sneakoscope 0.7.25 → 0.7.33

package/README.md

@@ -11,11 +11,10 @@ Install globally, then run `sks` from either a project or any global shell locat
 ```sh
 npm i -g sneakoscope
 sks root
-sks bootstrap
 sks
 ```
 
-`sks root` tells you whether SKS found a project root or is using the per-user global runtime root. Outside a repo/project marker, runtime commands such as `sks`, `sks deps check`, `sks pipeline status`, and `sks team ...` use that global root instead of writing `.sneakoscope` into the random current directory.
+`npm i -g sneakoscope` automatically refreshes the `sks` command shim, global Codex App `$` skills, and SKS bootstrap surface. When the install is run from a project, postinstall bootstraps that project. When it is run outside a repo/project marker, postinstall bootstraps the per-user global runtime root instead of writing `.sneakoscope` into a random current directory. `sks root` tells you which root SKS will use.
 
 If you only want a one-shot run without keeping `sks` installed globally:
 
@@ -43,8 +42,9 @@ sks selftest --mock
 
 | Area | What it does |
 | --- | --- |
-| CLI runtime | `sks tmux open` and `sks --mad` explicitly launch Codex CLI with tmux; bare `sks` only prints help/readiness surfaces. |
+| CLI runtime | Bare `sks` opens or reuses the default tmux Codex CLI workspace. `sks tmux open` remains the explicit form for session/workspace flags, and `sks --mad` launches the high-reasoning auto-review profile. |
 | Codex App commands | Installs generated skills so `$Team`, `$From-Chat-IMG`, `$DFix`, `$QA-LOOP`, `$PPT`, `$Goal`, `$DB`, `$Wiki`, `$Help`, and related routes are visible in prompt workflows. |
+| OpenClaw agents | Generates an OpenClaw skill package so OpenClaw agents can attach `sneakoscope-codex`, enable the `shell` tool, and discover/use SKS commands from the target repo root. |
 | Pipeline plans | Writes `pipeline-plan.json` for stateful routes so the runtime lane, kept stages, skipped stages, verification commands, and no-unrequested-fallback invariant are visible with `sks pipeline plan`. |
 | Team orchestration | Runs substantial work through score-based ambiguity handling, scouts, TriWiki refresh, debate, runtime task graphs, worker inboxes, implementation, review, cleanup, reflection, and Honest Mode; narrow work should use Proof Field evidence to skip unrelated pipeline work instead of expanding Team. |
 | Skill dreaming | Records cheap generated-skill usage counters in JSON and only periodically scans `.agents/skills` for keep, merge, prune, and improvement candidates. Reports are recommendation-only and never delete skills automatically. |
@@ -74,9 +74,9 @@ Install tmux from [tmux.dev/download](https://www.tmux.dev/download). On macOS,
 brew install tmux
 ```
 
-`sks --mad` is stricter than the normal runtime path:
+The default `sks` runtime checks npm for newer `sneakoscope` and `@openai/codex` versions before opening tmux and prompts to update when the terminal can answer y/n. If you approve the Codex CLI update, SKS installs `@openai/codex@latest` and opens tmux with the version visible on PATH. `sks --mad` is stricter than the normal runtime path:
 
-- Checks npm for a newer `sneakoscope` before launch and asks whether to update when the terminal can answer y/n.
+- Checks npm for newer `sneakoscope` and `@openai/codex` versions before launch and asks whether to update when the terminal can answer y/n.
 - Installs the latest Codex CLI with `npm i -g @openai/codex@latest` when it is missing and you approve or pass `--yes`.
 - Requires tmux 3.x or newer before opening the session.
 - Creates or reuses a named detached tmux session, splits panes, and prints the attach command.
@@ -90,10 +90,9 @@ Use this when you want `sks` available from any repo:
 ```sh
 npm i -g sneakoscope
 sks root
-sks bootstrap
 ```
 
-`sks` commands work even when no project root is present. Project-aware commands use the nearest `.sneakoscope`, `.dcodex`, or `.git` root; if none exists, SKS uses a per-user global runtime root. `sks bootstrap` still initializes the current project when you want project-local hooks, skills, and TriWiki state.
+`sks` commands work even when no project root is present. Project-aware commands use the nearest `.sneakoscope`, `.dcodex`, or `.git` root; if none exists, SKS uses a per-user global runtime root. Global npm install/upgrade automatically bootstraps the current project when a project marker is present, otherwise it bootstraps the global runtime root. Run `sks bootstrap` manually only when you intentionally want to initialize or repair the current project after install.
 
 Project setup writes shared `.gitignore` entries for generated SKS files: `.sneakoscope/`, `.codex/`, `.agents/`, and managed `AGENTS.md`. Setup, doctor repair, and npm postinstall refreshes also compare the previous SKS generated-file manifest with the current package templates and prune stale SKS-generated legacy skills or agent files while preserving user-owned custom skills. Use `sks setup --local-only` when you want those excludes kept only in `.git/info/exclude`.
 
@@ -161,12 +160,15 @@ sks fix-path
 ### Open Codex CLI With tmux
 
 ```sh
+sks
 sks tmux open
 sks tmux check
 sks tmux status --once
 ```
 
-`sks tmux open` creates or reuses a named tmux session for Codex CLI only when that is explicitly requested. `sks` and `sks tmux check` are diagnostic/help surfaces and do not start a workspace.
+Bare `sks` creates or reuses the default named tmux session for Codex CLI. Use `sks tmux open` when you need explicit `--workspace` / `--session` flags, `sks tmux check` for readiness without launching, and `sks help` for CLI help.
+
+Before opening tmux, SKS checks the installed Codex CLI against npm `@openai/codex@latest`. If a newer version exists, it asks `Y/n`; answering `y` updates automatically with `npm i -g @openai/codex@latest` and then opens tmux with the updated Codex CLI.
 
 ### MAD tmux Launch
 
@@ -301,6 +303,61 @@ Use `sks dollar-commands` to confirm that terminal discovery and Codex App promp
 
 TriWiki is intentionally sparse: `sks wiki sweep` records demote, soft-forget, archive, delete, promote-to-skill, and promote-to-rule candidates instead of injecting every old claim into future prompts. `sks harness fixture` validates the broader Harness Growth Factory contract: deliberate forgetting fixtures, skill card metadata, experiment schema, tool-error taxonomy, permission profiles, MultiAgentV2 defaults, and tmux cockpit view coverage. `sks code-structure scan` flags handwritten files above 1000/2000/3000-line thresholds so new logic can be extracted before command files become harder to maintain.
 
+## OpenClaw Agent Usage
+
+Sneakoscope can generate an OpenClaw skill package for agents that need to operate SKS-enabled repositories.
+
+```sh
+sks openclaw install
+sks openclaw path
+```
+
+By default this writes:
+
+```text
+~/.openclaw/skills/sneakoscope-codex/
+```
+
+The generated skill contains `manifest.yaml`, `SKILL.md`, a skill README, and `openclaw-agent-config.example.yaml`. If you use a custom OpenClaw home, set `OPENCLAW_HOME` or pass `--dir`:
+
+```sh
+OPENCLAW_HOME=/opt/openclaw sks openclaw install
+sks openclaw install --dir /opt/openclaw/skills/sneakoscope-codex
+```
+
+Attach the skill to an OpenClaw agent with the built-in `shell` tool enabled:
+
+```yaml
+agents:
+  coding-agent:
+    tools:
+      - shell
+    env:
+      SKS_OPENCLAW: "1"
+    skills:
+      - sneakoscope-codex
+```
+
+`SKS_OPENCLAW=1` tells SKS that commands are running from OpenClaw. In that mode, SKS auto-approves update/install prompts such as the Codex CLI update check before tmux launch, instead of waiting for a human `Y/n` response.
+
+Then prompt the OpenClaw agent from the target repo root:
+
+```text
+Run sks root, inspect AGENTS.md, then use the SKS Team route to implement this fix and verify it.
+```
+
+Useful commands for OpenClaw agents:
+
+```sh
+SKS_OPENCLAW=1 sks root
+SKS_OPENCLAW=1 sks commands
+SKS_OPENCLAW=1 sks dollar-commands
+SKS_OPENCLAW=1 sks deps check
+SKS_OPENCLAW=1 sks proof-field scan --intent "small CLI change" --changed src/cli/main.mjs
+```
+
+If OpenClaw runs the skill inside a sandbox, grant shell execution only for the trusted local workspace. Database, Supabase, migration, and destructive filesystem work should still follow the repo's SKS safety route and require explicit write scope.
+
 ## Prompt `$` Commands
 
 Use these inside Codex App or another agent prompt. They are prompt commands, not terminal commands.
@@ -341,9 +398,11 @@ sks selftest --mock
 
