@simplr-ai/connect 0.3.0-dev.0

package/README.md

@@ -0,0 +1,22 @@
+# Simplr Connect
+
+Simplr Connect enrolls a developer workstation and reports a bounded security inventory of installed AI tools, skill names, configured MCP servers, developer-tool versions, current Git repository and operating-system security posture.
+
+```bash
+npx -y @simplr-ai/connect@dev enroll --api-url <simplr-api-url> --code <one-time-code>
+```
+
+Use `simplr-connect sync` for a one-off inventory refresh or `simplr-connect watch` for a lightweight heartbeat every minute and full inventory reconciliation every 15 minutes.
+
+To make an AI process remotely controllable, start it through the companion:
+
+```bash
+simplr-connect run -- codex
+simplr-connect run -- claude
+```
+
+Pause, resume and stop commands are accepted only while Simplr Connect is supervising the process tree. Independently started AI processes remain visible in inventory but are never reported as remotely controlled. A signed privileged service is required for device-wide enforcement of unmanaged processes.
+
+Security posture checks cover disk encryption, firewall, automatic updates, screen lock, endpoint protection and Secure Boot where the operating system permits an unprivileged check. Simplr receives only pass, fail, unknown or not-applicable status with fixed evidence labels. It does not upload raw command output, source files, skill contents, prompt contents, environment variables, shell history, usernames, local file paths or developer credentials.
+
+The workstation credential is stored in macOS Keychain, Linux Secret Service or a Windows DPAPI-protected file. Enrollment fails when the platform credential store is unavailable rather than falling back to plaintext.

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/index.js

@@ -0,0 +1,778 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { execFileSync, spawn, spawnSync } from "child_process";
+import { constants, unlinkSync } from "fs";
+import {
+  access,
+  chmod,
+  mkdir,
+  open,
+  readFile,
+  readdir,
+  unlink,
+  writeFile
+} from "fs/promises";
+import { arch, homedir, hostname, platform } from "os";
+import { basename, join } from "path";
+var APP_VERSION = "0.3.0-dev.0";
+var managedProcesses = /* @__PURE__ */ new Map();
+function stateDirectory() {
+  if (platform() === "darwin")
+    return join(homedir(), "Library", "Application Support", "Simplr Connect");
+  if (platform() === "win32")
+    return join(
+      process.env.APPDATA || join(homedir(), "AppData", "Roaming"),
+      "Simplr Connect"
+    );
+  return join(
+    process.env.XDG_CONFIG_HOME || join(homedir(), ".config"),
+    "simplr-connect"
+  );
+}
+function statePath() {
+  return join(stateDirectory(), "state.json");
+}
+function encryptedCredentialPath() {
+  return join(stateDirectory(), "credential.bin");
+}
+function supervisorLockPath() {
+  return join(stateDirectory(), "supervisor.lock");
+}
+function apiUrl(override) {
+  const value = override || process.env.SIMPLR_API_URL;
+  if (!value) throw new Error("Use --api-url or set SIMPLR_API_URL");
+  const parsed = new URL(value);
+  const local = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "::1";
+  if (parsed.protocol !== "https:" && !local) throw new Error("Simplr API URL must use HTTPS");
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) throw new Error("Simplr API URL cannot contain credentials, query parameters or a fragment");
+  return value.replace(/\/$/, "");
+}
+function osName() {
+  if (platform() === "darwin") return "macos";
+  if (platform() === "win32") return "windows";
+  return "linux";
+}
+function commandResult(command, args, timeout = 3e3) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    shell: false,
+    timeout,
+    windowsHide: true
+  });
+  return {
+    ok: result.status === 0,
+    output: `${result.stdout || result.stderr}`.trim()
+  };
+}
+function commandVersion(command, args = ["--version"]) {
+  const result = commandResult(command, args);
+  if (!result.ok) return void 0;
+  return result.output.trim().split("\n")[0]?.slice(0, 100);
+}
+function detectAgents() {
+  const candidates = [
+    ["codex", "Codex", "codex"],
+    ["claude_code", "Claude Code", "claude"],
+    ["cursor", "Cursor", "cursor"]
+  ];
