sneakoscope 0.7.38 → 0.7.41

package/README.md

@@ -166,10 +166,37 @@ sks tmux check
 sks tmux status --once
 ```
 
-Bare `sks` creates or reuses the default named tmux session for Codex CLI and attaches to it in an interactive terminal. Use `sks tmux open` when you need explicit `--workspace` / `--session` flags, `sks tmux check` for readiness without launching, and `sks help` for CLI help. Use `--no-attach` or `SKS_TMUX_NO_AUTO_ATTACH=1` when you only want SKS to create/reuse the session and print the manual attach command.
+Bare `sks` creates or reuses the default named tmux session for Codex CLI and attaches to it in an interactive terminal. By default it launches Codex in the SKS fast-high runtime (`--model gpt-5.5 -c model_reasoning_effort="high"`). Override with `SKS_CODEX_MODEL`, `SKS_CODEX_REASONING`, or disable the default with `SKS_CODEX_FAST_HIGH=0`. Use `sks tmux open` when you need explicit `--workspace` / `--session` flags, `sks tmux check` for readiness without launching, and `sks help` for CLI help. Use `--no-attach` or `SKS_TMUX_NO_AUTO_ATTACH=1` when you only want SKS to create/reuse the session and print the manual attach command.
 
 Before opening tmux, SKS checks the installed Codex CLI against npm `@openai/codex@latest`. If a newer version exists, it asks `Y/n`; answering `y` updates automatically with `npm i -g @openai/codex@latest` and then opens tmux with the updated Codex CLI.
 
+If you use [codex-lb](https://github.com/Soju06/codex-lb), start it first, create an API key in its dashboard, then run:
+
+```sh
+sks codex-lb setup --host https://your-codex-lb.example.com --api-key "sk-clb-..."
+sks
+```
+
+Bare `sks` asks this before opening Codex when codex-lb is not configured:
+
+```text
+Authenticate and route Codex through codex-lb? [y/N]
+```
+
+Answering `y` asks for the hosted domain and API key, writes `~/.codex/config.toml`, stores the key in `~/.codex/sks-codex-lb.env` with mode `0600`, and sources that env file before launching Codex in tmux. When codex-lb is configured from this prompt, SKS opens a fresh tmux session for that launch so the new key is loaded by the Codex process immediately. The generated provider config follows the codex-lb README's Codex CLI API-key setup:
+
+```toml
+model_provider = "codex-lb"
+
+[model_providers.codex-lb]
+name = "OpenAI"
+base_url = "http://127.0.0.1:2455/backend-api/codex"
+wire_api = "responses"
+env_key = "CODEX_LB_API_KEY"
+supports_websockets = true
+requires_openai_auth = true
+```
+
 ### MAD tmux Launch
 
 ```sh
@@ -385,12 +412,38 @@ Use these inside Codex App or another agent prompt. They are prompt commands, no
 
 ### First Install Checklist
 
+1. Install SKS.
+
 ```sh
 npm i -g sneakoscope
+```
+
+2. Bootstrap and check dependencies.
+
+```sh
 sks bootstrap
 sks deps check
+```
+
+On macOS, missing tmux installs and Homebrew-managed tmux upgrades ask `Y/n` before running `brew install tmux` or `brew upgrade tmux`. If PATH resolves an npm-managed `tmux`, SKS prompts for `npm i -g tmux@latest` instead of using Homebrew. Unknown non-Homebrew `tmux` paths are reported as conflicts so the user can remove, upgrade with the owning package manager, or reorder PATH first.
+
+3. Confirm Codex App command surfaces.
+
+```sh
 sks codex-app check
 sks dollar-commands
+```
+
+4. Optional codex-lb key setup for CLI `sks` runs.
+
+```sh
+sks codex-lb setup --host <domain> --api-key <key>
+sks
+```
+
+5. Run a local smoke test.
+
+```sh
 sks selftest --mock
 ```
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "0.7.38",
+  "version": "0.7.41",
   "description": "Sneakoscope Codex: database-safe Codex CLI/App harness with Team, Goal, AutoResearch, TriWiki, and Honest Mode.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",

package/src/cli/install-helpers.mjs

@@ -3,7 +3,7 @@ import os from 'node:os';
 import fsp from 'node:fs/promises';
 import readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
-import { ensureDir, exists, globalSksRoot, packageRoot, runProcess, which, writeTextAtomic } from '../core/fsx.mjs';
+import { ensureDir, exists, globalSksRoot, packageRoot, readText, runProcess, which, writeTextAtomic } from '../core/fsx.mjs';
 import { getCodexInfo } from '../core/codex-adapter.mjs';
 import { formatHarnessConflictReport, llmHarnessCleanupPrompt, scanHarnessConflicts } from '../core/harness-conflicts.mjs';
 import { installSkills } from '../core/init.mjs';
@@ -113,6 +113,132 @@ export async function askPostinstallQuestion(question) {
   }
 }
 