 ```sh
 sks tmux check
-sks tmux open
+sks
 ```
 
+`sks tmux open` is the equivalent explicit launch form when you want to pass tmux session flags.
+
 For the high-reasoning full-access profile:
 
 ```sh

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "0.7.25",
+  "version": "0.7.33",
   "description": "Sneakoscope Codex: database-safe Codex CLI/App harness with Team, Goal, AutoResearch, TriWiki, and Honest Mode.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -48,6 +48,8 @@
     "sks",
     "openai",
     "openai-codex",
+    "openclaw",
+    "openclaw-skill",
     "cli",
     "developer-tools",
     "ai-coding",

package/src/cli/install-helpers.mjs

@@ -3,7 +3,7 @@ import os from 'node:os';
 import fsp from 'node:fs/promises';
 import readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
-import { ensureDir, exists, packageRoot, runProcess, which, writeTextAtomic } from '../core/fsx.mjs';
+import { ensureDir, exists, globalSksRoot, packageRoot, runProcess, which, writeTextAtomic } from '../core/fsx.mjs';
 import { getCodexInfo } from '../core/codex-adapter.mjs';
 import { formatHarnessConflictReport, llmHarnessCleanupPrompt, scanHarnessConflicts } from '../core/harness-conflicts.mjs';
 import { installSkills } from '../core/init.mjs';
@@ -83,15 +83,20 @@ function shouldAskPostinstallQuestion() {
 export async function postinstallBootstrapDecision(root) {
   if (process.env.SKS_POSTINSTALL_NO_BOOTSTRAP === '1') return { run: false, reason: 'SKS_POSTINSTALL_NO_BOOTSTRAP=1' };
   if (process.env.SKS_POSTINSTALL_BOOTSTRAP === '0') return { run: false, reason: 'SKS_POSTINSTALL_BOOTSTRAP=0' };
-  const candidate = await isProjectSetupCandidate(path.resolve(root || process.cwd()));
-  if (!candidate && process.env.SKS_POSTINSTALL_BOOTSTRAP !== '1') return { run: false, reason: 'no project marker found in install cwd' };
-  if (process.env.SKS_POSTINSTALL_BOOTSTRAP === '1') return { run: true, reason: 'forced by SKS_POSTINSTALL_BOOTSTRAP=1' };
-  return { run: true, reason: 'auto-running sks setup --bootstrap --install-scope global --force' };
+  const installRoot = path.resolve(root || process.cwd());
+  const candidate = await isProjectSetupCandidate(installRoot);
+  const target = candidate ? installRoot : globalSksRoot();
+  if (process.env.SKS_POSTINSTALL_BOOTSTRAP === '1') return { run: true, target, reason: 'forced by SKS_POSTINSTALL_BOOTSTRAP=1' };
+  if (candidate) return { run: true, target, reason: 'auto-running sks setup --bootstrap --install-scope global --force' };
+  return { run: true, target, reason: 'no project marker found; auto-running global SKS runtime bootstrap' };
 }
 
 async function runPostinstallBootstrap(root, bootstrap) {
   const previousCwd = process.cwd();
-  process.chdir(path.resolve(root || previousCwd));
+  const decision = await postinstallBootstrapDecision(root);
+  const target = path.resolve(decision.target || root || previousCwd);
+  await ensureDir(target);
+  process.chdir(target);
   try {
     await bootstrap(['--from-postinstall', '--install-scope', 'global', '--force']);
   } finally {
@@ -254,6 +259,88 @@ export async function ensureCodexCliTool({ skip = false } = {}) {
   };
 }
 
+export async function maybePromptCodexUpdateForLaunch(args = [], opts = {}) {
+  if (hasFlag(args, '--json') || hasFlag(args, '--skip-cli-tools') || hasFlag(args, '--skip-codex-update') || process.env.SKS_SKIP_CODEX_UPDATE === '1') return { status: 'skipped' };
+  const latest = await npmPackageVersion('@openai/codex');
+  const codex = await getCodexInfo().catch(() => ({}));
+  const current = codexCliVersionNumber(codex.version);
+  const command = 'npm i -g @openai/codex@latest';
+  const label = opts.label || 'tmux launch';
+  const missing = !codex.bin;
+  const updateAvailable = Boolean(latest.version && current && compareVersions(latest.version, current) > 0);
+  if (!missing && !updateAvailable) return { status: 'current', latest: latest.version || null, current, bin: codex.bin || null, error: latest.error || null };
+  const prompt = missing
+    ? `Codex CLI missing. Install @openai/codex${latest.version ? ` ${latest.version}` : '@latest'} before ${label}? [Y/n] `
+    : `Codex CLI ${current} -> ${latest.version} update before ${label}? [Y/n] `;
+  if (shouldAutoApproveInstall(args)) return installCodexLatest(command, latest.version, current);
+  if (!canAskYesNo()) {
+    const reason = missing ? 'Codex CLI missing' : `Codex CLI update available: ${current} -> ${latest.version}`;
+    console.log(`${reason}. Run: ${command}`);
+    return { status: missing ? 'missing' : 'available', latest: latest.version || null, current, command, bin: codex.bin || null };
+  }
+  const answer = (await askPostinstallQuestion(prompt)).trim();
+  const yes = answer === '' || /^(y|yes|예|네|응)$/i.test(answer);
+  if (!yes) return { status: 'skipped_by_user', latest: latest.version || null, current, command, bin: codex.bin || null };
+  return installCodexLatest(command, latest.version, current);
+}
+
+export function shouldAutoApproveInstall(args = [], env = process.env) {
+  return hasFlag(args, '--yes') || hasFlag(args, '-y') || isOpenClawRuntime(env);
+}
+
+function canAskYesNo() {
+  return Boolean(input.isTTY && output.isTTY && process.env.CI !== 'true');
+}
+
+function hasFlag(args = [], name) {
+  return args.includes(name);
+}
+
+function isOpenClawRuntime(env = process.env) {
+  return ['SKS_OPENCLAW', 'OPENCLAW', 'OPENCLAW_AGENT', 'OPENCLAW_RUN_ID', 'OPENCLAW_SESSION_ID']
+    .some((key) => /^(1|true|yes|y)$/i.test(String(env[key] || '').trim()));
+}
+
+async function installCodexLatest(command, latestVersion, previousVersion = null) {
+  const npm = await which('npm').catch(() => null);
+  if (!npm) return { status: 'failed', latest: latestVersion || null, previous: previousVersion || null, command, error: 'npm not found on PATH' };
+  const install = await runProcess(npm, ['i', '-g', '@openai/codex@latest'], { timeoutMs: 180000, maxOutputBytes: 128 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
+  if (install.code !== 0) return { status: 'failed', latest: latestVersion || null, previous: previousVersion || null, command, error: `${install.stderr || install.stdout || command + ' failed'}`.trim() };
+  const after = await getCodexInfo().catch(() => ({}));
+  const afterVersion = codexCliVersionNumber(after.version);
+  if (!after.bin) return { status: 'updated_not_reflected', latest: latestVersion || null, previous: previousVersion || null, version: afterVersion || null, command, error: 'npm completed, but codex is not on PATH. Restart the shell or set SKS_CODEX_BIN.' };
+  if (latestVersion && afterVersion && compareVersions(afterVersion, latestVersion) < 0) {
+    return { status: 'updated_not_reflected', latest: latestVersion, previous: previousVersion || null, version: afterVersion, bin: after.bin, command, error: `npm completed, but PATH still resolves Codex CLI ${afterVersion}; expected ${latestVersion}.` };
+  }
+  console.log(`Codex CLI ready: ${previousVersion || 'missing'} -> ${after.version || after.bin}`);
+  return { status: previousVersion ? 'updated' : 'installed', latest: latestVersion || null, previous: previousVersion || null, version: afterVersion || null, raw_version: after.version || null, bin: after.bin || null, command };
+}
+
+function codexCliVersionNumber(versionText = '') {
+  const match = String(versionText || '').match(/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/);
+  return match ? match[1] : null;
+}
+
+async function npmPackageVersion(name) {
+  const envName = `SKS_NPM_VIEW_${String(name || '').replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_VERSION`;
+  if (process.env[envName]) return { version: process.env[envName] };
+  const npm = await which('npm').catch(() => null);
+  if (!npm) return { error: 'npm not found' };
+  const result = await runProcess(npm, ['view', name, 'version'], { timeoutMs: 5000, maxOutputBytes: 4096 });
+  if (result.code !== 0) return { error: `${result.stderr || result.stdout || 'npm view failed'}`.trim() };
+  return { version: result.stdout.trim().split(/\s+/).pop() };
+}
+
+function compareVersions(a, b) {
+  const pa = String(a || '').split(/[.-]/).map((x) => Number.parseInt(x, 10) || 0);
+  const pb = String(b || '').split(/[.-]/).map((x) => Number.parseInt(x, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length, 3); i++) {
+    if ((pa[i] || 0) > (pb[i] || 0)) return 1;
+    if ((pa[i] || 0) < (pb[i] || 0)) return -1;
+  }
+  return 0;
+}
+
 async function isProjectSetupCandidate(root) {
   const markers = ['package.json', '.git', 'AGENTS.md', '.codex', '.sneakoscope'];
   for (const marker of markers) {