+  return candidates.flatMap(([kind, name, command]) => {
+    const version = commandVersion(command);
+    return version ? [{ kind, name, version, enabled: true }] : [];
+  });
+}
+function detectDeveloperTools() {
+  const candidates = [
+    { key: "git", name: "Git", category: "source_control", command: "git" },
+    {
+      key: "github_cli",
+      name: "GitHub CLI",
+      category: "source_control",
+      command: "gh",
+      authentication: () => commandResult("gh", ["auth", "status"]).ok ? "authenticated" : "not_authenticated"
+    },
+    {
+      key: "vscode",
+      name: "Visual Studio Code",
+      category: "ide",
+      command: "code"
+    },
+    { key: "cursor", name: "Cursor", category: "ide", command: "cursor" },
+    {
+      key: "docker",
+      name: "Docker",
+      category: "containers",
+      command: "docker"
+    },
+    {
+      key: "orbstack",
+      name: "OrbStack",
+      category: "containers",
+      command: "orb"
+    },
+    { key: "mise", name: "mise", category: "runtime", command: "mise" },
+    { key: "asdf", name: "asdf", category: "runtime", command: "asdf" },
+    { key: "node", name: "Node.js", category: "runtime", command: "node" },
+    { key: "bun", name: "Bun", category: "runtime", command: "bun" },
+    { key: "python", name: "Python", category: "runtime", command: "python3" },
+    {
+      key: "go",
+      name: "Go",
+      category: "runtime",
+      command: "go",
+      args: ["version"]
+    },
+    {
+      key: "java",
+      name: "Java",
+      category: "runtime",
+      command: "java",
+      args: ["-version"]
+    },
+    {
+      key: "onepassword",
+      name: "1Password CLI",
+      category: "secrets",
+      command: "op"
+    },
+    {
+      key: "vault",
+      name: "HashiCorp Vault",
+      category: "secrets",
+      command: "vault"
+    },
+    {
+      key: "gcloud",
+      name: "Google Cloud CLI",
+      category: "cloud",
+      command: "gcloud",
+      args: ["version"]
+    },
+    { key: "aws", name: "AWS CLI", category: "cloud", command: "aws" },
+    { key: "azure", name: "Azure CLI", category: "cloud", command: "az" },
+    {
+      key: "cloudflare",
+      name: "Cloudflare Wrangler",
+      category: "cloud",
+      command: "wrangler"
+    },
+    { key: "vercel", name: "Vercel CLI", category: "cloud", command: "vercel" },
+    {
+      key: "sentry",
+      name: "Sentry CLI",
+      category: "observability",
+      command: "sentry-cli"
+    },
+    {
+      key: "datadog",
+      name: "Datadog CI",
+      category: "observability",
+      command: "datadog-ci"
+    },
+    {
+      key: "jira",
+      name: "Jira CLI",
+      category: "work_management",
+      command: "jira"
+    },
+    {
+      key: "slack",
+      name: "Slack CLI",
+      category: "communication",
+      command: "slack"
+    }
+  ];
+  return candidates.map((candidate) => {
+    const version = commandVersion(candidate.command, candidate.args);
+    const installed = Boolean(version);
+    return {
+      key: candidate.key,
+      name: candidate.name,
+      category: candidate.category,
+      version,
+      installed,
+      authentication: !installed ? "not_applicable" : candidate.authentication ? candidate.authentication() : "unknown"
+    };
+  });
+}
+async function pathExists(path) {
+  try {
+    await access(path, constants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function postureCheck(key, status, evidence) {
+  return { key, status, evidence };
+}
+async function macosPosture() {
+  const encryption = commandResult("/usr/bin/fdesetup", ["status"]);
+  const firewall = commandResult(
+    "/usr/libexec/ApplicationFirewall/socketfilterfw",
+    ["--getglobalstate"]
+  );
+  const updates = commandResult("/usr/sbin/softwareupdate", ["--schedule"]);
+  const screenLock = commandResult("/usr/bin/defaults", [
+    "-currentHost",
+    "read",
+    "com.apple.screensaver",
+    "askForPassword"
+  ]);
+  const endpointProtection = await pathExists(
+    "/Library/Apple/System/Library/CoreServices/XProtect.bundle"
+  ) || await pathExists("/Applications/Falcon.app") || await pathExists("/Applications/SentinelOne");
+  return [
+    postureCheck(
+      "disk_encryption",
+      encryption.ok ? /FileVault is On/i.test(encryption.output) ? "pass" : "fail" : "unknown",
