sneakoscope 0.7.38 → 0.7.40

package/README.md

@@ -166,10 +166,31 @@ sks tmux check
 sks tmux status --once
 ```
 
-Bare `sks` creates or reuses the default named tmux session for Codex CLI and attaches to it in an interactive terminal. Use `sks tmux open` when you need explicit `--workspace` / `--session` flags, `sks tmux check` for readiness without launching, and `sks help` for CLI help. Use `--no-attach` or `SKS_TMUX_NO_AUTO_ATTACH=1` when you only want SKS to create/reuse the session and print the manual attach command.
+Bare `sks` creates or reuses the default named tmux session for Codex CLI and attaches to it in an interactive terminal. By default it launches Codex in the SKS fast-high runtime (`--model gpt-5.5 -c model_reasoning_effort="high"`). Override with `SKS_CODEX_MODEL`, `SKS_CODEX_REASONING`, or disable the default with `SKS_CODEX_FAST_HIGH=0`. Use `sks tmux open` when you need explicit `--workspace` / `--session` flags, `sks tmux check` for readiness without launching, and `sks help` for CLI help. Use `--no-attach` or `SKS_TMUX_NO_AUTO_ATTACH=1` when you only want SKS to create/reuse the session and print the manual attach command.
 
 Before opening tmux, SKS checks the installed Codex CLI against npm `@openai/codex@latest`. If a newer version exists, it asks `Y/n`; answering `y` updates automatically with `npm i -g @openai/codex@latest` and then opens tmux with the updated Codex CLI.
 
+If you use [codex-lb](https://github.com/Soju06/codex-lb), start it first, create an API key in its dashboard, then add this provider to `~/.codex/config.toml`:
+
+```toml
+model_provider = "codex-lb"
+
+[model_providers.codex-lb]
+name = "OpenAI"
+base_url = "http://127.0.0.1:2455/backend-api/codex"
+wire_api = "responses"
+env_key = "CODEX_LB_API_KEY"
+supports_websockets = true
+requires_openai_auth = true
+```
+
+Then run:
+
+```sh
+export CODEX_LB_API_KEY="sk-clb-..."
+sks
+```
+
 ### MAD tmux Launch
 
 ```sh
@@ -385,12 +406,38 @@ Use these inside Codex App or another agent prompt. They are prompt commands, no
 
 ### First Install Checklist
 
+1. Install SKS.
+
 ```sh
 npm i -g sneakoscope
+```
+
+2. Bootstrap and check dependencies.
+
+```sh
 sks bootstrap
 sks deps check
+```
+
+On macOS, missing tmux installs and Homebrew-managed tmux upgrades ask `Y/n` before running `brew install tmux` or `brew upgrade tmux`. If PATH resolves an npm-managed `tmux`, SKS prompts for `npm i -g tmux@latest` instead of using Homebrew. Unknown non-Homebrew `tmux` paths are reported as conflicts so the user can remove, upgrade with the owning package manager, or reorder PATH first.
+
+3. Confirm Codex App command surfaces.
+
+```sh
 sks codex-app check
 sks dollar-commands
+```
+
+4. Optional codex-lb key setup for CLI `sks` runs.
+
+```sh
+export CODEX_LB_API_KEY="sk-clb-..."
+sks
+```
+
+5. Run a local smoke test.
+
+```sh
 sks selftest --mock
 ```
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "0.7.38",
+  "version": "0.7.40",
   "description": "Sneakoscope Codex: database-safe Codex CLI/App harness with Team, Goal, AutoResearch, TriWiki, and Honest Mode.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",

package/src/cli/install-helpers.mjs

@@ -222,6 +222,7 @@ async function ensureGlobalGetdesignSkillDuringInstall() {
 export async function ensureRelatedCliTools(args = []) {
   const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
   const codex = await ensureCodexCliTool({ skip });
+  const tmuxRepair = skip ? { status: 'skipped', reason: 'SKS_SKIP_CLI_TOOLS=1 or --skip-cli-tools' } : await ensureTmuxCliTool(args);
   const tmux = await tmuxReadiness().catch((err) => ({ ok: false, version: null, error: err.message }));
   return {
     codex,
@@ -231,6 +232,7 @@ export async function ensureRelatedCliTools(args = []) {
       version: tmux.version || null,
       min_version: tmux.min_version || '3.0',
       current_session: Boolean(tmux.current_session),
+      repair: tmuxRepair,
       install_hint: tmux.ok ? null : platformTmuxInstallHint(),
       error: tmux.error || null
     }
@@ -259,6 +261,86 @@ export async function ensureCodexCliTool({ skip = false } = {}) {
   };
 }
 