package/src/cli/main.mjs

@@ -56,11 +56,13 @@ import { buildPromptContext } from '../core/prompt-context-builder.mjs';
 import { renderTeamDashboardState, writeTeamDashboardState } from '../core/team-dashboard-renderer.mjs';
 import { GOAL_WORKFLOW_ARTIFACT } from '../core/goal-workflow.mjs';
 import { CODEX_APP_DOCS_URL, codexAppIntegrationStatus, formatCodexAppStatus } from '../core/codex-app.mjs';
+import { OPENCLAW_SKILL_NAME, installOpenClawSkill } from '../core/openclaw.mjs';
 import { buildTmuxLaunchPlan, buildTmuxOpenArgs, createTmuxSession, isTmuxShellSession, runTmuxLaunchPlanSyntaxCheck, tmuxReadiness, tmuxStatusKind, defaultTmuxSessionName, formatTmuxBanner, launchTmuxTeamView, launchTmuxUi, platformTmuxInstallHint, runTmuxStatus, sanitizeTmuxSessionName, teamLaneStyle } from '../core/tmux-ui.mjs';
 import { autoReviewProfileName, autoReviewStatus, autoReviewSummary, enableAutoReview, disableAutoReview, enableMadHighProfile, madHighProfileName } from '../core/auto-review.mjs';
 import { context7Command } from './context7-command.mjs';
-import { askPostinstallQuestion, checkContext7, checkRequiredSkills, ensureCodexCliTool, ensureGlobalCodexSkillsDuringInstall, ensureProjectContext7Config, ensureRelatedCliTools, ensureSksCommandDuringInstall, globalCodexSkillsRoot, postinstall, postinstallBootstrapDecision } from './install-helpers.mjs';
+import { askPostinstallQuestion, checkContext7, checkRequiredSkills, ensureCodexCliTool, ensureGlobalCodexSkillsDuringInstall, ensureProjectContext7Config, ensureRelatedCliTools, ensureSksCommandDuringInstall, globalCodexSkillsRoot, maybePromptCodexUpdateForLaunch, postinstall, postinstallBootstrapDecision, shouldAutoApproveInstall } from './install-helpers.mjs';
 import { buildTeamPlan, codeStructureCommand, dbCommand, defaultBeta, defaultVGraph, evalCommand, gcCommand, goalCommand, gxCommand, harnessCommand, hproofCommand, memoryCommand, migrateWikiContextPack, parseTeamCreateArgs, perfCommand, profileCommand, projectWikiClaims, proofFieldCommand, qaLoopCommand, quickstartCommand, researchCommand, skillDreamCommand, statsCommand, team, teamWorkflowMarkdown, validateArtifactsCommand, wikiCommand, wikiVoxelRowCount, writeWikiContextPack } from './maintenance-commands.mjs';
+import { openClawCommand } from './openclaw-command.mjs';
 
 const flag = (args, name) => args.includes(name);
 const promptOf = (args) => args.filter((x) => !String(x).startsWith('--')).join(' ').trim();
@@ -80,7 +82,7 @@ export async function main(args) {
   if (isAutoReviewFlag(args[0])) return autoReviewCommand('start', args.slice(1));
   const [cmd, sub, ...rest] = args;
   const tail = sub === undefined ? [] : [sub, ...rest];
-  if (!cmd) return help();
+  if (!cmd) return defaultTmuxCommand();
   if (cmd === '--help' || cmd === '-h') return help();
   if (cmd === '--version' || cmd === '-v' || cmd === 'version') return version();
   if (cmd === 'tmux') return !sub || String(sub).startsWith('--') ? tmuxCommand('check', tail) : tmuxCommand(sub, rest);
@@ -88,7 +90,7 @@ export async function main(args) {
   if (cmd === 'dollar-commands' || cmd === 'dollars' || cmd === '$') return dollarCommands(tail);
   if (String(cmd).toLowerCase() === 'dfix') return dfixHelp();
   const handlers = {
-    postinstall: () => postinstall({ bootstrap }), wizard: () => wizard(tail), ui: () => wizard(tail), 'update-check': () => updateCheck(tail), help: () => help(tail), commands: () => commands(tail), usage: () => usage(tail), root: () => rootCommand(tail), quickstart: () => quickstartCommand(), 'codex-app': () => codexAppHelp(tail), bootstrap: () => bootstrap(tail), deps: () => deps(sub, rest),
+    postinstall: () => postinstall({ bootstrap }), wizard: () => wizard(tail), ui: () => wizard(tail), 'update-check': () => updateCheck(tail), help: () => help(tail), commands: () => commands(tail), usage: () => usage(tail), root: () => rootCommand(tail), quickstart: () => quickstartCommand(), 'codex-app': () => codexAppHelp(tail), openclaw: () => openClawCommand(tail), bootstrap: () => bootstrap(tail), deps: () => deps(sub, rest),
     'qa-loop': () => qaLoopCommand(sub, rest), ppt: () => pptCommand(sub, rest), context7: () => context7Command(sub, rest), pipeline: () => pipeline(sub, rest), guard: () => guard(sub, rest), conflicts: () => conflicts(sub, rest), versioning: () => versioning(sub, rest), reasoning: () => reasoningCommand(tail), aliases: () => aliases(), setup: () => setup(tail), 'fix-path': () => fixPath(tail), doctor: () => doctor(tail), init: () => init(tail), selftest: () => selftest(tail),
     goal: () => goalCommand(sub, rest), research: () => researchCommand(sub, rest), hook: () => emitHook(sub), profile: () => profileCommand(sub, rest), hproof: () => hproofCommand(sub, rest), 'validate-artifacts': () => validateArtifactsCommand(tail), perf: () => perfCommand(sub, rest), 'proof-field': () => proofFieldCommand(sub, rest), 'skill-dream': () => skillDreamCommand(sub, rest), 'code-structure': () => codeStructureCommand(sub, rest), memory: () => memoryCommand(sub, rest), gx: () => gxCommand(sub, rest),
     team: () => team(tail), db: () => dbCommand(sub, rest), eval: () => evalCommand(sub, rest), harness: () => harnessCommand(sub, rest), wiki: () => wikiCommand(sub, rest), gc: () => gcCommand(tail), stats: () => statsCommand(tail)
@@ -98,6 +100,26 @@ export async function main(args) {
   process.exitCode = 1;
 }
 
+async function defaultTmuxCommand(args = []) {
+  const update = await maybePromptSksUpdateForLaunch(args, { label: 'default tmux launch' });
+  if (update.status === 'updated') {
+    console.log(`SKS updated from ${PACKAGE_VERSION} to ${update.latest}. Rerun: sks`);
+    return;
+  }
+  if (update.status === 'failed') {
+    console.error(`SKS update failed: ${update.error}`);
+    process.exitCode = 1;
+    return;
+  }
+  const codexUpdate = await maybePromptCodexUpdateForLaunch(args, { label: 'default tmux launch' });
+  if (codexUpdate.status === 'failed' || codexUpdate.status === 'updated_not_reflected') {
+    console.error(`Codex CLI update failed: ${codexUpdate.error || 'updated version was not visible on PATH'}`);
+    process.exitCode = 1;
+    return;
+  }
+  return launchTmuxUi(args, { conciseBlockers: true });
+}
+
 function help(args = []) {
   const topic = args[0];
   if (topic) return usage([topic]);
@@ -105,6 +127,7 @@ function help(args = []) {
 Sneakoscope Codex
 