+      encryption.ok ? "FileVault state verified" : "FileVault state unavailable"
+    ),
+    postureCheck(
+      "firewall",
+      firewall.ok ? /enabled|state\s*=\s*1/i.test(firewall.output) ? "pass" : "fail" : "unknown",
+      firewall.ok ? "Application firewall state verified" : "Firewall state unavailable"
+    ),
+    postureCheck(
+      "automatic_updates",
+      updates.ok ? /on/i.test(updates.output) ? "pass" : "fail" : "unknown",
+      updates.ok ? "Automatic update schedule verified" : "Automatic update state unavailable"
+    ),
+    postureCheck(
+      "screen_lock",
+      screenLock.ok ? /^1$|true/i.test(screenLock.output) ? "pass" : "fail" : "unknown",
+      screenLock.ok ? "Screen-lock password requirement verified" : "Screen-lock state unavailable"
+    ),
+    postureCheck(
+      "endpoint_protection",
+      endpointProtection ? "pass" : "unknown",
+      endpointProtection ? "Built-in or managed endpoint protection detected" : "Endpoint protection could not be verified"
+    ),
+    postureCheck(
+      "secure_boot",
+      "unknown",
+      "Secure Boot requires elevated or MDM attestation"
+    )
+  ];
+}
+async function windowsPosture() {
+  const powershell = (script) => commandResult(
+    "powershell.exe",
+    ["-NoProfile", "-NonInteractive", "-Command", script],
+    5e3
+  );
+  const encryption = commandResult("manage-bde.exe", ["-status", "C:"]);
+  const firewall = powershell(
+    "if ((Get-NetFirewallProfile | Where-Object Enabled).Count -eq 3) { 'pass' } else { 'fail' }"
+  );
+  const updates = powershell(
+    "$v=(Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings' -ErrorAction SilentlyContinue).UxOption; if ($null -eq $v -or $v -ne 1) { 'pass' } else { 'fail' }"
+  );
+  const screenLock = powershell(
+    "$v=(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop' -ErrorAction SilentlyContinue).ScreenSaveActive; if ($v -eq '1') { 'pass' } else { 'fail' }"
+  );
+  const endpoint = powershell(
+    "$v=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($v.AMServiceEnabled -and $v.RealTimeProtectionEnabled) { 'pass' } else { 'fail' }"
+  );
+  const secureBoot = powershell(
+    "try { if (Confirm-SecureBootUEFI) { 'pass' } else { 'fail' } } catch { 'unknown' }"
+  );
+  const state = (result) => result.ok && /pass/i.test(result.output) ? "pass" : result.ok && /fail/i.test(result.output) ? "fail" : "unknown";
+  return [
+    postureCheck(
+      "disk_encryption",
+      encryption.ok ? /Protection Status:\s+Protection On/i.test(encryption.output) ? "pass" : "fail" : "unknown",
+      "BitLocker protection state checked"
+    ),
+    postureCheck(
+      "firewall",
+      state(firewall),
+      "Windows Firewall profiles checked"
+    ),
+    postureCheck(
+      "automatic_updates",
+      state(updates),
+      "Windows Update policy checked"
+    ),
+    postureCheck(
+      "screen_lock",
+      state(screenLock),
+      "Screen-lock policy checked"
+    ),
+    postureCheck(
+      "endpoint_protection",
+      state(endpoint),
+      "Microsoft Defender real-time protection checked"
+    ),
+    postureCheck(
+      "secure_boot",
+      state(secureBoot),
+      "UEFI Secure Boot state checked"
+    )
+  ];
+}
+async function linuxPosture() {
+  const rootSource = commandResult("findmnt", ["-no", "SOURCE", "/"]);
+  const rootDevice = rootSource.ok && /^\/dev\/[A-Za-z0-9._/+:-]+$/.test(rootSource.output) ? rootSource.output : "";
+  const encryption = rootDevice ? commandResult("lsblk", ["-s", "-no", "TYPE", rootDevice]) : { ok: false, output: "" };
+  const ufw = commandResult("ufw", ["status"]);
+  const firewalld = commandResult("firewall-cmd", ["--state"]);
+  const unattended = commandResult("systemctl", [
+    "is-enabled",
+    "unattended-upgrades"
+  ]);
+  const dnfAutomatic = commandResult("systemctl", [
+    "is-enabled",
+    "dnf-automatic.timer"
+  ]);
+  const secureBoot = commandResult("mokutil", ["--sb-state"]);
+  const endpointProtection = await pathExists("/opt/CrowdStrike/falconctl") || await pathExists("/opt/sentinelone/bin/sentinelctl") || await pathExists("/opt/microsoft/mdatp/sbin/wdavdaemon");
+  const firewallEnabled = ufw.ok && /Status:\s+active/i.test(ufw.output) || firewalld.ok && /running/i.test(firewalld.output);
