@simplr-ai/connect 0.7.5 → 0.7.7

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   spawnSync
 } from "child_process";
 import {
-  createHash,
+  createHash as createHash2,
   createPublicKey,
   randomBytes,
   randomUUID,
@@ -18,18 +18,52 @@ import {
   access,
   chmod,
   copyFile,
-  mkdir,
+  mkdir as mkdir2,
   open,
-  readFile,
-  readdir,
+  readFile as readFile2,
+  readdir as readdir2,
   rename,
+  symlink,
   unlink,
   writeFile
 } from "fs/promises";
 import { arch, homedir, hostname, platform } from "os";
-import { basename, join as join2 } from "path";
+import { basename, join as join3 } from "path";
 import { createServer } from "http";
 
+// src/execution-tools.ts
+import { createHash } from "crypto";
+import { cp, mkdir, readFile, readdir, rm } from "fs/promises";
+import { join, relative } from "path";
+async function directoryFingerprint(directory) {
+  const hash = createHash("sha256");
+  const visit = async (current) => {
+    const entries = await readdir(current, { withFileTypes: true });
+    for (const entry of entries.sort(
+      (left, right) => left.name.localeCompare(right.name)
+    )) {
+      const path = join(current, entry.name);
+      const name = relative(directory, path);
+      hash.update(`${entry.isDirectory() ? "directory" : "file"}:${name}\0`);
+      if (entry.isDirectory()) await visit(path);
+      else if (entry.isFile()) hash.update(await readFile(path));
+    }
+  };
+  await visit(directory);
+  return hash.digest("hex");
+}
+async function syncDirectoryContents(source, destination) {
+  const sourceFingerprint = await directoryFingerprint(source);
+  const destinationFingerprint = await directoryFingerprint(destination).catch(
+    () => void 0
+  );
+  if (sourceFingerprint === destinationFingerprint) return false;
+  await rm(destination, { recursive: true, force: true });
+  await mkdir(destination, { recursive: true, mode: 448 });
+  await cp(source, destination, { recursive: true, force: true });
+  return true;
+}
+
 // src/connections.ts
 function connectionKey(connection) {
   return `${connection.api_url}|${connection.organization_id}`;
@@ -86,7 +120,7 @@ function assertTenantEnvelope(connection, command) {
 }
 
 // src/hermes-config.ts
-import { join } from "path";
+import { join as join2 } from "path";
 function organizationIdsNeedingMcpConfiguration(connections, configuredVersion, requiredVersion) {
   if (configuredVersion === requiredVersion) return [];
   return connections.filter((connection) => connection.setup_status === "ready").map((connection) => connection.organization_id);
@@ -102,10 +136,10 @@ function mcpServerNamesFromConfiguration(contents) {
 }
 function mcpConfigurationPaths(homeDirectory, workingDirectory, organizationId) {
   return [
-    join(homeDirectory, ".codex", "config.toml"),
-    join(homeDirectory, ".claude.json"),
-    join(workingDirectory, ".mcp.json"),
-    join(
+    join2(homeDirectory, ".codex", "config.toml"),
+    join2(homeDirectory, ".claude.json"),
+    join2(workingDirectory, ".mcp.json"),
+    join2(
       homeDirectory,
       ".hermes",
       "profiles",
@@ -115,6 +149,102 @@ function mcpConfigurationPaths(homeDirectory, workingDirectory, organizationId)
   ];
 }
 
+// src/work-order-support.ts
+function workOrderClassification(payload) {
+  return {
+    ...typeof payload.work_order_kind === "string" ? { work_order_kind: payload.work_order_kind } : {},
+    ...typeof payload.source_type === "string" ? { source_type: payload.source_type } : {},
+    ...typeof payload.execution_mode === "string" ? { execution_mode: payload.execution_mode } : {}
+  };
+}
+function awaitsFeaturePlanApproval(classification) {
+  return classification.work_order_kind === "feature" && classification.source_type === "feedback" && classification.execution_mode === "plan";
+}
+function isIncompleteCodeWorkResult(classification, output) {
+  if (!["fix", "fix_and_ship"].includes(String(classification.execution_mode)))
+    return false;
+  if (typeof output !== "string") return false;
+  const hasExecutorBlocker = /(?:executor|codex|claude code)[\s\S]{0,160}(?:blocked|unavailable|not installed|oauth)|(?:blocked|unavailable|not installed|oauth)[\s\S]{0,160}(?:executor|codex|claude code)/i.test(
+    output
+  ) || /stopped before code changes due to required executor blocker/i.test(output);
+  return /files changed:\s*(?:none|0)\b/i.test(output) && /pull request:\s*(?:none|not created)\b/i.test(output) && hasExecutorBlocker;
+}
+function isRecoverableIncompleteCompletion(entry) {
+  return entry.type === "run_hermes" && entry.status === "completed" && entry.source_type === "feedback" && isIncompleteCodeWorkResult(entry, entry.result);
+}
+function matchesCommandAcknowledgement(commandId, status, acknowledgement) {
+  return acknowledgement.command_id === commandId && acknowledgement.status === status;
+}
+function isHermesRunCancellation(message) {
+  return message === "Hermes run cancelled" || message === "Hermes run exceeded the 30 minute monitoring window and was stopped";
+}
+function workOrderPayload(classification) {
+  return {
+    ...classification.work_order_kind ? { work_order_kind: classification.work_order_kind } : {},
+    ...classification.source_type ? { source_type: classification.source_type } : {},