 Usage:
+  sks
   sks help [topic]
   sks version
   sks update-check [--json]
@@ -116,6 +139,7 @@ Usage:
   sks bootstrap [--install-scope global|project] [--local-only] [--json]
   sks deps check|install [tmux|codex|context7|all] [--yes] [--json]
   sks codex-app
+  sks openclaw install|path|print [--dir path] [--force] [--json]
   sks --mad [--high]
   sks auto-review status|enable|start [--high]
   sks --Auto-review [--high]
@@ -870,6 +894,12 @@ async function tmuxCommand(sub = 'start', args = []) {
     return;
   }
   if (['start', 'attach', 'connect', 'open'].includes(action)) {
+    const codexUpdate = await maybePromptCodexUpdateForLaunch(args, { label: 'tmux launch' });
+    if (codexUpdate.status === 'failed' || codexUpdate.status === 'updated_not_reflected') {
+      console.error(`Codex CLI update failed: ${codexUpdate.error || 'updated version was not visible on PATH'}`);
+      process.exitCode = 1;
+      return;
+    }
     const result = await launchTmuxUi(args);
     if (flag(args, '--json')) console.log(JSON.stringify(result, null, 2));
     return;
@@ -884,7 +914,7 @@ async function madHighCommand(args = []) {
     const profile = await enableMadHighProfile();
     return console.log(JSON.stringify(profile, null, 2));
   }
-  const update = await maybePromptSksUpdateForMad(args);
+  const update = await maybePromptSksUpdateForLaunch(args, { label: 'MAD launch' });
   if (update.status === 'updated') {
     console.log(`SKS updated from ${PACKAGE_VERSION} to ${update.latest}. Rerun: sks --mad`);
     return;
@@ -894,6 +924,12 @@ async function madHighCommand(args = []) {
     process.exitCode = 1;
     return;
   }
+  const codexUpdate = await maybePromptCodexUpdateForLaunch(args, { label: 'MAD launch' });
+  if (codexUpdate.status === 'failed' || codexUpdate.status === 'updated_not_reflected') {
+    console.error(`Codex CLI update failed: ${codexUpdate.error || 'updated version was not visible on PATH'}`);
+    process.exitCode = 1;
+    return;
+  }
   const deps = await ensureMadLaunchDependencies(args);
   if (!deps.ready) {
     console.error('SKS MAD launch blocked by missing dependencies.');
@@ -912,18 +948,19 @@ async function madHighCommand(args = []) {
   });
 }
 
-async function maybePromptSksUpdateForMad(args = []) {
+async function maybePromptSksUpdateForLaunch(args = [], opts = {}) {
   if (flag(args, '--json') || flag(args, '--skip-update-check') || process.env.SKS_SKIP_UPDATE_CHECK === '1') return { status: 'skipped' };
   const latest = await npmPackageVersion('sneakoscope');
   const currentPackage = await effectivePackageVersion();
   if (!latest.version || compareVersions(latest.version, currentPackage) <= 0) return { status: 'current', latest: latest.version || null, error: latest.error || null };
   const command = 'npm i -g sneakoscope@latest';
-  if (flag(args, '--yes') || flag(args, '-y')) return installSksLatest(command, latest.version);
+  if (shouldAutoApproveInstall(args)) return installSksLatest(command, latest.version);
   if (!canAskYesNo()) {
     console.log(`SKS update available: ${currentPackage} -> ${latest.version}. Run: ${command}`);
     return { status: 'available', latest: latest.version, command };
   }
-  const answer = (await askPostinstallQuestion(`SKS ${currentPackage} -> ${latest.version} update before MAD launch? [Y/n] `)).trim();
+  const label = opts.label || 'launch';
+  const answer = (await askPostinstallQuestion(`SKS ${currentPackage} -> ${latest.version} update before ${label}? [Y/n] `)).trim();
   const yes = answer === '' || /^(y|yes|예|네|응)$/i.test(answer);
   if (!yes) return { status: 'skipped_by_user', latest: latest.version, command };
   return installSksLatest(command, latest.version);
@@ -1071,7 +1108,7 @@ async function installTmuxDependency(args = []) {
 }
 
 async function confirmInstall(question, args = []) {
-  if (flag(args, '--yes') || flag(args, '-y')) return true;
+  if (shouldAutoApproveInstall(args)) return true;
   if (!canAskYesNo()) return false;
   return /^(y|yes|예|네|응)$/i.test((await askPostinstallQuestion(`${question} [y/N] `)).trim());
 }
@@ -1116,6 +1153,12 @@ async function autoReviewCommand(sub = 'status', args = []) {
     const status = await enableAutoReview({ high });
     if (flag(args, '--json')) return console.log(JSON.stringify(status, null, 2));
     console.log(`SKS Auto-Review enabled: ${profile}`);
+    const codexUpdate = await maybePromptCodexUpdateForLaunch(args, { label: 'auto-review tmux launch' });
+    if (codexUpdate.status === 'failed' || codexUpdate.status === 'updated_not_reflected') {
+      console.error(`Codex CLI update failed: ${codexUpdate.error || 'updated version was not visible on PATH'}`);
+      process.exitCode = 1;
+      return;
+    }
     const sessionArg = readOption(cleanArgs, '--session', null);
     const session = sessionArg || sanitizeTmuxSessionName(`${profile}-${defaultTmuxSessionName(process.cwd())}`);
     return launchTmuxUi([...cleanArgs, '--session', session], { codexArgs: ['--profile', profile] });
@@ -1176,6 +1219,7 @@ Codex App prompt commands:
 ${formatDollarCommandsCompact('  ')}
 
 Examples:
+  sks
   sks setup
   sneakoscope setup
   sks commands
@@ -1191,7 +1235,8 @@ function usage(args = []) {
     bootstrap: ['Bootstrap', '', '  sks bootstrap', '  sks setup --bootstrap', '', 'Creates project SKS files, Codex App skills/hooks/config, state/guard files, then checks Codex App, Context7, and tmux.'],
     root: ['Root', '', '  sks root [--json]', '', 'Inside a project, SKS uses that project root. Outside any project marker, runtime commands use the per-user global SKS root instead of writing .sneakoscope into the current random folder.'],
     deps: ['Dependencies', '', '  sks deps check [--json]', '  sks deps install [tmux|codex|context7|all] [--yes]', '', 'tmux on macOS uses Homebrew only after approval.'],
-    tmux: ['tmux', '', '  sks tmux open', '  sks tmux check', '  sks tmux status --once', '  sks deps install tmux', '', 'tmux launch is explicit. Running bare `sks` prints help and never opens tmux by itself.'],
+    tmux: ['tmux', '', '  sks', '  sks tmux open', '  sks tmux check', '  sks tmux status --once', '  sks deps install tmux', '', 'Running bare `sks` opens or reuses the default tmux Codex CLI session. Before launch, SKS checks npm @openai/codex@latest and prompts Y/n when the installed Codex CLI is missing or outdated. Use `sks tmux open` when you need explicit session/workspace flags, and `sks help` for CLI help.'],
+    openclaw: ['OpenClaw', '', '  sks openclaw install', '  sks openclaw path', '  sks openclaw print SKILL.md', '', 'Installs an OpenClaw skill package under ~/.openclaw/skills/sneakoscope-codex so OpenClaw agents can attach skills: [sneakoscope-codex] with the shell tool and call local SKS commands from a project root.'],
     team: ['Team', '', '  sks team "task" executor:5 reviewer:2 user:1', '  sks team watch latest', '  sks team lane latest --agent analysis_scout_1 --follow', '  sks team message latest --from analysis_scout_1 --to executor_1 --message "handoff note"', '  sks team cleanup-tmux latest', '', '$Team runs questions -> contract -> scouts -> TriWiki attention -> debate -> runtime graph/inbox -> fresh executors -> review -> cleanup -> reflection -> Honest.'],
     'qa-loop': ['QA-LOOP', '', '  sks qa-loop prepare "QA this app"', '  sks qa-loop answer <MISSION_ID> answers.json', '  sks qa-loop run <MISSION_ID> --max-cycles 8', '', 'Report: YYYY-MM-DD-v<version>-qa-report.md'],
     ppt: ['PPT', '', '  $PPT 투자자용 피치덱을 HTML 기반 PDF로 만들어줘', '  $PPT 우리 SaaS 소개자료 만들어줘', '  sks ppt build latest --json', '  sks ppt status latest --json', '', '$PPT asks delivery context, audience profile, STP strategy, decision context, and 3+ pain-point/solution/aha mappings before source research, design-system work, HTML/PDF export, and render QA. Independent strategy/render/file-write phases run in parallel where inputs allow and are recorded in ppt-parallel-report.json. The visual system must stay simple, restrained, and information-first; editable source HTML is kept under source-html/, PPT-only temporary build files are cleaned, and installed skills/MCPs outside the $PPT allowlist are ignored. Design uses getdesign-reference plus the built-in PPT design pipeline; imagegen and Context7 are conditional only when the sealed PPT contract needs raster assets or current external docs.'],
@@ -1653,7 +1698,7 @@ function readMaxCycles(args, fallback) {
 