+export function codexLbConfigPath(home = process.env.HOME || os.homedir()) {
+  return path.join(home, '.codex', 'config.toml');
+}
+
+export function codexLbEnvPath(home = process.env.HOME || os.homedir()) {
+  return path.join(home, '.codex', 'sks-codex-lb.env');
+}
+
+export function normalizeCodexLbBaseUrl(input = '') {
+  let host = String(input || '').trim();
+  if (!host) host = 'http://127.0.0.1:2455';
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(host)) host = `https://${host}`;
+  host = host.replace(/\/+$/, '');
+  return /\/backend-api\/codex$/i.test(host) ? host : `${host}/backend-api/codex`;
+}
+
+export async function configureCodexLb(opts = {}) {
+  const home = opts.home || process.env.HOME || os.homedir();
+  const configPath = opts.configPath || codexLbConfigPath(home);
+  const envPath = opts.envPath || codexLbEnvPath(home);
+  const baseUrl = normalizeCodexLbBaseUrl(opts.host || opts.baseUrl);
+  const apiKey = String(opts.apiKey || '').trim();
+  if (!apiKey) return { ok: false, status: 'missing_api_key', config_path: configPath, env_path: envPath };
+  await ensureDir(path.dirname(configPath));
+  const current = await readText(configPath, '');
+  const next = upsertCodexLbConfig(current, baseUrl);
+  await writeTextAtomic(configPath, next);
+  await writeTextAtomic(envPath, `export CODEX_LB_API_KEY=${shellSingleQuote(apiKey)}\n`);
+  await fsp.chmod(envPath, 0o600).catch(() => {});
+  process.env.CODEX_LB_API_KEY = apiKey;
+  return { ok: true, status: 'configured', config_path: configPath, env_path: envPath, base_url: baseUrl, env_key: 'CODEX_LB_API_KEY' };
+}
+
+export async function codexLbStatus(opts = {}) {
+  const home = opts.home || process.env.HOME || os.homedir();
+  const configPath = opts.configPath || codexLbConfigPath(home);
+  const envPath = opts.envPath || codexLbEnvPath(home);
+  const config = await readText(configPath, '');
+  const envExists = await exists(envPath);
+  const envText = envExists ? await readText(envPath, '') : '';
+  const envKeyConfigured = /^(\s*export\s+)?CODEX_LB_API_KEY\s*=.+$/m.test(envText);
+  const providerConfigured = /\[model_providers\.codex-lb\]/.test(config);
+  const selected = /model_provider\s*=\s*"codex-lb"/.test(config);
+  return {
+    ok: selected && providerConfigured && envKeyConfigured,
+    config_path: configPath,
+    env_path: envPath,
+    provider_configured: providerConfigured,
+    selected,
+    env_file: envExists,
+    env_key_configured: envKeyConfigured,
+    base_url: config.match(/base_url\s*=\s*"([^"]+)"/)?.[1] || null
+  };
+}
+
+export async function maybePromptCodexLbSetupForLaunch(args = [], opts = {}) {
+  if (args.includes('--json') || args.includes('--skip-codex-lb') || process.env.SKS_SKIP_CODEX_LB_PROMPT === '1') return { status: 'skipped' };
+  if (!canAskYesNo()) return { status: 'non_interactive' };
+  const status = await codexLbStatus(opts);
+  if (status.ok) return { status: 'present', ...status };
+  const useCodexLb = (await askPostinstallQuestion('\nAuthenticate and route Codex through codex-lb? [y/N] ')).trim();
+  if (!/^(y|yes|예|네|응)$/i.test(useCodexLb)) return { status: 'continued_to_codex' };
+  const host = (await askPostinstallQuestion('codex-lb host domain [http://127.0.0.1:2455]: ')).trim() || 'http://127.0.0.1:2455';
+  const apiKey = (await askPostinstallQuestion('codex-lb API key: ')).trim();
+  const configured = await configureCodexLb({ ...opts, host, apiKey });
+  if (configured.ok) console.log(`codex-lb configured: ${configured.base_url}`);
+  else console.log('codex-lb setup skipped: API key was empty.');
+  return configured;
+}
+
+function upsertCodexLbConfig(text = '', baseUrl) {
+  let next = upsertTopLevelTomlString(text, 'model_provider', 'codex-lb');
+  const block = [
+    '[model_providers.codex-lb]',
+    'name = "OpenAI"',
+    `base_url = "${baseUrl}"`,
+    'wire_api = "responses"',
+    'env_key = "CODEX_LB_API_KEY"',
+    'supports_websockets = true',
+    'requires_openai_auth = true'
+  ].join('\n');
+  next = upsertTomlTable(next, 'model_providers.codex-lb', block);
+  return `${next.trim()}\n`;
+}
+
+function upsertTopLevelTomlString(text, key, value) {
+  const line = `${key} = "${value}"`;
+  const lines = String(text || '').split('\n');
+  const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
+  const end = firstTable === -1 ? lines.length : firstTable;
+  for (let i = 0; i < end; i++) {
+    if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(lines[i])) {
+      lines[i] = line;
+      return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+    }
+  }
+  lines.splice(end, 0, line);
+  return lines.join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
+}
+
+function upsertTomlTable(text, table, block) {
+  let lines = String(text || '').trimEnd().split('\n');
+  if (lines.length === 1 && lines[0] === '') lines = [];
+  const header = `[${table}]`;
+  const start = lines.findIndex((x) => x.trim() === header);
+  const blockLines = String(block || '').trim().split('\n');
+  if (start === -1) return [...lines, ...(lines.length ? [''] : []), ...blockLines].join('\n').replace(/\n{3,}/g, '\n\n');
+  let end = lines.length;
+  for (let i = start + 1; i < lines.length; i++) {
+    if (/^\s*\[.+\]\s*$/.test(lines[i])) {
+      end = i;
+      break;
+    }
+  }
+  lines.splice(start, end - start, ...blockLines);
+  return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+}
+
+function shellSingleQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 export async function ensureSksCommandDuringInstall(opts = {}) {
   if (process.env.SKS_SKIP_POSTINSTALL_SHIM === '1' && !opts.force) return { status: 'skipped', reason: 'SKS_SKIP_POSTINSTALL_SHIM=1' };
   const pathEnv = opts.pathEnv ?? process.env.PATH ?? '';
@@ -222,6 +348,7 @@ async function ensureGlobalGetdesignSkillDuringInstall() {
 export async function ensureRelatedCliTools(args = []) {
   const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
   const codex = await ensureCodexCliTool({ skip });
+  const tmuxRepair = skip ? { status: 'skipped', reason: 'SKS_SKIP_CLI_TOOLS=1 or --skip-cli-tools' } : await ensureTmuxCliTool(args);
   const tmux = await tmuxReadiness().catch((err) => ({ ok: false, version: null, error: err.message }));
   return {
     codex,
@@ -231,6 +358,7 @@ export async function ensureRelatedCliTools(args = []) {
       version: tmux.version || null,
       min_version: tmux.min_version || '3.0',
       current_session: Boolean(tmux.current_session),
+      repair: tmuxRepair,
       install_hint: tmux.ok ? null : platformTmuxInstallHint(),
       error: tmux.error || null
     }