+  return [
+    postureCheck(
+      "disk_encryption",
+      encryption.ok ? /crypt/i.test(encryption.output) ? "pass" : "fail" : "unknown",
+      "Encrypted block-device state checked"
+    ),
+    postureCheck(
+      "firewall",
+      ufw.ok || firewalld.ok ? firewallEnabled ? "pass" : "fail" : "unknown",
+      "Host firewall state checked"
+    ),
+    postureCheck(
+      "automatic_updates",
+      unattended.ok || dnfAutomatic.ok ? "pass" : "unknown",
+      "Automatic security update service checked"
+    ),
+    postureCheck(
+      "screen_lock",
+      "unknown",
+      "Desktop screen-lock policy requires MDM attestation"
+    ),
+    postureCheck(
+      "endpoint_protection",
+      endpointProtection ? "pass" : "unknown",
+      endpointProtection ? "Managed endpoint protection detected" : "Endpoint protection could not be verified"
+    ),
+    postureCheck(
+      "secure_boot",
+      secureBoot.ok ? /enabled/i.test(secureBoot.output) ? "pass" : "fail" : "unknown",
+      "Secure Boot state checked"
+    )
+  ];
+}
+async function detectSecurityPosture() {
+  const checks = platform() === "darwin" ? await macosPosture() : platform() === "win32" ? await windowsPosture() : await linuxPosture();
+  return { collected_at: (/* @__PURE__ */ new Date()).toISOString(), checks };
+}
+async function existingDirectories(paths) {
+  const found = [];
+  for (const path of paths) {
+    try {
+      await access(path, constants.R_OK);
+      found.push(path);
+    } catch {
+    }
+  }
+  return found;
+}
+async function detectSkills() {
+  const paths = await existingDirectories([
+    join(homedir(), ".agents", "skills"),
+    join(homedir(), ".claude", "skills"),
+    join(process.cwd(), ".agents", "skills"),
+    join(process.cwd(), ".claude", "skills")
+  ]);
+  const skills = /* @__PURE__ */ new Map();
+  for (const path of paths) {
+    const entries = await readdir(path, { withFileTypes: true }).catch(
+      () => []
+    );
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const source = path.startsWith(process.cwd()) ? "repository" : "local";
+      skills.set(`${source}:${entry.name}`, {
+        key: entry.name,
+        name: entry.name,
+        source,
+        enabled: true
+      });
+    }
+  }
+  return [...skills.values()].slice(0, 500);
+}
+async function detectMcpServers() {
+  const configPaths = await existingDirectories([
+    join(homedir(), ".codex", "config.toml"),
+    join(homedir(), ".claude.json"),
+    join(process.cwd(), ".mcp.json")
+  ]);
+  const names = /* @__PURE__ */ new Set();
+  for (const path of configPaths) {
+    const content = await readFile(path, "utf8").catch(() => "");
+    if (/simplr-dev|@simplr-ai\/dev-mcp/i.test(content))
+      names.add("simplr-dev");
+    if (/github/i.test(content)) names.add("github");
+    if (/sentry/i.test(content)) names.add("sentry");
+    if (/figma/i.test(content)) names.add("figma");
+  }
+  return [...names].map((name) => ({ name, status: "configured" }));
+}
+function detectRepository() {
+  try {
+    const root = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      timeout: 3e3
+    }).trim();
+    const branch = execFileSync("git", ["branch", "--show-current"], {
+      encoding: "utf8",
+      timeout: 3e3,
+      cwd: root
+    }).trim();
+    return [{ name: basename(root), branch: branch || void 0 }];
+  } catch {
+    return [];
+  }
+}
+async function inventory() {
+  return {
+    agents: detectAgents(),
+    skills: await detectSkills(),
+    mcp_servers: await detectMcpServers(),
+    repositories: detectRepository(),
+    active_runs: [...managedProcesses.entries()].map(([pid, process2]) => ({
+      id: `${pid}`,
+      agent: process2.agent,
+      label: process2.label,
+      status: process2.paused ? "blocked" : "running",
+      started_at: process2.started_at
+    })),
+    developer_tools: detectDeveloperTools(),
+    security_posture: await detectSecurityPosture()
+  };
+}
+async function post(url, body, token) {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...token ? { Authorization: `Bearer ${token}` } : {}
+    },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(1e4)
+  });
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok || !payload.content)