+    ...classification.execution_mode ? { execution_mode: classification.execution_mode } : {}
+  };
+}
+async function postWithApiKey(url, body, apiKey) {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-API-Key": apiKey
+    },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(1e4)
+  });
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok || !payload.content)
+    throw new Error(
+      payload.message || `Simplr request failed (${response.status})`
+    );
+  return payload.content;
+}
+function reservedSimplrConnectLane(organizationNamespace2) {
+  return `simplr-connect-reserved:${organizationNamespace2}`;
+}
+function isRunningTaskOwnedBy(task, expectedAssignee) {
+  return (task.task?.status || task.status) === "running" && (task.task?.assignee || task.assignee) === expectedAssignee;
+}
+var terminalCommentMarker = (action) => `[simplr-connect-terminal:${action}]`;
+function taskStatus(task) {
+  return task.task?.status || task.status;
+}
+function taskBlockKind(task) {
+  const blockedEvent = [...task.events || []].reverse().find((event) => event.kind === "blocked");
+  return task.task?.block_kind || task.block_kind || blockedEvent?.payload?.kind;
+}
+function hasTerminalComment(task, action) {
+  const marker = terminalCommentMarker(action);
+  return (task.comments || []).some((comment) => comment.body?.includes(marker));
+}
+function reconcileTerminalBlock(action, detail, operations) {
+  const kind = action === "needs_input" ? "needs_input" : "transient";
+  const matches = (task) => taskStatus(task) === "blocked" && taskBlockKind(task) === kind && hasTerminalComment(task, action);
+  let current = operations.read();
+  if (!current)
+    throw new Error(`Hermes work-board ${action} preflight failed`);
+  if (matches(current)) return true;
+  if (!hasTerminalComment(current, action)) {
+    const body = `${detail}
+
+${terminalCommentMarker(action)}`;
+    const commented = operations.comment(body);
+    current = operations.read();
+    if (!current || !commented && !hasTerminalComment(current, action))
+      throw new Error(`Hermes work-board ${action} comment reconciliation failed`);
+  }
+  if (matches(current)) return true;
+  const blocked = operations.block(kind);
+  current = operations.read();
+  if (current && matches(current)) return true;
+  if (!blocked)
+    throw new Error(`Hermes work-board ${action} reconciliation failed`);
+  throw new Error(`Hermes work-board ${action} verification failed`);
+}
+
 // src/index.ts
 var AmbiguousHermesRunError = class extends Error {
 };
@@ -122,7 +252,7 @@ var KanbanReconciliationError = class extends Error {
 };
 var DeferredUpdateError = class extends Error {
 };
-var APP_VERSION = "0.7.5";
+var APP_VERSION = "0.7.7";
 var STANDALONE_EXECUTABLE = process.env.SIMPLR_CONNECT_STANDALONE === "true";
 var MANIFEST_PUBLIC_KEY = process.env.SIMPLR_CONNECT_MANIFEST_PUBLIC_KEY || "";
 var HERMES_INSTALL_COMMIT = "542e146b055f0d43767ac43cdb9e78054b240263";
@@ -138,45 +268,45 @@ var hermesTraceMutation = Promise.resolve();
 var serviceExecutableSnapshot;
 function stateDirectory() {
   if (platform() === "darwin")
-    return join2(homedir(), "Library", "Application Support", "Simplr Connect");
+    return join3(homedir(), "Library", "Application Support", "Simplr Connect");
   if (platform() === "win32")
-    return join2(
-      process.env.APPDATA || join2(homedir(), "AppData", "Roaming"),
+    return join3(
+      process.env.APPDATA || join3(homedir(), "AppData", "Roaming"),
       "Simplr Connect"
     );
-  return join2(
-    process.env.XDG_CONFIG_HOME || join2(homedir(), ".config"),
+  return join3(
+    process.env.XDG_CONFIG_HOME || join3(homedir(), ".config"),
     "simplr-connect"
   );
 }
 function statePath() {
-  return join2(stateDirectory(), "state.json");
+  return join3(stateDirectory(), "state.json");
 }
 function encryptedCredentialPath(workstationId) {
-  return join2(
+  return join3(
     stateDirectory(),
     workstationId ? `credential-${workstationId}.bin` : "credential.bin"
   );
 }
 function encryptedAgentCredentialPath(workstationId) {
-  return join2(stateDirectory(), `agent-credential-${workstationId}.bin`);
+  return join3(stateDirectory(), `agent-credential-${workstationId}.bin`);
 }
 function encryptedHermesCredentialPath() {
-  return join2(stateDirectory(), "hermes-credential.bin");
+  return join3(stateDirectory(), "hermes-credential.bin");
 }
 function commandJournalPath() {
-  return join2(stateDirectory(), "commands.json");
+  return join3(stateDirectory(), "commands.json");
 }
 function hermesTracePath() {
-  return join2(stateDirectory(), "hermes-traces.json");
+  return join3(stateDirectory(), "hermes-traces.json");
 }
 function serviceLogPath() {
-  return join2(stateDirectory(), "connect.log");
+  return join3(stateDirectory(), "connect.log");
 }
 function serviceExecutablePath() {
   if (!STANDALONE_EXECUTABLE)
-    return join2(stateDirectory(), "simplr-connect.js");
-  return join2(
+    return join3(stateDirectory(), "simplr-connect.js");
+  return join3(
     stateDirectory(),
     platform() === "win32" ? "simplr-connect.exe" : "simplr-connect"
   );
@@ -188,28 +318,28 @@ function updateRollbackPath() {
   return `${serviceExecutablePath()}.rollback`;
 }
 function supervisorLockPath() {
-  return join2(stateDirectory(), "supervisor.lock");