@@ -259,6 +387,86 @@ export async function ensureCodexCliTool({ skip = false } = {}) {
   };
 }
 
+export async function ensureTmuxCliTool(args = [], opts = {}) {
+  const before = await tmuxReadiness().catch((err) => ({ ok: false, error: err.message }));
+  if (before.ok) return { target: 'tmux', status: 'present', bin: before.bin || null, version: before.version || null };
+  const command = process.platform === 'darwin' ? 'brew install tmux' : platformTmuxInstallHint();
+  if (process.platform !== 'darwin') return { target: 'tmux', status: 'manual_required', command, error: before.error || 'tmux not found' };
+  const brew = await which('brew').catch(() => null);
+  if (!brew) return { target: 'tmux', status: 'manual_required', command: 'Install Homebrew, then run: brew install tmux', error: before.error || 'tmux not found' };
+  const origin = await tmuxInstallOrigin(before.bin, brew);
+  if (before.bin && origin.manager === 'npm') {
+    const repairCommand = 'npm i -g tmux@latest';
+    if (args.includes('--dry-run') || opts.dryRun) return { target: 'tmux', status: 'dry_run', manager: 'npm', command: repairCommand, error: before.error || null };
+    const npmBin = await which('npm').catch(() => null);
+    if (!npmBin) return { target: 'tmux', status: 'manual_required', manager: 'npm', command: repairCommand, error: 'npm not found on PATH' };
+    const question = `npm-managed tmux ${before.version || 'unknown'} is not ready. Upgrade with ${repairCommand}?`;
+    if (!await confirmInstallYesDefault(question, args)) return { target: 'tmux', status: 'needs_approval', manager: 'npm', command: repairCommand, error: before.error || null };
+    const install = await runProcess(npmBin, ['i', '-g', 'tmux@latest'], { timeoutMs: 180000, maxOutputBytes: 128 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
+    if (install.code !== 0) return { target: 'tmux', status: 'failed', manager: 'npm', command: repairCommand, error: `${install.stderr || install.stdout || repairCommand + ' failed'}`.trim() };
+    const after = await tmuxReadiness().catch((err) => ({ ok: false, error: err.message }));
+    if (!after.ok) return { target: 'tmux', status: 'installed_not_ready', manager: 'npm', command: repairCommand, error: after.error || 'tmux upgraded with npm but is still not ready' };
+    return { target: 'tmux', status: 'upgraded', manager: 'npm', command: repairCommand, bin: after.bin || null, version: after.version || null };
+  }
+  if (before.bin && origin.manager !== 'homebrew') {
+    return {
+      target: 'tmux',
+      status: 'conflicting_tmux',
+      bin: before.bin,
+      version: before.version || null,
+      manager: origin.manager,
+      command,
+      error: `${before.error || 'tmux is not ready'}; PATH resolves an unknown non-Homebrew tmux (${origin.reason}). Remove, upgrade with its owning package manager, or reorder PATH first, then run: ${command}`
+    };
+  }
+  const repairCommand = before.bin ? 'brew upgrade tmux' : command;
+  if (args.includes('--dry-run') || opts.dryRun) return { target: 'tmux', status: 'dry_run', command: repairCommand, error: before.error || null };
+  const question = before.bin
+    ? `Homebrew tmux ${before.version || 'unknown'} is too old. Upgrade to latest tmux with ${repairCommand}?`
+    : `tmux is missing. Install latest tmux with ${repairCommand}?`;
+  if (!await confirmInstallYesDefault(question, args)) return { target: 'tmux', status: 'needs_approval', command: repairCommand, error: before.error || null };
+  const brewArgs = before.bin ? ['upgrade', 'tmux'] : ['install', 'tmux'];
+  const install = await runProcess(brew, brewArgs, { timeoutMs: 180000, maxOutputBytes: 128 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
+  if (install.code !== 0) return { target: 'tmux', status: 'failed', command: repairCommand, error: `${install.stderr || install.stdout || repairCommand + ' failed'}`.trim() };
+  const after = await tmuxReadiness().catch((err) => ({ ok: false, error: err.message }));
+  if (!after.ok) return { target: 'tmux', status: 'installed_not_ready', command: repairCommand, error: after.error || 'tmux installed but not ready' };
+  return { target: 'tmux', status: before.bin ? 'upgraded' : 'installed', command: repairCommand, bin: after.bin || null, version: after.version || null };
+}
+
+async function confirmInstallYesDefault(question, args = []) {
+  if (shouldAutoApproveInstall(args)) return true;
+  if (!canAskYesNo()) return false;
+  const answer = (await askPostinstallQuestion(`${question} [Y/n] `)).trim();
+  return answer === '' || /^(y|yes|예|네|응)$/i.test(answer);
+}
+
+async function tmuxInstallOrigin(bin, brewBin) {
+  if (!bin) return { manager: 'missing', reason: 'tmux not found on PATH' };
+  const resolved = await fsp.realpath(bin).catch(() => path.resolve(bin));
+  if (brewBin) {
+    const brewPrefix = await runProcess(brewBin, ['--prefix'], { timeoutMs: 5000, maxOutputBytes: 4096 }).catch(() => null);
+    const prefix = brewPrefix?.code === 0 ? brewPrefix.stdout.trim().split(/\r?\n/).pop() : '';
+    const brewTmux = await runProcess(brewBin, ['list', '--versions', 'tmux'], { timeoutMs: 5000, maxOutputBytes: 4096 }).catch(() => null);
+    if (prefix && resolved.startsWith(path.resolve(prefix) + path.sep) && brewTmux?.code === 0) {
+      return { manager: 'homebrew', reason: `${resolved} under ${prefix}` };
+    }
+  }
+  const npmBin = await which('npm').catch(() => null);
+  if (npmBin) {
+    const npmPrefix = await runProcess(npmBin, ['prefix', '-g'], { timeoutMs: 5000, maxOutputBytes: 4096 }).catch(() => null);
+    const prefix = npmPrefix?.code === 0 ? npmPrefix.stdout.trim().split(/\r?\n/).pop() : '';
+    const npmBinDir = prefix ? (process.platform === 'win32' ? prefix : path.join(prefix, 'bin')) : '';
+    const npmRoot = prefix ? path.join(prefix, 'lib', 'node_modules') : '';
+    if ((npmBinDir && path.resolve(bin).startsWith(path.resolve(npmBinDir) + path.sep)) || (npmRoot && resolved.startsWith(path.resolve(npmRoot) + path.sep))) {
+      return { manager: 'npm', reason: `${bin} resolves through npm global prefix ${prefix}` };
+    }
+  }
+  if (/\/node_modules\/(?:\.bin\/)?tmux(?:$|\/)/.test(resolved.split(path.sep).join('/'))) {
+    return { manager: 'npm', reason: `${resolved} is inside node_modules` };
+  }
+  return { manager: 'unknown', reason: `${bin} resolves to ${resolved}` };
+}
+
 export async function maybePromptCodexUpdateForLaunch(args = [], opts = {}) {
   if (hasFlag(args, '--json') || hasFlag(args, '--skip-cli-tools') || hasFlag(args, '--skip-codex-update') || process.env.SKS_SKIP_CODEX_UPDATE === '1') return { status: 'skipped' };
   const latest = await npmPackageVersion('@openai/codex');

