the installed CLI entry. Point any earlier shell alias or
+PATH symlink to it. `runtime legacy-hooks` switches known installed plugin caches
+to the same pin; check its output for customized hooks that still need review.
+`runtime supervisor-watchdog-install` registers the stable Node entry
+`~/.simy/bin/simy-runtime.mjs`, which resolves the verified runtime pin on each
+process start, instead of retaining a release-specific service path.
+When supervision is already live, install the candidate, request
+`runtime supervisor-handover --release ABSOLUTE_RELEASE`, and wait for activation.
+The watcher preserves the live supervisor while service registration is updated.
+No command here enrolls an unrelated conversation or renews an existing budget.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.15",
+  "version": "0.7.17",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -43,7 +43,7 @@
     "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js && npm run check:sqm",
     "check:workflow-observation-sender": "node --check ./src/workflow-observation-sender.js",
     "check:sqm": "node --check ./src/sqm/advisory-guidance.js && node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/reliability.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./src/sqm/agent-skill.js && node --check ./src/sqm/workflow-onboarding.js && node --check ./src/sqm/workflow-update.js && node --check ./src/sqm/history-store.js && node --check ./src/sqm/review-worker.js && node --check ./scripts/sqm-complete-loop-e2e.js && node --check ./scripts/sqm-local-review-e2e.js",
-    "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js",
+    "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js && node --check ./scripts/codex-plugin-runtime-e2e.js",
     "check:syntax": "node --check ./src/purpose-local-proof.js && node --check ./src/device-signing-identity.js && node --check ./src/index.js && node --check ./src/install-update.js && node --check ./src/agent.js && node --check ./src/connection-discovery.js && node --check ./src/connection-diagnostics.js && node --check ./src/launch-authorization.js && node --check ./src/codex-plugins/simy/hooks/connection-reminder.mjs && node --check ./src/codex-plugins/simy/hooks/dev-work.mjs && node --check ./src/dev-work-events.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/login-shell-path.js && node --check ./src/hook-runtime.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/pr-preparation.js && node --check ./src/orchestrator/minimum-completion.js && node --check ./src/orchestrator/delivery/scripts/check-minimum-completion.mjs && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./src/coding-run-store.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js && node --check ./src/codex-plugins/simy/hooks/delivery-loop.mjs && node --check ./src/delivery-hooks/command.js && node --check ./src/delivery-hooks/desktop.js && node --check ./src/delivery-hooks/supervisor.js && node --check ./src/delivery-hooks/recovery.js && node --check ./src/delivery-hooks/supervisor-owner.js && node --check ./src/delivery-hooks/supervisor-watchdog.js && node --check ./src/delivery-hooks/supervisor-service.js && node --check ./scripts/supervisor-watchdog-live-e2e.js && node --check ./src/codex-plugins/simy/hooks/recovery-incident.mjs && node --check ./src/session-supervision/automatic-continuation.js && node --check ./src/session-supervision/stop-notifications.js",
     "check:package": "node ./scripts/check-package-contents.js",
     "build:macos-installer:dev": "bash packaging/build-macos-arm64.sh --unsigned-dev",
@@ -52,6 +52,7 @@
     "build:macos-installer:production": "bash packaging/build-macos-arm64.sh --production",
     "test:e2e:claude-parity": "node ./scripts/claude-parity-runtime-e2e.js",
     "test:e2e:claude-plugin": "node ./scripts/claude-plugin-runtime-e2e.js",
+    "test:e2e:codex-plugin": "node ./scripts/codex-plugin-runtime-e2e.js",
     "test:e2e:flexible-delivery": "node --test --test-name-pattern=\"flexible prototype\" test/purpose-search.test.js",
     "test:e2e:sqm-faults": "node ./scripts/sqm-complete-loop-e2e.js"
   },
@@ -75,7 +76,8 @@
     "ink": "^6.8.0",
     "pdf-lib": "^1.17.1",
     "pngjs": "^7.0.0",
-    "react": "^19.2.0"
+    "react": "^19.2.0",
+    "ws": "^8.22.0"
   },
   "devDependencies": {
     "@xterm/headless": "^6.0.0",