+export async function ensureTmuxCliTool(args = [], opts = {}) {
+  const before = await tmuxReadiness().catch((err) => ({ ok: false, error: err.message }));
+  if (before.ok) return { target: 'tmux', status: 'present', bin: before.bin || null, version: before.version || null };
+  const command = process.platform === 'darwin' ? 'brew install tmux' : platformTmuxInstallHint();
+  if (process.platform !== 'darwin') return { target: 'tmux', status: 'manual_required', command, error: before.error || 'tmux not found' };
+  const brew = await which('brew').catch(() => null);
+  if (!brew) return { target: 'tmux', status: 'manual_required', command: 'Install Homebrew, then run: brew install tmux', error: before.error || 'tmux not found' };
+  const origin = await tmuxInstallOrigin(before.bin, brew);
+  if (before.bin && origin.manager === 'npm') {
+    const repairCommand = 'npm i -g tmux@latest';
+    if (args.includes('--dry-run') || opts.dryRun) return { target: 'tmux', status: 'dry_run', manager: 'npm', command: repairCommand, error: before.error || null };
+    const npmBin = await which('npm').catch(() => null);
+    if (!npmBin) return { target: 'tmux', status: 'manual_required', manager: 'npm', command: repairCommand, error: 'npm not found on PATH' };
+    const question = `npm-managed tmux ${before.version || 'unknown'} is not ready. Upgrade with ${repairCommand}?`;
+    if (!await confirmInstallYesDefault(question, args)) return { target: 'tmux', status: 'needs_approval', manager: 'npm', command: repairCommand, error: before.error || null };
+    const install = await runProcess(npmBin, ['i', '-g', 'tmux@latest'], { timeoutMs: 180000, maxOutputBytes: 128 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
+    if (install.code !== 0) return { target: 'tmux', status: 'failed', manager: 'npm', command: repairCommand, error: `${install.stderr || install.stdout || repairCommand + ' failed'}`.trim() };
+    const after = await tmuxReadiness().catch((err) => ({ ok: false, error: err.message }));
+    if (!after.ok) return { target: 'tmux', status: 'installed_not_ready', manager: 'npm', command: repairCommand, error: after.error || 'tmux upgraded with npm but is still not ready' };
+    return { target: 'tmux', status: 'upgraded', manager: 'npm', command: repairCommand, bin: after.bin || null, version: after.version || null };
+  }
+  if (before.bin && origin.manager !== 'homebrew') {
+    return {
+      target: 'tmux',
+      status: 'conflicting_tmux',
+      bin: before.bin,
+      version: before.version || null,
+      manager: origin.manager,
+      command,
+      error: `${before.error || 'tmux is not ready'}; PATH resolves an unknown non-Homebrew tmux (${origin.reason}). Remove, upgrade with its owning package manager, or reorder PATH first, then run: ${command}`
+    };
+  }
+  const repairCommand = before.bin ? 'brew upgrade tmux' : command;
+  if (args.includes('--dry-run') || opts.dryRun) return { target: 'tmux', status: 'dry_run', command: repairCommand, error: before.error || null };
+  const question = before.bin
+    ? `Homebrew tmux ${before.version || 'unknown'} is too old. Upgrade to latest tmux with ${repairCommand}?`
+    : `tmux is missing. Install latest tmux with ${repairCommand}?`;
+  if (!await confirmInstallYesDefault(question, args)) return { target: 'tmux', status: 'needs_approval', command: repairCommand, error: before.error || null };
+  const brewArgs = before.bin ? ['upgrade', 'tmux'] : ['install', 'tmux'];
+  const install = await runProcess(brew, brewArgs, { timeoutMs: 180000, maxOutputBytes: 128 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
+  if (install.code !== 0) return { target: 'tmux', status: 'failed', command: repairCommand, error: `${install.stderr || install.stdout || repairCommand + ' failed'}`.trim() };
+  const after = await tmuxReadiness().catch((err) => ({ ok: false, error: err.message }));
+  if (!after.ok) return { target: 'tmux', status: 'installed_not_ready', command: repairCommand, error: after.error || 'tmux installed but not ready' };
+  return { target: 'tmux', status: before.bin ? 'upgraded' : 'installed', command: repairCommand, bin: after.bin || null, version: after.version || null };
+}
+
+async function confirmInstallYesDefault(question, args = []) {
+  if (shouldAutoApproveInstall(args)) return true;
+  if (!canAskYesNo()) return false;
+  const answer = (await askPostinstallQuestion(`${question} [Y/n] `)).trim();
+  return answer === '' || /^(y|yes|예|네|응)$/i.test(answer);
+}
+
+async function tmuxInstallOrigin(bin, brewBin) {
+  if (!bin) return { manager: 'missing', reason: 'tmux not found on PATH' };
+  const resolved = await fsp.realpath(bin).catch(() => path.resolve(bin));
+  if (brewBin) {
+    const brewPrefix = await runProcess(brewBin, ['--prefix'], { timeoutMs: 5000, maxOutputBytes: 4096 }).catch(() => null);
+    const prefix = brewPrefix?.code === 0 ? brewPrefix.stdout.trim().split(/\r?\n/).pop() : '';
+    const brewTmux = await runProcess(brewBin, ['list', '--versions', 'tmux'], { timeoutMs: 5000, maxOutputBytes: 4096 }).catch(() => null);
+    if (prefix && resolved.startsWith(path.resolve(prefix) + path.sep) && brewTmux?.code === 0) {
+      return { manager: 'homebrew', reason: `${resolved} under ${prefix}` };
+    }
+  }
+  const npmBin = await which('npm').catch(() => null);
+  if (npmBin) {
+    const npmPrefix = await runProcess(npmBin, ['prefix', '-g'], { timeoutMs: 5000, maxOutputBytes: 4096 }).catch(() => null);
+    const prefix = npmPrefix?.code === 0 ? npmPrefix.stdout.trim().split(/\r?\n/).pop() : '';
+    const npmBinDir = prefix ? (process.platform === 'win32' ? prefix : path.join(prefix, 'bin')) : '';
+    const npmRoot = prefix ? path.join(prefix, 'lib', 'node_modules') : '';
+    if ((npmBinDir && path.resolve(bin).startsWith(path.resolve(npmBinDir) + path.sep)) || (npmRoot && resolved.startsWith(path.resolve(npmRoot) + path.sep))) {
+      return { manager: 'npm', reason: `${bin} resolves through npm global prefix ${prefix}` };
+    }
+  }
+  if (/\/node_modules\/(?:\.bin\/)?tmux(?:$|\/)/.test(resolved.split(path.sep).join('/'))) {
+    return { manager: 'npm', reason: `${resolved} is inside node_modules` };
+  }
+  return { manager: 'unknown', reason: `${bin} resolves to ${resolved}` };
+}
+
 export async function maybePromptCodexUpdateForLaunch(args = [], opts = {}) {
   if (hasFlag(args, '--json') || hasFlag(args, '--skip-cli-tools') || hasFlag(args, '--skip-codex-update') || process.env.SKS_SKIP_CODEX_UPDATE === '1') return { status: 'skipped' };
   const latest = await npmPackageVersion('@openai/codex');