package/src/cli/main.mjs

@@ -18,7 +18,7 @@ import { classifySql, classifyCommand, checkDbOperation, handleMadSksUserConfirm
 import { checkHarnessModification, harnessGuardStatus, isHarnessSourceProject } from '../core/harness-guard.mjs';
 import { formatHarnessConflictReport, llmHarnessCleanupPrompt, scanHarnessConflicts } from '../core/harness-conflicts.mjs';
 import { context7Docs, context7Resolve, context7Text, context7Tools } from '../core/context7-client.mjs';
-import { installVersionGitHook, runVersionPreCommit, versioningStatus } from '../core/version-manager.mjs';
+import { bumpProjectVersion, installVersionGitHook, runVersionPreCommit, versioningStatus } from '../core/version-manager.mjs';
 import { rustInfo } from '../core/rust-accelerator.mjs';
 import { renderCartridge, validateCartridge, driftCartridge, snapshotCartridge } from '../core/gx-renderer.mjs';
 import { defaultEvaluationScenario, runEvaluationBenchmark } from '../core/evaluation.mjs';
@@ -58,10 +58,10 @@ import { renderTeamDashboardState, writeTeamDashboardState } from '../core/team-
 import { GOAL_WORKFLOW_ARTIFACT } from '../core/goal-workflow.mjs';
 import { CODEX_APP_DOCS_URL, codexAppIntegrationStatus, formatCodexAppStatus } from '../core/codex-app.mjs';
 import { OPENCLAW_SKILL_NAME, installOpenClawSkill } from '../core/openclaw.mjs';
-import { buildTmuxLaunchPlan, buildTmuxOpenArgs, createTmuxSession, isTmuxShellSession, runTmuxLaunchPlanSyntaxCheck, shouldAutoAttachTmux, tmuxReadiness, tmuxStatusKind, defaultTmuxSessionName, formatTmuxBanner, launchTmuxTeamView, launchTmuxUi, platformTmuxInstallHint, runTmuxStatus, sanitizeTmuxSessionName, teamLaneStyle } from '../core/tmux-ui.mjs';
+import { buildTmuxLaunchPlan, buildTmuxOpenArgs, codexLaunchCommand, createTmuxSession, isTmuxShellSession, runTmuxLaunchPlanSyntaxCheck, shouldAutoAttachTmux, tmuxReadiness, tmuxStatusKind, defaultTmuxSessionName, formatTmuxBanner, launchTmuxTeamView, launchTmuxUi, platformTmuxInstallHint, runTmuxStatus, sanitizeTmuxSessionName, teamLaneStyle } from '../core/tmux-ui.mjs';
 import { autoReviewProfileName, autoReviewStatus, autoReviewSummary, enableAutoReview, disableAutoReview, enableMadHighProfile, madHighProfileName } from '../core/auto-review.mjs';
 import { context7Command } from './context7-command.mjs';
-import { askPostinstallQuestion, checkContext7, checkRequiredSkills, ensureCodexCliTool, ensureGlobalCodexSkillsDuringInstall, ensureProjectContext7Config, ensureRelatedCliTools, ensureSksCommandDuringInstall, globalCodexSkillsRoot, maybePromptCodexUpdateForLaunch, postinstall, postinstallBootstrapDecision, shouldAutoApproveInstall } from './install-helpers.mjs';
+import { askPostinstallQuestion, checkContext7, checkRequiredSkills, codexLbStatus, configureCodexLb, ensureCodexCliTool, ensureGlobalCodexSkillsDuringInstall, ensureProjectContext7Config, ensureRelatedCliTools, ensureSksCommandDuringInstall, ensureTmuxCliTool, globalCodexSkillsRoot, maybePromptCodexLbSetupForLaunch, maybePromptCodexUpdateForLaunch, postinstall, postinstallBootstrapDecision, shouldAutoApproveInstall } from './install-helpers.mjs';
 import { buildTeamPlan, codeStructureCommand, dbCommand, defaultBeta, defaultVGraph, evalCommand, gcCommand, goalCommand, gxCommand, harnessCommand, hproofCommand, memoryCommand, migrateWikiContextPack, parseTeamCreateArgs, perfCommand, profileCommand, projectWikiClaims, proofFieldCommand, qaLoopCommand, quickstartCommand, researchCommand, skillDreamCommand, statsCommand, team, teamWorkflowMarkdown, validateArtifactsCommand, wikiCommand, wikiVoxelRowCount, writeWikiContextPack } from './maintenance-commands.mjs';
 import { openClawCommand } from './openclaw-command.mjs';
 