+  return join3(stateDirectory(), "supervisor.lock");
 }
 function serviceLockPath() {
-  return join2(stateDirectory(), "service.lock");
+  return join3(stateDirectory(), "service.lock");
 }
 function serviceDefinitionPath() {
   if (platform() === "darwin")
-    return join2(
+    return join3(
       homedir(),
       "Library",
       "LaunchAgents",
       "ai.simplr.connect.plist"
     );
   if (platform() === "linux")
-    return join2(
+    return join3(
       homedir(),
       ".config",
       "systemd",
       "user",
       "simplr-connect.service"
     );
-  return join2(stateDirectory(), "simplr-connect-service.cmd");
+  return join3(stateDirectory(), "simplr-connect-service.cmd");
 }
 function apiUrl(override) {
   const value = override || process.env.SIMPLR_API_URL;
@@ -319,11 +449,11 @@ function hermesExecutableCandidates() {
     const localAppData = process.env.LOCALAPPDATA;
     if (localAppData)
       candidates.push(
-        join2(localAppData, "hermes", "hermes-agent", "bin", "hermes.exe")
+        join3(localAppData, "hermes", "hermes-agent", "bin", "hermes.exe")
       );
   } else {
     candidates.push(
-      join2(homedir(), ".local", "bin", "hermes"),
+      join3(homedir(), ".local", "bin", "hermes"),
       "/usr/local/bin/hermes"
     );
     if (platform() === "darwin") candidates.push("/opt/homebrew/bin/hermes");
@@ -644,15 +774,15 @@ async function existingDirectories(paths) {
 }
 async function detectSkills() {
   const paths = await existingDirectories([
-    join2(homedir(), ".agents", "skills"),
-    join2(homedir(), ".claude", "skills"),
-    join2(process.cwd(), ".agents", "skills"),
-    join2(process.cwd(), ".claude", "skills"),
-    join2(homedir(), ".hermes", "skills")
+    join3(homedir(), ".agents", "skills"),
+    join3(homedir(), ".claude", "skills"),
+    join3(process.cwd(), ".agents", "skills"),
+    join3(process.cwd(), ".claude", "skills"),
+    join3(homedir(), ".hermes", "skills")
   ]);
   const skills = /* @__PURE__ */ new Map();
   for (const path of paths) {
-    const entries = await readdir(path, { withFileTypes: true }).catch(
+    const entries = await readdir2(path, { withFileTypes: true }).catch(
       () => []
     );
     for (const entry of entries) {
@@ -673,7 +803,7 @@ async function detectMcpServers(state) {
     mcpConfigurationPaths(homedir(), process.cwd(), state.organization_id)
   );
   const contents = await Promise.all(
-    configPaths.map((path) => readFile(path, "utf8").catch(() => ""))
+    configPaths.map((path) => readFile2(path, "utf8").catch(() => ""))
   );
   const names = new Set(mcpServerNamesFromConfiguration(contents));
   for (const content of contents) {
@@ -767,7 +897,7 @@ async function get(url, token) {
   return payload.content;
 }
 async function saveState(state) {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   const { device_token: legacyToken, ...safeState } = state;
   void legacyToken;
   await writeFile(statePath(), `${JSON.stringify(safeState, null, 2)}
@@ -778,7 +908,7 @@ async function saveState(state) {
   if (platform() !== "win32") await chmod(statePath(), 384);
 }
 async function loadState() {
-  const stored = JSON.parse(await readFile(statePath(), "utf8"));
+  const stored = JSON.parse(await readFile2(statePath(), "utf8"));
   if (stored.device_token) {
     await storeCredential(stored.workstation_id, stored.device_token);
     delete stored.device_token;
@@ -789,13 +919,13 @@ async function loadState() {
 }
 async function loadCommandJournal() {
   try {
-    return JSON.parse(await readFile(commandJournalPath(), "utf8"));
+    return JSON.parse(await readFile2(commandJournalPath(), "utf8"));
   } catch {
     return {};
   }
 }
 async function saveCommandJournal(journal) {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   const temporaryPath = `${commandJournalPath()}.${process.pid}.tmp`;
   await writeFile(temporaryPath, `${JSON.stringify(journal, null, 2)}
 `, {
@@ -825,13 +955,13 @@ async function removeCommandJournalEntry(commandId) {
 }
 async function loadHermesTraces() {
   try {
-    return JSON.parse(await readFile(hermesTracePath(), "utf8"));
+    return JSON.parse(await readFile2(hermesTracePath(), "utf8"));
   } catch {
     return {};
   }
 }
 async function saveHermesTraces(traces) {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   const retained = Object.fromEntries(Object.entries(traces).sort(([, left], [, right]) => Date.parse(right.last_event_at) - Date.parse(left.last_event_at)).slice(0, 25));
   const temporaryPath = `${hermesTracePath()}.${process.pid}.tmp`;
   await writeFile(temporaryPath, `${JSON.stringify(retained, null, 2)}
@@ -916,7 +1046,7 @@ async function storeMacKeychainCredential(account, service, token) {
     throw new Error("Could not protect the credential in macOS Keychain");
 }
 async function storeCredential(workstationId, token) {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   if (platform() === "darwin") {
     await storeMacKeychainCredential(workstationId, "Simplr Connect", token);
     return;
@@ -994,10 +1124,10 @@ async function loadCredential(state) {
     );
     if (result.ok && result.output) return result.output;
   } else {
-    const encrypted = await readFile(
+    const encrypted = await readFile2(
       encryptedCredentialPath(state.workstation_id),
       "utf8"