package/src/cli/main.mjs

@@ -18,7 +18,7 @@ import { classifySql, classifyCommand, checkDbOperation, handleMadSksUserConfirm
 import { checkHarnessModification, harnessGuardStatus, isHarnessSourceProject } from '../core/harness-guard.mjs';
 import { formatHarnessConflictReport, llmHarnessCleanupPrompt, scanHarnessConflicts } from '../core/harness-conflicts.mjs';
 import { context7Docs, context7Resolve, context7Text, context7Tools } from '../core/context7-client.mjs';
-import { installVersionGitHook, runVersionPreCommit, versioningStatus } from '../core/version-manager.mjs';
+import { bumpProjectVersion, installVersionGitHook, runVersionPreCommit, versioningStatus } from '../core/version-manager.mjs';
 import { rustInfo } from '../core/rust-accelerator.mjs';
 import { renderCartridge, validateCartridge, driftCartridge, snapshotCartridge } from '../core/gx-renderer.mjs';
 import { defaultEvaluationScenario, runEvaluationBenchmark } from '../core/evaluation.mjs';
@@ -61,7 +61,7 @@ import { OPENCLAW_SKILL_NAME, installOpenClawSkill } from '../core/openclaw.mjs'
 import { buildTmuxLaunchPlan, buildTmuxOpenArgs, createTmuxSession, isTmuxShellSession, runTmuxLaunchPlanSyntaxCheck, shouldAutoAttachTmux, tmuxReadiness, tmuxStatusKind, defaultTmuxSessionName, formatTmuxBanner, launchTmuxTeamView, launchTmuxUi, platformTmuxInstallHint, runTmuxStatus, sanitizeTmuxSessionName, teamLaneStyle } from '../core/tmux-ui.mjs';
 import { autoReviewProfileName, autoReviewStatus, autoReviewSummary, enableAutoReview, disableAutoReview, enableMadHighProfile, madHighProfileName } from '../core/auto-review.mjs';
 import { context7Command } from './context7-command.mjs';
-import { askPostinstallQuestion, checkContext7, checkRequiredSkills, ensureCodexCliTool, ensureGlobalCodexSkillsDuringInstall, ensureProjectContext7Config, ensureRelatedCliTools, ensureSksCommandDuringInstall, globalCodexSkillsRoot, maybePromptCodexUpdateForLaunch, postinstall, postinstallBootstrapDecision, shouldAutoApproveInstall } from './install-helpers.mjs';
+import { askPostinstallQuestion, checkContext7, checkRequiredSkills, ensureCodexCliTool, ensureGlobalCodexSkillsDuringInstall, ensureProjectContext7Config, ensureRelatedCliTools, ensureSksCommandDuringInstall, ensureTmuxCliTool, globalCodexSkillsRoot, maybePromptCodexUpdateForLaunch, postinstall, postinstallBootstrapDecision, shouldAutoApproveInstall } from './install-helpers.mjs';
 import { buildTeamPlan, codeStructureCommand, dbCommand, defaultBeta, defaultVGraph, evalCommand, gcCommand, goalCommand, gxCommand, harnessCommand, hproofCommand, memoryCommand, migrateWikiContextPack, parseTeamCreateArgs, perfCommand, profileCommand, projectWikiClaims, proofFieldCommand, qaLoopCommand, quickstartCommand, researchCommand, skillDreamCommand, statsCommand, team, teamWorkflowMarkdown, validateArtifactsCommand, wikiCommand, wikiVoxelRowCount, writeWikiContextPack } from './maintenance-commands.mjs';
 import { openClawCommand } from './openclaw-command.mjs';
 
@@ -819,7 +819,7 @@ async function versioning(sub = 'status', args = []) {
     return;
   }
   if (action === 'bump') {
-    const res = await runVersionPreCommit(root, { force: true });
+    const res = await bumpProjectVersion(root, { force: true });
     if (flag(args, '--json')) return console.log(JSON.stringify(res, null, 2));
     if (!res.ok) {
       console.error(`Version bump failed: ${res.reason || 'unknown'}`);
@@ -839,7 +839,7 @@ async function versioning(sub = 'status', args = []) {
       return;
     }
     if (res.skipped) return;
-    console.log(res.changed ? `SKS versioning: ${res.previous_version} -> ${res.version}` : `SKS versioning: ${res.version} already unique`);
+    console.log(res.changed ? `SKS versioning synced: ${res.version}` : `SKS versioning: ${res.version} verified`);
     return;
   }
   console.error('Usage: sks versioning status|bump|pre-commit [--json]');
@@ -1106,11 +1106,7 @@ async function installContext7Dependency(root) {
 }
 
 async function installTmuxDependency(args = []) {
-  const before = await tmuxReadiness().catch(() => ({ ok: false }));
-  if (before.ok) return { target: 'tmux', status: 'present', version: before.version || null, app: before.app || null, cli: before.cli || null };
-  const command = process.platform === 'darwin' ? 'brew install tmux' : platformTmuxInstallHint();
-  if (flag(args, '--dry-run')) return { target: 'tmux', status: 'dry_run', command };
-  return { target: 'tmux', status: 'manual_required', command, error: before.error || 'tmux not found' };
+  return ensureTmuxCliTool(args, { dryRun: flag(args, '--dry-run') });
 }
 
