@awak-app/simy-cli 0.7.45 → 0.7.47

package/src/session-supervision/session-guidance.js

@@ -0,0 +1,160 @@
+import {dirname} from 'node:path';
+import {realpath} from 'node:fs/promises';
+import {openNativeBridge} from '../codex-plugins/simy/native/bridge.mjs';
+import {guidanceAllowed, guidanceDigest, guidancePending, guidanceTarget, assertGuidanceIntent} from '../codex-plugins/simy/native/guidance-intent.mjs';
+import {matchesNativeDelegation} from '../codex-plugins/simy/native/submission-receipt.mjs';
+import {readRecord, updateRecord, hasPendingUserStop, managedBudgetReason, queuePurposeDiagnosis, advanceDeliveryControlRevision} from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import {requireProviderLink} from '../provider-links.js';
+
+const fail = code => Object.assign(new Error(code), {code});
+const terminal = phase => ['observed', 'cancelled'].includes(phase);
+function assertWritable(root, record, id, text) {
+  const intent = assertGuidanceIntent(record, id, text);
+  if (hasPendingUserStop(root, record) || managedBudgetReason(record.run)) throw fail('native_guidance_changed');
+  return intent;
+}
+export function sessionGuidancePresentation(candidate, record, now = Date.now()) {
+  const local = !candidate.remoteHost && candidate.teamRemote !== true && (!candidate.hostId || candidate.hostId === 'local');
+  const matched = record?.provider === candidate.provider && record?.session === candidate.session;
+  const observation = matched ? record.run?.managed?.nativeConnectionObservation : null;
+  const pending = matched ? record.run?.managed?.userGuidance : null;
+  const age = now - observation?.at;
+  const available = local && matched && candidate.isRunning === false && candidate.workState?.stale !== true &&
+    candidate.dispatchReadiness?.state !== 'blocked' && guidanceAllowed(record) &&
+    observation?.session === candidate.session && observation.state === 'connected' && observation.transport === 'codex_app_tools' && observation.guidanceAuthorization === true && age >= 0 && age < 30_000;
+  return {available: Boolean(available), state: pending?.phase || 'not_sent',
+    ...(pending ? {requestId: pending.id} : {}), providerExecutionConfirmed: false,
+    ...(available ? {target: guidanceTarget(record)} : {}),
+    reason: candidate.provider !== 'codex' ? 'direct_guidance_unsupported' : pending && !terminal(pending.phase) ? 'guidance_pending' : available ? null : 'original_connection_required'};
+}
+
+// Read-only capability negotiation for the selected original conversation.
+// A connection observation never resumes a writer or proves provider execution.
+export async function observeSessionGuidanceConnection({root, record, signal, authorize = async () => {},
+  openClient = openNativeBridge, checkLink = requireProviderLink, now = Date.now}) {
+  if (!guidanceAllowed(record)) return record;
+  const target = JSON.stringify(guidanceTarget(record));
+  await authorize();
+  const link = await checkLink({root, provider: record.provider});
+  let client, observation;
+  try {
+    signal?.throwIfAborted();
+    client = await openClient({root: dirname(root), record, signal});
+    const thread = (await client?.request('thread/read', {threadId: record.session}))?.thread;
+    if (client?.transport !== 'codex_app_tools' || client.guidanceAuthorization !== true) throw fail('native_guidance_unavailable');
+    if (thread?.id !== record.session || thread.ephemeral || await realpath(thread.cwd) !== await realpath(record.cwd)) throw fail('native_tools_owner_mismatch');
+    if (thread.status?.type !== 'idle') throw fail('original_thread_not_idle');