-    ).catch(() => readFile(encryptedCredentialPath(), "utf8"));
+    ).catch(() => readFile2(encryptedCredentialPath(), "utf8"));
     const script = "$e=[Convert]::FromBase64String([Console]::In.ReadToEnd());$b=[Security.Cryptography.ProtectedData]::Unprotect($e,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Text.Encoding]::UTF8.GetString($b)";
     const result = spawnSync(
       "powershell.exe",
@@ -1085,7 +1215,7 @@ async function loadAgentCredential(state) {
     );
     if (result.ok && result.output) return result.output;
   } else {
-    const encrypted = await readFile(
+    const encrypted = await readFile2(
       encryptedAgentCredentialPath(state.workstation_id),
       "utf8"
     );
@@ -1217,7 +1347,7 @@ async function loadHermesCredential(state) {
       }
     }
   } else {
-    const encrypted = await readFile(encryptedHermesCredentialPath(), "utf8");
+    const encrypted = await readFile2(encryptedHermesCredentialPath(), "utf8");
     const script = "$e=[Convert]::FromBase64String([Console]::In.ReadToEnd());$b=[Security.Cryptography.ProtectedData]::Unprotect($e,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Text.Encoding]::UTF8.GetString($b)";
     const result = spawnSync(
       "powershell.exe",
@@ -1306,7 +1436,7 @@ async function streamHermesRunEvents(state, command, runId) {
             hermesRunApprovals.set(runId, {
               approval_command: approvalCommand,
               approval_tool: tool,
-              approval_fingerprint: createHash("sha256").update(JSON.stringify({ run_id: runId, tool, command: approvalCommand })).digest("hex"),
+              approval_fingerprint: createHash2("sha256").update(JSON.stringify({ run_id: runId, tool, command: approvalCommand })).digest("hex"),
               approval_policy_decision: "approval_required"
             });
           }
@@ -1345,9 +1475,9 @@ async function waitForProcess(child) {
   });
 }
 async function installHermes() {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   const windows = platform() === "win32";
-  const scriptPath = join2(
+  const scriptPath = join3(
     stateDirectory(),
     windows ? "hermes-install.ps1" : "hermes-install.sh"
   );
@@ -1404,14 +1534,14 @@ async function installHermes() {
     if (userPath.ok && userPath.output)
       process.env.PATH = `${userPath.output};${process.env.PATH || ""}`;
   } else {
-    process.env.PATH = `${join2(homedir(), ".local", "bin")}:${process.env.PATH || ""}`;
+    process.env.PATH = `${join3(homedir(), ".local", "bin")}:${process.env.PATH || ""}`;
   }
 }
 async function configureHermesEnvironment(apiKey) {
-  const directory = join2(homedir(), ".hermes");
-  const path = join2(directory, ".env");
-  await mkdir(directory, { recursive: true, mode: 448 });
-  const existing = await readFile(path, "utf8").catch(() => "");
+  const directory = join3(homedir(), ".hermes");
+  const path = join3(directory, ".env");
+  await mkdir2(directory, { recursive: true, mode: 448 });
+  const existing = await readFile2(path, "utf8").catch(() => "");
   const settings = {
     API_SERVER_ENABLED: "true",
     API_SERVER_HOST: "127.0.0.1",
@@ -1441,15 +1571,15 @@ function hermesProfileArgs(state) {
   return ["--profile", hermesProfile(state.organization_id)];
 }
 async function configureSimplrMcp(state, executable) {
-  const profileDirectory = join2(
+  const profileDirectory = join3(
     homedir(),
     ".hermes",
     "profiles",
     hermesProfile(state.organization_id)
   );
-  await mkdir(profileDirectory, { recursive: true, mode: 448 });
-  const environmentPath = join2(profileDirectory, ".env");
-  const existing = await readFile(environmentPath, "utf8").catch(() => "");
+  await mkdir2(profileDirectory, { recursive: true, mode: 448 });
+  const environmentPath = join3(profileDirectory, ".env");
+  const existing = await readFile2(environmentPath, "utf8").catch(() => "");
   const settings = {
     SIMPLR_API_URL: state.api_url,
     SIMPLR_API_KEY: await ensureAgentCredential(state),
@@ -1471,7 +1601,7 @@ async function configureSimplrMcp(state, executable) {
   });
   if (platform() !== "win32") await chmod(environmentPath, 384);
   const profileArgs = hermesProfileArgs(state);
-  const wrapperPath = join2(profileDirectory, "simplr-mcp.mjs");
+  const wrapperPath = join3(profileDirectory, "simplr-mcp.mjs");
   const wrapper = `#!/usr/bin/env node
 import { readFileSync } from "node:fs";
 import { spawn } from "node:child_process";
@@ -1530,8 +1660,8 @@ async function ensureSimplrMcpConfiguration(state) {
   state.mcp_configuration_version = SIMPLR_MCP_CONFIGURATION_VERSION;
   await saveState(state);
 }
-async function installHermesSkill(state) {
-  const directory = join2(
+async function installHermesSkills(state) {
+  const directory = join3(
     homedir(),
     ".hermes",
     "profiles",
@@ -1539,9 +1669,9 @@ async function installHermesSkill(state) {
     "skills",
     "simplr-remote-operations"
   );
-  await mkdir(directory, { recursive: true, mode: 448 });
+  await mkdir2(directory, { recursive: true, mode: 448 });
   await writeFile(
-    join2(directory, "SKILL.md"),
+    join3(directory, "SKILL.md"),
     `---
 name: simplr-remote-operations
 description: Execute a verified Simplr work-order envelope delivered by Simplr Connect. Do not use for direct local Hermes requests.