 async function confirmInstall(question, args = []) {
@@ -1237,11 +1233,11 @@ function usage(args = []) {
   const topic = String(args[0] || 'overview').toLowerCase();
   const blocks = {
     overview: ['ㅅㅋㅅ Usage', '', 'Discover:', '  sks commands', '  sks quickstart', '  sks root', '  sks bootstrap', '  sks deps check', '  sks codex-app check', '  sks tmux check', '  sks dollar-commands', '', `Topics: ${USAGE_TOPICS}`],
-    install: ['Install', '', '  npm i -g sneakoscope', '  sks root', '  sks', '', 'Project bootstrap:', '  sks bootstrap', '', 'Fallback:', '  npx -y -p sneakoscope sks root', '', 'Project:', '  npm i -D sneakoscope', '  npx sks setup --install-scope project'],
+    install: ['Install', '', '1. Global install:', '  npm i -g sneakoscope', '', '2. Bootstrap and check dependencies:', '  sks bootstrap', '  sks deps check', '', '3. Confirm Codex App commands:', '  sks codex-app check', '  sks dollar-commands', '', '4. Optional codex-lb key setup for CLI sks runs:', '  # Add the codex-lb provider to ~/.codex/config.toml, then:', '  export CODEX_LB_API_KEY="sk-clb-..."', '  sks', '', 'Fallback:', '  npx -y -p sneakoscope sks root', '', 'Project:', '  npm i -D sneakoscope', '  npx sks setup --install-scope project'],
     bootstrap: ['Bootstrap', '', '  sks bootstrap', '  sks setup --bootstrap', '', 'Creates project SKS files, Codex App skills/hooks/config, state/guard files, then checks Codex App, Context7, and tmux.'],
     root: ['Root', '', '  sks root [--json]', '', 'Inside a project, SKS uses that project root. Outside any project marker, runtime commands use the per-user global SKS root instead of writing .sneakoscope into the current random folder.'],
-    deps: ['Dependencies', '', '  sks deps check [--json]', '  sks deps install [tmux|codex|context7|all] [--yes]', '', 'tmux on macOS uses Homebrew only after approval.'],
-    tmux: ['tmux', '', '  sks', '  sks tmux open', '  sks tmux check', '  sks tmux status --once', '  sks deps install tmux', '', 'Running bare `sks` opens or reuses the default tmux Codex CLI session. Before launch, SKS checks npm @openai/codex@latest and prompts Y/n when the installed Codex CLI is missing or outdated. Use `sks tmux open` when you need explicit session/workspace flags, and `sks help` for CLI help.'],
+    deps: ['Dependencies', '', '  sks deps check [--json]', '  sks deps install [tmux|codex|context7|all] [--yes]', '', 'tmux on macOS uses Homebrew after Y/n approval for missing installs or Homebrew-managed upgrades. If PATH resolves an npm-managed tmux, SKS prompts for npm i -g tmux@latest instead. Unknown non-Homebrew tmux paths are reported as conflicts.'],
+    tmux: ['tmux', '', '  sks', '  sks tmux open', '  sks tmux check', '  sks tmux status --once', '  sks deps install tmux', '', 'Running bare `sks` opens or reuses the default tmux Codex CLI session in fast-high mode: --model gpt-5.5 -c model_reasoning_effort="high". Override with SKS_CODEX_MODEL or SKS_CODEX_REASONING. Before launch, SKS checks npm @openai/codex@latest and prompts Y/n when the installed Codex CLI is missing or outdated. Use `sks tmux open` when you need explicit session/workspace flags, and `sks help` for CLI help.'],
     openclaw: ['OpenClaw', '', '  sks openclaw install', '  sks openclaw path', '  sks openclaw print SKILL.md', '', 'Installs an OpenClaw skill package under ~/.openclaw/skills/sneakoscope-codex so OpenClaw agents can attach skills: [sneakoscope-codex] with the shell tool and call local SKS commands from a project root.'],
     team: ['Team', '', '  sks team "task" executor:5 reviewer:2 user:1', '  sks team watch latest', '  sks team lane latest --agent analysis_scout_1 --follow', '  sks team message latest --from analysis_scout_1 --to executor_1 --message "handoff note"', '  sks team cleanup-tmux latest', '', '$Team runs questions -> contract -> scouts -> TriWiki attention -> debate -> runtime graph/inbox -> fresh executors -> review -> cleanup -> reflection -> Honest.'],
     'qa-loop': ['QA-LOOP', '', '  sks qa-loop prepare "QA this app"', '  sks qa-loop answer <MISSION_ID> answers.json', '  sks qa-loop run <MISSION_ID> --max-cycles 8', '', 'Report: YYYY-MM-DD-v<version>-qa-report.md'],
@@ -1937,6 +1933,8 @@ async function selftest() {
   if (!tmuxSyntax.ok || !tmuxSyntax.command.includes('tmux attach-session -t sks-mad-selftest')) throw new Error('selftest failed: MAD tmux attach plan is not stable by session name');
   const tmuxOpenArgs = buildTmuxOpenArgs(workspacePlan);
   if (tmuxOpenArgs.join(' ') !== 'attach-session -t sks-mad-selftest') throw new Error('selftest failed: MAD tmux attach args are not stable by session name');
+  const defaultFastHighPlan = await buildTmuxLaunchPlan({ root: tmp, tmux: { ok: true, bin: 'tmux', version: '3.4' }, codex: { bin: 'codex', version: 'codex-cli 99.0.0' }, app: { ok: true } });
+  if (defaultFastHighPlan.codexArgs.join(' ') !== '--model gpt-5.5 -c model_reasoning_effort="high"') throw new Error('selftest failed: default sks tmux launch is not fast-high');
   if (!shouldAutoAttachTmux(['--mad'], {}, { stdin: { isTTY: true }, stdout: { isTTY: true } })) throw new Error('selftest failed: MAD tmux launch does not auto-attach in an interactive terminal');
