sneakoscope 0.7.65 → 0.7.67

package/README.md

@@ -1,8 +1,6 @@
 # Sneakoscope Codex
 
-![](https://github.com/mandarange/Sneakoscope-Codex/raw/dev/docs/assets/sneakoscope-codex-logo.png)
-
-Sneakoscope Codex (`sks`, displayed as `ㅅㅋㅅ`) is a Codex CLI/App harness for repeatable agent workflows. It adds terminal commands, Codex App `$` prompt commands, tmux-native CLI workspaces, Team/QA/Research routes, inspectable pipeline plans, a maximum-speed Computer Use lane, an imagegen/gpt-image-2 UI/UX review route, a fast Goal bridge for native `/goal` persistence, Context7 evidence checks, DB safety, TriWiki context tracking, design-system SSOT routing, lightweight skill dreaming, Honest Mode, and release-readiness gates.
+Sneakoscope Codex (`sks`) is a Codex CLI/App harness for repeatable workflows. It adds terminal commands, Codex App `$` commands, tmux workspaces, Team/QA/Research routes, pipeline plans, Computer Use, imagegen UI/UX review, Goal, Context7, DB safety, TriWiki, design-system routing, skill dreaming, Honest Mode.
 
 ## Quick Start
 
@@ -42,30 +40,30 @@ sks selftest --mock
 
 | Area | What it does |
 | --- | --- |
-| CLI runtime | Bare `sks` opens or reuses the default tmux Codex CLI workspace. `sks tmux open` remains the explicit form for session/workspace flags, and `sks --mad` launches a single-pane MAD tmux session with the explicit full-access high-reasoning profile. Split panes are reserved for active Team scout/worker lanes. |
-| Codex App commands | Installs generated skills so `$Team`, `$From-Chat-IMG`, `$DFix`, `$QA-LOOP`, `$PPT`, `$Image-UX-Review`, `$UX-Review`, `$Goal`, `$DB`, `$Wiki`, `$Help`, and related routes are visible in prompt workflows. `sks codex-app remote-control` wraps Codex CLI 0.130.0+ headless remote control without falling back to older app-server internals. |
-| OpenClaw agents | Generates an OpenClaw skill package so OpenClaw agents can attach `sneakoscope-codex`, enable the `shell` tool, and discover/use SKS commands from the target repo root. |
-| Pipeline plans | Writes `pipeline-plan.json` for stateful routes so the runtime lane, kept stages, skipped stages, verification commands, and no-unrequested-fallback invariant are visible with `sks pipeline plan`. |
-| Team orchestration | Runs substantial work through score-based ambiguity handling, scouts, TriWiki refresh, debate, runtime task graphs, worker inboxes, implementation, review, cleanup, reflection, and Honest Mode; narrow work should use Proof Field evidence to skip unrelated pipeline work instead of expanding Team. |
+| CLI runtime | Bare `sks` opens/reuses the default tmux Codex CLI workspace. `sks tmux open` handles explicit session flags, and `sks --mad` launches a single-pane MAD session. |
+| Codex App commands | Installs generated skills for `$Team`, `$DFix`, `$QA-LOOP`, `$PPT`, `$UX-Review`, `$Goal`, `$DB`, `$Wiki`, `$Help`, and related routes. |
+| OpenClaw agents | Generates an OpenClaw skill package so agents can attach `sneakoscope-codex` and discover SKS commands from the repo root. |
+| Pipeline plans | Writes `pipeline-plan.json` so runtime lanes, stages, verification, and no-fallback invariants are visible with `sks pipeline plan`. |
+| Team orchestration | Runs substantial work through ambiguity handling, scouts, TriWiki, debate, runtime tasks, implementation, review, cleanup, reflection, and Honest Mode; narrow work should use Proof Field evidence. |
 | Skill dreaming | Records cheap generated-skill usage counters in JSON and only periodically scans `.agents/skills` for keep, merge, prune, and improvement candidates. Reports are recommendation-only and never delete skills automatically. |
 | From-Chat-IMG | Turns chat screenshots plus original attachments into source-bound work orders, then requires scoped QA evidence before completion. |
 | QA loop | Dogfoods UI/API behavior with safety gates, Codex Computer Use-only UI evidence, safe fixes, and rechecks. |
-| PPT pipeline | Uses `$PPT` for simple, restrained, information-first HTML/PDF presentation artifacts, first asking delivery context, audience profile, STP strategy, decision context, and 3+ pain-point to solution/aha mappings before source research, design-system work, HTML/PDF export, and render QA. Independent strategy/render/file-write phases run in parallel where inputs allow and are recorded in `ppt-parallel-report.json`; editable source HTML is preserved under `source-html/`, PPT-only temporary build files are cleaned after completion, installed skills/MCPs outside the `$PPT` allowlist are ignored, generated image assets must use real `$imagegen`/`gpt-image-2` output when sealed in the contract, and `ppt-style-tokens.json` records the design SSOT plus fused source inputs. |
-| Image UX Review | Uses `$Image-UX-Review` / `$UX-Review` for UI/UX audits where source screenshots are first turned into generated annotated review images through Codex App `$imagegen`/`gpt-image-2`; those generated images are then read back into `image-ux-issue-ledger.json`, optional requested fixes are rechecked, and missing generated review images or text-only screenshot critique cannot pass `image-ux-review-gate.json`. |
-| Computer Use fast lane | Uses `$Computer-Use` / `$CU` for UI/browser/visual work that needs maximum speed: skip Team debate and upfront TriWiki loops, use Codex Computer Use directly, then refresh/validate TriWiki and run Honest Mode at final closeout. |
-| Goal | Provides a fast SKS bridge overlay for Codex native persisted `/goal` create, pause, resume, and clear controls; an ambient non-disruptive Goal continuation overlay is also recorded in normal pipeline plans while implementation continues through the selected SKS execution route. |
-| TriWiki voxels | Maintains `.sneakoscope/wiki/context-pack.json` as the context SSOT with coordinate anchors, voxel metadata, `attention.use_first`, `attention.hydrate_first`, and prompt-bound mistake recall ledgers. |
+| PPT pipeline | Uses `$PPT` for restrained HTML/PDF decks with sealed context, design SSOT, export QA, editable source HTML, and `$imagegen` assets when required. |
+| Image UX Review | Uses `$Image-UX-Review` / `$UX-Review` for UI/UX audits that require generated annotated review images before issue extraction. |
+| Computer Use fast lane | Uses `$Computer-Use` / `$CU` for fast UI/browser/visual work, then refreshes/validates TriWiki and runs Honest Mode. |
+| Goal | Bridges Codex native `/goal` create, pause, resume, and clear controls while implementation continues through the selected SKS route. |
+| TriWiki voxels | Maintains `.sneakoscope/wiki/context-pack.json` as the context SSOT with coordinate anchors, voxel metadata, attention hints, and mistake recall. |
 | Context7 | Requires current docs for external packages, APIs, MCPs, SDKs, and framework/runtime behavior when correctness depends on current guidance. |
-| Design SSOT | Treats `design.md` as the only design decision source of truth. `docs/Design-Sys-Prompt.md` is the builder prompt; getdesign.md, official getdesign docs, and curated DESIGN.md examples from `VoltAgent/awesome-design-md` are source inputs that must be fused into `design.md` or route-local style tokens instead of becoming parallel authorities. |
+| Design SSOT | Treats `design.md` as the only design decision source of truth; getdesign and curated DESIGN.md examples are inputs, not parallel authorities. |
 | DB safety | Treats SQL, migrations, Supabase, RLS, and destructive operations as high risk. |
-| Release hygiene | Checks versioning, changelog, package contents, tarball size, syntax, selftests, and dry-run publishing. |
+| Release hygiene | Checks versioning, changelog, size, syntax. |
 
 ## Requirements
 
 - Node.js `>=20.11`
 - npm
 - Codex CLI for terminal workflows
-- Codex App for app-facing workflows, with Codex Computer Use required for UI/browser evidence and `$imagegen`/`gpt-image-2` required for generated raster assets or generated image-review evidence
+- Codex App for app-facing workflows, including Codex Computer Use and `$imagegen`/`gpt-image-2` evidence when required
 - tmux for the CLI-first runtime
 - Context7 MCP for current-docs-gated routes
 
@@ -75,12 +73,7 @@ Install tmux from [tmux.dev/download](https://www.tmux.dev/download). On macOS,
 brew install tmux
 ```
 
-The default `sks` runtime checks npm for newer `sneakoscope` and `@openai/codex` versions before opening tmux and prompts to update when the terminal can answer y/n. If you approve the Codex CLI update, SKS installs `@openai/codex@latest` and opens tmux with the version visible on PATH. `sks --mad` is stricter than the normal runtime path:
-
-- Checks npm for newer `sneakoscope` and `@openai/codex` versions before launch and asks whether to update when the terminal can answer y/n.
-- Installs the latest Codex CLI with `npm i -g @openai/codex@latest` when it is missing and you approve or pass `--yes`.
-- Requires tmux 3.x or newer before opening the session.
-- Creates a named detached single-pane tmux session and prints only the session, gate, attach, and blocker details needed to act.
+The default `sks` runtime checks npm for newer `sneakoscope` and `@openai/codex` versions before opening tmux. `sks --mad` also checks dependencies, requires tmux 3.x, and prints only the session, gate, attach, and blocker details needed to act.
 
 ## Installation
 
@@ -97,7 +90,7 @@ sks root
 
 Project setup writes shared `.gitignore` entries for generated SKS files: `.sneakoscope/`, `.codex/`, `.agents/`, and managed `AGENTS.md`. Setup, doctor repair, and npm postinstall refreshes also compare the previous SKS generated-file manifest with the current package templates and prune stale SKS-generated legacy skills or agent files while preserving user-owned custom skills. Use `sks setup --local-only` when you want those excludes kept only in `.git/info/exclude`.
 
-During npm postinstall, SKS also installs generated Codex App skills and tries the official getdesign Codex skill command, `skills add MohtashamMurshid/getdesign`, when the `skills` CLI is available. If that CLI is missing, setup still installs the generated `getdesign-reference` skill. Design work still flows through one authority: `design.md`. When `design.md` is missing, `docs/Design-Sys-Prompt.md` is the builder prompt and getdesign plus curated DESIGN.md examples such as [VoltAgent/awesome-design-md](https://github.com/VoltAgent/awesome-design-md) are inputs to fuse into that SSOT or into route-local `$PPT` style tokens.
+During npm postinstall, SKS installs generated Codex App skills and tries `skills add MohtashamMurshid/getdesign` when the `skills` CLI is available. Design work still flows through one authority: `design.md`.
 
 ### One-Shot Install
 
@@ -171,7 +164,7 @@ Bare `sks` creates or reuses the default named tmux session for Codex CLI and at
 
 Before opening tmux, SKS checks the installed Codex CLI against npm `@openai/codex@latest`. If a newer version exists, it asks `Y/n`; answering `y` updates automatically with `npm i -g @openai/codex@latest` and then opens tmux with the updated Codex CLI.
 
-If you use [codex-lb](https://github.com/Soju06/codex-lb), start it first, create an API key in its dashboard, then run:
+For [codex-lb](https://github.com/Soju06/codex-lb), start the server, create a dashboard API key, then run:
 