+    observation = {state: 'connected', transport: client.transport, guidanceAuthorization: true};
+  } catch (error) {
+    observation = {state: 'unavailable', transport: 'codex_app_tools', guidanceAuthorization: false,
+      code: /^[a-zA-Z0-9_]{1,80}$/.test(error.code || '') ? error.code : 'native_connection_failed'};
+  } finally {await client?.close();}
+  await authorize();
+  await checkLink({root, provider: record.provider, expectedEpoch: link.epoch});
+  return updateRecord(root, record.provider, record.session, async fresh => {
+    if (!guidanceAllowed(fresh) || JSON.stringify(guidanceTarget(fresh)) !== target) return fresh;
+    // Recheck authority while holding the same task/intent lock used by sends.
+    await authorize();
+    await checkLink({root, provider: record.provider, expectedEpoch: link.epoch});
+    fresh.run.managed.nativeConnectionObservation = {...observation, session: record.session, at: now()};
+    return fresh;
+  });
+}
+
+// A human explicitly submits a new instruction to the same loaded conversation.
+// A durable, exact intent fences automatic work; the app bridge claims it once
+// before dispatch. Unknown writes are reconciled only, never replayed.
+export async function sendSessionGuidance({root, provider, session, requestId, expectedRunId, taskId, expectedRevision, expectedEpoch,
+  text, signal, authorize = async () => {}, openClient = openNativeBridge, checkLink = requireProviderLink, now = Date.now}) {
+  if (provider !== 'codex' || !/^[0-9a-f-]{36}$/i.test(session || '') || !/^[0-9a-f-]{36}$/i.test(requestId || '') ||
+      typeof text !== 'string' || !text.trim() || text.length > 4000) throw fail('native_guidance_invalid');
+  const prompt = `[SIMY user guidance ${requestId}]\n${text}`;
+  await authorize();
+  const link = await checkLink({root, provider});
+  let duplicate;
+  const record = await updateRecord(root, provider, session, r => {
+    const old = r?.run?.managed?.userGuidance;
+    if (old?.id === requestId) {
+      if (old.digest !== guidanceDigest(prompt)) throw fail('native_guidance_conflict');
+      duplicate = {state: old.phase, requestId}; return r;
+    }
+    if (!guidanceAllowed(r) || hasPendingUserStop(root, r) || managedBudgetReason(r.run) || r.run.id !== expectedRunId ||
+        r.run.managed.taskId !== taskId || guidanceTarget(r).revision !== expectedRevision || r.autoContinueEpoch !== expectedEpoch ||
+        r.run.managed.guidanceHistory?.some(item => item.id === requestId)) throw fail('native_guidance_changed');
+    if (old) r.run.managed.guidanceHistory = [...(r.run.managed.guidanceHistory || []), {id: old.id, digest: old.digest, phase: old.phase}];
+    r.run.managed.userGuidance = {id: requestId, text: prompt, digest: guidanceDigest(prompt), target: guidanceTarget(r), phase: 'prepared', createdAt: now()};
+    return r;
+  });
+  if (duplicate) return duplicate;
+  let client;
+  try {
+    signal?.throwIfAborted();
+    client = await openClient({root: dirname(root), record, guidanceId: requestId, signal});
+    if (!client?.submitGuidance) throw fail('native_guidance_unavailable');
+    const thread = (await client.request('thread/read', {threadId: session}))?.thread;
+    if (thread?.id !== session || thread.ephemeral || thread.status?.type !== 'idle' || await realpath(thread.cwd) !== await realpath(record.cwd)) throw fail('native_guidance_unavailable');
+    await authorize(); await checkLink({root, provider, expectedEpoch: link.epoch});
+    await updateRecord(root, provider, session, r => {const intent = assertWritable(root, r, requestId, prompt); intent.phase = 'submitting'; return r;});