   if (shouldAutoAttachTmux(['--mad', '--json'], {}, { stdin: { isTTY: true }, stdout: { isTTY: true } })) throw new Error('selftest failed: MAD tmux json mode should not auto-attach');
   if (shouldAutoAttachTmux(['--mad', '--no-attach'], {}, { stdin: { isTTY: true }, stdout: { isTTY: true } })) throw new Error('selftest failed: MAD tmux --no-attach should remain print-only');
@@ -2037,9 +2035,12 @@ async function selftest() {
   const versionHookText = await safeReadText(versionStatus.hook_path);
   if (!versionHookText.includes('versioning pre-commit')) throw new Error('selftest failed: versioning hook command missing');
   if (versionHookText.indexOf('versioning pre-commit') > versionHookText.indexOf('exit 0')) throw new Error('selftest failed: versioning hook was appended after an early exit');
+  await writeTextAtomic(path.join(versionTmp, 'CHANGELOG.md'), '# Changelog\n\n## [Unreleased]\n\n## [0.1.0] - 2026-05-08\n\n### Fixed\n\n- Initial version selftest fixture.\n');
   await writeTextAtomic(path.join(versionTmp, 'README.md'), 'version selftest\n');
-  await runProcess('git', ['add', 'README.md'], { cwd: versionTmp, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
-  const firstVersionBump = await runVersionPreCommit(versionTmp);
+  await runProcess('git', ['add', 'README.md', 'CHANGELOG.md'], { cwd: versionTmp, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
+  const preCommitVerify = await runVersionPreCommit(versionTmp);
+  if (!preCommitVerify.ok || preCommitVerify.version !== '0.1.0' || preCommitVerify.changed) throw new Error('selftest failed: pre-commit should verify current version without bumping');
+  const firstVersionBump = await bumpProjectVersion(versionTmp);
   if (!firstVersionBump.ok || firstVersionBump.version !== '0.1.1' || !firstVersionBump.changed) throw new Error('selftest failed: first version bump did not advance patch version');
   const bumpedPackage = await readJson(path.join(versionTmp, 'package.json'));
   const bumpedLock = await readJson(path.join(versionTmp, 'package-lock.json'));
@@ -2052,7 +2053,7 @@ async function selftest() {
   await writeJsonAtomic(versionStatus.state_path, { schema_version: 1, last_version: '0.1.5', updated_at: nowIso(), pid: process.pid, changed: true });
   await writeTextAtomic(path.join(versionTmp, 'CHANGELOG.md'), 'collision selftest\n');
   await runProcess('git', ['add', 'CHANGELOG.md'], { cwd: versionTmp, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
-  const collisionBump = await runVersionPreCommit(versionTmp);
+  const collisionBump = await bumpProjectVersion(versionTmp);
   if (!collisionBump.ok || collisionBump.version !== '0.1.6') throw new Error('selftest failed: version collision state did not bump above last seen version');
   const localOnlyTmp = tmpdir();
   await ensureDir(path.join(localOnlyTmp, '.git'));
@@ -2547,9 +2548,16 @@ async function selftest() {
   const codexConfigText = await safeReadText(path.join(tmp, '.codex', 'config.toml'));
   if (!codexConfigText.includes('multi_agent = true')) throw new Error('selftest failed: multi_agent not enabled');
   if (!hasContext7ConfigText(codexConfigText)) throw new Error('selftest failed: Context7 MCP not configured');
-  if (!codexConfigText.includes('[profiles.sks-task-low]') || !codexConfigText.includes('[profiles.sks-task-medium]') || !codexConfigText.includes('[profiles.sks-logic-high]') || !codexConfigText.includes('[profiles.sks-research-xhigh]') || !codexConfigText.includes('[profiles.sks-mad-high]')) throw new Error('selftest failed: GPT-5.5 reasoning profiles not configured');
+  if (!codexConfigText.includes('[profiles.sks-task-low]') || !codexConfigText.includes('[profiles.sks-task-medium]') || !codexConfigText.includes('[profiles.sks-logic-high]') || !codexConfigText.includes('[profiles.sks-fast-high]') || !codexConfigText.includes('[profiles.sks-research-xhigh]') || !codexConfigText.includes('[profiles.sks-mad-high]')) throw new Error('selftest failed: GPT-5.5 reasoning profiles not configured');
   if (!codexConfigText.includes('[agents.analysis_scout]')) throw new Error('selftest failed: analysis_scout agent not configured');
   if (!codexConfigText.includes('[agents.team_consensus]')) throw new Error('selftest failed: team_consensus agent not configured');
+  const preservedConfigTmp = tmpdir();
+  await ensureDir(path.join(preservedConfigTmp, '.codex'));
+  await writeTextAtomic(path.join(preservedConfigTmp, '.codex', 'config.toml'), '[features]\nfast_mode_ui = true\n\n[user.fast_mode]\nvisible = true\n');
+  await initProject(preservedConfigTmp, {});
+  const preservedConfig = await safeReadText(path.join(preservedConfigTmp, '.codex', 'config.toml'));
+  if (!preservedConfig.includes('fast_mode_ui = true') || !preservedConfig.includes('[user.fast_mode]') || !preservedConfig.includes('visible = true')) throw new Error('selftest failed: Codex config merge dropped user Fast mode settings');
+  if (!preservedConfig.includes('codex_hooks = true') || !preservedConfig.includes('[profiles.sks-fast-high]')) throw new Error('selftest failed: Codex config merge did not add SKS managed settings');
   const autoReviewHome = path.join(tmp, 'auto-review-home');
   const autoReviewEnv = { HOME: autoReviewHome };
   const autoReviewEnabled = await enableAutoReview({ env: autoReviewEnv, high: true });