 ```sh
 sks codex-lb setup --host https://your-codex-lb.example.com --api-key "sk-clb-..."
@@ -179,30 +172,9 @@ sks codex-lb repair
 sks
 ```
 
-Bare `sks` asks this before opening Codex when codex-lb is not configured:
-
-```text
-Authenticate and route Codex through codex-lb? [y/N]
-```
-
-Answering `y` asks for the hosted domain and API key, writes `~/.codex/config.toml`, stores the key in `~/.codex/sks-codex-lb.env` with mode `0600`, syncs Codex CLI API-key auth through `codex login --with-api-key`, and sources that env file before launching Codex in tmux. When codex-lb is configured from this prompt, SKS opens a fresh tmux session for that launch so the new key is loaded by the Codex process immediately. SKS keeps Codex App Fast mode visible and defaulted by writing top-level `model = "gpt-5.5"`, `service_tier = "fast"`, `[features].fast_mode = true`, and the `sks-fast-high` profile while removing legacy top-level reasoning locks; route-specific reasoning stays in named profiles or explicit tmux launch args.
-
-If Codex CLI auth drifts after a tmux/MAD launch, run `sks codex-lb repair` or `sks auth repair`. This reuses the stored `~/.codex/sks-codex-lb.env` key and re-syncs Codex CLI API-key auth without asking for the key again. To replace the key or host, run `sks codex-lb reconfigure --host <domain> --api-key <key>`.
-
-The generated provider config follows the codex-lb README's Codex CLI API-key setup:
-
-```toml
-model_provider = "codex-lb"
-service_tier = "fast"
+Bare `sks` can also prompt for codex-lb auth before launch; SKS stores the key in `~/.codex/sks-codex-lb.env`, syncs `codex login --with-api-key`, and loads it into a fresh tmux session.
 
-[model_providers.codex-lb]
-name = "OpenAI"
-base_url = "http://127.0.0.1:2455/backend-api/codex"
-wire_api = "responses"
-env_key = "CODEX_LB_API_KEY"
-supports_websockets = true
-requires_openai_auth = true
-```
+If Codex CLI auth drifts after a launch or reinstall, run `sks codex-lb repair`; to replace it, run `sks codex-lb reconfigure --host <domain> --api-key <key>`.
 
 ### MAD tmux Launch
 
@@ -211,17 +183,9 @@ sks --mad
 sks --mad --yes
 ```
 
-This syncs existing codex-lb/Codex CLI auth before launch, creates/uses the `sks-mad-high` Codex profile for a one-shot full-access, high-reasoning tmux session with `sandbox_mode = "danger-full-access"` and `approval_policy = "never"`, opens an active MAD-SKS permission gate for that tmux run, then launches a single Codex CLI pane. The session recreates the named session on launch so stale split-pane MAD sessions collapse back to the single-pane default, then attaches in an interactive terminal. If codex-lb is configured and no explicit `--workspace`/`--session` was passed, SKS opens a fresh tmux session so the repaired key is loaded by the Codex process immediately. While the gate is active, live server work, Supabase MCP database writes, direct SQL, targeted DML, schema cleanup, Supabase MCP `apply_migration`, and required Supabase CLI migration application such as `supabase migration up` or `supabase db push` are allowed. Catastrophic database wipe/all-row/project-management safeguards remain active.
-
-MAD does not disable the pipeline contract: stages, executors, reviewers, and auto-review policy still must not invent unrequested fallback implementation code. If the requested path cannot be implemented, SKS should block with evidence rather than add substitute behavior.
-
-Before launching, SKS checks whether a newer `sneakoscope` exists on npm. In an interactive terminal it prompts:
+This syncs existing codex-lb/Codex CLI auth, creates/uses the `sks-mad-high` full-access profile, opens the MAD-SKS permission gate for that tmux run, and launches a single Codex CLI pane. The session recreates the named session so stale split-pane MAD sessions collapse back to one pane. Catastrophic database wipe/all-row/project-management safeguards remain active, and the pipeline contract still forbids unrequested fallback implementation code.
 
-```text
-SKS 0.x.y -> 0.x.z update before MAD launch? [Y/n]
-```
-
-Answer `y` to install `sneakoscope@latest`, then rerun `sks --mad`. Answer `n` to continue with the current version. Use `--yes` to approve missing dependency installs automatically.
+Before launching, SKS checks npm for a newer `sneakoscope`; answer `y` to update or `n` to continue. Use `--yes` to approve missing dependency installs automatically.
 
 ### Team Missions
 
@@ -237,17 +201,7 @@ sks team dashboard latest
 sks team log latest
 ```
 
-By default, Team missions keep at least five QA/reviewer lanes active. Use explicit role counts only when you need to raise or otherwise pin the lane mix for a specific mission.
-
-Team mode prepares the mission, records live events, compiles runtime tasks and worker inboxes, writes schema-backed effort/work-order/dashboard artifacts, and reconciles split live lanes inside the current SKS-owned tmux session when available. Outside an SKS tmux session, `sks team open-tmux --separate-session` keeps the named `sks-team-*` fallback view. Use `--no-open-tmux` for artifact-only mission creation. The default terminal output stays compact: mission id, agent count, role count, tmux status, watch command, and artifact directory. `sks team dashboard` renders the cockpit panes for mission overview, agent lanes, task DAG, QA/dogfood, artifacts/evidence, and performance.
-
-The tmux Team launch is a live orchestration screen in one tmux window: the main Codex pane stays alive, a managed overview pane follows `sks team watch <mission-id> --follow`, and neighboring managed split panes follow individual `sks team lane <mission-id> --agent <name> --follow` views. Pane headers show only mission, lane, phase, follow command, and cleanup command. SKS tags Team panes with tmux user options, closes only those managed panes when agent lanes complete or cleanup is requested, and recalculates the tiled layout after split/close operations. The separate `sks-team-*` session remains available as a fallback. SKS gives lanes role-specific colors, labels, and terminal titles, so scouts, planning/debate voices, executors, reviewers, and safety lanes are visually distinct while detailed evidence is mirrored into `team-transcript.jsonl`, `team-live.md`, and `team-dashboard.json`.
-
-Team roster and runtime artifacts now include per-agent Fast reasoning metadata. Simple bounded Team lanes can use low reasoning, tool-heavy runtime/CLI/tmux work uses medium, and knowledge, current-docs, safety, DB, release, commit, or research-heavy lanes use high or xhigh as appropriate instead of opening every scout at high.
-
-Agent sessions communicate through the bounded Team transcript. Use `sks team message <mission-id|latest> --from <agent> --to <agent|all> --message "..."` to add direct or broadcast messages; lane panes show messages addressed to that agent plus the fallback global tail.
-
-When the Team route reaches `session_cleanup`, SKS marks the tmux session record complete and asks `watch --follow` / `lane --follow` panes to show a cleanup summary and stop. You can also run `sks team cleanup-tmux <mission-id|latest>` manually, or `sks team cleanup-tmux latest --close` to kill the recorded tmux session.
+Team missions keep at least five QA/reviewer lanes active, record live events, compile runtime tasks and worker inboxes, write schema-backed effort/work-order/dashboard artifacts, and reconcile split live lanes in tmux when available. Use `sks team watch`, `sks team lane`, `sks team message`, and `sks team cleanup-tmux` to inspect or close the live view.
 
 ### QA, Computer Use, Goal, Research, DB, Wiki, GX
 
@@ -273,21 +227,11 @@ sks skill-dream run --json
 sks code-structure scan --json
 ```
 
-`sks pipeline plan` is the 0.7 runtime map. It reads or refreshes `.sneakoscope/missions/<id>/pipeline-plan.json`, then shows which lane is active, which stages are kept or skipped, which verification commands are required, and whether the no-unrequested-fallback invariant is present.
-
-`sks proof-field scan` is SKS's lightweight outcome rubric: it maps the goal to proof cones, records unrelated work that can be skipped with evidence, reports a simplicity score, and names escalation triggers for when the route must return to the full Team/Honest proof path. The rubric embeds Hyperplan-style adversarial pressure as compact lenses instead of a new command: challenge framing, subtract surface, demand evidence, test integration risk, and consider one simpler alternative. When `execution_lane.lane` is `proof_field_fast_lane`, SKS can keep the parent-owned minimal patch plus listed verification and skip Team debate, fresh executor teams, broad route rework, and unrelated checks. Database, security, visual-forensic, unknown, broad, failed, or unsupported-claim signals fail closed to the normal Team/Honest path. Use `sks pipeline plan --proof-field` after changed files are known to bind that Proof Field decision to the mission plan.
+`sks pipeline plan` shows the active route lane, kept/skipped stages, verification commands, and no-unrequested-fallback invariant. `sks proof-field scan` is the lightweight rubric for small changes; risky or broad signals return to the full Team/Honest path.
 