@@ -1575,6 +1705,79 @@ Never expose credentials, environment variables, tokens, keys, cookies, secret f
 `,
     { encoding: "utf8", mode: 384 }
   );
+  const bundledCodexSources = [
+    join3(homedir(), ".hermes", "skills", "autonomous-ai-agents", "codex"),
+    join3(
+      homedir(),
+      ".hermes",
+      "hermes-agent",
+      "skills",
+      "autonomous-ai-agents",
+      "codex"
+    )
+  ];
+  const codexSource = (await Promise.all(
+    bundledCodexSources.map(async (candidate) => {
+      try {
+        await access(join3(candidate, "SKILL.md"), constants.R_OK);
+        return candidate;
+      } catch {
+        return void 0;
+      }
+    })
+  )).find(Boolean);
+  if (!codexSource)
+    throw new Error("Hermes bundled Codex skill is unavailable");
+  const codexDestination = join3(
+    homedir(),
+    ".hermes",
+    "profiles",
+    hermesProfile(state.organization_id),
+    "skills",
+    "autonomous-ai-agents",
+    "codex"
+  );
+  return syncDirectoryContents(codexSource, codexDestination);
+}
+async function ensureCodexExecutor() {
+  if (platform() === "win32") return false;
+  const localBin = join3(homedir(), ".local", "bin");
+  const pathEntries = (process.env.PATH || "").split(":");
+  const pathChanged = !pathEntries.includes(localBin);
+  if (pathChanged)
+    process.env.PATH = `${localBin}:${process.env.PATH || ""}`;
+  if (commandVersion("codex")) return pathChanged;
+  if (platform() !== "darwin") return pathChanged;
+  const destination = join3(localBin, "codex");
+  const candidates = [
+    "/Applications/ChatGPT.app/Contents/Resources/codex",
+    "/Applications/Codex.app/Contents/Resources/codex"
+  ];
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants.X_OK);
+      await mkdir2(localBin, { recursive: true, mode: 448 });
+      await symlink(candidate, destination).catch((error) => {
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "EEXIST")
+          throw error;
+      });
+      if (commandVersion("codex")) return true;
+    } catch {
+    }
+  }
+  return pathChanged;
+}
+async function ensureHermesExecutionTools(state) {
+  let changed = await ensureCodexExecutor();
+  for (const connection of state.connections.filter(
+    (candidate) => candidate.setup_status === "ready"
+  )) {
+    const installed = await installHermesSkills(
+      stateForConnection(state, connection)
+    );
+    changed = changed || installed;
+  }
+  return changed;
 }
 function isSimplrWorkOrder(command) {
   return ["incident", "bug", "feature"].includes(
@@ -1583,11 +1786,47 @@ function isSimplrWorkOrder(command) {
     String(command.payload.execution_mode)
   );
 }
+async function claimSimplrFeedbackInCloud(state, command) {
+  if (String(command.payload.source_type) !== "feedback") return;
+  const sourceId = String(command.payload.source_id || "");
+  if (!sourceId) throw new Error("Simplr feedback source is missing");
+  const agentToken = await ensureAgentCredential(state);
+  await postWithApiKey(
+    `${state.api_url}/v1/feedback/agent/items/${encodeURIComponent(sourceId)}/claim`,
+    {},
+    agentToken
+  );
+}
+function readSimplrKanbanTask(executable, state, taskId) {
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const shown = commandResult(
+      executable,
+      [
+        ...hermesProfileArgs(state),
+        "kanban",
+        "--board",
+        `simplr-${organizationNamespace(state.organization_id)}`,
+        "show",
+        taskId,
+        "--json"
+      ],
+      1e4
+    );
+    if (shown.ok) return JSON.parse(shown.output);
+  }
+  return null;
+}
+function simplrKanbanTaskStatus(task) {
+  return task.task?.status || task.status;
+}
 function ensureSimplrKanbanTask(state, command, prompt) {
   if (!isSimplrWorkOrder(command)) return void 0;
   const executable = detectHermesExecutable();
   if (!executable) throw new Error("Hermes executable is unavailable");
   const boardSlug = `simplr-${organizationNamespace(state.organization_id)}`;
+  const reservedAssignee = reservedSimplrConnectLane(
+    organizationNamespace(state.organization_id)
+  );
   const boards = commandResult(
     executable,
     [...hermesProfileArgs(state), "kanban", "boards", "list", "--json"],
@@ -1664,10 +1903,12 @@ ${prompt}`;
       `simplr-connect:${state.organization_id}:${command.id}`,
       "--created-by",
       "Simplr Connect",
+      "--assignee",
+      reservedAssignee,
       "--skill",
       "simplr-remote-operations",
       "--initial-status",
-      "blocked",
+      "running",
       "--json"
     ],
     15e3
@@ -1676,12 +1917,33 @@ ${prompt}`;
     throw new Error("Hermes could not persist the Simplr work order");
   const task = JSON.parse(createdTask.output);
   if (!task.id) throw new Error("Hermes did not return a work-order task id");
-  updateSimplrKanbanTask(
-    state,
-    task.id,
-    "comment",
-    "Simplr Connect started the governed Hermes run. Use Simplr for approvals and deployment decisions; this card preserves the durable handoff."