+    await client.submitGuidance({text: prompt, beforeSubmit: async () => {
+      await authorize(); await checkLink({root, provider, expectedEpoch: link.epoch});
+      assertWritable(root, await readRecord(root, provider, session), requestId, prompt);
+    }});
+    await updateRecord(root, provider, session, r => {
+      const intent = r?.run?.managed?.userGuidance;
+      if (intent?.id === requestId) {intent.phase = 'submitted'; intent.acceptedAt = now();}
+      return r;
+    });
+    return {state: 'submitted', requestId, providerExecutionConfirmed: false};
+  } catch (error) {
+    await updateRecord(root, provider, session, r => {
+      const intent = r?.run?.managed?.userGuidance;
+      if (intent?.id === requestId && intent.phase !== 'observed') {
+        intent.phase = intent.bridgeAttemptedAt || ['native_submission_unknown', 'native_tools_closed'].includes(error.code) ? 'unknown' : 'cancelled';
+        intent.failedAt = now();
+      }
+      return r;
+    });
+    throw Object.assign(fail(error.code === 'native_guidance_changed' ? error.code : 'native_guidance_unconfirmed'), {cause: error});
+  } finally { await client?.close(); }
+}
+
+// A fresh bridge can read the exact original receipt after a host restart.
+// No code path here invokes submitGuidance or retries a write.
+export async function reconcileSessionGuidance({root, record, signal, authorize = async () => {}, openClient = openNativeBridge, now = Date.now}) {
+  const intent = record?.run?.managed?.userGuidance;
+  if (!guidancePending(record) || !intent.bridgeAttemptedAt) return false;
+  let client;
+  try {
+    await authorize();
+    signal?.throwIfAborted();
+    client = await openClient({root: dirname(root), record, guidanceId: intent.id, signal});
+    if (!client) return false;
+    let cursor;
+    for (let page = 0; page < 3; page++) {
+      const result = await client.request('thread/turns/list', {threadId: record.session, ...(cursor ? {cursor} : {})});
+      if (!Array.isArray(result?.data)) return false;
+      const turn = result.data.find(turn => matchesNativeDelegation(turn, record.session, intent.text));
+      if (turn) {
+        await authorize();
+        let inspectedNext = false;
+        await updateRecord(root, record.provider, record.session, r => {
+          if (r?.run?.id !== record.run.id || r.run.managed?.userGuidance?.id !== intent.id) return r;
+          const guide = r.run.managed.userGuidance;
+          guide.receiptObservedAt = now(); guide.turnId = turn.id;
+          // A receipt alone must not release the old automatic plan. If the
+          // controller cannot queue a fresh inspection (stop/budget/backoff),
+          // retain the send hold and let later read-only reconciliation retry.
+          inspectedNext = !hasPendingUserStop(root, r) && !r.run.stopReason && queuePurposeDiagnosis(r.run,
+            'Read the latest user guidance and current original conversation before choosing the next authorized action. Preserve corrections, stops, permissions, goals and budgets; do not repeat previous effects.',
+            `user-guidance:${intent.id}`, now(), 'user_guidance');
+          if (inspectedNext) {advanceDeliveryControlRevision(r.run); guide.phase = 'observed'; guide.observedAt = now();}
+          return r;
+        });
+        return inspectedNext;
+      }
+      if (!result.nextCursor || result.nextCursor === cursor) return false;
+      cursor = result.nextCursor;
+    }
+    return false;
+  } finally { await client?.close(); }
+}