 ### Ambiguity Questions
 
-SKS no longer starts from a fixed checklist such as `GOAL_PRECISE` and `ACCEPTANCE_CRITERIA`. The clarification gate first scores goal clarity, constraint clarity, success-criteria clarity, and codebase-context clarity, then asks only the lowest-clarity item that can change execution. Predictable UI defaults, DB safety defaults, test scope, fallback policy, and ordinary implementation acceptance criteria are inferred and sealed automatically.
-
-The design borrows two useful ideas from external planning systems without copying their route weight: Ouroboros-style ambiguity thresholds decide whether the prompt is clear enough to proceed, while Prometheus/Hyperplan-style adversarial lenses challenge framing, remove unnecessary surface, demand evidence, test integration risk, and consider a simpler alternative before Team work starts.
-
-`sks skill-dream` keeps generated skill complexity bounded without doing a heavy evaluation on every prompt. Route use writes compact counters to `.sneakoscope/skills/dream-state.json`; after the configured 10-route-event threshold and cooldown, or when you run `sks skill-dream run`, SKS scans `.agents/skills` and writes `.sneakoscope/reports/skill-dream-latest.json` with keep, merge, prune, and improvement candidates. The report is intentionally advisory: deleting or merging skills requires explicit approval.
-
-`sks goal` and `$Goal` only prepare/control the native `/goal` persistence bridge. They do not replace Team, QA, DB, or other implementation routes; use the selected execution route for the actual work and verification. Context7 is only needed for Goal when external API/library documentation becomes relevant.
-
-Use `$Computer-Use` or `$CU` inside Codex App when the task specifically needs Codex Computer Use speed for UI/browser/visual work. This lane intentionally skips Team debate, QA-LOOP clarification, subagents, and upfront TriWiki refresh. It still requires Codex Computer Use as the evidence source, and it defers TriWiki refresh/validate plus Honest Mode to the final closeout. SKS does not install a generated skill named `computer-use`, because that name is reserved for the first-party Codex Computer Use plugin; use `$CU` or `$computer-use-fast` from the SKS picker for the SKS route, and use `@Computer` for the OpenAI plugin.
+Clarification asks only for ambiguity that changes execution; predictable defaults are inferred and sealed. `sks skill-dream` records cheap counters and periodically writes advisory skill reports. `$Goal` controls native `/goal` persistence without replacing the selected execution route. `$Computer-Use` / `$CU` is the fast Codex Computer Use lane for UI/browser/visual work.
 
 ### Create A Presentation
 
@@ -295,9 +239,7 @@ Use `$Computer-Use` or `$CU` inside Codex App when the task specifically needs C
 $PPT create a customer proposal deck as HTML/PDF
 ```
 
-`$PPT` seals presentation-specific context before artifact work: delivery format, target audience, STP strategy, decision context, and at least three pain-point/solution/aha mappings. The route writes source and render evidence such as `ppt-audience-strategy.json`, `ppt-source-ledger.json`, `ppt-storyboard.json`, `ppt-style-tokens.json`, `ppt-render-report.json`, and `ppt-parallel-report.json`.
-
-Design references do not compete with each other. `design.md` is the design decision SSOT; if it is missing, SKS uses `docs/Design-Sys-Prompt.md` to build or project the system. getdesign.md, official getdesign docs, and curated DESIGN.md examples from `VoltAgent/awesome-design-md` are source inputs that get fused into `design.md` or route-local `$PPT` style tokens. `$PPT` ignores installed design skills and MCP servers that are not in the route allowlist; generic design skills such as `design-artifact-expert`, `design-ui-editor`, and `design-system-builder` are not automatically used just because they are installed. This is an anti-AI-like-design guard: `$PPT` must ground visual choices in audience, source material, getdesign reference, and the design SSOT instead of freeform cards, gradients, and vague SaaS styling.
+`$PPT` seals presentation context before artifact work and grounds design in `design.md`, getdesign inputs, and source material.
 
 ## Codex App Usage
 
@@ -535,7 +477,7 @@ node ./bin/sks.mjs --version
 npm install -g .
 ```
 
-If the global command is stale, reinstall globally from the repo or from npm.
+If stale, reinstall globally from the repo or npm.
 
 ### tmux is missing
 
@@ -544,7 +486,7 @@ sks deps install tmux
 sks tmux check
 ```
 
-Install tmux from [tmux.dev/download](https://www.tmux.dev/download) or run `brew install tmux` on macOS, then re-run `sks tmux check`.
+Install tmux from [tmux.dev/download](https://www.tmux.dev/download) or `brew install tmux` on macOS, then re-run the check.
 
 ### Codex App tools are missing
 
@@ -553,9 +495,7 @@ sks codex-app check
 codex mcp list
 ```
 
-Codex App workflows need the app installed. QA and UI/browser visual-evidence workflows require first-party Codex Computer Use; Browser Use may support non-UI browser context, but it is not valid UI/browser verification evidence. Generated raster assets and image-review evidence require real Codex App `$imagegen`/`gpt-image-2` output, or the route must stay blocked/unverified.
-
-SKS setup removes old SKS-generated `computer-use` skills from `.agents/skills` so they cannot shadow the first-party Computer Use plugin. If a running Codex App thread was opened before setup or upgrade, start a fresh thread and invoke `@Computer` or Browser again so the host reloads plugin tools.
+Codex App workflows need the app installed. UI/browser evidence requires first-party Codex Computer Use, and generated raster/image-review evidence requires real `$imagegen`/`gpt-image-2` output. After setup/upgrade, start a fresh thread so Codex reloads plugin tools.
 
 ### Setup is blocked by another harness
 
@@ -564,7 +504,7 @@ sks conflicts check
 sks conflicts prompt
 ```
 
-OMX/DCodex conflicts intentionally block setup/doctor until the user approves cleanup.
+OMX/DCodex conflicts block setup/doctor until the user approves cleanup.
 
 ### The route is stuck or a final hook keeps reopening
 
@@ -575,7 +515,7 @@ sks team lane latest --agent parent_orchestrator --follow
 sks wiki validate .sneakoscope/wiki/context-pack.json
 ```
 
-Finalization requires real evidence, no unsupported critical claims, valid Team cleanup artifacts, reflection when required, and Honest Mode.
+Finalization requires evidence, valid Team cleanup artifacts, reflection when required, and Honest Mode.
 