package/src/core/fsx.mjs

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 
-export const PACKAGE_VERSION = '0.7.38';
+export const PACKAGE_VERSION = '0.7.40';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 

package/src/core/init.mjs

@@ -415,15 +415,118 @@ export async function initProject(root, opts = {}) {
     };
   }
 
-  function installPolicy(scope, commandPrefix) {
-    return {
-      scope,
-      default_scope: 'global',
-      hook_command_prefix: commandPrefix,
-      global_install: 'npm i -g sneakoscope',
-      project_install: 'npm i -D sneakoscope && npx sks setup --install-scope project'
-    };
+function installPolicy(scope, commandPrefix) {
+  return {
+    scope,
+    default_scope: 'global',
+    hook_command_prefix: commandPrefix,
+    global_install: 'npm i -g sneakoscope',
+    project_install: 'npm i -D sneakoscope && npx sks setup --install-scope project'
+  };
+}
+
+function mergeManagedCodexConfigToml(existingContent = '') {
+  let next = String(existingContent || '').trimEnd();
+  next = upsertTomlTableKey(next, 'features', 'codex_hooks = true');
+  next = upsertTomlTableKey(next, 'features', 'multi_agent = true');
+  next = upsertTomlTableKey(next, 'agents', 'max_threads = 6');
+  next = upsertTomlTableKey(next, 'agents', 'max_depth = 1');
+  for (const block of managedCodexConfigBlocks()) {
+    next = upsertTomlTable(next, block.table, block.text);
+  }
+  return `${next.trim()}\n`;
+}
+
+function managedCodexConfigBlocks() {
+  return [
+    { table: 'mcp_servers.context7', text: context7ConfigToml().trim() },
+    { table: 'agents.analysis_scout', text: agentConfigBlock('analysis_scout', 'Read-only SKS scout.', './agents/analysis-scout.toml', ['Scout', 'Mapper']) },
+    { table: 'agents.team_consensus', text: agentConfigBlock('team_consensus', 'SKS planning/debate agent.', './agents/team-consensus.toml', ['Consensus', 'Atlas']) },
+    { table: 'agents.implementation_worker', text: agentConfigBlock('implementation_worker', 'SKS bounded implementation worker.', './agents/implementation-worker.toml', ['Builder', 'Mason']) },
+    { table: 'agents.db_safety_reviewer', text: agentConfigBlock('db_safety_reviewer', 'Read-only DB safety reviewer.', './agents/db-safety-reviewer.toml', ['Sentinel', 'Ledger']) },
+    { table: 'agents.qa_reviewer', text: agentConfigBlock('qa_reviewer', 'Read-only QA reviewer.', './agents/qa-reviewer.toml', ['Verifier', 'Scout']) },
+    { table: 'profiles.sks-task-low', text: profileConfigBlock('sks-task-low', 'low') },
+    { table: 'profiles.sks-task-medium', text: profileConfigBlock('sks-task-medium', 'medium') },
+    { table: 'profiles.sks-logic-high', text: profileConfigBlock('sks-logic-high', 'high') },
+    { table: 'profiles.sks-fast-high', text: profileConfigBlock('sks-fast-high', 'high') },
+    { table: 'profiles.sks-research-xhigh', text: profileConfigBlock('sks-research-xhigh', 'xhigh') },
+    { table: 'profiles.sks-research', text: profileConfigBlock('sks-research', 'xhigh', { approval: 'never' }) },
+    { table: 'profiles.sks-team', text: profileConfigBlock('sks-team', 'high') },
+    { table: 'profiles.sks-mad-high', text: profileConfigBlock('sks-mad-high', 'high', { sandbox: 'danger-full-access', approvalsReviewer: 'auto_review' }) },
+    {
+      table: 'auto_review',
+      text: '[auto_review]\npolicy = "Deny destructive database operations, credential exfiltration, persistent security weakening, broad file deletion, writes outside the workspace, and unrequested fallback implementation code unless explicitly authorized by the user or sealed decision contract."'
+    },
+    { table: 'profiles.sks-default', text: profileConfigBlock('sks-default', 'high') }
+  ];
+}
+
+function agentConfigBlock(table, description, configFile, nicknames = []) {
+  return [
+    `[agents.${table}]`,
+    `description = "${description}"`,
+    `config_file = "${configFile}"`,
+    `nickname_candidates = [${nicknames.map((name) => `"${name}"`).join(', ')}]`
+  ].join('\n');
+}
+
+function profileConfigBlock(profile, effort, opts = {}) {
+  return [
+    `[profiles.${profile}]`,
+    'model = "gpt-5.5"',
+    `approval_policy = "${opts.approval || 'on-request'}"`,
+    ...(opts.approvalsReviewer ? [`approvals_reviewer = "${opts.approvalsReviewer}"`] : []),
+    `sandbox_mode = "${opts.sandbox || 'workspace-write'}"`,
+    `model_reasoning_effort = "${effort}"`
+  ].join('\n');
+}
+
+function upsertTomlTableKey(text, table, line) {
+  const key = String(line).split('=')[0].trim();
+  let lines = String(text || '').split('\n');
+  if (lines.length === 1 && lines[0] === '') lines = [];
+  const header = `[${table}]`;
+  let start = lines.findIndex((x) => x.trim() === header);
+  if (start === -1) {
+    const prefix = lines.length && lines[lines.length - 1].trim() ? ['', header, line] : [header, line];
+    return [...lines, ...prefix].join('\n').replace(/\n{3,}/g, '\n\n');
+  }
+  let end = lines.length;
+  for (let i = start + 1; i < lines.length; i++) {
+    if (/^\s*\[.+\]\s*$/.test(lines[i])) {
+      end = i;
+      break;
+    }
+  }
+  for (let i = start + 1; i < end; i++) {
+    if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(lines[i])) {
+      lines[i] = line;
+      return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+    }
   }
+  lines.splice(start + 1, 0, line);
+  return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+}
+
+function upsertTomlTable(text, table, block) {
+  let lines = String(text || '').trimEnd().split('\n');
+  if (lines.length === 1 && lines[0] === '') lines = [];
+  const header = `[${table}]`;
+  const start = lines.findIndex((x) => x.trim() === header);
+  const blockLines = String(block || '').trim().split('\n');
+  if (start === -1) {
+    return [...lines, ...(lines.length ? [''] : []), ...blockLines].join('\n').replace(/\n{3,}/g, '\n\n');
+  }
+  let end = lines.length;
+  for (let i = start + 1; i < lines.length; i++) {
+    if (/^\s*\[.+\]\s*$/.test(lines[i])) {
+      end = i;
+      break;
+    }
+  }
+  lines.splice(start, end - start, ...blockLines);
+  return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+}
 