@@ -91,7 +91,7 @@ export async function main(args) {
   if (cmd === 'dollar-commands' || cmd === 'dollars' || cmd === '$') return dollarCommands(tail);
   if (String(cmd).toLowerCase() === 'dfix') return dfixHelp();
   const handlers = {
-    postinstall: () => postinstall({ bootstrap }), wizard: () => wizard(tail), ui: () => wizard(tail), 'update-check': () => updateCheck(tail), help: () => help(tail), commands: () => commands(tail), usage: () => usage(tail), root: () => rootCommand(tail), quickstart: () => quickstartCommand(), 'codex-app': () => codexAppHelp(tail), openclaw: () => openClawCommand(tail), bootstrap: () => bootstrap(tail), deps: () => deps(sub, rest),
+    postinstall: () => postinstall({ bootstrap }), wizard: () => wizard(tail), ui: () => wizard(tail), 'update-check': () => updateCheck(tail), help: () => help(tail), commands: () => commands(tail), usage: () => usage(tail), root: () => rootCommand(tail), quickstart: () => quickstartCommand(), 'codex-app': () => codexAppHelp(tail), 'codex-lb': () => codexLbCommand(sub, rest), openclaw: () => openClawCommand(tail), bootstrap: () => bootstrap(tail), deps: () => deps(sub, rest),
     'qa-loop': () => qaLoopCommand(sub, rest), ppt: () => pptCommand(sub, rest), context7: () => context7Command(sub, rest), pipeline: () => pipeline(sub, rest), guard: () => guard(sub, rest), conflicts: () => conflicts(sub, rest), versioning: () => versioning(sub, rest), reasoning: () => reasoningCommand(tail), aliases: () => aliases(), setup: () => setup(tail), 'fix-path': () => fixPath(tail), doctor: () => doctor(tail), init: () => init(tail), selftest: () => selftest(tail),
     goal: () => goalCommand(sub, rest), research: () => researchCommand(sub, rest), hook: () => emitHook(sub), profile: () => profileCommand(sub, rest), hproof: () => hproofCommand(sub, rest), 'validate-artifacts': () => validateArtifactsCommand(tail), perf: () => perfCommand(sub, rest), 'proof-field': () => proofFieldCommand(sub, rest), 'skill-dream': () => skillDreamCommand(sub, rest), 'code-structure': () => codeStructureCommand(sub, rest), memory: () => memoryCommand(sub, rest), gx: () => gxCommand(sub, rest),
     team: () => team(tail), db: () => dbCommand(sub, rest), eval: () => evalCommand(sub, rest), harness: () => harnessCommand(sub, rest), wiki: () => wikiCommand(sub, rest), gc: () => gcCommand(tail), stats: () => statsCommand(tail)
@@ -118,7 +118,12 @@ async function defaultTmuxCommand(args = []) {
     process.exitCode = 1;
     return;
   }
-  return launchTmuxUi(args, { conciseBlockers: true });
+  const lb = await maybePromptCodexLbSetupForLaunch(args);
+  if (lb.status === 'missing_api_key') {
+    process.exitCode = 1;
+    return;
+  }
+  return launchTmuxUi(args, codexLbImmediateLaunchOpts(args, lb, { conciseBlockers: true }));
 }
 
 function help(args = []) {
@@ -140,6 +145,7 @@ Usage:
   sks bootstrap [--install-scope global|project] [--local-only] [--json]
   sks deps check|install [tmux|codex|context7|all] [--yes] [--json]
   sks codex-app
+  sks codex-lb setup --host <domain> --api-key <key>
   sks openclaw install|path|print [--dir path] [--force] [--json]
   sks --mad [--high]
   sks auto-review status|enable|start [--high]
@@ -819,7 +825,7 @@ async function versioning(sub = 'status', args = []) {
     return;
   }
   if (action === 'bump') {
-    const res = await runVersionPreCommit(root, { force: true });
+    const res = await bumpProjectVersion(root, { force: true });
     if (flag(args, '--json')) return console.log(JSON.stringify(res, null, 2));
     if (!res.ok) {
       console.error(`Version bump failed: ${res.reason || 'unknown'}`);
@@ -839,7 +845,7 @@ async function versioning(sub = 'status', args = []) {
       return;
     }
     if (res.skipped) return;
-    console.log(res.changed ? `SKS versioning: ${res.previous_version} -> ${res.version}` : `SKS versioning: ${res.version} already unique`);
+    console.log(res.changed ? `SKS versioning synced: ${res.version}` : `SKS versioning: ${res.version} verified`);
     return;
   }
   console.error('Usage: sks versioning status|bump|pre-commit [--json]');
@@ -906,7 +912,12 @@ async function tmuxCommand(sub = 'start', args = []) {
       process.exitCode = 1;
       return;
     }
-    const result = await launchTmuxUi(args);
+    const lb = await maybePromptCodexLbSetupForLaunch(args);
+    if (lb.status === 'missing_api_key') {
+      process.exitCode = 1;
+      return;
+    }
+    const result = await launchTmuxUi(args, codexLbImmediateLaunchOpts(args, lb));
     if (flag(args, '--json')) console.log(JSON.stringify(result, null, 2));
     return;
   }
@@ -914,6 +925,56 @@ async function tmuxCommand(sub = 'start', args = []) {
   process.exitCode = 1;
 }
 
+async function codexLbCommand(action = 'status', args = []) {
+  const sub = action || 'status';
+  const json = flag(args, '--json');
+  if (sub === 'status' || sub === 'check') {
+    const status = await codexLbStatus();
+    if (json) return console.log(JSON.stringify(status, null, 2));
+    console.log('SKS codex-lb\n');
+    console.log(`Configured: ${status.ok ? 'yes' : 'no'}`);
+    console.log(`Selected:   ${status.selected ? 'yes' : 'no'}`);
+    console.log(`Provider:   ${status.provider_configured ? 'yes' : 'no'}`);
+    console.log(`Env file:   ${status.env_file ? status.env_path : 'missing'}`);
+    if (status.base_url) console.log(`Base URL:   ${status.base_url}`);
+    if (!status.ok) console.log('\nRun: sks codex-lb setup --host <domain> --api-key <key>');
+    return;
+  }
+  if (sub === 'setup') {
+    const host = readOption(args, '--host', readOption(args, '--domain', null));
+    const apiKey = readOption(args, '--api-key', readOption(args, '--key', null));
+    if (!host || !apiKey) {
+      if (json) return console.log(JSON.stringify({ ok: false, reason: 'missing_host_or_api_key' }, null, 2));
+      console.error('Usage: sks codex-lb setup --host <domain> --api-key <key>');
+      process.exitCode = 1;
+      return;
+    }
+    const result = await configureCodexLb({ host, apiKey });
+    if (json) return console.log(JSON.stringify(result, null, 2));
+    if (!result.ok) {
+      console.error(`codex-lb setup failed: ${result.status}`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(`codex-lb configured: ${result.base_url}`);
+    console.log(`Config: ${result.config_path}`);
+    console.log(`Key env: ${result.env_path}`);
+    return;
+  }
+  console.error('Usage: sks codex-lb status|setup --host <domain> --api-key <key> [--json]');
+  process.exitCode = 1;
+}
+
+function codexLbImmediateLaunchOpts(args = [], lb = {}, opts = {}) {
+  if (!lb?.ok || lb.status !== 'configured') return opts;
+  if (readOption(args, '--session', null) || readOption(args, '--workspace', null)) return opts;
+  const root = readOption(args, '--root', process.cwd());
+  const session = sanitizeTmuxSessionName(`sks-codex-lb-${Date.now().toString(36)}-${defaultTmuxSessionName(root)}`);
+  console.log(`codex-lb key loaded for this launch: ${lb.env_path}`);
+  console.log(`Using fresh tmux session: ${session}`);
+  return { ...opts, session };
+}
+
 async function madHighCommand(args = []) {
   const cleanArgs = args.filter((arg) => !['--mad', '--MAD', '--mad-sks', '--high', '--no-auto-install-tmux'].includes(arg));
   if (flag(args, '--json')) {
@@ -1106,11 +1167,7 @@ async function installContext7Dependency(root) {
 }
 