 ## Development And Release
 
@@ -590,27 +530,7 @@ npm run sizecheck
 npm run release:check
 ```
 
-Package pipeline UI/browser verification and visual inspection evidence must come from Codex Computer Use only. Do not use Playwright, Chrome MCP, Browser Use, Selenium, Puppeteer, or other browser automation as substitutes for that evidence. Package image-generation evidence must come from real `$imagegen`/`gpt-image-2` output when generated raster assets or generated image-review evidence are required.
-
-Dry-run publish:
-
-```sh
-npm run publish:dry
-```
-
-`publish:dry` proves the local package is packable. It does not prove npm ownership, OTP, or registry publish permission.
-
-## Documentation Style
-
-This README follows a common open-source CLI shape:
-
-- quick start first
-- explicit install paths
-- separate CLI and app/plugin usage
-- command examples before internal architecture
-- troubleshooting and release checks near the end
-
-That shape mirrors how projects such as `rdme` and Vite separate quick start, setup/configuration, and CLI usage while keeping copy-ready commands visible.
+`release:check` runs audit, changelog, syntax, selftest, size, and registry checks.
 
 ## License
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "0.7.65",
+  "version": "0.7.67",
   "description": "Sneakoscope Codex: database-safe Codex CLI/App harness with Team, Goal, AutoResearch, TriWiki, and Honest Mode.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -37,10 +37,11 @@
     "packcheck": "find bin src scripts -name '*.mjs' -print0 | xargs -0 -n1 node --check",
     "changelog:check": "node ./scripts/changelog-check.mjs",
     "sizecheck": "node ./scripts/sizecheck.mjs",
-    "release:check": "npm run repo-audit && npm run changelog:check && npm run packcheck && npm run selftest && npm run sizecheck",
-    "publish:dry": "npm run release:check && npm --cache /tmp/sks-npm-cache pack --dry-run",
-    "publish:npm": "npm --cache /tmp/sks-npm-cache publish --access public",
-    "prepublishOnly": "npm run release:check"
+    "registry:check": "node ./scripts/release-registry-check.mjs",
+    "release:check": "npm run repo-audit && npm run changelog:check && npm run packcheck && npm run selftest && npm run sizecheck && npm run registry:check",
+    "publish:dry": "npm run release:check && npm --cache /tmp/sks-npm-cache publish --dry-run --registry https://registry.npmjs.org/ --access public",
+    "publish:npm": "npm --cache /tmp/sks-npm-cache publish --registry https://registry.npmjs.org/ --access public",
+    "prepublishOnly": "npm run release:check && node ./scripts/release-registry-check.mjs --require-unpublished"
   },
   "keywords": [
     "sneakoscope",

package/src/cli/install-helpers.mjs

@@ -6,7 +6,7 @@ import { stdin as input, stdout as output } from 'node:process';
 import { ensureDir, exists, globalSksRoot, packageRoot, readText, runProcess, which, writeTextAtomic } from '../core/fsx.mjs';
 import { getCodexInfo } from '../core/codex-adapter.mjs';
 import { formatHarnessConflictReport, llmHarnessCleanupPrompt, scanHarnessConflicts } from '../core/harness-conflicts.mjs';
-import { installSkills } from '../core/init.mjs';
+import { initProject, installSkills } from '../core/init.mjs';
 import { context7ConfigToml, DOLLAR_SKILL_NAMES, GETDESIGN_REFERENCE, hasContext7ConfigText, RECOMMENDED_SKILLS } from '../core/routes.mjs';
 import { codexLaunchCommand, platformTmuxInstallHint, tmuxReadiness } from '../core/tmux-ui.mjs';
 
@@ -17,6 +17,7 @@ export async function postinstall({ bootstrap }) {
     await postinstallHarnessConflictNotice(conflictScan);
     return;
   }
+  const codexLbConfigSnapshot = await capturePostinstallCodexLbConfigSnapshot();
   console.log('\nSKS installed.');
   const shim = await ensureSksCommandDuringInstall();
   if (shim.status === 'present') console.log(`SKS command: available (${shim.command}).`);
@@ -54,9 +55,11 @@ export async function postinstall({ bootstrap }) {
   if (bootstrapDecision.run) {
     console.log(`SKS bootstrap: ${bootstrapDecision.reason}.`);
     await runPostinstallBootstrap(installRoot, bootstrap);
+    await restorePostinstallCodexLbConfigSnapshot(codexLbConfigSnapshot);
     await reportPostinstallCodexLbAuth();
     return;
   }
+  await restorePostinstallCodexLbConfigSnapshot(codexLbConfigSnapshot);
   await reportPostinstallCodexLbAuth();
   console.log('\nNext:');
   console.log('  sks bootstrap');
@@ -141,6 +144,28 @@ export function codexLbEnvPath(home = process.env.HOME || os.homedir()) {
   return path.join(home, '.codex', 'sks-codex-lb.env');
 }
 
+async function capturePostinstallCodexLbConfigSnapshot(home = process.env.HOME || os.homedir()) {
+  const configPath = codexLbConfigPath(home);
+  const envPath = codexLbEnvPath(home);
+  const config = await readText(configPath, '');
+  if (!hasTopLevelCodexLbSelected(config)) return null;
+  const baseUrl = codexLbProviderBaseUrl(config);
+  if (!baseUrl) return null;
+  if (!parseCodexLbEnvKey(await readText(envPath, ''))) return null;
+  return { config_path: configPath, env_path: envPath, base_url: baseUrl };
+}
+
+async function restorePostinstallCodexLbConfigSnapshot(snapshot) {
+  if (!snapshot?.base_url) return { status: 'skipped', reason: 'no_snapshot' };
+  const current = await readText(snapshot.config_path, '');
+  if (hasTopLevelCodexLbSelected(current) && codexLbProviderBaseUrl(current)) {
+    return { status: 'present', config_path: snapshot.config_path };
+  }
+  const next = normalizeCodexFastModeUiConfig(upsertCodexLbConfig(current, snapshot.base_url));
+  await writeTextAtomic(snapshot.config_path, next);
+  return { status: 'restored', config_path: snapshot.config_path };
+}
+
 export function normalizeCodexLbBaseUrl(input = '') {
   let host = String(input || '').trim();
   if (!host) host = 'http://127.0.0.1:2455';
@@ -189,6 +214,16 @@ export async function codexLbStatus(opts = {}) {
   };
 }
 
+function hasTopLevelCodexLbSelected(text = '') {
+  const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
+  return /(^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/.test(topLevel);
+}
+
+function codexLbProviderBaseUrl(text = '') {
+  const block = String(text || '').match(/(^|\n)\[model_providers\.codex-lb\]([\s\S]*?)(?=\n\[[^\]]+\]|\s*$)/)?.[2] || '';
+  return block.match(/(^|\n)\s*base_url\s*=\s*"([^"]+)"/)?.[2] || '';
+}
+
 export async function repairCodexLbAuth(opts = {}) {
   const status = await codexLbStatus(opts);
   if (!status.ok) {
@@ -869,6 +904,15 @@ export async function selftestCodexLb(tmp) {
   const codexLbEnv = await safeReadText(path.join(codexLbHome, '.codex', 'sks-codex-lb.env'));
   const codexLbAuth = await safeReadText(path.join(codexLbHome, '.codex', 'auth.json'));
   if (!codexLbSetupJson.ok || codexLbSetupJson.base_url !== 'https://lb.example.test/backend-api/codex' || !codexLbConfig.includes('model_provider = "codex-lb"') || !codexLbConfig.includes('[model_providers.codex-lb]') || !codexLbEnv.includes("CODEX_LB_API_KEY='sk-test'") || !/(\"auth_mode\"\s*:\s*\"apikey\")/.test(codexLbAuth)) throw new Error('selftest failed: codex-lb setup did not write provider config, env key, and Codex API-key auth');
+  await initProject(codexLbHome, { installScope: 'global', force: true, repair: true });
+  const codexLbRepairSetupConfig = await safeReadText(path.join(codexLbHome, '.codex', 'config.toml'));
+  if (!codexLbRepairSetupConfig.includes('model_provider = "codex-lb"') || !codexLbRepairSetupConfig.includes('[model_providers.codex-lb]') || !codexLbRepairSetupConfig.includes('https://lb.example.test/backend-api/codex') || codexLbRepairSetupConfig.includes('sk-test')) throw new Error('selftest failed: initProject repair lost codex-lb provider config or exposed the stored key');
+  await writeTextAtomic(path.join(codexLbHome, '.codex', 'config.toml'), `${codexLbConfig}\n[mcp_servers.supabase]\nurl = "https://mcp.supabase.com/mcp?project_ref=ref&read_only=true&features=database,docs"\n`);
+  const ptmp = path.join(tmp, 'codex-lb-project-config'), prevHome = process.env.HOME;
+  try { process.env.HOME = codexLbHome; await initProject(ptmp, { installScope: 'global' }); }
+  finally { if (prevHome === undefined) delete process.env.HOME; else process.env.HOME = prevHome; }
+  const pcfg = await safeReadText(path.join(ptmp, '.codex', 'config.toml'));
+  if (!pcfg.includes('model_provider = "codex-lb"') || !pcfg.includes('[model_providers.codex-lb]') || !pcfg.includes('[mcp_servers.supabase]') || !pcfg.includes('read_only=true')) throw new Error('selftest failed: project bootstrap lost global codex-lb or MCP config');
   await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), '{"auth_mode":"browser"}\n');
   const codexLbRepair = await runProcess(process.execPath, [path.join(packageRoot(), 'bin', 'sks.mjs'), 'auth', 'repair', '--json'], { cwd: tmp, env: codexLbEnvForSelftest, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
   if (codexLbRepair.code !== 0) throw new Error(`selftest failed: codex-lb repair exited ${codexLbRepair.code}: ${codexLbRepair.stderr}`);
@@ -912,7 +956,12 @@ export async function selftestCodexLb(tmp) {
       SKS_SKIP_POSTINSTALL_GLOBAL_SKILLS: '1',