+    throw new Error(
+      payload.message || `Simplr request failed (${response.status})`
+    );
+  return payload.content;
+}
+async function saveState(state) {
+  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  const { device_token: legacyToken, ...safeState } = state;
+  void legacyToken;
+  await writeFile(statePath(), `${JSON.stringify(safeState, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  if (platform() !== "win32") await chmod(statePath(), 384);
+}
+async function loadState() {
+  const state = JSON.parse(await readFile(statePath(), "utf8"));
+  state.api_url = apiUrl(state.api_url);
+  if (state.device_token) {
+    await storeCredential(state.workstation_id, state.device_token);
+    delete state.device_token;
+    await saveState(state);
+  }
+  return state;
+}
+function credentialService(workstationId) {
+  return `simplr-connect:${workstationId}`;
+}
+async function storeCredential(workstationId, token) {
+  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  if (platform() === "darwin") {
+    const result2 = spawnSync("/usr/bin/security", ["add-generic-password", "-U", "-a", workstationId, "-s", "Simplr Connect", "-w"], {
+      input: `${token}
+`,
+      encoding: "utf8",
+      timeout: 5e3
+    });
+    if (result2.status !== 0) throw new Error("Could not protect the workstation credential in macOS Keychain");
+    return;
+  }
+  if (platform() === "linux") {
+    const result2 = spawnSync("secret-tool", ["store", "--label=Simplr Connect", "service", "simplr-connect", "workstation", workstationId], {
+      input: `${token}
+`,
+      encoding: "utf8",
+      timeout: 5e3
+    });
+    if (result2.status !== 0) throw new Error("Install and unlock Secret Service support before enrolling this workstation");
+    return;
+  }
+  const script = "$p=[Console]::In.ReadToEnd();$b=[Text.Encoding]::UTF8.GetBytes($p);$e=[Security.Cryptography.ProtectedData]::Protect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Convert]::ToBase64String($e)";
+  const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { input: token, encoding: "utf8", timeout: 5e3, windowsHide: true });
+  if (result.status !== 0 || !result.stdout.trim()) throw new Error("Could not protect the workstation credential with Windows DPAPI");
+  await writeFile(encryptedCredentialPath(), result.stdout.trim(), { encoding: "utf8", mode: 384 });
+}
+async function loadCredential(state) {
+  if (state.device_token) return state.device_token;
+  if (platform() === "darwin") {
+    const result = commandResult("/usr/bin/security", ["find-generic-password", "-a", state.workstation_id, "-s", "Simplr Connect", "-w"], 5e3);
+    if (result.ok && result.output) return result.output;
+  } else if (platform() === "linux") {
+    const result = commandResult("secret-tool", ["lookup", "service", "simplr-connect", "workstation", state.workstation_id], 5e3);
+    if (result.ok && result.output) return result.output;
+  } else {
+    const encrypted = await readFile(encryptedCredentialPath(), "utf8");
+    const script = "$e=[Convert]::FromBase64String([Console]::In.ReadToEnd());$b=[Security.Cryptography.ProtectedData]::Unprotect($e,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Text.Encoding]::UTF8.GetString($b)";
+    const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { input: encrypted, encoding: "utf8", timeout: 5e3, windowsHide: true });
+    if (result.status === 0 && result.stdout.trim()) return result.stdout.trim();
+  }
+  throw new Error(`Protected credential ${credentialService(state.workstation_id)} is unavailable; re-enroll this workstation`);
+}
+async function enroll(code, apiUrlOverride) {
+  const enrollmentApiUrl = apiUrl(apiUrlOverride);
+  const content = await post(`${enrollmentApiUrl}/v1/ai-workstations/enroll`, {
+    code,
+    name: hostname(),
+    os: osName(),
+    architecture: arch(),
+    app_version: APP_VERSION
+  });
+  await storeCredential(content.workstation.id, content.device_token);
+  const state = {
+    api_url: enrollmentApiUrl,
+    workstation_id: content.workstation.id,
+    organization_name: content.organization.name,
+    control_state: "running"
+  };
+  await saveState(state);
+  await sync(state);
+  process.stdout.write(
+    `Connected ${hostname()} to ${state.organization_name}.
