@awak-app/simy-cli 0.7.3 → 0.7.4

package/README.md

@@ -15,7 +15,7 @@ cached in memory, so restarting the host may retrieve live contexts again.
 
 `simy --version` prints the installed CLI version without starting an agent or
 checking for updates. `simy doctor` performs read-only local connection and
-provider login checks and prints a JSON diagnostic report: installed/running
+provider login and SIMY provider-link checks and prints a JSON diagnostic report: installed/running
 versions, stale discovery records, session expiry, provider readiness, and recent
 structured SQM failures, plus `host_exit` with the latest native desktop host's
 abnormal exit time and status. `failures.total_failures` counts scoped SQM
@@ -1095,3 +1095,11 @@ Diagnosis now returns an issue-first worksheet in `analysis.hypothesisSheet.requ
 Default issue selection is the first eight original acceptance criteria (or `objective` when absent); `omittedIssueCount` and `issueDescriptionsTruncated` disclose bounded input. Use an explicit issue list to focus on other original issues, including a prior `rule:*` or `objective` row. The latest retained runtime worksheet is supplied as context; this read-only command neither writes nor replaces the runtime ledger.
 
 Manual diagnosis and delivery reasoning share the scoped SQM knowledge loader. Partial environment overrides cannot mix a token, account, organization or endpoint with saved credentials; unavailable knowledge is reported without blocking the diagnosis. The brief response retains `knowledge.status`, `reason`, `suppliedCount`, and `bundleDigest`, separately from `knowledgeReferenceCount` and test execution (always zero for diagnosis). Truncated evidence is disclosed to both the analyst and the caller.
+
+Provider diagnostics distinguish `authentication`, `connection`, and `connection_ready`.
+If both login and SIMY connection are missing, `actions` lists both remedies in one
+report. Connection readiness does not certify model access or task completion.
+Diagnostics do not reconnect providers or enable existing tasks. Explicit refresh
+waits for a fresh probe when a pre-login check is already running. macOS login
+terminals preserve an explicitly configured `CODEX_HOME` or `CLAUDE_CONFIG_DIR`,
+without copying credentials.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.3";
+export const CLI_VERSION = "0.7.4";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/desktop-host.js

@@ -39,7 +39,7 @@ import { createCliAutoUpdater, readCliPackageInfo } from "./auto-update.js";
 import { createAgentShutdown } from "./shutdown.js";
 import { resolveWebOrigin } from "./web-origin.js";
 import { openAuthorizationUrl } from "./browser.js";
-import { inspectBackendExecutable } from "./backend-executable.js";
+import { inspectBackendExecutable, CODEX_WRITER_LOCK_MINIMUM_VERSION } from "./backend-executable.js";
 import { inspectSqmAgentSkill } from "./sqm/agent-skill.js";
 import { startWorkflowUpdates, syncInstalledWorkflows } from "./sqm/workflow-update.js";
 import { createNativeDevelopmentReportsApi, normalizeNativeDevelopmentReportSave } from "./native-development-reports.js";
@@ -1442,7 +1442,7 @@ export async function openProviderLogin(provider, root, {
   execFileImpl = promisify(execFile), platform = process.platform, env = process.env,
 } = {}) {
   if (provider !== "codex" && provider !== "claude") throw new Error("Unsupported provider.");
-  const executable = await inspectExecutable(provider);
+  const executable = await inspectExecutable(provider, provider === "codex" ? { minimumVersion: CODEX_WRITER_LOCK_MINIMUM_VERSION } : {});
   if (!executable.available || !executable.executable) throw Object.assign(new Error("Provider is not installed."), { code: "provider_not_installed" });
   const label = provider === "claude" ? "Claude Code" : "Codex";
   const args = provider === "claude" ? ["auth", "login"] : ["login"];
@@ -1456,7 +1456,11 @@ export async function openProviderLogin(provider, root, {
   const directory = await mkdtemp(join(root, `${provider}-login-`));
   const script = join(directory, `Sign in to ${label}.command`);
   const quote = (s) => `'${s.replaceAll("'", "'\\''")}'`;
-  await writeFile(script, `#!/bin/bash\nexport PATH=${quote(env.PATH || "/usr/bin:/bin")}\n${quote(executable.executable)} ${args.join(" ")}\nresult=$?\nif [ "$result" -ne 0 ]; then\n  echo "Sign-in failed. Check the error above, then press Return to close."\n  read -r _\nfi\nrm -f -- ${quote(script)}\nrmdir -- ${quote(directory)}\nexit "$result"\n`, { mode: 0o700 });
+  // Terminal does not inherit custom provider homes from the desktop host.
+  // Preserve only path settings, never copy tokens or credential contents.
+  const homeKey = provider === "codex" ? "CODEX_HOME" : "CLAUDE_CONFIG_DIR";
+  const providerHome = typeof env[homeKey] === "string" && env[homeKey] ? `export ${homeKey}=${quote(env[homeKey])}\n` : "";
+  await writeFile(script, `#!/bin/bash\n${providerHome}export PATH=${quote(env.PATH || "/usr/bin:/bin")}\n${quote(executable.executable)} ${args.join(" ")}\nresult=$?\nif [ "$result" -ne 0 ]; then\n  echo "Sign-in failed. Check the error above, then press Return to close."\n  read -r _\nfi\nrm -f -- ${quote(script)}\nrmdir -- ${quote(directory)}\nexit "$result"\n`, { mode: 0o700 });
   await chmod(script, 0o700);
   try { await execFileImpl("/usr/bin/open", ["-a", "Terminal", script], { timeout: 10_000 }); }
   catch (error) { await rm(directory, { recursive: true, force: true }); throw error; }