 async function installTmuxDependency(args = []) {
-  const before = await tmuxReadiness().catch(() => ({ ok: false }));
-  if (before.ok) return { target: 'tmux', status: 'present', version: before.version || null, app: before.app || null, cli: before.cli || null };
-  const command = process.platform === 'darwin' ? 'brew install tmux' : platformTmuxInstallHint();
-  if (flag(args, '--dry-run')) return { target: 'tmux', status: 'dry_run', command };
-  return { target: 'tmux', status: 'manual_required', command, error: before.error || 'tmux not found' };
+  return ensureTmuxCliTool(args, { dryRun: flag(args, '--dry-run') });
 }
 
 async function confirmInstall(question, args = []) {
@@ -1237,11 +1294,11 @@ function usage(args = []) {
   const topic = String(args[0] || 'overview').toLowerCase();
   const blocks = {
     overview: ['ㅅㅋㅅ Usage', '', 'Discover:', '  sks commands', '  sks quickstart', '  sks root', '  sks bootstrap', '  sks deps check', '  sks codex-app check', '  sks tmux check', '  sks dollar-commands', '', `Topics: ${USAGE_TOPICS}`],
-    install: ['Install', '', '  npm i -g sneakoscope', '  sks root', '  sks', '', 'Project bootstrap:', '  sks bootstrap', '', 'Fallback:', '  npx -y -p sneakoscope sks root', '', 'Project:', '  npm i -D sneakoscope', '  npx sks setup --install-scope project'],
+    install: ['Install', '', '1. Global install:', '  npm i -g sneakoscope', '', '2. Bootstrap and check dependencies:', '  sks bootstrap', '  sks deps check', '', '3. Confirm Codex App commands:', '  sks codex-app check', '  sks dollar-commands', '', '4. Optional codex-lb key setup for CLI sks runs:', '  sks codex-lb setup --host <domain> --api-key <key>', '  sks', '', 'Fallback:', '  npx -y -p sneakoscope sks root', '', 'Project:', '  npm i -D sneakoscope', '  npx sks setup --install-scope project'],
     bootstrap: ['Bootstrap', '', '  sks bootstrap', '  sks setup --bootstrap', '', 'Creates project SKS files, Codex App skills/hooks/config, state/guard files, then checks Codex App, Context7, and tmux.'],
     root: ['Root', '', '  sks root [--json]', '', 'Inside a project, SKS uses that project root. Outside any project marker, runtime commands use the per-user global SKS root instead of writing .sneakoscope into the current random folder.'],
-    deps: ['Dependencies', '', '  sks deps check [--json]', '  sks deps install [tmux|codex|context7|all] [--yes]', '', 'tmux on macOS uses Homebrew only after approval.'],
-    tmux: ['tmux', '', '  sks', '  sks tmux open', '  sks tmux check', '  sks tmux status --once', '  sks deps install tmux', '', 'Running bare `sks` opens or reuses the default tmux Codex CLI session. Before launch, SKS checks npm @openai/codex@latest and prompts Y/n when the installed Codex CLI is missing or outdated. Use `sks tmux open` when you need explicit session/workspace flags, and `sks help` for CLI help.'],
+    deps: ['Dependencies', '', '  sks deps check [--json]', '  sks deps install [tmux|codex|context7|all] [--yes]', '', 'tmux on macOS uses Homebrew after Y/n approval for missing installs or Homebrew-managed upgrades. If PATH resolves an npm-managed tmux, SKS prompts for npm i -g tmux@latest instead. Unknown non-Homebrew tmux paths are reported as conflicts.'],
+    tmux: ['tmux', '', '  sks', '  sks tmux open', '  sks tmux check', '  sks tmux status --once', '  sks deps install tmux', '', 'Running bare `sks` opens or reuses the default tmux Codex CLI session in fast-high mode: --model gpt-5.5 -c model_reasoning_effort="high". Override with SKS_CODEX_MODEL or SKS_CODEX_REASONING. Before launch, SKS checks npm @openai/codex@latest and prompts Y/n when the installed Codex CLI is missing or outdated. Use `sks tmux open` when you need explicit session/workspace flags, and `sks help` for CLI help.'],
     openclaw: ['OpenClaw', '', '  sks openclaw install', '  sks openclaw path', '  sks openclaw print SKILL.md', '', 'Installs an OpenClaw skill package under ~/.openclaw/skills/sneakoscope-codex so OpenClaw agents can attach skills: [sneakoscope-codex] with the shell tool and call local SKS commands from a project root.'],
     team: ['Team', '', '  sks team "task" executor:5 reviewer:2 user:1', '  sks team watch latest', '  sks team lane latest --agent analysis_scout_1 --follow', '  sks team message latest --from analysis_scout_1 --to executor_1 --message "handoff note"', '  sks team cleanup-tmux latest', '', '$Team runs questions -> contract -> scouts -> TriWiki attention -> debate -> runtime graph/inbox -> fresh executors -> review -> cleanup -> reflection -> Honest.'],
     'qa-loop': ['QA-LOOP', '', '  sks qa-loop prepare "QA this app"', '  sks qa-loop answer <MISSION_ID> answers.json', '  sks qa-loop run <MISSION_ID> --max-cycles 8', '', 'Report: YYYY-MM-DD-v<version>-qa-report.md'],
@@ -1937,6 +1994,22 @@ async function selftest() {
   if (!tmuxSyntax.ok || !tmuxSyntax.command.includes('tmux attach-session -t sks-mad-selftest')) throw new Error('selftest failed: MAD tmux attach plan is not stable by session name');
   const tmuxOpenArgs = buildTmuxOpenArgs(workspacePlan);
   if (tmuxOpenArgs.join(' ') !== 'attach-session -t sks-mad-selftest') throw new Error('selftest failed: MAD tmux attach args are not stable by session name');
+  const defaultFastHighPlan = await buildTmuxLaunchPlan({ root: tmp, tmux: { ok: true, bin: 'tmux', version: '3.4' }, codex: { bin: 'codex', version: 'codex-cli 99.0.0' }, app: { ok: true } });
+  if (defaultFastHighPlan.codexArgs.join(' ') !== '--model gpt-5.5 -c model_reasoning_effort="high"') throw new Error('selftest failed: default sks tmux launch is not fast-high');
+  const codexLbHome = path.join(tmp, 'codex-lb-home');
+  const codexLbSetup = await runProcess(process.execPath, [path.join(packageRoot(), 'bin', 'sks.mjs'), 'codex-lb', 'setup', '--host', 'lb.example.test', '--api-key', 'sk-test', '--json'], {
+    cwd: tmp,
+    env: { HOME: codexLbHome, SKS_GLOBAL_ROOT: path.join(tmp, 'codex-lb-global') },
+    timeoutMs: 15000,
+    maxOutputBytes: 64 * 1024
+  });
+  if (codexLbSetup.code !== 0) throw new Error(`selftest failed: codex-lb setup exited ${codexLbSetup.code}: ${codexLbSetup.stderr}`);
+  const codexLbSetupJson = JSON.parse(codexLbSetup.stdout);
+  const codexLbConfig = await safeReadText(path.join(codexLbHome, '.codex', 'config.toml'));
+  const codexLbEnv = await safeReadText(path.join(codexLbHome, '.codex', 'sks-codex-lb.env'));
+  if (!codexLbSetupJson.ok || codexLbSetupJson.base_url !== 'https://lb.example.test/backend-api/codex' || !codexLbConfig.includes('model_provider = "codex-lb"') || !codexLbConfig.includes('[model_providers.codex-lb]') || !codexLbEnv.includes("CODEX_LB_API_KEY='sk-test'")) throw new Error('selftest failed: codex-lb setup did not write provider config and env key');
+  const codexLbLaunch = codexLaunchCommand(tmp, 'codex', []);
+  if (!codexLbLaunch.includes('sks-codex-lb.env')) throw new Error('selftest failed: tmux launch command does not source codex-lb env file');
   if (!shouldAutoAttachTmux(['--mad'], {}, { stdin: { isTTY: true }, stdout: { isTTY: true } })) throw new Error('selftest failed: MAD tmux launch does not auto-attach in an interactive terminal');
   if (shouldAutoAttachTmux(['--mad', '--json'], {}, { stdin: { isTTY: true }, stdout: { isTTY: true } })) throw new Error('selftest failed: MAD tmux json mode should not auto-attach');
   if (shouldAutoAttachTmux(['--mad', '--no-attach'], {}, { stdin: { isTTY: true }, stdout: { isTTY: true } })) throw new Error('selftest failed: MAD tmux --no-attach should remain print-only');
@@ -2037,9 +2110,12 @@ async function selftest() {
   const versionHookText = await safeReadText(versionStatus.hook_path);
   if (!versionHookText.includes('versioning pre-commit')) throw new Error('selftest failed: versioning hook command missing');
   if (versionHookText.indexOf('versioning pre-commit') > versionHookText.indexOf('exit 0')) throw new Error('selftest failed: versioning hook was appended after an early exit');
+  await writeTextAtomic(path.join(versionTmp, 'CHANGELOG.md'), '# Changelog\n\n## [Unreleased]\n\n## [0.1.0] - 2026-05-08\n\n### Fixed\n\n- Initial version selftest fixture.\n');
   await writeTextAtomic(path.join(versionTmp, 'README.md'), 'version selftest\n');
-  await runProcess('git', ['add', 'README.md'], { cwd: versionTmp, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
-  const firstVersionBump = await runVersionPreCommit(versionTmp);
+  await runProcess('git', ['add', 'README.md', 'CHANGELOG.md'], { cwd: versionTmp, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
+  const preCommitVerify = await runVersionPreCommit(versionTmp);
+  if (!preCommitVerify.ok || preCommitVerify.version !== '0.1.0' || preCommitVerify.changed) throw new Error('selftest failed: pre-commit should verify current version without bumping');
+  const firstVersionBump = await bumpProjectVersion(versionTmp);
   if (!firstVersionBump.ok || firstVersionBump.version !== '0.1.1' || !firstVersionBump.changed) throw new Error('selftest failed: first version bump did not advance patch version');
   const bumpedPackage = await readJson(path.join(versionTmp, 'package.json'));
   const bumpedLock = await readJson(path.join(versionTmp, 'package-lock.json'));
@@ -2052,7 +2128,7 @@ async function selftest() {
   await writeJsonAtomic(versionStatus.state_path, { schema_version: 1, last_version: '0.1.5', updated_at: nowIso(), pid: process.pid, changed: true });
   await writeTextAtomic(path.join(versionTmp, 'CHANGELOG.md'), 'collision selftest\n');
   await runProcess('git', ['add', 'CHANGELOG.md'], { cwd: versionTmp, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
-  const collisionBump = await runVersionPreCommit(versionTmp);
+  const collisionBump = await bumpProjectVersion(versionTmp);
   if (!collisionBump.ok || collisionBump.version !== '0.1.6') throw new Error('selftest failed: version collision state did not bump above last seen version');
   const localOnlyTmp = tmpdir();
   await ensureDir(path.join(localOnlyTmp, '.git'));
@@ -2547,9 +2623,16 @@ async function selftest() {
   const codexConfigText = await safeReadText(path.join(tmp, '.codex', 'config.toml'));
   if (!codexConfigText.includes('multi_agent = true')) throw new Error('selftest failed: multi_agent not enabled');
   if (!hasContext7ConfigText(codexConfigText)) throw new Error('selftest failed: Context7 MCP not configured');
-  if (!codexConfigText.includes('[profiles.sks-task-low]') || !codexConfigText.includes('[profiles.sks-task-medium]') || !codexConfigText.includes('[profiles.sks-logic-high]') || !codexConfigText.includes('[profiles.sks-research-xhigh]') || !codexConfigText.includes('[profiles.sks-mad-high]')) throw new Error('selftest failed: GPT-5.5 reasoning profiles not configured');
+  if (!codexConfigText.includes('[profiles.sks-task-low]') || !codexConfigText.includes('[profiles.sks-task-medium]') || !codexConfigText.includes('[profiles.sks-logic-high]') || !codexConfigText.includes('[profiles.sks-fast-high]') || !codexConfigText.includes('[profiles.sks-research-xhigh]') || !codexConfigText.includes('[profiles.sks-mad-high]')) throw new Error('selftest failed: GPT-5.5 reasoning profiles not configured');
   if (!codexConfigText.includes('[agents.analysis_scout]')) throw new Error('selftest failed: analysis_scout agent not configured');
   if (!codexConfigText.includes('[agents.team_consensus]')) throw new Error('selftest failed: team_consensus agent not configured');
+  const preservedConfigTmp = tmpdir();
+  await ensureDir(path.join(preservedConfigTmp, '.codex'));
+  await writeTextAtomic(path.join(preservedConfigTmp, '.codex', 'config.toml'), '[features]\nfast_mode_ui = true\n\n[user.fast_mode]\nvisible = true\n');
+  await initProject(preservedConfigTmp, {});
+  const preservedConfig = await safeReadText(path.join(preservedConfigTmp, '.codex', 'config.toml'));
+  if (!preservedConfig.includes('fast_mode_ui = true') || !preservedConfig.includes('[user.fast_mode]') || !preservedConfig.includes('visible = true')) throw new Error('selftest failed: Codex config merge dropped user Fast mode settings');
+  if (!preservedConfig.includes('codex_hooks = true') || !preservedConfig.includes('[profiles.sks-fast-high]')) throw new Error('selftest failed: Codex config merge did not add SKS managed settings');
   const autoReviewHome = path.join(tmp, 'auto-review-home');
   const autoReviewEnv = { HOME: autoReviewHome };
   const autoReviewEnabled = await enableAutoReview({ env: autoReviewEnv, high: true });