 function positionalArgs(args = []) {
   const out = [];
-  const valueFlags = new Set(['--format', '--iterations', '--out', '--baseline', '--candidate', '--install-scope', '--max-cycles', '--depth', '--scope', '--transport', '--query', '--topic', '--tokens', '--timeout-ms', '--sql', '--command', '--project-ref', '--agent', '--phase', '--message', '--role', '--max-anchors', '--lines']);
+  const valueFlags = new Set(['--format', '--iterations', '--out', '--baseline', '--candidate', '--install-scope', '--max-cycles', '--depth', '--scope', '--transport', '--query', '--topic', '--tokens', '--timeout-ms', '--sql', '--command', '--project-ref', '--agent', '--phase', '--message', '--role', '--max-anchors', '--lines', '--dir']);
   for (let i = 0; i < args.length; i++) {
     const arg = String(args[i]);
     if (valueFlags.has(arg)) {
@@ -1840,6 +1885,16 @@ async function selftest() {
   if (oldNoBootstrap === undefined) delete process.env.SKS_POSTINSTALL_NO_BOOTSTRAP;
   else process.env.SKS_POSTINSTALL_NO_BOOTSTRAP = oldNoBootstrap;
   if (noBootstrapDecision.run || noBootstrapDecision.reason !== 'SKS_POSTINSTALL_NO_BOOTSTRAP=1') throw new Error('selftest failed: postinstall bootstrap opt-out decision');
+  const postinstallNoMarkerTmp = tmpdir();
+  const postinstallNoMarkerHome = path.join(postinstallNoMarkerTmp, 'home');
+  const postinstallNoMarkerCwd = path.join(postinstallNoMarkerTmp, 'cwd');
+  const postinstallNoMarkerGlobalRoot = path.join(postinstallNoMarkerTmp, 'global-root');
+  await ensureDir(postinstallNoMarkerCwd);
+  const postinstallNoMarker = await runProcess(process.execPath, [path.join(packageRoot(), 'bin', 'sks.mjs'), 'postinstall'], { cwd: postinstallNoMarkerCwd, env: { INIT_CWD: postinstallNoMarkerCwd, HOME: postinstallNoMarkerHome, SKS_GLOBAL_ROOT: postinstallNoMarkerGlobalRoot, SKS_SKIP_POSTINSTALL_SHIM: '1', SKS_SKIP_POSTINSTALL_CONTEXT7: '1', SKS_SKIP_POSTINSTALL_GETDESIGN: '1', SKS_SKIP_CLI_TOOLS: '1' }, timeoutMs: 30000, maxOutputBytes: 256 * 1024 });
+  if (postinstallNoMarker.code !== 0) throw new Error(`selftest failed: no-marker postinstall bootstrap exited ${postinstallNoMarker.code}: ${postinstallNoMarker.stderr}`);
+  if (!String(postinstallNoMarker.stdout || '').includes('no project marker found; auto-running global SKS runtime bootstrap')) throw new Error('selftest failed: no-marker postinstall did not report global runtime bootstrap');
+  if (!(await exists(path.join(postinstallNoMarkerGlobalRoot, '.sneakoscope', 'manifest.json')))) throw new Error('selftest failed: no-marker postinstall did not bootstrap global runtime root');
+  if (await exists(path.join(postinstallNoMarkerCwd, '.sneakoscope'))) throw new Error('selftest failed: no-marker postinstall polluted install cwd');
   const bootstrapJsonTmp = tmpdir();
   await writeJsonAtomic(path.join(bootstrapJsonTmp, 'package.json'), { name: 'bootstrap-json-smoke', version: '0.0.0' });
   const bootstrapJson = await runProcess(process.execPath, [path.join(packageRoot(), 'bin', 'sks.mjs'), 'bootstrap', '--json'], { cwd: bootstrapJsonTmp, env: { HOME: path.join(bootstrapJsonTmp, 'home'), SKS_SKIP_POSTINSTALL_GLOBAL_SKILLS: '1', SKS_SKIP_CLI_TOOLS: '1' }, timeoutMs: 30000, maxOutputBytes: 256 * 1024 });
@@ -1872,6 +1927,39 @@ async function selftest() {
   if (tmuxOpenArgs.join(' ') !== 'attach-session -t sks-mad-selftest') throw new Error('selftest failed: MAD tmux attach args are not stable by session name');
   if (!isTmuxShellSession({ TMUX: '/tmp/tmux-501/default,1,0' })) throw new Error('selftest failed: tmux shell session env was not detected');
   if (tmuxStatusKind({ ok: false, bin: null }) !== 'missing') throw new Error('selftest failed: missing tmux was not labeled missing');
+  const bareDefault = await runProcess(process.execPath, [path.join(packageRoot(), 'bin', 'sks.mjs')], {
+    cwd: globalCwd,
+    env: { SKS_GLOBAL_ROOT: globalRuntimeRoot, SKS_NPM_VIEW_SNEAKOSCOPE_VERSION: PACKAGE_VERSION, PATH: '' },
+    timeoutMs: 15000,
+    maxOutputBytes: 64 * 1024
+  });
+  if (bareDefault.code !== 1 || !String(bareDefault.stderr || '').includes('SKS tmux launch blocked') || String(bareDefault.stdout || '').includes('Usage:')) throw new Error('selftest failed: bare sks did not route to default tmux launch');
+  const fakeCodexBin = path.join(tmp, 'fake-codex-bin');
+  await ensureDir(fakeCodexBin);
+  const fakeCodexPath = path.join(fakeCodexBin, 'codex');
+  await writeTextAtomic(fakeCodexPath, '#!/bin/sh\necho "codex-cli 0.1.0"\n');
+  await fsp.chmod(fakeCodexPath, 0o755);
+  const codexUpdatePrompt = await runProcess(process.execPath, [path.join(packageRoot(), 'bin', 'sks.mjs')], {
+    cwd: globalCwd,
+    env: { SKS_GLOBAL_ROOT: globalRuntimeRoot, SKS_NPM_VIEW_SNEAKOSCOPE_VERSION: PACKAGE_VERSION, SKS_NPM_VIEW__OPENAI_CODEX_VERSION: '99.0.0', PATH: fakeCodexBin },
+    timeoutMs: 15000,
+    maxOutputBytes: 64 * 1024
+  });
+  if (!String(codexUpdatePrompt.stdout || '').includes('Codex CLI update available: 0.1.0 -> 99.0.0') || String(codexUpdatePrompt.stdout || '').includes('Usage:')) throw new Error('selftest failed: bare sks did not recommend Codex CLI update before tmux launch');
+  const openClawAutoBin = path.join(tmp, 'openclaw-auto-bin');
+  await ensureDir(openClawAutoBin);
+  const openClawCodexPath = path.join(openClawAutoBin, 'codex');
+  await writeTextAtomic(openClawCodexPath, '#!/bin/sh\necho "codex-cli 0.1.0"\n');
+  await writeTextAtomic(path.join(openClawAutoBin, 'npm'), '#!/bin/sh\nDIR="${0%/*}"\nif [ "$1" = "i" ]; then\n  printf \'#!/bin/sh\\necho "codex-cli 99.0.0"\\n\' > "$DIR/codex"\n  chmod +x "$DIR/codex"\n  exit 0\nfi\necho "unexpected npm $*" >&2\nexit 1\n');
+  await fsp.chmod(openClawCodexPath, 0o755);
+  await fsp.chmod(path.join(openClawAutoBin, 'npm'), 0o755);
+  const openClawAutoUpdate = await runProcess(process.execPath, [path.join(packageRoot(), 'bin', 'sks.mjs')], {
+    cwd: globalCwd,
+    env: { SKS_GLOBAL_ROOT: globalRuntimeRoot, SKS_OPENCLAW: '1', SKS_NPM_VIEW_SNEAKOSCOPE_VERSION: PACKAGE_VERSION, SKS_NPM_VIEW__OPENAI_CODEX_VERSION: '99.0.0', PATH: openClawAutoBin },
+    timeoutMs: 15000,
+    maxOutputBytes: 64 * 1024
+  });
+  if (!String(openClawAutoUpdate.stdout || '').includes('Codex CLI ready: 0.1.0 -> codex-cli 99.0.0')) throw new Error('selftest failed: OpenClaw mode did not auto-approve Codex CLI update before tmux launch');
   const guardBlocked = await checkHarnessModification(tmp, { tool_name: 'apply_patch', command: '*** Update File: .agents/skills/team/SKILL.md\n+tamper\n' });
   if (guardBlocked.action !== 'block') throw new Error('selftest failed: harness guard allowed skill tampering');
   const setupBlocked = await checkHarnessModification(tmp, { command: 'sks setup --force' });
@@ -2014,6 +2102,9 @@ async function selftest() {
   if (!promptPipelineSkillExists) throw new Error('selftest failed: prompt pipeline skill not installed');
   const promptPipelineText = await safeReadText(path.join(tmp, '.agents', 'skills', 'prompt-pipeline', 'SKILL.md'));
   if (!promptPipelineText.includes('TriWiki context-tracking SSOT')) throw new Error('selftest failed: prompt pipeline missing TriWiki context-tracking SSOT');
+  if (!promptPipelineText.includes('Codex App pipeline activation:') || !promptPipelineText.includes('sks hook user-prompt-submit') || !promptPipelineText.includes('hookSpecificOutput.additionalContext')) throw new Error('selftest failed: prompt pipeline missing Codex App pipeline activation fallback');
+  const teamSkillText = await safeReadText(path.join(tmp, '.agents', 'skills', 'team', 'SKILL.md'));
+  if (!teamSkillText.includes('Codex App pipeline activation:') || !teamSkillText.includes('sks pipeline status') || !teamSkillText.includes('mission/pipeline artifacts')) throw new Error('selftest failed: Team skill missing pipeline activation fallback');
   if (!promptPipelineText.includes('before every route stage') || !promptPipelineText.includes('sks wiki refresh')) throw new Error('selftest failed: prompt pipeline missing per-stage TriWiki policy');
   if (!promptPipelineText.includes('single design decision authority') || !promptPipelineText.includes('imagegen') || !promptPipelineText.includes('getdesign-reference') || !promptPipelineText.includes(AWESOME_DESIGN_MD_REFERENCE.url) || !promptPipelineText.includes('not parallel authorities')) throw new Error('selftest failed: prompt pipeline missing design SSOT/source-input routing');
   if (!promptPipelineText.includes(CODEX_APP_IMAGE_GENERATION_DOC_URL)) throw new Error('selftest failed: prompt pipeline missing Codex App image generation policy');
@@ -2062,7 +2153,16 @@ async function selftest() {
   if (!DOLLAR_DEFAULT_PIPELINE_TEXT.includes('$Team')) throw new Error('selftest failed: dollar-commands missing Team default routing guidance');
   if (!DOLLAR_DEFAULT_PIPELINE_TEXT.includes('$From-Chat-IMG')) throw new Error('selftest failed: dollar-commands missing From-Chat-IMG guidance');
   if (!DOLLAR_DEFAULT_PIPELINE_TEXT.includes('$MAD-SKS')) throw new Error('selftest failed: dollar-commands missing MAD-SKS scoped override guidance');
-  if (!COMMAND_CATALOG.some((c) => c.name === 'context7') || !COMMAND_CATALOG.some((c) => c.name === 'pipeline') || !COMMAND_CATALOG.some((c) => c.name === 'qa-loop') || !COMMAND_CATALOG.some((c) => c.name === 'root')) throw new Error('selftest failed: context7/pipeline/qa-loop/root commands missing from catalog');
+  if (!COMMAND_CATALOG.some((c) => c.name === 'context7') || !COMMAND_CATALOG.some((c) => c.name === 'pipeline') || !COMMAND_CATALOG.some((c) => c.name === 'qa-loop') || !COMMAND_CATALOG.some((c) => c.name === 'root') || !COMMAND_CATALOG.some((c) => c.name === 'openclaw')) throw new Error('selftest failed: context7/pipeline/qa-loop/root/openclaw commands missing from catalog');
+  const openClawTmp = tmpdir();
+  const openClawResult = await installOpenClawSkill({ targetDir: path.join(openClawTmp, 'skills', OPENCLAW_SKILL_NAME) });
+  if (!openClawResult.ok) throw new Error(`selftest failed: OpenClaw skill install blocked: ${openClawResult.reason}`);
+  const openClawSkillText = await safeReadText(path.join(openClawResult.target_dir, 'SKILL.md'));
+  const openClawManifestText = await safeReadText(path.join(openClawResult.target_dir, 'manifest.yaml'));
+  const openClawConfigText = await safeReadText(path.join(openClawResult.target_dir, 'openclaw-agent-config.example.yaml'));
+  if (!openClawSkillText.includes('sks root') || !openClawSkillText.includes('$Team') || !openClawSkillText.includes('OpenClaw agent must have the built-in `shell` tool enabled') || !openClawSkillText.includes('SKS_OPENCLAW=1')) throw new Error('selftest failed: OpenClaw skill missing SKS agent guidance');
+  if (!openClawManifestText.includes('generated_by: sneakoscope') || !openClawManifestText.includes(`version: ${PACKAGE_VERSION}`)) throw new Error('selftest failed: OpenClaw manifest missing generated marker or version');
+  if (!openClawConfigText.includes(`- ${OPENCLAW_SKILL_NAME}`) || !openClawConfigText.includes('- shell') || !openClawConfigText.includes('SKS_OPENCLAW')) throw new Error('selftest failed: OpenClaw agent config example missing skill, shell tool, or OpenClaw env');
   const registryDollarCommands = DOLLAR_COMMANDS.map((c) => c.command);
   const manifest = await readJson(path.join(tmp, '.sneakoscope', 'manifest.json'));
   const policy = await readJson(path.join(tmp, '.sneakoscope', 'policy.json'));
@@ -2138,7 +2238,7 @@ async function selftest() {
   if (String(hookUpdateCurrentContext).includes('Update SKS now') || String(hookUpdateCurrentContext).includes('Skip update for this conversation')) throw new Error('selftest failed: hook prompted for update even though installed SKS is current');
   const hookUpdateCurrentState = await readJson(path.join(hookUpdateCurrentTmp, '.sneakoscope', 'state', 'update-check.json'), {});
   if (hookUpdateCurrentState.pending_offer) throw new Error('selftest failed: current installed SKS left a pending update offer');
-  if (hookUpdateCurrentState.current !== '9.9.9' || hookUpdateCurrentState.runtime_current !== PACKAGE_VERSION || hookUpdateCurrentState.installed_current !== '9.9.9') throw new Error('selftest failed: hook did not record effective installed SKS version');
+  if (hookUpdateCurrentState.current !== '9.9.9' || hookUpdateCurrentState.runtime_current !== PACKAGE_VERSION || hookUpdateCurrentState.installed_current !== '9.9.9') throw new Error(`selftest failed: hook did not record effective installed SKS version: ${JSON.stringify({ expected: { current: '9.9.9', runtime_current: PACKAGE_VERSION, installed_current: '9.9.9' }, actual: hookUpdateCurrentState })}`);
   const hookUpdatePendingTmp = tmpdir();
   await initProject(hookUpdatePendingTmp, {});
   await writeJsonAtomic(path.join(hookUpdatePendingTmp, '.sneakoscope', 'state', 'update-check.json'), {