package/src/desktop-status.js

@@ -137,9 +137,19 @@ export function createProviderStatusInspector(provider, {
   let cached = null;
   let cachedAt = 0;
   let inFlight = null;
-  return async ({ force = false } = {}) => {
+  const refreshAfterFlight = new WeakMap();
+  return async function readStatus({ force = false } = {}) {
     const current = now();
     if (!force && cached && current - cachedAt < cacheMs) return structuredClone(cached);
+    if (inFlight && force) {
+      // A login can finish while a previous signed-out probe is in flight.
+      // Explicit refresh must observe after that probe, not return its old result.
+      const previous = inFlight;
+      if (!refreshAfterFlight.has(previous)) {
+        refreshAfterFlight.set(previous, previous.catch(() => {}).then(() => readStatus({ force: true })));
+      }
+      return structuredClone(await refreshAfterFlight.get(previous));
+    }
     if (inFlight) return structuredClone(await inFlight);
     inFlight = Promise.resolve(inspect({ ...inspectOptions, now: () => new Date(now()) }))
       .then((result) => {

package/src/doctor.js

@@ -1,3 +1,4 @@
+import { readProviderLinks } from "./provider-links.js";
 import { purposeSigningKeyPath, purposeVerificationCapability } from "./purpose-local-proof.js";
 import { readFile } from "node:fs/promises";
 import { connectionDiscoveryPath } from "./connection-discovery.js";
@@ -7,7 +8,7 @@ import { readDiagnosticLog } from "./diagnostic-log.js";
 import { readHostExitDiagnostics } from "./host-exit-diagnostics.js";
 
 export async function collectDiagnostics({ webOrigin, cliVersion, root = defaultSessionRoot(),
-  readSessionImpl = readSession, inspectProvider = inspectProviderStatus, fetchImpl = fetch,
+  readSessionImpl = readSession, inspectProvider = inspectProviderStatus, readLinks = readProviderLinks, fetchImpl = fetch,
   readFileImpl = readFile, alive = pid => { try { process.kill(pid, 0); return true; } catch { return false; } }, now = Date.now() } = {}) {
   const session = await readSessionImpl(webOrigin, root).catch(() => null);
   const valid = isSessionValid(session, now, webOrigin);
@@ -27,10 +28,14 @@ export async function collectDiagnostics({ webOrigin, cliVersion, root = default
         background: health.daemon === true };
     }
   } catch (error) { if (error.code !== "ENOENT") daemon.state = "unverified"; }
+  const links = await readLinks(root).catch(() => ({}));
   const providers = Object.fromEntries(await Promise.all(["codex", "claude"].map(async provider => {
     const result = await inspectProvider(provider).catch(() => ({ state: "unknown" }));
     return [provider, { state: ["ready", "signed_out", "missing", "outdated", "unknown"].includes(result?.state) ? result.state : "unknown",
       version: typeof result?.version === "string" && /^\d+\.\d+\.\d+(?:-[a-z0-9.-]+)?$/i.test(result.version) ? result.version : null,
+      connection: links[provider]?.settingsError || !links[provider] ? "unknown" : links[provider].connected ? "connected" : "disconnected",
+      authentication: result?.state === "ready" ? "signed_in" : result?.state === "signed_out" ? "signed_out" : "unknown",
+      connection_ready: result?.state === "ready" && links[provider]?.connected === true && !links[provider]?.settingsError,
       model_access: "unknown" }];
   })));
   const scope = session?.account_id && session?.organization_id ? { webOrigin, accountId: session.account_id, organizationId: session.organization_id } : null;
@@ -41,6 +46,11 @@ export async function collectDiagnostics({ webOrigin, cliVersion, root = default
     providers, failures, host_exit: await readHostExitDiagnostics(root),
     purpose_verification: await purposeVerificationCapability(purposeSigningKeyPath(root)).then(value => ({ state: value ? "available" : "not_initialized", key_id: value?.key_id || null, execution: "explicit_frozen_recipes_only" })).catch(() => ({ state: "unavailable", key_id: null, execution: "explicit_frozen_recipes_only" })),
     actions: [
+      ...Object.entries(providers).filter(([, provider]) => provider.connection === "disconnected")
+        .map(([provider]) => ({ id: `connect_${provider}`, action: "provider_connect", provider,
+          instruction: `Open SIMY settings and connect ${provider}. Provider login and SIMY connection are separate; existing tasks remain stopped.` })),
+      ...Object.entries(providers).filter(([, provider]) => provider.connection === "unknown")
+        .map(([provider]) => ({ id: `check_${provider}_connection`, instruction: "SIMY connection settings could not be read. Refresh connections; do not reset saved consent." })),
       ...(!valid ? [{ id: "reconnect_cli", command: "simy" }] : []),
       ...(["stale_record", "not_found", "unverified"].includes(daemon.state) ? [{ id: "inspect_daemon", command: "simy doctor" }] : []),
       ...(daemon.version_matches === false ? [{ id: "update_when_idle", command: "simy update --check" }] : []),