       SKS_SKIP_POSTINSTALL_CODEX_LB_AUTH: '0'
     });
-    await postinstall({ bootstrap: async () => writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), '{"auth_mode":"browser"}\n') });
+    await postinstall({
+      bootstrap: async () => {
+        await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), '{"auth_mode":"browser"}\n');
+        await writeTextAtomic(path.join(codexLbHome, '.codex', 'config.toml'), 'model = "gpt-5.5"\nservice_tier = "fast"\n\n[features]\nhooks = true\n');
+      }
+    });
   } finally {
     for (const key of postinstallEnvKeys) {
       if (postinstallEnvBefore[key] === undefined) delete process.env[key];
@@ -920,8 +969,10 @@ export async function selftestCodexLb(tmp) {
     }
   }
   const codexLbPostBootstrapAuth = await safeReadText(path.join(codexLbHome, '.codex', 'auth.json'));
+  const codexLbPostBootstrapConfig = await safeReadText(path.join(codexLbHome, '.codex', 'config.toml'));
   const codexLbLoginCallsAfterBootstrap = (await safeReadText(path.join(codexLbHome, '.codex', 'login-calls.log'))).trim().split(/\r?\n/).filter(Boolean).length;
   if (!codexLbPostBootstrapAuth.includes('"auth_mode":"apikey"') || !codexLbPostBootstrapAuth.includes('sk-test') || codexLbLoginCallsAfterBootstrap <= codexLbLoginCallsBeforeBootstrap) throw new Error('selftest failed: postinstall did not repair codex-lb auth after bootstrap drift');
+  if (!codexLbPostBootstrapConfig.includes('model_provider = "codex-lb"') || !codexLbPostBootstrapConfig.includes('[model_providers.codex-lb]') || !codexLbPostBootstrapConfig.includes('https://lb.example.test/backend-api/codex') || codexLbPostBootstrapConfig.includes('sk-test')) throw new Error('selftest failed: postinstall did not restore codex-lb provider config after bootstrap drift');
   const codexLbContext7Bin = path.join(tmp, 'codex-lb-context7-bin');
   await ensureDir(codexLbContext7Bin);
   await writeTextAtomic(path.join(codexLbContext7Bin, 'codex'), '#!/bin/sh\nif [ "$1" = "--version" ]; then echo "codex-cli 99.0.0"; exit 0; fi\nif [ "$CODEX_LB_API_KEY" ]; then echo "context7 leaked CODEX_LB_API_KEY" >&2; exit 77; fi\nif [ "$1" = "mcp" ] && [ "$2" = "list" ]; then echo ""; exit 0; fi\nif [ "$1" = "mcp" ] && [ "$2" = "add" ]; then echo "context7 added"; exit 0; fi\necho "unexpected codex $*" >&2\nexit 2\n');

package/src/cli/main.mjs

@@ -12,7 +12,7 @@ import { sealContract, validateAnswers } from '../core/decision-contract.mjs';
 import { buildQaLoopQuestionSchema, buildQaLoopPrompt, defaultQaGate, evaluateQaGate, isQaReportFilename, qaStatus, writeMockQaResult, writeQaLoopArtifacts } from '../core/qa-loop.mjs';
 import { containsUserQuestion, noQuestionContinuationReason } from '../core/no-question-guard.mjs';
 import { evaluateDoneGate, defaultDoneGate } from '../core/hproof.mjs';
-import { emitHook } from '../core/hooks-runtime.mjs';
+import { emitHook, selftestCodexCommitHooks } from '../core/hooks-runtime.mjs';
 import { storageReport, enforceRetention, pruneWikiArtifacts } from '../core/retention.mjs';
 import { classifySql, classifyCommand, classifyToolPayload, checkDbOperation, handleMadSksUserConfirmation, loadDbSafetyPolicy, scanDbSafety } from '../core/db-safety.mjs';
 import { checkHarnessModification, harnessGuardStatus, isHarnessSourceProject } from '../core/harness-guard.mjs';
@@ -2603,15 +2603,16 @@ async function selftest() {
   const codexAppQuickRefExists = await exists(path.join(tmp, '.codex', 'SNEAKOSCOPE.md'));
   if (!codexAppQuickRefExists) throw new Error('selftest failed: Codex App quick reference missing');
   const codexAppQuickRefText = await safeReadText(path.join(tmp, '.codex', 'SNEAKOSCOPE.md'));
-  if (!codexAppQuickRefText.includes('dollar-commands')) throw new Error('selftest failed: Codex App quick reference missing dollar-command discovery');
-  if (!codexAppQuickRefText.includes('Context Tracking') || !codexAppQuickRefText.includes('TriWiki')) throw new Error('selftest failed: Codex App quick reference missing TriWiki context tracking');
-  if (!codexAppQuickRefText.includes('Before each route phase') || !codexAppQuickRefText.includes('every stage')) throw new Error('selftest failed: Codex App quick reference missing per-stage TriWiki policy');
+  if (!codexAppQuickRefText.includes('dollar-commands')) throw new Error('selftest failed: quickref commands');
+  if (!codexAppQuickRefText.includes('Context Tracking') || !codexAppQuickRefText.includes('TriWiki')) throw new Error('selftest failed: quickref TriWiki');
+  if (!codexAppQuickRefText.includes('Before each route phase') || !codexAppQuickRefText.includes('every stage')) throw new Error('selftest failed: quickref stage policy');
   for (const { command } of DOLLAR_COMMANDS) {
     if (!codexAppQuickRefText.includes(command)) throw new Error(`selftest failed: Codex App quick reference missing ${command}`);
   }
   const hookGoalTmp = tmpdir();
   await initProject(hookGoalTmp, {});
   const hookBin = path.join(packageRoot(), 'bin', 'sks.mjs');
+  await selftestCodexCommitHooks();
   const hookImageUxTmp = tmpdir();
   await initProject(hookImageUxTmp, {});
   const hookImageUxPayload = JSON.stringify({ cwd: hookImageUxTmp, prompt: '$Image-UX-Review localhost 화면을 gpt-image-2 콜아웃 리뷰로 검수해줘' });
@@ -3279,7 +3280,7 @@ async function selftest() {
   if (!tmuxTeam.agents?.length || !tmuxTeam.agents.some((entry) => entry.agent === 'analysis_scout_1') || !tmuxTeam.agents.every((entry) => String(entry.command || '').includes('team lane') && String(entry.command || '').includes('--agent'))) throw new Error('selftest failed: Team tmux view did not expose agent live lanes');
   if (!roleTeamPlan.roster.analysis_team.every((agent) => tmuxTeam.agents.some((entry) => entry.agent === agent.id))) throw new Error('selftest failed: Team tmux view collapsed numbered analysis scout lanes');
   if (!tmuxTeam.overview?.command?.includes('team watch') || !tmuxTeam.lanes?.some((entry) => entry.role === 'overview') || !tmuxTeam.lanes?.some((entry) => entry.agent === 'analysis_scout_1')) throw new Error('selftest failed: Team tmux view did not expose orchestration overview plus agent lanes');
-  if (tmuxTeam.split_ui?.mode !== 'single_window_split_panes' || tmuxTeam.split_ui?.layout !== 'tiled' || tmuxTeam.split_ui?.live_updates !== true) throw new Error('selftest failed: Team tmux view did not expose single-window split UI metadata');
+  if (tmuxTeam.split_ui?.mode !== 'single_window_split_panes' || tmuxTeam.split_ui?.layout !== 'main-vertical' || tmuxTeam.split_ui?.right_side_only !== true || tmuxTeam.split_ui?.live_updates !== true) throw new Error('selftest failed: tmux UI');
   if (String(tmuxTeam.overview?.command || '').includes('SNEAKOSCOPE CODEX') || !String(tmuxTeam.overview?.command || '').includes('Follow: team watch')) throw new Error('selftest failed: Team tmux pane banner is too noisy or missing compact follow hint');
   if (teamLaneStyle('analysis_scout_1').role !== 'scout' || teamLaneStyle('executor_1').role !== 'execution' || teamLaneStyle('reviewer_1').role !== 'review') throw new Error('selftest failed: Team tmux role palette did not classify lane roles');
   if (!String(tmuxTeam.cleanup_policy || '').includes('mark-complete') || !tmuxTeam.lanes.every((entry) => entry.style?.color && entry.title)) throw new Error('selftest failed: Team tmux view did not expose color/title metadata and cleanup policy');
@@ -3288,7 +3289,7 @@ async function selftest() {
   await ensureDir(fakeTmuxDir);
   const fakeTmuxLog = path.join(fakeTmuxDir, 'tmux.log');
   const fakeTmuxBin = path.join(fakeTmuxDir, 'tmux');
-  await writeTextAtomic(fakeTmuxBin, `#!/usr/bin/env node\nconst fs = require('node:fs');\nconst log = process.env.SKS_FAKE_TMUX_LOG;\nif (log) fs.appendFileSync(log, process.argv.slice(2).join(' ') + '\\n');\nconst cmd = process.argv[2];\nif (cmd === 'has-session') process.exit(0);\nif (cmd === 'kill-session') process.exit(0);\nif (cmd === 'kill-pane') process.exit(0);\nif (cmd === 'new-session') { console.log('%1'); process.exit(0); }\nif (cmd === 'split-window') { console.log(process.env.SKS_FAKE_TMUX_SPLIT_ID || '%2'); process.exit(0); }\nif (cmd === 'list-windows') { console.log('@1'); process.exit(0); }\nif (cmd === 'display-message') { console.log(process.env.SKS_FAKE_TMUX_DISPLAY || 'sks-existing-selftest\\t@1\\t%1'); process.exit(0); }\nif (cmd === 'list-panes') { console.log(process.env.SKS_FAKE_TMUX_LIST || ''); process.exit(0); }\nif (cmd === 'set-option' || cmd === 'select-layout' || cmd === 'resize-window' || cmd === 'set-window-option' || cmd === 'set-hook') process.exit(0);\nprocess.exit(0);\n`);
+  await writeTextAtomic(fakeTmuxBin, `#!/usr/bin/env node\nconst{appendFileSync:a}=require('node:fs'),e=process.env,c=process.argv[2];if(e.SKS_FAKE_TMUX_LOG)a(e.SKS_FAKE_TMUX_LOG,process.argv.slice(2).join(' ')+'\\n');if(['has-session','kill-session','kill-pane','set-option','select-pane','select-layout','resize-window','set-window-option','set-hook'].includes(c))process.exit(0);if(c==='new-session'){console.log('%1');process.exit(0)}if(c==='split-window'){console.log(e.SKS_FAKE_TMUX_SPLIT_ID||'%2');process.exit(0)}if(c==='list-windows'){console.log('@1');process.exit(0)}if(c==='display-message'){console.log(e.SKS_FAKE_TMUX_DISPLAY||'sks-existing-selftest\\t@1\\t%1');process.exit(0)}if(c==='list-panes'){console.log(e.SKS_FAKE_TMUX_LIST||'');process.exit(0)}process.exit(0);\n`);