+Run "simplr-connect watch" to keep inventory online.
+`
+  );
+}
+async function sync(existingState) {
+  const state = existingState || await loadState();
+  const token = await loadCredential(state);
+  const response = await post(
+    `${state.api_url}/v1/ai-workstations/heartbeat`,
+    {
+      app_version: APP_VERSION,
+      control_state: state.control_state || "running",
+      accept_control_commands: managedProcesses.size > 0,
+      inventory: await inventory()
+    },
+    token
+  );
+  process.stdout.write(`Inventory synced at ${(/* @__PURE__ */ new Date()).toISOString()}.
+`);
+  if (response.command) await applyCommand(state, response.command, true);
+}
+async function heartbeat(state) {
+  const token = await loadCredential(state);
+  const response = await post(
+    `${state.api_url}/v1/ai-workstations/heartbeat`,
+    {
+      app_version: APP_VERSION,
+      control_state: state.control_state || "running",
+      accept_control_commands: managedProcesses.size > 0
+    },
+    token
+  );
+  if (response.command) await applyCommand(state, response.command, false);
+}
+function signalManagedProcesses(signal) {
+  if (platform() === "win32") throw new Error("Pause and resume require the signed Windows service and are not available in companion mode");
+  for (const [pid, managed] of managedProcesses) {
+    process.kill(-pid, signal);
+    managed.paused = signal === "SIGSTOP";
+  }
+}
+async function stopManagedProcesses() {
+  if (managedProcesses.size === 0) return "No Simplr-managed AI processes were running";
+  const processes = [...managedProcesses.entries()];
+  for (const [pid] of processes) {
+    if (platform() === "win32") {
+      const result = commandResult("taskkill.exe", ["/PID", `${pid}`, "/T", "/F"], 1e4);
+      if (!result.ok) throw new Error(`Windows could not terminate managed process ${pid}`);
+    } else {
+      process.kill(-pid, "SIGTERM");
+    }
+  }
+  if (platform() !== "win32") {
+    await new Promise((resolve) => setTimeout(resolve, 1e3));
+    for (const [pid] of processes) {
+      if (!managedProcesses.has(pid)) continue;
+      try {
+        process.kill(-pid, "SIGKILL");
+      } catch {
+      }
+    }
+  }
+  return `${processes.length} Simplr-managed AI process${processes.length === 1 ? "" : "es"} terminated`;
+}
+async function acquireSupervisorLock() {
+  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  const lockPath = supervisorLockPath();
+  const create = async () => {
+    const handle = await open(lockPath, "wx", 384);
+    await handle.writeFile(`${process.pid}
+`);
+    await handle.close();
+  };
+  try {
+    await create();
+  } catch (error) {
+    if (!(error instanceof Error) || !("code" in error) || error.code !== "EEXIST") throw error;
+    const existingPid = Number.parseInt((await readFile(lockPath, "utf8").catch(() => "0")).trim(), 10);
+    let active = false;
+    if (existingPid > 0) {
+      try {
+        process.kill(existingPid, 0);
+        active = true;
+      } catch {
+      }
+    }
+    if (active) throw new Error("Another Simplr-managed AI process is already active on this workstation");
+    await unlink(lockPath).catch(() => void 0);
+    await create();
+  }
+  const release = () => {
+    try {
+      unlinkSync(lockPath);
+    } catch {
+    }
+  };
+  process.once("exit", release);
+  return release;
+}
+async function applyCommand(state, command, inventoryAlreadySynced) {
+  let result = "Command applied";
+  let status = "completed";
+  try {
+    if (command.type === "pause_agents") {
+      signalManagedProcesses("SIGSTOP");
+      state.control_state = "paused";
+      result = `${managedProcesses.size} Simplr-managed process${managedProcesses.size === 1 ? "" : "es"} paused`;
+    }
+    if (command.type === "resume_agents") {
+      signalManagedProcesses("SIGCONT");
+      state.control_state = "running";
+      result = `${managedProcesses.size} Simplr-managed process${managedProcesses.size === 1 ? "" : "es"} resumed`;
+    }
+    if (command.type === "stop_all") {
+      result = await stopManagedProcesses();
+      state.control_state = "stopped";
+    }
+    if (command.type === "sync_inventory" && !inventoryAlreadySynced) await sync(state);
+    await saveState(state);
+  } catch (error) {
+    status = "failed";