   const currentState = path.join(sine, 'state', 'current.json');
   if (!(await exists(currentState)) || opts.force) {
@@ -441,26 +544,9 @@ export async function initProject(root, opts = {}) {
     created.push('AGENTS.md managed block');
   }
 
-  await writeTextAtomic(path.join(root, '.codex', 'config.toml'), `[features]\ncodex_hooks = true\nmulti_agent = true\n\n[agents]\nmax_threads = 6\nmax_depth = 1\n\n${context7ConfigToml()}\n[agents.analysis_scout]\ndescription = "Read-only SKS scout."\nconfig_file = "./agents/analysis-scout.toml"\nnickname_candidates = ["Scout", "Mapper"]\n\n[agents.team_consensus]\ndescription = "SKS planning/debate agent."\nconfig_file = "./agents/team-consensus.toml"\nnickname_candidates = ["Consensus", "Atlas"]\n\n[agents.implementation_worker]\ndescription = "SKS bounded implementation worker."\nconfig_file = "./agents/implementation-worker.toml"\nnickname_candidates = ["Builder", "Mason"]\n\n[agents.db_safety_reviewer]\ndescription = "Read-only DB safety reviewer."\nconfig_file = "./agents/db-safety-reviewer.toml"\nnickname_candidates = ["Sentinel", "Ledger"]\n\n[agents.qa_reviewer]\ndescription = "Read-only QA reviewer."\nconfig_file = "./agents/qa-reviewer.toml"\nnickname_candidates = ["Verifier", "Scout"]\n\n[profiles.sks-task-medium]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "medium"\n\n[profiles.sks-logic-high]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "high"\n\n[profiles.sks-research-xhigh]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "xhigh"\n\n[profiles.sks-research]\nmodel = "gpt-5.5"\napproval_policy = "never"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "xhigh"\n\n[profiles.sks-team]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "high"\n\n[profiles.sks-mad-high]
-model = "gpt-5.5"
-approval_policy = "on-request"
-approvals_reviewer = "auto_review"
-sandbox_mode = "danger-full-access"
-model_reasoning_effort = "high"
-
-[auto_review]
-policy = "Deny destructive database operations, credential exfiltration, persistent security weakening, broad file deletion, writes outside the workspace, and unrequested fallback implementation code unless explicitly authorized by the user or sealed decision contract."
-
-[profiles.sks-default]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "medium"\n`);
   const generatedCodexConfigPath = path.join(root, '.codex', 'config.toml');
-  let generatedCodexConfig = await readText(generatedCodexConfigPath, '');
-  if (!generatedCodexConfig.includes('[profiles.sks-task-low]')) {
-    generatedCodexConfig = generatedCodexConfig.replace(
-      '[profiles.sks-task-medium]',
-      '[profiles.sks-task-low]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "low"\n\n[profiles.sks-task-medium]'
-    );
-    await writeTextAtomic(generatedCodexConfigPath, generatedCodexConfig);
-  }
+  const existingCodexConfig = await readText(generatedCodexConfigPath, '');
+  await writeTextAtomic(generatedCodexConfigPath, mergeManagedCodexConfigToml(existingCodexConfig));
   created.push('.codex/config.toml');
 
   await writeTextAtomic(path.join(root, '.codex', 'SNEAKOSCOPE.md'), codexAppQuickReference(installScope, hookCommandPrefix));

package/src/core/tmux-ui.mjs

@@ -14,6 +14,19 @@ export const SKS_TMUX_LOGO = [
   'Sneakoscope Codex tmux'
 ].join('\n');
 