-  );
+  let current = readSimplrKanbanTask(executable, state, task.id);
+  if (!current) throw new Error("Hermes could not verify the Simplr work-order task");
+  if (simplrKanbanTaskStatus(current) === "ready") {
+    const claimed = commandResult(
+      executable,
+      [
+        ...hermesProfileArgs(state),
+        "kanban",
+        "--board",
+        boardSlug,
+        "claim",
+        task.id,
+        "--ttl",
+        "3600"
+      ],
+      1e4
+    );
+    current = readSimplrKanbanTask(executable, state, task.id);
+    if (!claimed.ok && simplrKanbanTaskStatus(current || {}) !== "running") {
+      throw new Error("Hermes could not claim the Simplr work-order task");
+    }
+  }
+  if (!current || !isRunningTaskOwnedBy(current, reservedAssignee)) {
+    throw new Error(
+      "Hermes Simplr work-order task is not running in its reserved ownership lane"
+    );
+  }
   return task.id;
 }
 function updateSimplrKanbanTask(state, taskId, action, detail) {
@@ -1710,7 +1972,47 @@ function updateSimplrKanbanTask(state, taskId, action, detail) {
       1e4
     ).ok;
   }
-  const args = action === "complete" ? [
+  if (action === "failed" || action === "needs_input") {
+    try {
+      return reconcileTerminalBlock(action, detail.slice(0, 2e3), {
+        read: () => readSimplrKanbanTask(executable, state, taskId),
+        comment: (body) => commandResult(
+          executable,
+          [
+            ...hermesProfileArgs(state),
+            "kanban",
+            "--board",
+            `simplr-${organizationNamespace(state.organization_id)}`,
+            "comment",
+            "--author",
+            "Simplr Connect",
+            taskId,
+            body
+          ],
+          1e4
+        ).ok,
+        block: (kind) => commandResult(
+          executable,
+          [
+            ...hermesProfileArgs(state),
+            "kanban",
+            "--board",
+            `simplr-${organizationNamespace(state.organization_id)}`,
+            "block",
+            "--kind",
+            kind,
+            taskId
+          ],
+          1e4
+        ).ok
+      });
+    } catch (error) {
+      throw new KanbanReconciliationError(
+        error instanceof Error ? error.message : `Hermes work-board ${action} reconciliation failed`
+      );
+    }
+  }
+  const args = [
     ...hermesProfileArgs(state),
     "kanban",
     "--board",
@@ -1724,44 +2026,27 @@ function updateSimplrKanbanTask(state, taskId, action, detail) {
       source: "simplr-connect",
       rules_version: "simplr-work-order-v1"
     })
-  ] : [
-    ...hermesProfileArgs(state),
-    "kanban",
-    "--board",
-    `simplr-${organizationNamespace(state.organization_id)}`,
-    "block",
-    "--kind",
-    "transient",
-    taskId,
-    detail.slice(0, 2e3)
   ];
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    if (commandResult(executable, args, 1e4).ok) return true;
-    const shown = commandResult(
-      executable,
-      [
-        ...hermesProfileArgs(state),
-        "kanban",
-        "--board",
-        `simplr-${organizationNamespace(state.organization_id)}`,
-        "show",
-        taskId,
-        "--json"
-      ],
-      1e4
+  const matchesAction = (current) => {
+    const currentStatus = simplrKanbanTaskStatus(current);
+    return action === "complete" && currentStatus === "done";
+  };
+  const initial = readSimplrKanbanTask(executable, state, taskId);
+  if (!initial) {
+    throw new KanbanReconciliationError(
+      `Hermes work-board ${action} preflight failed`
     );
-    if (shown.ok) {
-      const current = JSON.parse(shown.output);
-      const currentStatus = current.task?.status || current.status;
-      if (action === "complete" && currentStatus === "done" || action === "failed" && currentStatus === "blocked")
-        return true;
-    }
   }
+  if (matchesAction(initial)) return true;
+  if (commandResult(executable, args, 1e4).ok) return true;
+  const reconciled = readSimplrKanbanTask(executable, state, taskId);
+  if (reconciled && matchesAction(reconciled)) return true;
   throw new KanbanReconciliationError(
     `Hermes work-board ${action} reconciliation failed`
   );
 }
 async function setupHermes(state, interactiveOAuth) {
+  await ensureCodexExecutor();
   let executable = detectHermesExecutable();
   if (!executable) {
     await installHermes();
@@ -1812,7 +2097,7 @@ async function setupHermes(state, interactiveOAuth) {
   );
   await configureHermesEnvironment(apiKey);
   await configureSimplrMcp(state, executable);
-  await installHermesSkill(state);
+  await installHermesSkills(state);
   const multiplex = commandResult(
     executable,
     [
@@ -2073,11 +2358,15 @@ async function acknowledgeCommand(state, commandId, status, result) {
   let lastError;
   for (let attempt = 1; attempt <= 5; attempt += 1) {
     try {
-      await post(
+      const acknowledged = await post(
         `${state.api_url}/v1/ai-workstations/commands/${commandId}/acknowledge`,
         { status, result: result.slice(0, 5e3) },
         token
       );
+      if (!matchesCommandAcknowledgement(commandId, status, acknowledged))
+        throw new Error(
+          `Command acknowledgement remained ${acknowledged.status}`
+        );
       await removeCommandJournalEntry(commandId);
       return;
     } catch (error) {
@@ -2156,6 +2445,23 @@ async function monitorHermesRun(state, command, runId, startedAt) {
       }
       if (status.status === "completed") {
         const output = status.output || "Hermes completed the task";
+        if (isIncompleteCodeWorkResult(
+          workOrderClassification(command.payload),
+          output
+        )) {
+          await updateCommandJournal({
+            command_id: command.id,
+            type: command.type,
+            label: command.reason,
+            ...workOrderClassification(command.payload),
+            run_id: runId,
+            status: "failed",
+            result: output,
+            started_at: startedAt,
+            updated_at: (/* @__PURE__ */ new Date()).toISOString()
+          });
+          throw new Error(output);
+        }
         await updateHermesTrace(command, state, runId, {
           status: "completed",
           current_action: "Hermes run completed",
@@ -2167,13 +2473,24 @@ async function monitorHermesRun(state, command, runId, startedAt) {
           command_id: command.id,
           type: command.type,
           label: command.reason,
+          ...workOrderClassification(command.payload),
           run_id: runId,
           status: "completed",
           result: output,
           started_at: startedAt,
           updated_at: (/* @__PURE__ */ new Date()).toISOString()
         });
-        updateSimplrKanbanTask(state, taskId, "complete", output);
+        const awaitingPlanApproval = awaitsFeaturePlanApproval(
+          workOrderClassification(command.payload)
+        );
+        updateSimplrKanbanTask(
+          state,
+          taskId,
+          awaitingPlanApproval ? "needs_input" : "complete",
+          awaitingPlanApproval ? `Feature plan ready for comment and approval. Review the plan below, add guidance, then explicitly approve a new implementation work order.