package/src/cli/openclaw-command.mjs

@@ -0,0 +1,83 @@
+import path from 'node:path';
+import { OPENCLAW_SKILL_NAME, buildOpenClawSkillFiles, defaultOpenClawSkillDir, installOpenClawSkill } from '../core/openclaw.mjs';
+
+const flag = (args, name) => args.includes(name);
+
+function readFlagValue(args, name, fallback) {
+  const i = args.indexOf(name);
+  return i >= 0 && args[i + 1] ? args[i + 1] : fallback;
+}
+
+function positionalArgs(args = []) {
+  const out = [];
+  const valueFlags = new Set(['--dir']);
+  for (let i = 0; i < args.length; i++) {
+    const arg = String(args[i]);
+    if (valueFlags.has(arg)) {
+      i++;
+      continue;
+    }
+    if (!arg.startsWith('--')) out.push(arg);
+  }
+  return out;
+}
+
+export async function openClawCommand(args = []) {
+  const action = args[0] || 'help';
+  const targetDir = readFlagValue(args, '--dir', defaultOpenClawSkillDir());
+  const resultOptions = {
+    targetDir,
+    force: flag(args, '--force'),
+    dryRun: flag(args, '--dry-run')
+  };
+  if (action === 'path') {
+    const result = { skill: OPENCLAW_SKILL_NAME, target_dir: path.resolve(targetDir) };
+    if (flag(args, '--json')) return console.log(JSON.stringify(result, null, 2));
+    console.log(result.target_dir);
+    return;
+  }
+  if (action === 'print') {
+    const file = positionalArgs(args.slice(1))[0] || 'SKILL.md';
+    const files = buildOpenClawSkillFiles();
+    if (!files[file]) {
+      console.error(`Unknown OpenClaw skill file: ${file}`);
+      console.error(`Files: ${Object.keys(files).join(', ')}`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(files[file]);
+    return;
+  }
+  if (action === 'install') {
+    const result = await installOpenClawSkill(resultOptions);
+    if (flag(args, '--json')) return console.log(JSON.stringify(result, null, 2));
+    if (!result.ok) {
+      console.error(`OpenClaw skill install blocked: ${result.reason}`);
+      console.error(`Target: ${result.target_dir}`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(`OpenClaw skill ${result.status}: ${result.target_dir}`);
+    console.log(`Attach it to an agent with skills: [${OPENCLAW_SKILL_NAME}] and tools: [shell].`);
+    return;
+  }
+  console.log(`OpenClaw
+
+Usage:
+  sks openclaw install [--dir path] [--force] [--dry-run] [--json]
+  sks openclaw path [--dir path] [--json]
+  sks openclaw print [SKILL.md|manifest.yaml|README.md|openclaw-agent-config.example.yaml]
+
+Default skill: ${OPENCLAW_SKILL_NAME}
+Default path:  ${defaultOpenClawSkillDir()}
+
+After install, add this to an OpenClaw agent config:
+
+agents:
+  coding-agent:
+    tools:
+      - shell
+    skills:
+      - ${OPENCLAW_SKILL_NAME}
+`);
+}