+    result = error instanceof Error ? error.message : "Command could not be applied";
+  }
+  const token = await loadCredential(state);
+  await post(`${state.api_url}/v1/ai-workstations/commands/${command.id}/acknowledge`, { status, result }, token);
+}
+async function watch() {
+  const state = await loadState();
+  await sync(state);
+  setInterval(
+    () => void heartbeat(state).catch(
+      (error) => process.stderr.write(
+        `${error instanceof Error ? error.message : "Heartbeat failed"}
+`
+      )
+    ),
+    6e4
+  );
+  setInterval(
+    () => void sync(state).catch(
+      (error) => process.stderr.write(
+        `${error instanceof Error ? error.message : "Inventory sync failed"}
+`
+      )
+    ),
+    15 * 6e4
+  );
+}
+async function runManaged(command, args) {
+  if (!command) throw new Error("Use: simplr-connect run -- <ai-command> [arguments]");
+  const releaseLock = await acquireSupervisorLock();
+  const state = await loadState();
+  const child = spawn(command, args, { cwd: process.cwd(), stdio: "inherit", shell: false, detached: platform() !== "win32" });
+  if (!child.pid) throw new Error("Managed AI process could not be started");
+  const exit = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+  });
+  const managed = {
+    child,
+    agent: basename(command),
+    label: `Managed ${basename(command)} process`,
+    started_at: (/* @__PURE__ */ new Date()).toISOString(),
+    paused: false
+  };
+  managedProcesses.set(child.pid, managed);
+  child.once("exit", () => managedProcesses.delete(child.pid));
+  await sync(state);
+  const heartbeatTimer = setInterval(() => void heartbeat(state).catch((error) => process.stderr.write(`${error instanceof Error ? error.message : "Heartbeat failed"}
+`)), 6e4);
+  const inventoryTimer = setInterval(() => void sync(state).catch((error) => process.stderr.write(`${error instanceof Error ? error.message : "Inventory sync failed"}
+`)), 15 * 6e4);
+  const exitCode = await exit;
+  clearInterval(heartbeatTimer);
+  clearInterval(inventoryTimer);
+  state.control_state = "running";
+  await saveState(state);
+  await sync(state).catch(() => void 0);
+  releaseLock();
+  process.exitCode = exitCode;
+}
+function argument(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : void 0;
+}
+async function main() {
+  const command = process.argv[2];
+  if (command === "enroll") {
+    const code = argument("--code");
+    const apiUrlOverride = argument("--api-url");
+    if (!code)
+      throw new Error("Use: simplr-connect enroll --code <one-time-code>");
+    await enroll(code, apiUrlOverride);
+    return;
+  }
+  if (command === "sync") {
+    await sync();
+    return;
+  }
+  if (command === "watch") {
+    await watch();
+    return;
+  }
+  if (command === "run") {
+    const separator = process.argv.indexOf("--");
+    const managedCommand = separator >= 0 ? process.argv[separator + 1] : process.argv[3];
+    const args = separator >= 0 ? process.argv.slice(separator + 2) : process.argv.slice(4);
+    await runManaged(managedCommand || "", args);
+    return;
+  }
+  process.stdout.write(
+    "Simplr Connect\n\nCommands:\n  enroll --api-url <url> --code <code>\n  sync\n  watch\n  run -- <ai-command> [arguments]\n"
+  );
+}
+main().catch((error) => {
+  process.stderr.write(
+    `${error instanceof Error ? error.message : "Simplr Connect failed"}
+`
+  );
+  process.exitCode = 1;
+});

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@simplr-ai/connect",
+  "version": "0.3.0-dev.0",
+  "description": "Simplr Connect workstation enrollment and AI tool inventory companion",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "simplr-connect": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/doshexchnage/simplr-sdk.git",
+    "directory": "simplr-connect"
+  },
+  "bugs": {
+    "url": "https://github.com/doshexchnage/simplr-sdk/issues"
+  },
+  "homepage": "https://github.com/doshexchnage/simplr-sdk/tree/main/simplr-connect#readme",
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsup",
+    "prepack": "bun run build",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/node": "^25.6.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.9.3"
+  },
+  "keywords": [
+    "simplr",
+    "codex",
+    "claude",
+    "mcp",
+    "workstation"
+  ],
+  "license": "UNLICENSED"
+}