@simplr-ai/connect 0.3.0-dev.0 → 0.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +39 -1
  2. package/dist/index.js +2930 -203
  3. package/package.json +7 -4
package/README.md CHANGED
@@ -2,12 +2,32 @@
2
2
 
3
3
  Simplr Connect enrolls a developer workstation and reports a bounded security inventory of installed AI tools, skill names, configured MCP servers, developer-tool versions, current Git repository and operating-system security posture.
4
4
 
5
+ Production releases include a notarized universal macOS disk image, Authenticode-signed Windows executables for x64 and ARM64, and standalone Linux archives for x64 and ARM64. Opening the standalone app starts a localhost-only browser wizard, so Node, Bun and npm are not required on the workstation.
6
+
7
+ ```bash
8
+ npx -y @simplr-ai/connect@0.4.0 enroll --api-url <simplr-api-url> --code <one-time-code>
9
+ ```
10
+
11
+ To connect a Hermes installation on the same machine, add `--setup-hermes`. Simplr Connect runs Hermes's own Nous Portal OAuth wizard, enables the Hermes API only on `127.0.0.1`, creates a random local API key, protects its copy in the operating-system credential store, starts the Hermes gateway and reports bounded health/capability metadata to Simplr.
12
+
5
13
  ```bash
6
- npx -y @simplr-ai/connect@dev enroll --api-url <simplr-api-url> --code <one-time-code>
14
+ npx -y @simplr-ai/connect@0.4.0 enroll --api-url <simplr-api-url> --code <one-time-code> --setup-hermes --install-service
7
15
  ```
8
16
 
17
+ The Hermes refresh token and API key never leave the workstation. Remote tasks arrive over the existing outbound Simplr heartbeat and are forwarded to the local Hermes Runs API. Use `simplr-connect hermes-setup` to repair or repeat the OAuth setup.
18
+
19
+ Install the persistent per-user service after enrollment when it was not included in the enrollment command:
20
+
21
+ ```bash
22
+ simplr-connect service-install
23
+ ```
24
+
25
+ The service starts at login, restarts after crashes, serializes cloud polling, reconciles in-flight Hermes runs from a mode-0600 local journal and repairs the Hermes gateway after repeated health failures. Run `simplr-connect repair` for an immediate local health check and repair. macOS uses LaunchAgent, Linux uses a hardened systemd user service and Windows uses a scheduled user task with a restart loop.
26
+
9
27
  Use `simplr-connect sync` for a one-off inventory refresh or `simplr-connect watch` for a lightweight heartbeat every minute and full inventory reconciliation every 15 minutes.
10
28
 
29
+ Hermes run prompts and results are encrypted at rest by Simplr. Approval requests and stop controls are relayed through the outbound workstation connection; the local Hermes API remains bound to localhost.
30
+
11
31
  To make an AI process remotely controllable, start it through the companion:
12
32
 
13
33
  ```bash
@@ -20,3 +40,21 @@ Pause, resume and stop commands are accepted only while Simplr Connect is superv
20
40
  Security posture checks cover disk encryption, firewall, automatic updates, screen lock, endpoint protection and Secure Boot where the operating system permits an unprivileged check. Simplr receives only pass, fail, unknown or not-applicable status with fixed evidence labels. It does not upload raw command output, source files, skill contents, prompt contents, environment variables, shell history, usernames, local file paths or developer credentials.
21
41
 
22
42
  The workstation credential is stored in macOS Keychain, Linux Secret Service or a Windows DPAPI-protected file. Enrollment fails when the platform credential store is unavailable rather than falling back to plaintext.
43
+
44
+ ## Commercial release
45
+
46
+ Create a `connect-v<package-version>` tag to run the release pipeline. The protected `connect-release` GitHub environment must provide:
47
+
48
+ - `APPLE_CERTIFICATE_P12`
49
+ - `APPLE_CERTIFICATE_PASSWORD`
50
+ - `APPLE_DEVELOPER_ID_APPLICATION`
51
+ - `APPLE_NOTARY_KEY`
52
+ - `APPLE_NOTARY_KEY_ID`
53
+ - `APPLE_NOTARY_ISSUER_ID`
54
+ - `WINDOWS_SIGNING_CERTIFICATE_PFX`
55
+ - `WINDOWS_SIGNING_CERTIFICATE_PASSWORD`
56
+ - `SIMPLR_CONNECT_MANIFEST_SIGNING_KEY`
57
+
58
+ The manifest signing key is an Ed25519 private key encoded as base64 PEM. Release jobs fail closed when signing credentials are missing. GitHub Actions dependencies are commit-pinned, macOS artifacts are hardened-runtime signed and notarized, Windows artifacts are timestamped and Authenticode verified, and every published artifact is covered by the signed SHA-256 release manifest.
59
+
60
+ Set the matching base64 PEM public key as the `SIMPLR_CONNECT_MANIFEST_PUBLIC_KEY` GitHub Actions repository variable. It is embedded into standalone binaries. `simplr-connect update-check` verifies release metadata without changing the workstation; `simplr-connect update` verifies the manifest signature and artifact hash, retains the previous executable and rolls back if the new supervised service exits before its first successful heartbeat.