sneakoscope 0.6.26 → 0.6.27

package/README.md

@@ -43,7 +43,7 @@ npm i -g sneakoscope
 sks
 ```
 
-`npm i -g sneakoscope` prints setup guidance without making npm output look like a crash. If OMX, DCodex, or their global/repo-level traces are detected, npm can finish but SKS reports that `sks setup` and `sks doctor --fix` are blocked until human-approved cleanup. Otherwise postinstall best-effort creates an `sks` shim, configures Context7 when Codex CLI is available, and initializes the current project when `INIT_CWD` looks like one. Project setup writes hooks, skills, agents, `$team`, and the `$agent-team` fallback picker alias. Run `sks` for the setup UI.
+`npm i -g sneakoscope` prints setup guidance without looking like a crash. If OMX/DCodex traces exist, npm can finish but SKS blocks setup/doctor until human-approved cleanup. Otherwise postinstall best-effort creates an `sks` shim, configures Context7 when Codex CLI exists, and initializes the current project when `INIT_CWD` looks like one. Project setup writes hooks, skills, agents, `$team`, and `$agent-team`.
 
 Default non-interactive setup:
 
@@ -161,9 +161,9 @@ AGENTS.md                repository rules loaded by Codex agents
 
 Codex App discovers repo-local skills from `.agents/skills/`. The picker should find `$team`, `$ralph`, `$sks`, `$db`, `$gx`, and other lowercase aliases; SKS still accepts `$Team`, `$Ralph`, and uppercase forms. SKS also installs `$agent-team` as a Team fallback alias when the app hides the plain `team` skill name.
 
-SKS uses the official Codex hook behavior: `UserPromptSubmit` can inject additional developer context or block a prompt, `Stop` with `decision: "block"` continues the turn by creating a new continuation prompt, and hook `statusMessage` text makes active SKS routing, guard, permission, and done-gate checks visible in Codex App.
+SKS uses official Codex hook behavior for prompt context injection, blocking, continuation, and visible route or guard status.
 
-After setup, SKS writes `.sneakoscope/harness-guard.json`. Hooks block LLM tool calls that try to edit installed harness control files such as `.codex/hooks.json`, `.codex/config.toml`, `.codex/SNEAKOSCOPE.md`, `.agents/skills/`, `.codex/agents/`, `.sneakoscope/manifest.json`, `.sneakoscope/policy.json`, `.sneakoscope/db-safety.json`, `AGENTS.md`, or `node_modules/sneakoscope`. The only automatic exception is the Sneakoscope engine source repository itself, detected from `package.json` name `sneakoscope` plus `bin/sks.mjs` and `src/core/*`.
+After setup, hooks block LLM tool calls that edit installed harness control files. The automatic exception is the Sneakoscope engine source repository, detected from `package.json` name `sneakoscope` plus `bin/sks.mjs` and `src/core/*`.
 
 ## Project Versioning
 
@@ -816,7 +816,7 @@ npm run doctor
 
 `npm run repo-audit` checks tracked files for risky local paths and high-confidence secret material such as private keys, npm/GitHub/OpenAI-style tokens, local MCP configs, DB dumps, and credential files. It is included in `release:check` and `prepublishOnly`. The package intentionally does not define `prepack`; GitHub installs should not trigger npm's heavier git-dependency preparation path for normal users.
 
-`npm run sizecheck` blocks accidental package bloat during `release:check`, `publish:dry`, and `npm publish`. Defaults: packed tarball `<=136 KiB`, unpacked package `<=500 KiB`, package files `<=40`, and each tracked file `<=256 KiB`. Override only for an intentional release with `SKS_MAX_PACK_BYTES`, `SKS_MAX_UNPACKED_BYTES`, `SKS_MAX_PACK_FILES`, or `SKS_MAX_TRACKED_FILE_BYTES`.
+`npm run sizecheck` blocks accidental package bloat during release and publish checks. Defaults: packed tarball `<=136 KiB`, unpacked package `<=500 KiB`, package files `<=40`, and each tracked file `<=256 KiB`.
 
 `npm run selftest` uses the mock path and does not call a model. Live Ralph runs require a working Codex CLI installation and authentication.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "Sneakoscope Codex",
-  "version": "0.6.26",
+  "version": "0.6.27",
   "description": "Sneakoscope Codex: update-aware, database-safe Codex CLI harness with multi-agent Team orchestration, Ralph no-question execution, autoresearch-style loops, and H-Proof gates.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",

package/src/core/fsx.mjs

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 
-export const PACKAGE_VERSION = '0.6.25';
+export const PACKAGE_VERSION = '0.6.27';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 

package/src/core/version-manager.mjs

@@ -76,8 +76,9 @@ export async function bumpProjectVersion(root, opts = {}) {
     pkg.version = formatSemver(target);
     await writeJsonAtomic(pkgPath, pkg);
   }
+  const sourceVersion = await syncSourcePackageVersion(root, formatSemver(target));
   const synced = await syncPackageLockVersions(root, formatSemver(target));
-  const staged = await stageVersionFiles(root, [pkgPath, ...synced.files]);
+  const staged = await stageVersionFiles(root, [pkgPath, ...synced.files, ...sourceVersion.files]);
   if (!staged.ok) return { ok: false, reason: 'git_add_version_files_failed', stderr: staged.stderr };
   if (statePath) {
     await writeJsonAtomic(statePath, {
@@ -95,7 +96,7 @@ export async function bumpProjectVersion(root, opts = {}) {
     version: formatSemver(target),
     previous_version: formatSemver(current),
     changed,
-    synced_files: synced.relative_files,
+    synced_files: [...synced.relative_files, ...sourceVersion.relative_files],
     staged_files: staged.relative_files,
     updated_at: nowIso()
   }).catch(() => {});
@@ -104,7 +105,7 @@ export async function bumpProjectVersion(root, opts = {}) {
     changed,
     version: formatSemver(target),
     previous_version: formatSemver(current),
-    synced_files: synced.relative_files,
+    synced_files: [...synced.relative_files, ...sourceVersion.relative_files],
     staged_files: staged.relative_files,
     lock_scope: git.common_dir
   };
@@ -187,6 +188,16 @@ async function syncPackageLockVersions(root, version) {
   return { files, relative_files: files.map((file) => path.relative(root, file)) };
 }
 
+async function syncSourcePackageVersion(root, version) {
+  const file = path.join(root, 'src', 'core', 'fsx.mjs');
+  const text = await readFileMaybe(file);
+  if (!text) return { files: [], relative_files: [] };
+  const next = text.replace(/export const PACKAGE_VERSION = ['"][^'"]+['"];/, `export const PACKAGE_VERSION = '${version}';`);
+  if (next === text) return { files: [], relative_files: [] };
+  await writeTextAtomic(file, next);
+  return { files: [file], relative_files: [path.relative(root, file)] };
+}
+
 async function stageVersionFiles(root, files) {
   const existing = [];
   for (const file of files) if (await exists(file)) existing.push(path.relative(root, file));