package/src/sqm/claude-plugin.js

@@ -34,6 +34,8 @@ export async function claudePluginFiles() {
   for (const name of ["loop-kernel.mjs", "loop-kernel/index.mjs", "loop-kernel/policy.json", "loop-kernel/pin.json", "loop-kernel/outcome-review.mjs", "loop-kernel/work-frontier.mjs", "loop-kernel/task-pool.mjs"]) {
     files.set(`hooks/${name}`, await readFile(path.join(SOURCE, "hooks", name), "utf8"));
   }
+  // The shared hook imports this standalone helper; no native bridge is needed.
+  files.set("native/guidance-intent.mjs", await readFile(path.join(SOURCE, "native/guidance-intent.mjs"), "utf8"));
   const collector = await readFile(new URL("../cli-observability.js", import.meta.url), "utf8");
   // Standalone hooks do not ship the CLI capability dependency graph. Freeze the
   // maintained package version into their generated collector instead.
@@ -61,6 +63,8 @@ export async function claudePluginFiles() {
   files.set("hooks/purpose-evidence.mjs", await readFile(path.join(SOURCE, "hooks/purpose-evidence.mjs"), "utf8"));
   files.set("hooks/user-experience.mjs", await readFile(path.join(SOURCE, "hooks/user-experience.mjs"), "utf8"));
   files.set("hooks/result-cycle.mjs", await readFile(path.join(SOURCE, "hooks/result-cycle.mjs"), "utf8"));
+  for (const name of ['measurement-contract', 'measurement-store', 'measurement-snapshot', 'measurement-judge', 'measurement-collector'])
+    files.set(`hooks/${name}.mjs`, await readFile(path.join(SOURCE, `hooks/${name}.mjs`), 'utf8'));
   files.set("hooks/scene-reasoning.mjs", await readFile(path.join(SOURCE, "hooks/scene-reasoning.mjs"), "utf8"));
   files.set("hooks/purpose-cycle.mjs", await readFile(path.join(SOURCE, "hooks/purpose-cycle.mjs"), "utf8"));
   files.set("hooks/purpose-rule-policy.mjs", await readFile(path.join(SOURCE, "hooks/purpose-rule-policy.mjs"), "utf8"));

package/src/sqm/history-store.js

@@ -6,6 +6,9 @@ import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promise
 import { basename, join } from "node:path";
 import { formatSqmCoverage, sqmCoverageWarnings } from "./report.js";
 import { defaultSessionRoot } from "../session-store.js";
+import { recordMeasurementSqm } from '../codex-plugins/simy/hooks/measurement-collector.mjs';
+import { measurementBinding, appendMeasurement, measurementCollectionEnabled } from '../codex-plugins/simy/hooks/measurement-store.mjs';
+import { measurementDigest } from '../codex-plugins/simy/hooks/measurement-contract.mjs';
 
 // Limit the desktop projection, never the durable history.
 const DISPLAY_LIMIT = 100;
@@ -132,11 +135,35 @@ export function projectSqmHistory(items, live = { activeCount: 0, items: [] }) {
 }
 
 export function createSqmCheckRecorder({ root, scope, phase, cwd, baseBranch, providerSession, conversationProvider, onError = () => console.warn("Could not save the local SQM check history.") }) {
-  if (!scope?.webOrigin || !scope?.accountId || !scope?.organizationId) return async () => {};
+  const historyEnabled = Boolean(scope?.webOrigin && scope?.accountId && scope?.organizationId);
   const history = createSqmHistoryStore({ root });
   const key = `sqm-check:${randomUUID()}`;
   const startedAt = new Date().toISOString();
+  const measurementRoot = join(root || defaultSessionRoot(), 'delivery-hooks');
+  // Pin the current trace before the check starts. A new task in the same
+  // provider conversation cannot inherit the old task's late SQM result.
+  const measurement = providerSession && conversationProvider ? measurementBinding(measurementRoot, conversationProvider, providerSession).catch(() => null) : Promise.resolve(null);
   return async (result, presentation = {}) => {
+    try {
+      const binding = await measurement;
+      if (binding && measurementCollectionEnabled(measurementRoot, conversationProvider, providerSession, binding.trace)) {
+        const context = { root: measurementRoot, provider: conversationProvider, session: providerSession, trace: binding.trace };
+        if (result.proof) await recordMeasurementSqm({ ...context, result });
+        else await appendMeasurement({ ...context, type: 'sqm_attempt', key,
+          data: { attempt: measurementDigest(key), phase: phase === 'min' ? 'min' : 'full',
+            outcome: result.status === 'unavailable' ? 'unavailable' : ['failed', 'preliminary_failed'].includes(result.status) ? 'failed' : ['passed', 'preliminary_passed'].includes(result.status) ? 'passed' : 'unknown',
+            candidate: result.repository_identity ? measurementDigest(result.repository_identity) : null,
+            diagnostic: result.diagnostic ? measurementDigest(result.diagnostic) : null } });
+      }
+    } catch {
+      console.warn('Adoption measurement could not retain this SQM observation.');
+      try {
+        const binding = await measurement;
+        if (binding) await appendMeasurement({ root: measurementRoot, provider: conversationProvider, session: providerSession, trace: binding.trace,
+          type: 'gap', key: `sqm:${key}`, data: { reason: 'capture_failed' } });
+      } catch { /* The collection audit must report the damaged journal. */ }
+    }
+    if (!historyEnabled) return;
     const proof = result.proof, identity = proof?.repository_identity || result.repository_identity || result.min_check?.repository_identity;
     const repository = identity?.repository || result.repository;
     const outcome = result.status === "stale" ? "stale" : proof?.outcome.status || result.min_check?.status || result.status;