   await fsp.chmod(fakeTmuxBin, 0o755);
   const previousFakeTmuxLog = process.env.SKS_FAKE_TMUX_LOG;
   const previousPath = process.env.PATH;
@@ -3327,20 +3328,22 @@ async function selftest() {
     env: { ...process.env, TMUX: '/tmp/tmux-selftest/default,1,0' }
   });
   const cockpitOpenLog = await safeReadText(fakeTmuxLog);
-  if (!cockpitOpen.ok || cockpitOpen.opened_lane_count !== 2 || !cockpitOpenLog.includes('display-message -p') || !cockpitOpenLog.includes('split-window -t @1') || !cockpitOpenLog.includes('set-option -pt %80 @sks_team_managed 1') || !cockpitOpenLog.includes('select-layout -t @1 tiled')) throw new Error('selftest failed: dynamic Team cockpit did not split managed panes in the current SKS tmux session');
+  if (!cockpitOpen.ok || cockpitOpen.opened_lane_count !== 2 || cockpitOpen.main_pane_id !== '%1' || cockpitOpen.relayout?.layout_name !== 'main-vertical' || !cockpitOpenLog.includes('display-message -p') || !cockpitOpenLog.includes('split-window -h -t %1') || !cockpitOpenLog.includes('set-option -pt %80 @sks_team_managed 1') || !cockpitOpenLog.includes('select-pane -t %1') || !cockpitOpenLog.includes('select-layout -t @1 main-vertical')) throw new Error('selftest failed: split');
   await writeTextAtomic(fakeTmuxLog, '');
-  process.env.SKS_FAKE_TMUX_LIST = `%81\tscout: analysis_scout_1\tnode\t1\t${teamId}\tanalysis_scout_1\tscout\n%82\tscout: analysis_scout_2\tnode\t1\t${teamId}\tanalysis_scout_2\tscout\n%83\tuser pane\tzsh\t\t\t\t`;
+  const fakePanes = `%81\tscout: analysis_scout_1\tnode\t1\t${teamId}\tanalysis_scout_1\tscout\n%82\tscout: analysis_scout_2\tnode\t1\t${teamId}\tanalysis_scout_2\tscout\n%83\tuser pane\tzsh\t\t\t\t`;
+  process.env.SKS_FAKE_TMUX_LIST = fakePanes;
   const cockpitClose = await reconcileTmuxTeamCockpit({
     root: tmp,
     missionId: teamId,
     plan: roleTeamPlan,
-    dashboard: { agents: { analysis_scout_1: { status: 'completed' }, analysis_scout_2: { status: 'assigned' } } },
-    control: { status: 'running' },
+    dashboard: { agents: { analysis_scout_2: { status: 'assigned' } } },
+    control: { status: 'cleanup_requested' },
+    close: true,
     tmux: { bin: fakeTmuxBin },
     env: { ...process.env, TMUX: '/tmp/tmux-selftest/default,1,0' }
   });
   const cockpitCloseLog = await safeReadText(fakeTmuxLog);
-  if (!cockpitClose.ok || cockpitClose.closed_lane_count !== 1 || !cockpitCloseLog.includes('kill-pane -t %81') || cockpitCloseLog.includes('kill-pane -t %83')) throw new Error('selftest failed: dynamic Team cockpit did not close only stale managed panes');
+  if (!cockpitClose.ok || cockpitClose.closed_lane_count !== 2 || !cockpitCloseLog.includes('kill-pane -t %81') || !cockpitCloseLog.includes('kill-pane -t %82') || cockpitCloseLog.includes('kill-pane -t %83')) throw new Error('selftest failed: cleanup');
   delete process.env.SKS_FAKE_TMUX_DISPLAY;
   delete process.env.SKS_FAKE_TMUX_LIST;
   delete process.env.SKS_FAKE_TMUX_SPLIT_ID;
@@ -3443,6 +3446,7 @@ async function selftest() {
   if (!(await readTeamTranscriptTail(teamDir, 1)).join('\n').includes('selftest mapped options')) throw new Error('selftest failed: team transcript tail missing event');
   const teamLane = await renderTeamAgentLane(teamDir, { missionId: teamId, agent: 'analysis_scout_1', lines: 4 });
   if (!teamLane.includes('selftest mapped repo slice')) throw new Error('selftest failed: team agent lane missing event context');
+  if (!teamLane.includes('## Live Chat') || !teamLane.includes('selftest mapped repo slice') || teamLane.includes('## Global Tail')) throw new Error('selftest failed:cht');
   const teamLaneCli = await runProcess(process.execPath, [hookBin, 'team', 'lane', teamId, '--agent', 'analysis_scout_1', '--lines', '4'], { cwd: tmp, env: { SKS_DISABLE_UPDATE_CHECK: '1' }, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
   if (teamLaneCli.code !== 0 || !String(teamLaneCli.stdout || '').includes('SKS Team Agent Lane') || !String(teamLaneCli.stdout || '').includes('analysis_scout_1')) throw new Error('selftest failed: sks team lane CLI did not render an agent lane');
   await writeTextAtomic(path.join(teamDir, 'team-analysis.md'), '- claim: analysis scout mapped route registry | source: src/core/routes.mjs | risk: high | confidence: supported\n');

package/src/cli/maintenance-commands.mjs

@@ -2052,7 +2052,7 @@ async function teamCommand(sub, args) {
         missionId: id,
         agent: readFlagValue(args, '--agent', 'parent_orchestrator'),
         reason: message,
-        finalMessage: 'Team cleanup event received. Managed tmux Team panes may close; follow loops may stop.'
+        finalMessage: 'Team cleanup event received. Follow loops stop and managed tmux Team panes are closed when reachable.'
       }).then(() => cleanupTmuxTeamView({ root, missionId: id, closeSession: flag(args, '--close-session') || flag(args, '--close') })).catch((err) => ({ ok: false, reason: err.message || 'tmux cleanup failed' }))
       : null;
     if (flag(args, '--json')) return console.log(JSON.stringify(record, null, 2));
@@ -2091,7 +2091,7 @@ async function teamCommand(sub, args) {
       missionId: id,
       agent: readFlagValue(args, '--agent', 'parent_orchestrator'),
       reason: readFlagValue(args, '--reason', 'Team session ended; clean up live follow panes.'),
-      finalMessage: 'Team session ended. Lane/watch follow loops will stop after showing this cleanup summary; managed tmux Team panes may close.'
+      finalMessage: 'Team session ended. Lane/watch follow loops will stop after showing this cleanup summary; managed tmux Team panes are closed when reachable.'
     });
     await appendTeamEvent(dir, {
       agent: readFlagValue(args, '--agent', 'parent_orchestrator'),

package/src/core/fsx.mjs

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 
-export const PACKAGE_VERSION = '0.7.65';
+export const PACKAGE_VERSION = '0.7.67';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 

package/src/core/hooks-runtime.mjs

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { projectRoot, readJson, readText, writeJsonAtomic, appendJsonl, readStdin, nowIso, runProcess, which, PACKAGE_VERSION, sha256, packageRoot } from './fsx.mjs';
+import { projectRoot, readJson, readText, writeJsonAtomic, appendJsonl, readStdin, nowIso, runProcess, which, PACKAGE_VERSION, sha256, packageRoot, tmpdir } from './fsx.mjs';
 import { looksInteractiveCommand, interactiveCommandReason } from './no-question-guard.mjs';
 import { missionDir, setCurrent, stateFile } from './mission.mjs';
 import { checkDbOperation, dbBlockReason, handleMadSksUserConfirmation } from './db-safety.mjs';
@@ -15,9 +15,11 @@ const TEAM_DIGEST_CONTEXT_CHARS = 1600;
 const TEAM_DIGEST_SYSTEM_CHARS = 260;
 const STOP_REPEAT_GUARD_ARTIFACT = 'stop-hook-repeat-guard.json';
 const LIGHT_ROUTE_STOP_ARTIFACT = 'light-route-stop.json';
+const CODEX_GIT_ACTION_STOP_ARTIFACT = 'codex-git-action-stop-bypass.json';
 const STOP_REPEAT_GUARD_WINDOW_MS = 10 * 60 * 1000;
 const STOP_REPEAT_GUARD_MAX_ENTRIES = 25;
 const DEFAULT_STOP_REPEAT_GUARD_LIMIT = 2;
+const CODEX_GIT_ACTION_STOP_TTL_MS = 5 * 60 * 1000;
 
 async function loadHookPayload() {
   const raw = await readStdin();
@@ -143,6 +145,13 @@ function clientModelCandidates(value, depth = 0) {
 }
 
 async function hookUserPrompt(root, state, payload, noQuestion) {
+  if (looksLikeCodexGitCommitMessageGeneration(payload)) {
+    await armCodexGitActionStopBypass(root, payload).catch(() => null);
+    return {
+      continue: true,
+      systemMessage: 'SKS: Codex App git commit message generation bypassed route gates.'
+    };
+  }
   if (!noQuestion) {
     const prompt = stripVisibleDecisionAnswerBlocks(extractUserPrompt(payload));
     const madSksConfirmation = await handleMadSksUserConfirmation(root, state, prompt);
@@ -348,6 +357,12 @@ function clarificationPauseBlockReason(state = {}) {
 
 async function hookStop(root, state, payload, noQuestion) {
   const last = extractLastMessage(payload);
+  if (await consumeCodexGitActionStopBypass(root, payload)) {
+    return {
+      continue: true,
+      systemMessage: 'SKS: Codex App git commit message generation accepted without route finalization gates.'
+    };
+  }
   if (!noQuestion && (hasDfixLightCompletion(last) || await consumeLightRouteStop(root, payload))) {
     return {
       continue: true,
@@ -422,6 +437,79 @@ function explicitConversationId(payload = {}) {
   return payload.conversation_id || payload.thread_id || payload.session_id || payload.chat_id || null;
 }
 
+function looksLikeCodexGitCommitMessageGeneration(payload = {}) {
+  const prompt = stripVisibleDecisionAnswerBlocks(extractUserPrompt(payload));
+  const haystack = [
+    payload.action,
+    payload.intent,
+    payload.operation,
+    payload.permission,
+    payload.description,
+    payload.kind,
+    payload.type,
+    payload.feature,
+    payload.tool_name,
+    payload.toolName,
+    payload.source,
+    payload.event,
