@awak-app/simy-cli 0.7.46 → 0.7.47

package/src/sqm/claude-plugin.js

@@ -34,6 +34,8 @@ export async function claudePluginFiles() {
   for (const name of ["loop-kernel.mjs", "loop-kernel/index.mjs", "loop-kernel/policy.json", "loop-kernel/pin.json", "loop-kernel/outcome-review.mjs", "loop-kernel/work-frontier.mjs", "loop-kernel/task-pool.mjs"]) {
     files.set(`hooks/${name}`, await readFile(path.join(SOURCE, "hooks", name), "utf8"));
   }
+  // The shared hook imports this standalone helper; no native bridge is needed.
+  files.set("native/guidance-intent.mjs", await readFile(path.join(SOURCE, "native/guidance-intent.mjs"), "utf8"));
   const collector = await readFile(new URL("../cli-observability.js", import.meta.url), "utf8");
   // Standalone hooks do not ship the CLI capability dependency graph. Freeze the
   // maintained package version into their generated collector instead.

package/src/sqm/review-worker.js

@@ -475,6 +475,8 @@ async function runSingleProviderReview(
 ) {
   assertProvider(provider);
   assertStructuredRequest(request);
+  // Probe the same filtered environment used by the actual provider process.
+  environment = safeReviewEnvironment(environment, provider);
   if (signal?.aborted) throw new SqmLocalReviewError('Local analysis was cancelled.', { code: 'analysis_cancelled' });
   const label = provider === "claude" ? "Claude Code" : "Codex";
   const inspection = await inspectExecutor(provider);
@@ -621,7 +623,7 @@ function spawnReview(command, args, prompt, { spawnImpl, dispatchTransport, exec
       child = dispatchTransport(() => {
         try {
           return spawnImpl(command, args, {
-            env: safeReviewEnvironment(environment, provider), cwd, windowsHide: true, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"],
+            env: environment, cwd, windowsHide: true, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"],
           });
         } catch { throw providerFailure("provider_spawn_failed", { model }); }
       });
@@ -811,6 +813,8 @@ function providerSignInRequired(message) {
 function safeReviewEnvironment(environment, provider) {
   const allowed = [
     "HOME", "PATH", "CODEX_HOME", "CLAUDE_CONFIG_DIR",
+    // Native credential lookup on macOS needs the local user identity too.
+    "USER", "LOGNAME",
     "SystemRoot", "SYSTEMROOT", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "TEMP", "TMP", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR",
     "SSL_CERT_FILE", "SSL_CERT_DIR", "HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY", "NO_PROXY",
   ];