package/src/core/fsx.mjs

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 
-export const PACKAGE_VERSION = '0.7.38';
+export const PACKAGE_VERSION = '0.7.41';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 

package/src/core/init.mjs

@@ -415,15 +415,118 @@ export async function initProject(root, opts = {}) {
     };
   }
 
-  function installPolicy(scope, commandPrefix) {
-    return {
-      scope,
-      default_scope: 'global',
-      hook_command_prefix: commandPrefix,
-      global_install: 'npm i -g sneakoscope',
-      project_install: 'npm i -D sneakoscope && npx sks setup --install-scope project'
-    };
+function installPolicy(scope, commandPrefix) {
+  return {
+    scope,
+    default_scope: 'global',
+    hook_command_prefix: commandPrefix,
+    global_install: 'npm i -g sneakoscope',
+    project_install: 'npm i -D sneakoscope && npx sks setup --install-scope project'
+  };
+}
+
+function mergeManagedCodexConfigToml(existingContent = '') {
+  let next = String(existingContent || '').trimEnd();
+  next = upsertTomlTableKey(next, 'features', 'codex_hooks = true');
+  next = upsertTomlTableKey(next, 'features', 'multi_agent = true');
+  next = upsertTomlTableKey(next, 'agents', 'max_threads = 6');
+  next = upsertTomlTableKey(next, 'agents', 'max_depth = 1');
+  for (const block of managedCodexConfigBlocks()) {
+    next = upsertTomlTable(next, block.table, block.text);
+  }
+  return `${next.trim()}\n`;
+}
+
+function managedCodexConfigBlocks() {
+  return [
+    { table: 'mcp_servers.context7', text: context7ConfigToml().trim() },
+    { table: 'agents.analysis_scout', text: agentConfigBlock('analysis_scout', 'Read-only SKS scout.', './agents/analysis-scout.toml', ['Scout', 'Mapper']) },
+    { table: 'agents.team_consensus', text: agentConfigBlock('team_consensus', 'SKS planning/debate agent.', './agents/team-consensus.toml', ['Consensus', 'Atlas']) },
+    { table: 'agents.implementation_worker', text: agentConfigBlock('implementation_worker', 'SKS bounded implementation worker.', './agents/implementation-worker.toml', ['Builder', 'Mason']) },
+    { table: 'agents.db_safety_reviewer', text: agentConfigBlock('db_safety_reviewer', 'Read-only DB safety reviewer.', './agents/db-safety-reviewer.toml', ['Sentinel', 'Ledger']) },
+    { table: 'agents.qa_reviewer', text: agentConfigBlock('qa_reviewer', 'Read-only QA reviewer.', './agents/qa-reviewer.toml', ['Verifier', 'Scout']) },
+    { table: 'profiles.sks-task-low', text: profileConfigBlock('sks-task-low', 'low') },
+    { table: 'profiles.sks-task-medium', text: profileConfigBlock('sks-task-medium', 'medium') },
+    { table: 'profiles.sks-logic-high', text: profileConfigBlock('sks-logic-high', 'high') },
+    { table: 'profiles.sks-fast-high', text: profileConfigBlock('sks-fast-high', 'high') },
+    { table: 'profiles.sks-research-xhigh', text: profileConfigBlock('sks-research-xhigh', 'xhigh') },
+    { table: 'profiles.sks-research', text: profileConfigBlock('sks-research', 'xhigh', { approval: 'never' }) },
+    { table: 'profiles.sks-team', text: profileConfigBlock('sks-team', 'high') },
+    { table: 'profiles.sks-mad-high', text: profileConfigBlock('sks-mad-high', 'high', { sandbox: 'danger-full-access', approvalsReviewer: 'auto_review' }) },
+    {
+      table: 'auto_review',
+      text: '[auto_review]\npolicy = "Deny destructive database operations, credential exfiltration, persistent security weakening, broad file deletion, writes outside the workspace, and unrequested fallback implementation code unless explicitly authorized by the user or sealed decision contract."'
+    },
+    { table: 'profiles.sks-default', text: profileConfigBlock('sks-default', 'high') }
+  ];
+}
+
+function agentConfigBlock(table, description, configFile, nicknames = []) {
+  return [
+    `[agents.${table}]`,
+    `description = "${description}"`,
+    `config_file = "${configFile}"`,
+    `nickname_candidates = [${nicknames.map((name) => `"${name}"`).join(', ')}]`
+  ].join('\n');
+}
+
+function profileConfigBlock(profile, effort, opts = {}) {
+  return [
+    `[profiles.${profile}]`,
+    'model = "gpt-5.5"',
+    `approval_policy = "${opts.approval || 'on-request'}"`,
+    ...(opts.approvalsReviewer ? [`approvals_reviewer = "${opts.approvalsReviewer}"`] : []),
+    `sandbox_mode = "${opts.sandbox || 'workspace-write'}"`,
+    `model_reasoning_effort = "${effort}"`
+  ].join('\n');
+}
+
+function upsertTomlTableKey(text, table, line) {
+  const key = String(line).split('=')[0].trim();
+  let lines = String(text || '').split('\n');
+  if (lines.length === 1 && lines[0] === '') lines = [];
+  const header = `[${table}]`;
+  let start = lines.findIndex((x) => x.trim() === header);
+  if (start === -1) {
+    const prefix = lines.length && lines[lines.length - 1].trim() ? ['', header, line] : [header, line];
+    return [...lines, ...prefix].join('\n').replace(/\n{3,}/g, '\n\n');
+  }
+  let end = lines.length;
+  for (let i = start + 1; i < lines.length; i++) {
+    if (/^\s*\[.+\]\s*$/.test(lines[i])) {
+      end = i;
+      break;
+    }
+  }
+  for (let i = start + 1; i < end; i++) {
+    if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(lines[i])) {
+      lines[i] = line;
+      return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+    }
   }
+  lines.splice(start + 1, 0, line);
+  return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+}
+
+function upsertTomlTable(text, table, block) {
+  let lines = String(text || '').trimEnd().split('\n');
+  if (lines.length === 1 && lines[0] === '') lines = [];
+  const header = `[${table}]`;
+  const start = lines.findIndex((x) => x.trim() === header);
+  const blockLines = String(block || '').trim().split('\n');
+  if (start === -1) {
+    return [...lines, ...(lines.length ? [''] : []), ...blockLines].join('\n').replace(/\n{3,}/g, '\n\n');
+  }
+  let end = lines.length;
+  for (let i = start + 1; i < lines.length; i++) {
+    if (/^\s*\[.+\]\s*$/.test(lines[i])) {
+      end = i;
+      break;
+    }
+  }
+  lines.splice(start, end - start, ...blockLines);
+  return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+}
 
   const currentState = path.join(sine, 'state', 'current.json');
   if (!(await exists(currentState)) || opts.force) {
@@ -441,26 +544,9 @@ export async function initProject(root, opts = {}) {
     created.push('AGENTS.md managed block');
   }
 
-  await writeTextAtomic(path.join(root, '.codex', 'config.toml'), `[features]\ncodex_hooks = true\nmulti_agent = true\n\n[agents]\nmax_threads = 6\nmax_depth = 1\n\n${context7ConfigToml()}\n[agents.analysis_scout]\ndescription = "Read-only SKS scout."\nconfig_file = "./agents/analysis-scout.toml"\nnickname_candidates = ["Scout", "Mapper"]\n\n[agents.team_consensus]\ndescription = "SKS planning/debate agent."\nconfig_file = "./agents/team-consensus.toml"\nnickname_candidates = ["Consensus", "Atlas"]\n\n[agents.implementation_worker]\ndescription = "SKS bounded implementation worker."\nconfig_file = "./agents/implementation-worker.toml"\nnickname_candidates = ["Builder", "Mason"]\n\n[agents.db_safety_reviewer]\ndescription = "Read-only DB safety reviewer."\nconfig_file = "./agents/db-safety-reviewer.toml"\nnickname_candidates = ["Sentinel", "Ledger"]\n\n[agents.qa_reviewer]\ndescription = "Read-only QA reviewer."\nconfig_file = "./agents/qa-reviewer.toml"\nnickname_candidates = ["Verifier", "Scout"]\n\n[profiles.sks-task-medium]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "medium"\n\n[profiles.sks-logic-high]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "high"\n\n[profiles.sks-research-xhigh]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "xhigh"\n\n[profiles.sks-research]\nmodel = "gpt-5.5"\napproval_policy = "never"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "xhigh"\n\n[profiles.sks-team]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "high"\n\n[profiles.sks-mad-high]
-model = "gpt-5.5"
-approval_policy = "on-request"
-approvals_reviewer = "auto_review"
-sandbox_mode = "danger-full-access"
-model_reasoning_effort = "high"
-
-[auto_review]
-policy = "Deny destructive database operations, credential exfiltration, persistent security weakening, broad file deletion, writes outside the workspace, and unrequested fallback implementation code unless explicitly authorized by the user or sealed decision contract."
-
-[profiles.sks-default]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "medium"\n`);
   const generatedCodexConfigPath = path.join(root, '.codex', 'config.toml');
-  let generatedCodexConfig = await readText(generatedCodexConfigPath, '');
-  if (!generatedCodexConfig.includes('[profiles.sks-task-low]')) {
-    generatedCodexConfig = generatedCodexConfig.replace(
-      '[profiles.sks-task-medium]',
-      '[profiles.sks-task-low]\nmodel = "gpt-5.5"\napproval_policy = "on-request"\nsandbox_mode = "workspace-write"\nmodel_reasoning_effort = "low"\n\n[profiles.sks-task-medium]'
-    );
-    await writeTextAtomic(generatedCodexConfigPath, generatedCodexConfig);
-  }
+  const existingCodexConfig = await readText(generatedCodexConfigPath, '');
+  await writeTextAtomic(generatedCodexConfigPath, mergeManagedCodexConfigToml(existingCodexConfig));
   created.push('.codex/config.toml');
 
   await writeTextAtomic(path.join(root, '.codex', 'SNEAKOSCOPE.md'), codexAppQuickReference(installScope, hookCommandPrefix));