+
+${output}` : output
+        );
         return output;
       }
       if (status.status === "cancelled")
@@ -2186,6 +2503,7 @@ async function monitorHermesRun(state, command, runId, startedAt) {
           command_id: command.id,
           type: command.type,
           label: command.reason,
+          ...workOrderClassification(command.payload),
           run_id: runId,
           status: run.status,
           started_at: startedAt,
@@ -2197,6 +2515,7 @@ async function monitorHermesRun(state, command, runId, startedAt) {
             command_id: command.id,
             type: command.type,
             label: command.reason,
+            ...workOrderClassification(command.payload),
             run_id: runId,
             status: run.status,
             approval_command: approval.approval_command,
@@ -2236,7 +2555,7 @@ async function monitorHermesRun(state, command, runId, startedAt) {
     );
   } catch (error) {
     const message = error instanceof Error ? error.message : "Hermes run failed";
-    const cancelled = /cancelled|stopped/i.test(message);
+    const cancelled = isHermesRunCancellation(message);
     await updateHermesTrace(command, state, runId, {
       status: cancelled ? "cancelled" : "failed",
       current_action: cancelled ? "Hermes run stopped" : "Hermes run failed",
@@ -2254,11 +2573,16 @@ async function runHermesCommand(state, command) {
   const journal = await loadCommandJournal();
   const existing = journal[command.id];
   if (existing?.status === "completed") {
+    if (isIncompleteCodeWorkResult(existing, existing.result))
+      throw new Error(existing.result || "Hermes code work did not complete");
+    const awaitingPlanApproval = awaitsFeaturePlanApproval(existing);
     updateSimplrKanbanTask(
       state,
       existing.kanban_task_id,
-      "complete",
-      existing.result || "Hermes completed the task"
+      awaitingPlanApproval ? "needs_input" : "complete",
+      awaitingPlanApproval ? `Feature plan ready for comment and approval. Review the plan below, add guidance, then explicitly approve a new implementation work order.
+
+${existing.result || "Hermes completed the plan"}` : existing.result || "Hermes completed the task"
     );
     return "Hermes completed this task before Simplr reconnected";
   }
@@ -2273,6 +2597,21 @@ async function runHermesCommand(state, command) {
   if (!runId) {
     const prompt = typeof command.payload.prompt === "string" ? command.payload.prompt : "";
     if (!prompt) throw new Error("Hermes task prompt is missing");
+    if (existing?.status !== "preparing") {
+      await updateCommandJournal({
+        command_id: command.id,
+        organization_id: state.organization_id,
+        organization_name: state.organization_name,
+        workstation_id: state.workstation_id,
+        type: command.type,
+        label: command.reason,
+        ...workOrderClassification(command.payload),
+        status: "preparing",
+        started_at: startedAt,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+    await claimSimplrFeedbackInCloud(state, command);
     const kanbanTaskId = ensureSimplrKanbanTask(state, command, prompt);
     await updateCommandJournal({
       command_id: command.id,
@@ -2281,6 +2620,7 @@ async function runHermesCommand(state, command) {
       workstation_id: state.workstation_id,
       type: command.type,
       label: command.reason,
+      ...workOrderClassification(command.payload),
       status: "creating",
       kanban_task_id: kanbanTaskId,
       started_at: startedAt,
@@ -2303,6 +2643,7 @@ async function runHermesCommand(state, command) {
       command_id: command.id,
       type: command.type,
       label: command.reason,
+      ...workOrderClassification(command.payload),
       run_id: runId,
       status: "running",
       started_at: startedAt,
@@ -2446,7 +2787,7 @@ async function stopManagedProcesses() {
   return `${processes.length} Simplr-managed AI process${processes.length === 1 ? "" : "es"} terminated`;
 }
 async function acquireProcessLock(lockPath, activeMessage) {
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   const create = async () => {
     const handle = await open(lockPath, "wx", 384);
     await handle.writeFile(`${process.pid}
@@ -2459,7 +2800,7 @@ async function acquireProcessLock(lockPath, activeMessage) {
     if (!(error instanceof Error) || !("code" in error) || error.code !== "EEXIST")
       throw error;
     const existingPid = Number.parseInt(
-      (await readFile(lockPath, "utf8").catch(() => "0")).trim(),
+      (await readFile2(lockPath, "utf8").catch(() => "0")).trim(),
       10
     );
     let active = false;
@@ -2612,6 +2953,7 @@ async function applyCommand(state, command, inventoryAlreadySynced) {
         command_id: command.id,
         type: command.type,
         label: command.reason,
+        ...workOrderClassification(command.payload),
         run_id: existing?.run_id,
         status: "failed",
         started_at: existing?.started_at || (/* @__PURE__ */ new Date()).toISOString(),
@@ -2667,22 +3009,38 @@ async function resumeHermesRuns(state) {
         workstation_id: connection.workstation_id,
         type: "run_hermes",
         reason: entry.label,
-        payload: {}
+        payload: workOrderPayload(entry)
       },
       false
     );
   }
 }
+async function reconcileIncompleteCompletedRuns(state) {
+  const journal = await loadCommandJournal();
+  for (const entry of Object.values(journal)) {
+    if (!isRecoverableIncompleteCompletion(entry)) continue;
+    const connection = entry.organization_id ? state.connections.find(
+      (candidate) => candidate.organization_id === entry.organization_id && candidate.workstation_id === entry.workstation_id