+    payload.hook,
+    payload.hook_name,
+    payload.input?.action,
+    payload.input?.intent,
+    payload.input?.operation,
+    payload.input?.feature,
+    payload.input?.source,
+    payload.metadata?.action,
+    payload.metadata?.intent,
+    payload.metadata?.operation,
+    payload.metadata?.feature,
+    payload.metadata?.source
+  ].filter(Boolean).join(' ');
+  const appSignal = /\b(?:codex[_\s-]*(?:app[_\s-]*)?)?(?:git[_\s-]*)?(?:commit[_\s-]*message|git[_\s-]*commit|codex_git_commit)\b/i.test(haystack)
+    || /커밋\s*메시지\s*생성/i.test(haystack);
+  const promptSignal = /\bgenerate(?:\s+a)?(?:\s+git)?\s+commit\s+message\b/i.test(prompt)
+    || /\bcommit\s+message\b[\s\S]{0,80}\b(?:staged|diff|changes?|git)\b/i.test(prompt)
+    || /커밋\s*메시지\s*생성/i.test(prompt);
+  if (!appSignal && !promptSignal) return false;
+  if (appSignal) return true;
+  return !looksLikeUserImplementationRequest(prompt);
+}
+
+function looksLikeUserImplementationRequest(text = '') {
+  return /(fix|bug|broken|error|issue|implement|change|update|repair|수정|버그|오류|에러|문제|고쳐|고치|해결|변경|수리|패치|안생기|안\s*생기)/i.test(String(text || ''));
+}
+
+async function armCodexGitActionStopBypass(root, payload = {}) {
+  const nowMs = Date.now();
+  const record = {
+    schema_version: 1,
+    route: 'codex_git_commit',
+    pending_stop_bypass: true,
+    conversation_id: conversationId(payload),
+    created_at: nowIso(),
+    expires_at: new Date(nowMs + CODEX_GIT_ACTION_STOP_TTL_MS).toISOString()
+  };
+  await writeJsonAtomic(path.join(root, '.sneakoscope', 'state', CODEX_GIT_ACTION_STOP_ARTIFACT), record);
+  return record;
+}
+
+async function consumeCodexGitActionStopBypass(root, payload = {}) {
+  const file = path.join(root, '.sneakoscope', 'state', CODEX_GIT_ACTION_STOP_ARTIFACT);
+  const record = await readJson(file, null).catch(() => null);
+  if (!record?.pending_stop_bypass) return false;
+  if (record.route !== 'codex_git_commit') return false;
+  const expiresMs = Date.parse(record.expires_at || '');
+  if (!Number.isFinite(expiresMs) || expiresMs < Date.now()) return false;
+  const currentConversation = conversationId(payload);
+  if (record.conversation_id && explicitConversationId(payload) && record.conversation_id !== currentConversation) return false;
+  await writeJsonAtomic(file, {
+    ...record,
+    pending_stop_bypass: false,
+    consumed_at: nowIso()
+  }).catch(() => null);
+  return true;
+}
+
 async function finalizationRepeatDecision(root, state = {}, payload = {}, reason = '', kind = 'finalization') {
   const now = nowIso();
   const guardPath = path.join(root, '.sneakoscope', 'state', STOP_REPEAT_GUARD_ARTIFACT);
@@ -812,6 +900,27 @@ export async function emitHook(name) {
   process.stdout.write(`${JSON.stringify(normalizeHookResult(name, result))}\n`);
 }
 
+export async function selftestCodexCommitHooks() {
+  const root = tmpdir();
+  const hookBin = path.join(packageRoot(), 'bin', 'sks.mjs');
+  const env = { SKS_DISABLE_UPDATE_CHECK: '1' };
+  const setup = await runProcess(process.execPath, [hookBin, 'setup', '--install-scope', 'project'], { cwd: root, env, timeoutMs: 15000, maxOutputBytes: 128 * 1024 });
+  if (setup.code !== 0) throw new Error(`selftest failed: commit setup ${setup.code}: ${setup.stderr}`);
+  const runHook = (name, payload) => runProcess(process.execPath, [hookBin, 'hook', name], { cwd: root, input: JSON.stringify({ cwd: root, ...payload }), env, timeoutMs: 15000, maxOutputBytes: 128 * 1024 });
+  const id = 'commit-selftest';
+  const hook = await runHook('user-prompt-submit', { conversation_id: id, action: 'codex_git_commit', prompt: 'Generate a git commit message for the staged diff.' });
+  if (hook.code !== 0) throw new Error(`selftest failed: commit hook ${hook.code}: ${hook.stderr}`);
+  const hookJson = JSON.parse(hook.stdout);
+  if (hookJson.decision === 'block' || hookJson.hookSpecificOutput?.additionalContext || !String(hookJson.systemMessage || '').includes('git commit message generation')) throw new Error('selftest failed: commit route bypass');
+  const stop = await runHook('stop', { conversation_id: id, last_assistant_message: 'Fix Codex App commit message hook bypass' });
+  if (stop.code !== 0) throw new Error(`selftest failed: commit stop ${stop.code}: ${stop.stderr}`);
+  const stopJson = JSON.parse(stop.stdout);
+  if (stopJson.decision === 'block' || !String(stopJson.systemMessage || '').includes('accepted without route finalization')) throw new Error('selftest failed: commit stop bypass');
+  const userHook = await runHook('user-prompt-submit', { prompt: '[커밋 메시지를 생성하지 못했습니다.] 코덱스 앱에서 이 버그 수정해줘' });
+  if (userHook.code !== 0) throw new Error(`selftest failed: user commit hook ${userHook.code}: ${userHook.stderr}`);
+  if (!JSON.parse(userHook.stdout).hookSpecificOutput?.additionalContext?.includes('$Team route prepared')) throw new Error('selftest failed: user prompt route');
+}
+
 function normalizeHookResult(name, result = {}) {
   const eventName = codexHookEventName(name);
   const out = { ...result };

package/src/core/init.mjs

@@ -112,6 +112,7 @@ export async function initProject(root, opts = {}) {
   const sine = path.join(root, '.sneakoscope');
   const manifestPath = path.join(sine, 'manifest.json');
   const previousManifest = await readJson(manifestPath, null);
+  const preRepairCodexConfig = opts.repair ? await readText(path.join(root, '.codex', 'config.toml'), '') : '';
   if (opts.repair) {
     const repair = await repairSksGeneratedArtifacts(root, { resetState: Boolean(opts.resetState) });
     if (repair.removed.length) created.push(`repaired generated SKS files (${repair.removed.length})`);
@@ -462,6 +463,34 @@ function mergeManagedCodexConfigToml(existingContent = '') {
   return `${next.trim()}\n`;
 }
 
+async function mergeGlobalCodexConfigIfAvailable(configText = '', configPath = '') {
+  const selectedRe = /(^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/;
+  const home = process.env.HOME || '';
+  if (!home) return configText;
+  const globalConfigPath = path.join(home, '.codex', 'config.toml');
+  if (configPath && path.resolve(configPath) === path.resolve(globalConfigPath)) return configText;
+  const globalConfig = await readText(globalConfigPath, '');
+  let next = mergeGlobalMcpServers(configText, globalConfig);
+  if (selectedRe.test(next) && /\[model_providers\.codex-lb\]/.test(next)) return `${String(next || '').trim()}\n`;
+  if (!(await exists(path.join(home, '.codex', 'sks-codex-lb.env')))) return next;
+  const baseUrl = globalConfig.match(/(^|\n)\[model_providers\.codex-lb\][\s\S]*?\n\s*base_url\s*=\s*"([^"]+)"/)?.[2];
+  if (!selectedRe.test(globalConfig) || !baseUrl) return next;
+  next = upsertTopLevelTomlString(next, 'model_provider', 'codex-lb');
+  next = upsertTomlTable(next, 'model_providers.codex-lb', `[model_providers.codex-lb]\nname = "OpenAI"\nbase_url = "${baseUrl}"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = true`);
+  return `${next.trim()}\n`;
+}
+
+function mergeGlobalMcpServers(configText = '', globalConfig = '') {
+  let next = configText;
+  const re = /(?:^|\n)(\[(mcp_servers\.[^\]\r\n]+)\][\s\S]*?)(?=\n\[[^\]]+\]|\s*$)/g;
+  for (const match of String(globalConfig || '').matchAll(re)) {
+    const block = match[1].trim();
+    const table = match[2].trim();
+    if (!new RegExp(`(^|\\n)\\[${escapeRegExp(table)}\\]`).test(next)) next = upsertTomlTable(next, table, block);
+  }
+  return next;
+}
+
 function removeLegacyTopLevelCodexModeLocks(text = '') {
   const legacy = {
     model_reasoning_effort: new Set(['high'])
@@ -618,8 +647,12 @@ function upsertTomlTable(text, table, block) {
   }
 
   const generatedCodexConfigPath = path.join(root, '.codex', 'config.toml');
-  const existingCodexConfig = await readText(generatedCodexConfigPath, '');
-  await writeTextAtomic(generatedCodexConfigPath, mergeManagedCodexConfigToml(existingCodexConfig));
+  const existingCodexConfig = await readText(generatedCodexConfigPath, '') || preRepairCodexConfig;
+  const managedCodexConfig = await mergeGlobalCodexConfigIfAvailable(
+    mergeManagedCodexConfigToml(existingCodexConfig),
+    generatedCodexConfigPath
+  );
+  await writeTextAtomic(generatedCodexConfigPath, managedCodexConfig);
   created.push('.codex/config.toml');
 
   await writeTextAtomic(path.join(root, '.codex', 'SNEAKOSCOPE.md'), codexAppQuickReference(installScope, hookCommandPrefix));

package/src/core/team-live.mjs

@@ -498,7 +498,7 @@ export async function requestTeamSessionCleanup(dir, opts = {}) {
     cleanup_requested_at: opts.ts || nowIso(),
     cleanup_requested_by: opts.agent || 'parent_orchestrator',
     cleanup_reason: opts.reason || 'Team session cleanup requested.',
-    final_message: opts.finalMessage || 'Team session ended. Lane follow loops may stop; managed tmux Team panes may close.'
+    final_message: opts.finalMessage || 'Team session ended. Lane/watch follow loops stop after this summary; managed tmux Team panes are closed when reachable.'
   };
   await writeJsonAtomic(files.control, next);
   return next;
@@ -518,7 +518,7 @@ export function renderTeamCleanupSummary(control = {}) {
     `Requested by: ${control.cleanup_requested_by || 'unknown'}`,