package/src/core/routes.mjs

@@ -456,6 +456,7 @@ export const COMMAND_CATALOG = [
   { name: 'root', usage: 'sks root [--json]', description: 'Show whether SKS is using a project root or the per-user global SKS runtime root.' },
   { name: 'deps', usage: 'sks deps check|install [tmux|codex|context7|all] [--yes]', description: 'Check or guided-install Node/npm PATH, Codex CLI/App, Context7, Browser Use, Computer Use, tmux, and Homebrew on macOS.' },
   { name: 'codex-app', usage: 'sks codex-app [check|open]', description: 'Check Codex App install and first-party MCP/plugin readiness, then show app setup files and examples.' },
+  { name: 'codex-lb', usage: 'sks codex-lb status|setup --host <domain> --api-key <key>', description: 'Configure codex-lb as the Codex CLI provider by writing ~/.codex/config.toml and the CODEX_LB_API_KEY env file.' },
   { name: 'openclaw', usage: 'sks openclaw install|path|print [--dir path] [--force] [--json]', description: 'Generate an OpenClaw skill package so OpenClaw agents can discover and use local SKS workflows.' },
   { name: 'tmux', usage: 'sks | sks tmux open|check|status [--workspace name]', description: 'Open the default SKS tmux runtime with bare sks, or use tmux subcommands for explicit launch/check/status.' },
   { name: 'mad', usage: 'sks --mad [--high]', description: 'Open a one-shot tmux Codex CLI workspace with the SKS MAD full-access auto-review profile.' },

package/src/core/tmux-ui.mjs

@@ -14,6 +14,19 @@ export const SKS_TMUX_LOGO = [
   'Sneakoscope Codex tmux'
 ].join('\n');
 
+export const DEFAULT_SKS_CODEX_MODEL = 'gpt-5.5';
+export const DEFAULT_SKS_CODEX_REASONING = 'high';
+
+export function defaultCodexLaunchArgs(env = process.env) {
+  if (/^(0|false|off|none)$/i.test(String(env.SKS_CODEX_FAST_HIGH || '').trim())) return [];
+  const model = String(env.SKS_CODEX_MODEL || DEFAULT_SKS_CODEX_MODEL).trim();
+  const effort = String(env.SKS_CODEX_REASONING || DEFAULT_SKS_CODEX_REASONING).trim();
+  const args = [];
+  if (model) args.push('--model', model);
+  if (effort) args.push('-c', `model_reasoning_effort="${effort}"`);
+  return args;
+}
+
 export function sanitizeTmuxSessionName(input) {
   const base = String(input || 'sks').trim().replace(/[^A-Za-z0-9_.:-]+/g, '-').replace(/^-+|-+$/g, '');
   return (base || 'sks').slice(0, 80);
@@ -95,6 +108,7 @@ export function codexLaunchCommand(root, codexBin, codexArgs = []) {
     `printf '\\nProject: %s\\n' ${shellEscape(root)}`,
     'printf \'Runtime: tmux session for Codex CLI\\n\'',
     'printf \'Prompt:  use canonical $ commands, for example $Team or $QA-LOOP\\n\\n\'',
+    '[ -f "$HOME/.codex/sks-codex-lb.env" ] && . "$HOME/.codex/sks-codex-lb.env"',
     'sleep 1',
     `exec ${[shellEscape(codexBin), ...extraArgs.map(shellEscape), '--cd', shellEscape(root)].join(' ')}`
   ].join('; ');
@@ -177,7 +191,7 @@ export async function buildTmuxLaunchPlan(opts = {}) {
   const codex = opts.codex || await getCodexInfo().catch(() => ({}));
   const tmux = opts.tmux || await tmuxReadiness(opts);
   const app = opts.app || await codexAppIntegrationStatus({ codex });
-  const codexArgs = Array.isArray(opts.codexArgs) ? opts.codexArgs : [];
+  const codexArgs = Array.isArray(opts.codexArgs) ? opts.codexArgs : defaultCodexLaunchArgs(opts.env || process.env);
   return {
     root,
     session,

package/src/core/version-manager.mjs

@@ -48,7 +48,11 @@ async function runtimeDriftStatus(root, packageVersion) {
   if (!packageVersion || process.env.SKS_RUNTIME_DRIFT_CHECK === '0') {
     return { ok: true, checked: false, reason: packageVersion ? 'disabled' : 'package_json_version_missing' };
   }
-  const result = await runProcess('sks', ['--version'], {
+  const localBin = path.join(root, 'bin', 'sks.mjs');
+  const useLocalBin = await exists(localBin);
+  const command = useLocalBin ? process.execPath : 'sks';
+  const args = useLocalBin ? [localBin, '--version'] : ['--version'];
+  const result = await runProcess(command, args, {
     cwd: root,
     timeoutMs: 5000,
     maxOutputBytes: 16 * 1024,
@@ -68,6 +72,7 @@ async function runtimeDriftStatus(root, packageVersion) {
   return {
     ok: comparison >= 0,
     checked: true,
+    command: [command, ...args].join(' '),
     runtime_version: runtimeVersion,
     package_version: packageVersion,
     relation: comparison === 0 ? 'same' : (comparison > 0 ? 'runtime_newer' : 'runtime_older')
@@ -83,7 +88,7 @@ export async function runVersionPreCommit(root, opts = {}) {
   if (!pkg?.version) return { ok: true, skipped: true, reason: 'package_json_version_missing' };
   const git = await gitPaths(root);
   if (!git.ok) return { ok: true, skipped: true, reason: git.reason || 'not_git' };
-  return withVersionLock(git.common_dir, async () => bumpProjectVersion(root, { ...opts, policy, git }));
+  return withVersionLock(git.common_dir, async () => verifyProjectVersion(root, { ...opts, policy, git }));
 }
 
 export async function bumpProjectVersion(root, opts = {}) {
@@ -145,6 +150,43 @@ export async function bumpProjectVersion(root, opts = {}) {
   };
 }
 
+export async function verifyProjectVersion(root, opts = {}) {
+  const git = opts.git || await gitPaths(root);
+  const pkgPath = path.join(root, 'package.json');
+  const pkg = await readJson(pkgPath);
+  const current = parseSemver(pkg.version);
+  if (!current) return { ok: false, reason: `Unsupported package.json version: ${pkg.version}` };
+  const version = formatSemver(current);
+  const sourceVersion = await syncSourcePackageVersion(root, version);
+  const synced = await syncPackageLockVersions(root, version);
+  if (!await changelogHasVersionSection(root, version)) {
+    return { ok: false, reason: 'changelog_section_missing', version, expected: `## [${version}]` };
+  }
+  const staged = await stageVersionFiles(root, [...synced.files, ...sourceVersion.files]);
+  if (!staged.ok) return { ok: false, reason: 'git_add_version_files_failed', stderr: staged.stderr };
+  const statePath = git.ok ? path.join(git.common_dir, VERSION_STATE_FILE) : null;
+  if (statePath) {
+    await writeJsonAtomic(statePath, {
+      schema_version: 1,
+      last_version: version,
+      updated_at: nowIso(),
+      pid: process.pid,
+      mode: 'verify',
+      changed: Boolean(synced.files.length || sourceVersion.files.length)
+    });
+  }
+  return {
+    ok: true,
+    changed: Boolean(synced.files.length || sourceVersion.files.length),
+    version,
+    previous_version: version,
+    synced_files: [...synced.relative_files, ...sourceVersion.relative_files],
+    staged_files: staged.relative_files,
+    lock_scope: git.common_dir,
+    mode: 'verify'
+  };
+}
+
 async function versionPolicy(root) {
   const policy = await readJson(path.join(root, '.sneakoscope', 'policy.json'), {});
   return {
@@ -252,6 +294,13 @@ async function syncChangelogVersionSection(root, version) {
   return { files: [file], relative_files: [path.relative(root, file)] };
 }
 
+async function changelogHasVersionSection(root, version) {
+  const file = path.join(root, 'CHANGELOG.md');
+  const text = await readFileMaybe(file);
+  const sectionRe = new RegExp(`^##\\s+\\[${escapeRegExp(version)}\\]\\s+-\\s+\\d{4}-\\d{2}-\\d{2}\\s*$`, 'm');
+  return sectionRe.test(text);
+}
+
 async function stageVersionFiles(root, files) {
   const existing = [];
   for (const file of files) if (await exists(file)) existing.push(path.relative(root, file));