package/src/core/fsx.mjs

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 
-export const PACKAGE_VERSION = '0.7.25';
+export const PACKAGE_VERSION = '0.7.33';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 

package/src/core/init.mjs

@@ -569,8 +569,8 @@ function codexAppQuickReference(scope, commandPrefix) {
     `Runtime root: ${commandPrefix} root shows whether SKS is using the nearest project root or the per-user global SKS runtime root; outside any project marker, runtime commands use the global root instead of writing .sneakoscope into the current random directory.`,
     `Context Tracking: TriWiki SSOT. Before each route phase read only the latest coordinate+voxel overlay pack at .sneakoscope/wiki/context-pack.json; coordinate-only legacy packs are invalid. Use attention.use_first for compact high-trust recall and hydrate attention.hydrate_first from source before risky/lower-trust decisions. During every stage hydrate low-trust claims from source/hash/RGBA anchors; after changes run ${commandPrefix} wiki refresh or pack; before handoff/final run ${commandPrefix} wiki validate .sneakoscope/wiki/context-pack.json.`,
     stackCurrentDocsPolicyText(commandPrefix),
-    `Team tmux view: ${commandPrefix} team "task" prepares live watch/lane commands without opening tmux by default; add --open-tmux when you explicitly want a named tmux session with an overview watch pane plus color-coded split per-agent lanes; ${commandPrefix} team lane latest --agent analysis_scout_1 --follow shows one agent's status, assigned runtime tasks, recent agent events, direct messages, and fallback global tail; ${commandPrefix} team message latest --from analysis_scout_1 --to executor_1 --message "handoff note" mirrors bounded agent communication into transcript/lane panes; ${commandPrefix} team cleanup-tmux latest marks the SKS session record complete and asks follow panes to show a cleanup summary then stop.`,
-    `Runtime: open Codex App once, then run ${commandPrefix} bootstrap, ${commandPrefix} deps check, or ${commandPrefix} tmux open when you explicitly want a tmux/Codex CLI launch.`,
+    `Team tmux view: ${commandPrefix} team "task" prepares live watch/lane commands without opening a Team tmux view by default; add --open-tmux when you explicitly want a named Team tmux session with an overview watch pane plus color-coded split per-agent lanes; ${commandPrefix} team lane latest --agent analysis_scout_1 --follow shows one agent's status, assigned runtime tasks, recent agent events, direct messages, and fallback global tail; ${commandPrefix} team message latest --from analysis_scout_1 --to executor_1 --message "handoff note" mirrors bounded agent communication into transcript/lane panes; ${commandPrefix} team cleanup-tmux latest marks the SKS session record complete and asks follow panes to show a cleanup summary then stop.`,
+    `Runtime: open Codex App once, then run ${commandPrefix} bootstrap and ${commandPrefix} deps check. Bare ${commandPrefix} opens or reuses the default tmux/Codex CLI session; before launch it checks npm @openai/codex@latest and prompts Y/n when the installed Codex CLI is missing or outdated. ${commandPrefix} tmux open is the explicit form for session/workspace flags.`,
     `Guard: generated harness files are immutable outside the engine source repo; check ${commandPrefix} guard check; conflicts use ${commandPrefix} conflicts prompt with human approval.`
   ].join('\n') + '\n';
 }
@@ -680,8 +680,11 @@ async function removeStaleGeneratedSkillsFromManifest(root, skillNames) {
 function enrichSkillContent(name, content) {
   if (!['sks', 'answer', 'wiki', 'team', 'qa-loop', 'ppt', 'computer-use', 'computer-use-fast', 'cu', 'goal', 'research', 'autoresearch', 'db', 'gx', 'reflection', 'prompt-pipeline', 'pipeline-runner', 'context7-docs', 'turbo-context-pack', 'hproof-evidence-bind'].includes(name)) return content;
   const text = String(content || '').trimEnd();
-  if (text.includes('TriWiki context-tracking SSOT')) return text;
-  return `${text}
+  const activation = pipelineActivationText(name);
+  if (text.includes('TriWiki context-tracking SSOT')) {
+    return activation && !text.includes('Codex App pipeline activation:') ? `${text}\n\n${activation}` : text;
+  }
+  return `${text}${activation ? `\n\n${activation}` : ''}
 
 Context tracking:
 - Ask only ambiguity that can change scope, safety, behavior, or acceptance; infer the rest from TriWiki/current code and seal answers before execution.
@@ -692,6 +695,16 @@ Context tracking:
 `;
 }
 
+function pipelineActivationText(name) {
+  const stateful = new Set(['sks', 'team', 'qa-loop', 'ppt', 'computer-use', 'computer-use-fast', 'cu', 'goal', 'research', 'autoresearch', 'db', 'gx', 'prompt-pipeline', 'pipeline-runner']);
+  if (!stateful.has(name)) return '';
+  return `Codex App pipeline activation:
+- If the SKS UserPromptSubmit hook already injected route context, follow that context.
+- If no SKS hook context is visible in the current turn, immediately run \`sks hook user-prompt-submit\` from the target repo root with JSON input containing the current prompt, for example: \`printf '%s' '{"prompt":"<user prompt>","cwd":"<repo root>"}' | sks hook user-prompt-submit\`.
+- Use the returned \`hookSpecificOutput.additionalContext\` as authoritative route context before answering or editing. If it creates a mission, continue through \`sks pipeline status\`, \`sks pipeline plan\`, and \`sks pipeline answer\` as directed.
+- Do not treat this skill text alone as completion of the SKS route; a stateful SKS route must materialize mission/pipeline artifacts or explicitly report why the hook could not run.`;
+}
+
 async function writeSkillMetadata(dir, name) {
   const effort = ['computer-use', 'computer-use-fast', 'cu'].includes(name)
     ? 'low'