package/src/sqm/review-worker.js

@@ -475,6 +475,8 @@ async function runSingleProviderReview(
 ) {
   assertProvider(provider);
   assertStructuredRequest(request);
+  // Probe the same filtered environment used by the actual provider process.
+  environment = safeReviewEnvironment(environment, provider);
   if (signal?.aborted) throw new SqmLocalReviewError('Local analysis was cancelled.', { code: 'analysis_cancelled' });
   const label = provider === "claude" ? "Claude Code" : "Codex";
   const inspection = await inspectExecutor(provider);
@@ -621,7 +623,7 @@ function spawnReview(command, args, prompt, { spawnImpl, dispatchTransport, exec
       child = dispatchTransport(() => {
         try {
           return spawnImpl(command, args, {
-            env: safeReviewEnvironment(environment, provider), cwd, windowsHide: true, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"],
+            env: environment, cwd, windowsHide: true, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"],
           });
         } catch { throw providerFailure("provider_spawn_failed", { model }); }
       });
@@ -811,6 +813,8 @@ function providerSignInRequired(message) {
 function safeReviewEnvironment(environment, provider) {
   const allowed = [
     "HOME", "PATH", "CODEX_HOME", "CLAUDE_CONFIG_DIR",
+    // Native credential lookup on macOS needs the local user identity too.
+    "USER", "LOGNAME",
     "SystemRoot", "SYSTEMROOT", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "TEMP", "TMP", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR",
     "SSL_CERT_FILE", "SSL_CERT_DIR", "HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY", "NO_PROXY",
   ];

package/src/web-api.js

@@ -17,6 +17,9 @@ export function publicImageUrl(value) {
 
 const APP_DEV_ORIGIN = "https://app-dev.simy.one";
 const APP_DEV_GATEWAY_BASE_URL = "https://app.simy.one/api/local-cli-gateway/";
+// An isolated dev build can explicitly select the dev gateway before a new
+// route reaches stable. Never infer this endpoint or redirect a saved session.
+const APP_DEV_LOCAL_GATEWAY_BASE_URL = "https://app-dev.simy.one/api/local-cli-gateway/";
 
 export function resolveWebApiBaseUrl(webOrigin, requestedBaseUrl = null) {
   const normalizedWebOrigin = new URL(webOrigin).origin;
@@ -36,9 +39,9 @@ export function resolveWebApiBaseUrl(webOrigin, requestedBaseUrl = null) {
   if (requested.href === directBase) return directBase;
   if (
     normalizedWebOrigin === APP_DEV_ORIGIN &&
-    requested.href === APP_DEV_GATEWAY_BASE_URL
+    [APP_DEV_GATEWAY_BASE_URL, APP_DEV_LOCAL_GATEWAY_BASE_URL].includes(requested.href)
   ) {
-    return APP_DEV_GATEWAY_BASE_URL;
+    return requested.href;
   }
   throw new Error("SIMY Web provided an untrusted CLI API endpoint.");
 }