+export const DEFAULT_SKS_CODEX_MODEL = 'gpt-5.5';
+export const DEFAULT_SKS_CODEX_REASONING = 'high';
+
+export function defaultCodexLaunchArgs(env = process.env) {
+  if (/^(0|false|off|none)$/i.test(String(env.SKS_CODEX_FAST_HIGH || '').trim())) return [];
+  const model = String(env.SKS_CODEX_MODEL || DEFAULT_SKS_CODEX_MODEL).trim();
+  const effort = String(env.SKS_CODEX_REASONING || DEFAULT_SKS_CODEX_REASONING).trim();
+  const args = [];
+  if (model) args.push('--model', model);
+  if (effort) args.push('-c', `model_reasoning_effort="${effort}"`);
+  return args;
+}
+
 export function sanitizeTmuxSessionName(input) {
   const base = String(input || 'sks').trim().replace(/[^A-Za-z0-9_.:-]+/g, '-').replace(/^-+|-+$/g, '');
   return (base || 'sks').slice(0, 80);
@@ -177,7 +190,7 @@ export async function buildTmuxLaunchPlan(opts = {}) {
   const codex = opts.codex || await getCodexInfo().catch(() => ({}));
   const tmux = opts.tmux || await tmuxReadiness(opts);
   const app = opts.app || await codexAppIntegrationStatus({ codex });
-  const codexArgs = Array.isArray(opts.codexArgs) ? opts.codexArgs : [];
+  const codexArgs = Array.isArray(opts.codexArgs) ? opts.codexArgs : defaultCodexLaunchArgs(opts.env || process.env);
   return {
     root,
     session,

package/src/core/version-manager.mjs

@@ -48,7 +48,11 @@ async function runtimeDriftStatus(root, packageVersion) {
   if (!packageVersion || process.env.SKS_RUNTIME_DRIFT_CHECK === '0') {
     return { ok: true, checked: false, reason: packageVersion ? 'disabled' : 'package_json_version_missing' };
   }
-  const result = await runProcess('sks', ['--version'], {
+  const localBin = path.join(root, 'bin', 'sks.mjs');
+  const useLocalBin = await exists(localBin);
+  const command = useLocalBin ? process.execPath : 'sks';
+  const args = useLocalBin ? [localBin, '--version'] : ['--version'];
+  const result = await runProcess(command, args, {
     cwd: root,
     timeoutMs: 5000,
     maxOutputBytes: 16 * 1024,
@@ -68,6 +72,7 @@ async function runtimeDriftStatus(root, packageVersion) {
   return {
     ok: comparison >= 0,
     checked: true,
+    command: [command, ...args].join(' '),
     runtime_version: runtimeVersion,
     package_version: packageVersion,
     relation: comparison === 0 ? 'same' : (comparison > 0 ? 'runtime_newer' : 'runtime_older')
@@ -83,7 +88,7 @@ export async function runVersionPreCommit(root, opts = {}) {
   if (!pkg?.version) return { ok: true, skipped: true, reason: 'package_json_version_missing' };
   const git = await gitPaths(root);
   if (!git.ok) return { ok: true, skipped: true, reason: git.reason || 'not_git' };
-  return withVersionLock(git.common_dir, async () => bumpProjectVersion(root, { ...opts, policy, git }));
+  return withVersionLock(git.common_dir, async () => verifyProjectVersion(root, { ...opts, policy, git }));
 }
 
 export async function bumpProjectVersion(root, opts = {}) {
@@ -145,6 +150,43 @@ export async function bumpProjectVersion(root, opts = {}) {
   };
 }
 
+export async function verifyProjectVersion(root, opts = {}) {
+  const git = opts.git || await gitPaths(root);
+  const pkgPath = path.join(root, 'package.json');
+  const pkg = await readJson(pkgPath);
+  const current = parseSemver(pkg.version);
+  if (!current) return { ok: false, reason: `Unsupported package.json version: ${pkg.version}` };
+  const version = formatSemver(current);
+  const sourceVersion = await syncSourcePackageVersion(root, version);
+  const synced = await syncPackageLockVersions(root, version);
+  if (!await changelogHasVersionSection(root, version)) {
+    return { ok: false, reason: 'changelog_section_missing', version, expected: `## [${version}]` };
+  }
+  const staged = await stageVersionFiles(root, [...synced.files, ...sourceVersion.files]);
+  if (!staged.ok) return { ok: false, reason: 'git_add_version_files_failed', stderr: staged.stderr };
+  const statePath = git.ok ? path.join(git.common_dir, VERSION_STATE_FILE) : null;
+  if (statePath) {
+    await writeJsonAtomic(statePath, {
+      schema_version: 1,
+      last_version: version,
+      updated_at: nowIso(),
+      pid: process.pid,
+      mode: 'verify',
+      changed: Boolean(synced.files.length || sourceVersion.files.length)
+    });
+  }
+  return {
+    ok: true,
+    changed: Boolean(synced.files.length || sourceVersion.files.length),
+    version,
+    previous_version: version,
+    synced_files: [...synced.relative_files, ...sourceVersion.relative_files],
+    staged_files: staged.relative_files,
+    lock_scope: git.common_dir,
+    mode: 'verify'
+  };
+}
+
 async function versionPolicy(root) {
   const policy = await readJson(path.join(root, '.sneakoscope', 'policy.json'), {});
   return {
@@ -252,6 +294,13 @@ async function syncChangelogVersionSection(root, version) {
   return { files: [file], relative_files: [path.relative(root, file)] };
 }
 
+async function changelogHasVersionSection(root, version) {
+  const file = path.join(root, 'CHANGELOG.md');
+  const text = await readFileMaybe(file);
+  const sectionRe = new RegExp(`^##\\s+\\[${escapeRegExp(version)}\\]\\s+-\\s+\\d{4}-\\d{2}-\\d{2}\\s*$`, 'm');
+  return sectionRe.test(text);
+}
+
 async function stageVersionFiles(root, files) {
   const existing = [];
   for (const file of files) if (await exists(file)) existing.push(path.relative(root, file));