package/src/core/openclaw.mjs

@@ -0,0 +1,167 @@
+import path from 'node:path';
+import os from 'node:os';
+import { exists, readText, writeTextAtomic, PACKAGE_VERSION } from './fsx.mjs';
+
+export const OPENCLAW_SKILL_NAME = 'sneakoscope-codex';
+
+export function defaultOpenClawHome(env = process.env) {
+  return path.resolve(env.OPENCLAW_HOME || path.join(env.HOME || os.homedir(), '.openclaw'));
+}
+
+export function defaultOpenClawSkillDir(env = process.env) {
+  return path.join(defaultOpenClawHome(env), 'skills', OPENCLAW_SKILL_NAME);
+}
+
+export function buildOpenClawSkillFiles(options = {}) {
+  const sksCommand = options.sksCommand || 'sks';
+  const version = options.version || PACKAGE_VERSION;
+  const skillName = options.skillName || OPENCLAW_SKILL_NAME;
+  return {
+    'manifest.yaml': openClawManifest({ skillName, version }),
+    'SKILL.md': openClawSkillMarkdown({ sksCommand, skillName, version }),
+    'README.md': openClawSkillReadme({ sksCommand, skillName, version }),
+    'openclaw-agent-config.example.yaml': openClawAgentConfigExample({ skillName })
+  };
+}
+
+export async function installOpenClawSkill(options = {}) {
+  const targetDir = path.resolve(options.targetDir || defaultOpenClawSkillDir(options.env || process.env));
+  const files = buildOpenClawSkillFiles(options);
+  const existingManifest = path.join(targetDir, 'manifest.yaml');
+  const existing = await exists(existingManifest);
+  if (existing && !options.force) {
+    const text = await readText(existingManifest, '');
+    if (!text.includes('generated_by: sneakoscope')) {
+      return {
+        ok: false,
+        status: 'blocked_existing_skill',
+        target_dir: targetDir,
+        reason: 'Existing OpenClaw skill is not marked as generated by Sneakoscope. Re-run with --force to overwrite.'
+      };
+    }
+  }
+  if (options.dryRun) {
+    return { ok: true, status: existing ? 'would_update' : 'would_create', target_dir: targetDir, files: Object.keys(files) };
+  }
+  for (const [name, content] of Object.entries(files)) {
+    await writeTextAtomic(path.join(targetDir, name), content);
+  }
+  return { ok: true, status: existing ? 'updated' : 'created', target_dir: targetDir, files: Object.keys(files) };
+}
+
+function openClawManifest({ skillName, version }) {
+  return `name: ${skillName}
+version: ${version}
+description: Expose Sneakoscope Codex (sks) workflows to OpenClaw agents.
+author: mandarange
+license: MIT
+generated_by: sneakoscope
+homepage: https://github.com/mandarange/Sneakoscope-Codex
+entrypoint: SKILL.md
+permissions:
+  shell: execute
+  filesystem: read_write_project
+tags:
+  - codex
+  - coding-agent
+  - orchestration
+  - qa
+  - safety
+`;
+}
+
+function openClawSkillMarkdown({ sksCommand, skillName, version }) {
+  return `---
+name: ${skillName}
+version: ${version}
+description: Use Sneakoscope Codex routes, checks, and release gates from an OpenClaw agent.
+---
+
+# Sneakoscope Codex For OpenClaw
+
+Use this skill when the user asks an OpenClaw agent to work in a codebase that uses Sneakoscope Codex, SKS, Team, QA-LOOP, TriWiki, Context7, DB safety, Honest Mode, release gates, or \`$...\` prompt routes.
+
+## Required Tool Access
+
+The OpenClaw agent must have the built-in \`shell\` tool enabled. Prefer running commands in the target repository root.
+
+Set \`SKS_OPENCLAW=1\` for SKS shell commands. In OpenClaw mode, SKS treats update/install prompts as automatically approved so \`sks\` can update \`sneakoscope\` or \`@openai/codex\` before launching tmux without pausing for a human \`Y/n\` answer.
+
+## Core Commands
+
+- \`${sksCommand} root\` checks whether SKS is using a project root or the global runtime root.
+- \`${sksCommand} bootstrap\` installs or repairs SKS project files, Codex App skills, hooks, and runtime state.
+- \`${sksCommand} commands\` lists terminal commands the agent can call.
+- \`${sksCommand} dollar-commands\` lists prompt routes such as \`$Team\`, \`$DFix\`, \`$QA-LOOP\`, \`$PPT\`, \`$Goal\`, \`$DB\`, \`$Wiki\`, and \`$Help\`.
+- \`${sksCommand} deps check\` checks Codex, Context7, tmux, and related local readiness.
+- \`${sksCommand} proof-field scan --intent "<task>" --changed file1,file2\` checks whether a narrow change can stay on a lightweight proof path.
+- \`${sksCommand} release:check\` is not a terminal command; use \`npm run release:check\` inside the Sneakoscope package repository.
+
+## Agent Operating Rules
+
+1. Before substantive work, run \`SKS_OPENCLAW=1 ${sksCommand} root\` and inspect the repository's \`AGENTS.md\` if present.
+2. For implementation, prefer the repository's requested SKS route. General code work normally routes to \`$Team\`; tiny design or copy edits can use \`$DFix\`; UI/browser dogfood uses \`$QA-LOOP\`; database or Supabase work uses \`$DB\`.
+3. Do not invent fallback implementation code when the requested SKS path is blocked. Report the blocker with command output and source paths.
+4. For database, migration, and Supabase tasks, default to read-only inspection unless the user explicitly authorizes a write/migration scope.
+5. Before claiming completion, run the most relevant verification command and summarize what passed, what was not verified, and any remaining blocker.
+
+## Example Prompts For An OpenClaw Agent
+
+- "In this repo, run \`${sksCommand} root\`, inspect \`AGENTS.md\`, then use the SKS Team route to implement the bug fix and verify it."
+- "Use SKS QA-LOOP against localhost:3000. Do not run destructive tests."
+- "Prepare this project for Codex App use: run \`${sksCommand} bootstrap\`, \`${sksCommand} codex-app check\`, and \`${sksCommand} dollar-commands\`."
+`;
+}
+
+function openClawSkillReadme({ sksCommand, skillName, version }) {
+  return `# ${skillName}
+
+Version: ${version}
+
+This OpenClaw skill lets an OpenClaw agent discover and use Sneakoscope Codex through the local \`${sksCommand}\` command.
+
+OpenClaw agents should set \`SKS_OPENCLAW=1\` when running SKS commands. That mode auto-approves SKS dependency/update prompts, including the Codex CLI update preflight before tmux launch.
+
+## Install
+
+\`\`\`sh
+${sksCommand} openclaw install
+\`\`\`
+
+Then attach the skill to an OpenClaw agent:
+
+\`\`\`yaml
+agents:
+  coding-agent:
+    tools:
+      - shell
+    skills:
+      - ${skillName}
+\`\`\`
+
+## Verify
+
+\`\`\`sh
+openclaw skill run ${skillName} --help
+${sksCommand} root
+${sksCommand} commands
+\`\`\`
+
+If OpenClaw runs skills in a sandbox, allow shell execution for this skill and run it from the target repository root so SKS can find \`.git\`, \`.sneakoscope\`, or \`.dcodex\`.
+`;
+}
+
+function openClawAgentConfigExample({ skillName }) {
+  return `agents:
+  coding-agent:
+    model: openai/gpt-4o
+    channels:
+      - terminal
+    tools:
+      - shell
+    env:
+      SKS_OPENCLAW: "1"
+    skills:
+      - ${skillName}
+`;
+}

package/src/core/routes.mjs

@@ -7,7 +7,7 @@ export const FROM_CHAT_IMG_CHECKLIST_ARTIFACT = 'from-chat-img-checklist.md';
 export const FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT = 'from-chat-img-temp-triwiki.json';
 export const FROM_CHAT_IMG_QA_LOOP_ARTIFACT = 'from-chat-img-qa-loop.json';
 export const FROM_CHAT_IMG_TEMP_TRIWIKI_SESSIONS = 5;
-export const USAGE_TOPICS = 'install|setup|bootstrap|root|deps|tmux|auto-review|team|qa-loop|ppt|goal|research|db|codex-app|dfix|design|imagegen|dollar|context7|pipeline|reasoning|guard|conflicts|versioning|eval|harness|hproof|gx|wiki|code-structure|proof-field|skill-dream';
+export const USAGE_TOPICS = 'install|setup|bootstrap|root|deps|tmux|auto-review|team|qa-loop|ppt|goal|research|db|codex-app|openclaw|dfix|design|imagegen|dollar|context7|pipeline|reasoning|guard|conflicts|versioning|eval|harness|hproof|gx|wiki|code-structure|proof-field|skill-dream';
 export const CODEX_COMPUTER_USE_EVIDENCE_SOURCE = 'codex_computer_use';
 export const CODEX_APP_IMAGE_GENERATION_DOC_URL = 'https://developers.openai.com/codex/app/features#image-generation';
 export const CODEX_COMPUTER_USE_ONLY_POLICY = 'Pipeline UI/browser verification and visual inspection must use Codex Computer Use only. Do not use Playwright, Chrome MCP, Browser Use, Selenium, Puppeteer, or any other browser automation substitute; if Codex Computer Use is unavailable, mark the UI/browser evidence unverified instead of substituting another tool.';
@@ -456,7 +456,8 @@ export const COMMAND_CATALOG = [
   { name: 'root', usage: 'sks root [--json]', description: 'Show whether SKS is using a project root or the per-user global SKS runtime root.' },
   { name: 'deps', usage: 'sks deps check|install [tmux|codex|context7|all] [--yes]', description: 'Check or guided-install Node/npm PATH, Codex CLI/App, Context7, Browser Use, Computer Use, tmux, and Homebrew on macOS.' },
   { name: 'codex-app', usage: 'sks codex-app [check|open]', description: 'Check Codex App install and first-party MCP/plugin readiness, then show app setup files and examples.' },
-  { name: 'tmux', usage: 'sks tmux open|check|status [--workspace name]', description: 'Explicitly open the SKS tmux runtime, or check/status without launching tmux.' },
+  { name: 'openclaw', usage: 'sks openclaw install|path|print [--dir path] [--force] [--json]', description: 'Generate an OpenClaw skill package so OpenClaw agents can discover and use local SKS workflows.' },
+  { name: 'tmux', usage: 'sks | sks tmux open|check|status [--workspace name]', description: 'Open the default SKS tmux runtime with bare sks, or use tmux subcommands for explicit launch/check/status.' },
   { name: 'mad', usage: 'sks --mad [--high]', description: 'Open a one-shot tmux Codex CLI workspace with the SKS MAD full-access auto-review profile.' },
   { name: 'auto-review', usage: 'sks auto-review status|enable|start [--high] | sks --Auto-review --high', description: 'Enable Codex automatic approval review and launch SKS tmux with the auto-review profile.' },
   { name: 'dollar-commands', usage: 'sks dollar-commands [--json]', description: 'List Codex App $ commands such as $DFix and $Team.' },

package/src/core/tmux-ui.mjs

@@ -207,7 +207,8 @@ export function formatTmuxBanner(status = null) {
     '  $DFix  $Answer  $SKS  $Team  $QA-LOOP  $PPT  $Goal  $Research  $AutoResearch  $DB  $GX  $Wiki  $Help',
     '',
     'CLI-first runtime:',
-    '  sks tmux open       open or attach a tmux Codex CLI session',
+    '  sks                 open or attach the default tmux Codex CLI session',
+    '  sks tmux open       open or attach a tmux Codex CLI session with explicit flags',
     '  sks --mad           open one-shot MAD full-access auto-review tmux session',
     '  sks team "task"     prepare Team mission and tmux multi-pane live view',
     '',