+    ) : state.connections.length === 1 ? state.connections[0] : void 0;
+    if (!connection) continue;
+    await acknowledgeCommand(
+      stateForConnection(state, connection),
+      entry.command_id,
+      "failed",
+      entry.result || "Hermes code work did not complete"
+    );
+  }
+}
 async function serviceInstallationPresent() {
   try {
     await access(serviceExecutablePath(), constants.R_OK);
     if (serviceExecutableSnapshot) {
-      const deployed = await readFile(serviceExecutablePath());
-      const expectedHash = createHash("sha256").update(serviceExecutableSnapshot).digest("hex");
-      const deployedHash = createHash("sha256").update(deployed).digest("hex");
+      const deployed = await readFile2(serviceExecutablePath());
+      const expectedHash = createHash2("sha256").update(serviceExecutableSnapshot).digest("hex");
+      const deployedHash = createHash2("sha256").update(deployed).digest("hex");
       if (expectedHash !== deployedHash) return false;
     }
-    const definition = await readFile(serviceDefinitionPath(), "utf8");
+    const definition = await readFile2(serviceDefinitionPath(), "utf8");
     if (!definition.includes(serviceExecutablePath()) || !definition.includes("watch"))
       return false;
     if (platform() !== "win32") return true;
@@ -2724,10 +3082,13 @@ async function watch() {
   const state = await loadState();
   const executableSource = STANDALONE_EXECUTABLE ? process.execPath : process.argv[1];
   if (executableSource)
-    serviceExecutableSnapshot = await readFile(executableSource).catch(
+    serviceExecutableSnapshot = await readFile2(executableSource).catch(
       () => void 0
     );
+  const executionToolsChanged = await ensureHermesExecutionTools(state);
   await ensureSimplrMcpConfiguration(state);
+  if (executionToolsChanged) await restartHermesGateway(state);
+  await reconcileIncompleteCompletedRuns(state);
   await resumeHermesRuns(state);
   let nextInventoryAt = 0;
   let nextServiceAuditAt = 0;
@@ -2940,10 +3301,10 @@ function systemdValue(value) {
 }
 async function deployServiceExecutable() {
   const source = STANDALONE_EXECUTABLE ? process.execPath : process.argv[1];
-  const executable = serviceExecutableSnapshot || (source ? await readFile(source) : void 0);
+  const executable = serviceExecutableSnapshot || (source ? await readFile2(source) : void 0);
   if (!executable)
     throw new Error("Simplr Connect executable path is unavailable");
-  await mkdir(stateDirectory(), { recursive: true, mode: 448 });
+  await mkdir2(stateDirectory(), { recursive: true, mode: 448 });
   await writeFile(serviceExecutablePath(), executable, {
     mode: 448
   });
@@ -2956,9 +3317,9 @@ async function installService(activate = true) {
   const nodePath = process.execPath;
   const connectPath = serviceExecutablePath();
   if (platform() === "darwin") {
-    const directory = join2(homedir(), "Library", "LaunchAgents");
+    const directory = join3(homedir(), "Library", "LaunchAgents");
     const path = serviceDefinitionPath();
-    await mkdir(directory, { recursive: true, mode: 448 });
+    await mkdir2(directory, { recursive: true, mode: 448 });
     const programArguments = STANDALONE_EXECUTABLE ? [connectPath, "watch"] : [nodePath, connectPath, "watch"];
     const plistArguments = programArguments.map((value) => `<string>${xmlValue(value)}</string>`).join("");
     const plist = `<?xml version="1.0" encoding="UTF-8"?>
@@ -2989,9 +3350,9 @@ async function installService(activate = true) {
     return "Simplr Connect self-healing service installed";
   }
   if (platform() === "linux") {
-    const directory = join2(homedir(), ".config", "systemd", "user");
+    const directory = join3(homedir(), ".config", "systemd", "user");
     const path = serviceDefinitionPath();
-    await mkdir(directory, { recursive: true, mode: 448 });
+    await mkdir2(directory, { recursive: true, mode: 448 });
     const serviceCommand = STANDALONE_EXECUTABLE ? `${systemdValue(connectPath)} watch` : `${systemdValue(nodePath)} ${systemdValue(connectPath)} watch`;
     const unit = `[Unit]
 Description=Simplr Connect secure workstation proxy
@@ -3006,7 +3367,7 @@ RestartSec=10
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
-ReadWritePaths=${systemdValue(stateDirectory())} ${systemdValue(join2(homedir(), ".hermes"))}
+ReadWritePaths=${systemdValue(stateDirectory())} ${systemdValue(join3(homedir(), ".hermes"))}
 
 [Install]
 WantedBy=default.target
@@ -3195,7 +3556,7 @@ async function updateConnector(apply, expectedVersion, reportStage, commandId, o
     status: "downloaded",
     artifact_sha256: artifact.sha256
   });
-  if (bytes.byteLength !== artifact.size || createHash("sha256").update(bytes).digest("hex") !== artifact.sha256)
+  if (bytes.byteLength !== artifact.size || createHash2("sha256").update(bytes).digest("hex") !== artifact.sha256)
     throw new Error("Downloaded update failed integrity verification");
   await reportStage?.({
     status: "verified",
@@ -3242,7 +3603,7 @@ async function updateConnector(apply, expectedVersion, reportStage, commandId, o
       1e4
     );
   else {
-    const helperPath = join2(stateDirectory(), "complete-update.ps1");
+    const helperPath = join3(stateDirectory(), "complete-update.ps1");
     const powershellValue = (value) => `'${value.replace(/'/g, "''")}'`;
     const helper = `$ErrorActionPreference = "Stop"\r
 & schtasks.exe /End /TN "Simplr Connect" | Out-Null\r

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simplr-ai/connect",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Simplr Connect workstation enrollment and AI tool inventory companion",
   "type": "module",
   "main": "dist/index.js",