     `Reason: ${control.cleanup_reason || 'Team session cleanup requested.'}`,
     '',
-    control.final_message || 'Team session ended. managed tmux Team panes may close.'
+    control.final_message || 'Team session ended. managed tmux Team panes are closed when reachable.'
   ].join('\n');
 }
 
@@ -554,6 +554,9 @@ export async function renderTeamAgentLane(dir, opts = {}) {
   const assignedTasks = runtimeTasks.filter((task) => aliasSet.has(task?.worker) || aliasSet.has(task?.agent_hint));
   const agentEvents = parsedWindow.filter((event) => aliasSet.has(event?.agent) || aliases.some((id) => eventAddressedTo(event, id))).slice(-lines);
   const directMessages = parsedWindow.filter((event) => event?.type === 'message' && aliases.some((id) => eventAddressedTo(event, id))).slice(-lines);
+  const chatEvents = uniqueTranscriptEvents([...agentEvents, ...directMessages])
+    .sort((a, b) => String(a.ts || '').localeCompare(String(b.ts || '')))
+    .slice(-lines);
   const laneStyle = teamLaneTextStyle(agent);
   return [
     `# SKS Team Agent Lane`,
@@ -573,11 +576,8 @@ export async function renderTeamAgentLane(dir, opts = {}) {
     `## Assigned Runtime Tasks`,
     ...(runtime ? formatRuntimeTasks(assignedTasks) : ['- team-runtime-tasks.json not available yet.']),
     '',
-    `## Recent Agent Events`,
-    ...(agentEvents.length ? agentEvents.map(formatTranscriptEvent) : ['- No recent agent-specific events in the bounded tail.']),
-    '',
-    `## Direct Messages`,
-    ...(directMessages.length ? directMessages.map(formatTranscriptEvent) : ['- No direct or broadcast messages in the bounded tail.']),
+    `## Live Chat`,
+    ...(chatEvents.length ? chatEvents.map((event) => formatChatTranscriptEvent(event, aliases[0])) : ['- waiting for live agent messages...']),
     opts.includeGlobalTail ? '' : null,
     opts.includeGlobalTail ? `## Global Tail` : null,
     ...(opts.includeGlobalTail
@@ -608,11 +608,11 @@ export async function renderTeamWatch(dir, opts = {}) {
     '## Split-Screen Map',
     '- This overview pane follows the whole mission transcript.',
     '- Run `sks team open-tmux ...` to materialize or reopen the split-pane Team tmux view for an existing mission.',
-    '- Inside an SKS-owned tmux session, Team panes are reconciled in the current window and managed panes may close as agent lanes finish.',
-    '- Neighbor tmux panes follow individual `sks team lane ... --agent <name>` views.',
+    '- Inside an SKS-owned tmux session, Team panes are reconciled in the current window with the Codex pane on the left and Team lanes stacked on the right.',
+    '- Neighbor tmux panes follow individual `sks team lane ... --agent <name>` chat-style views.',
     '- Use `sks team event ...` to mirror scout, debate, executor, review, and verification status into the live panes.',
     '- Use `sks team message ... --from <agent> --to <agent|all>` for bounded inter-agent communication in transcript/lane views.',
-    '- Use `sks team cleanup-tmux ...` at session end; follow loops show cleanup and exit while tmux panes remain user-controlled.',
+    '- Use `sks team cleanup-tmux ...` at session end; follow loops show cleanup and managed Team panes close when reachable.',
     '',
     '## Cockpit Views',
     '- Mission / Goal | Agents | MultiAgentV2 | Work Orders | Skills | Memory Health | Forget Queue',
@@ -697,6 +697,29 @@ function formatTranscriptEvent(event = {}) {
   return `- ${parts.join(' ')}: ${String(event.message || '').slice(0, 500)}${suffix}`;
 }
 
+function uniqueTranscriptEvents(events = []) {
+  const seen = new Set();
+  const out = [];
+  for (const event of events) {
+    const key = event?.raw || [event?.ts, event?.agent, event?.to, event?.type, event?.message].map((value) => String(value || '')).join('\t');
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(event);
+  }
+  return out;
+}
+
+function formatChatTranscriptEvent(event = {}, laneAgent = '') {
+  if (event.raw) return `- system: ${event.raw}`;
+  const from = event.agent || 'unknown';
+  const to = event.to ? ` -> ${event.to}` : '';
+  const kind = event.type && event.type !== 'message' ? ` [${event.type}]` : '';
+  const ts = event.ts ? `${event.ts} ` : '';
+  const artifact = event.artifact ? ` (${event.artifact})` : '';
+  const marker = String(from) === String(laneAgent) ? 'me' : from;
+  return `- ${ts}${marker}${to}${kind}: ${String(event.message || '').slice(0, 500)}${artifact}`;
+}
+
 function eventAddressedTo(event = {}, agent = '') {
   if (!event?.to) return false;
   const target = String(event.to || '').trim().toLowerCase();

package/src/core/tmux-ui.mjs

@@ -121,6 +121,7 @@ const TERMINAL_TEAM_AGENT_STATUSES = new Set([
 
 const LEGACY_TEAM_PANE_TITLE_RE = /^(?:overview: mission_overview|scout: analysis_scout|plan: (?:debate|consensus|planner|user)|exec: (?:executor|implementation|worker)|review: (?:reviewer|qa|validation)|safety:)/;
 const GENERIC_TEAM_AGENT_IDS = new Set(['parent_orchestrator', 'analysis_scout', 'team_consensus', 'implementation_worker', 'db_safety_reviewer', 'qa_reviewer']);
+const DYNAMIC_TEAM_TMUX_LAYOUT = 'main-vertical';
 
 export function isTmuxShellSession(env = process.env) {
   return Boolean(String(env.TMUX || '').trim());
@@ -582,14 +583,20 @@ export async function createTmuxSession(plan = {}, panes = [], opts = {}) {
   }
   const first = normalizedPanes[0] || { cwd: root, command: 'pwd' };
   const dimensions = currentTerminalDimensions(opts);
-  const layout = tmuxLayoutName(opts.layout || 'tiled');
+  const rightSidePanes = Boolean(opts.rightSidePanes || opts.rightSideOnly);
+  const layout = tmuxLayoutName(opts.layout || (rightSidePanes ? DYNAMIC_TEAM_TMUX_LAYOUT : 'tiled'));
   const create = await tmuxRun(tmuxBin, ['new-session', '-d', '-x', dimensions.width, '-y', dimensions.height, '-s', session, '-c', path.resolve(first.cwd || root), '-n', 'sks', '-P', '-F', '#{pane_id}', first.command || 'pwd']);
   if (create.code !== 0) return { ok: false, session, panes: [], stderr: create.stderr || create.stdout || 'tmux new-session failed' };
   const created = [{ pane_id: paneId(create.stdout), role: first.role || 'overview', title: first.title || 'overview' }];
+  let rightStackTarget = created[0].pane_id || session;
   for (const pane of normalizedPanes.slice(1)) {
-    const split = await tmuxRun(tmuxBin, ['split-window', '-t', session, pane.vertical ? '-v' : '-h', '-d', '-P', '-F', '#{pane_id}', '-c', path.resolve(pane.cwd || root), pane.command || 'pwd']);
+    const direction = rightSidePanes ? (created.length === 1 ? '-h' : '-v') : (pane.vertical ? '-v' : '-h');
+    const splitTarget = rightSidePanes ? rightStackTarget : session;
+    const split = await tmuxRun(tmuxBin, ['split-window', '-t', splitTarget, direction, '-d', '-P', '-F', '#{pane_id}', '-c', path.resolve(pane.cwd || root), pane.command || 'pwd']);
     if (split.code !== 0) return { ok: false, session, panes: created, stderr: split.stderr || split.stdout || 'tmux split-window failed' };
-    created.push({ pane_id: paneId(split.stdout), role: pane.role || 'lane', title: pane.title || null });
+    const newPaneId = paneId(split.stdout);
+    created.push({ pane_id: newPaneId, role: pane.role || 'lane', title: pane.title || null });
+    if (rightSidePanes && newPaneId) rightStackTarget = newPaneId;
     await tmuxRun(tmuxBin, ['select-layout', '-t', session, layout]).catch(() => null);
   }
   const dynamic_resize = await enableTmuxDynamicResize(tmuxBin, session, { layout });
@@ -732,6 +739,10 @@ export async function reconcileTmuxTeamCockpit({ root, missionId, plan = {}, pro
   const desiredAgents = new Set(lanes.map((lane) => lane.agent));
   const paneList = await listTmuxWindowPanes(tmuxBin, target.window_id);
   if (!paneList.ok) return { ok: false, skipped: false, session: target.session, window_id: target.window_id, reason: paneList.stderr };
+  const cockpitState = await readJson(tmuxCockpitStatePath(resolvedRoot), {}).catch(() => ({}));
+  const previousCockpit = cockpitState?.missions?.[id] || {};
+  const currentPane = paneList.panes.find((pane) => pane.pane_id === target.pane_id);
+  const mainPaneId = previousCockpit.main_pane_id || (currentPane?.managed && currentPane?.mission_id === id ? null : target.pane_id);
   const managed = paneList.panes.filter((pane) => pane.managed && pane.mission_id === id);
   const byAgent = new Map();
   for (const pane of managed) {
@@ -747,14 +758,19 @@ export async function reconcileTmuxTeamCockpit({ root, missionId, plan = {}, pro
       else failed.push({ action: 'kill-pane', pane_id: pane.pane_id, agent: pane.agent, stderr: kill.stderr || kill.stdout || 'tmux kill-pane failed' });
     }
   }
+  const remainingManaged = managed.filter((pane) => desiredAgents.has(pane.agent) && !closed.some((entry) => entry.pane_id === pane.pane_id));
+  let rightStackTarget = remainingManaged.at(-1)?.pane_id || mainPaneId || target.window_id;
   for (const lane of lanes) {
     if (byAgent.has(lane.agent)) continue;
-    const split = await tmuxRun(tmuxBin, ['split-window', '-t', target.window_id, '-d', '-P', '-F', '#{pane_id}', '-c', resolvedRoot, lane.command || 'pwd'], { timeoutMs: 5000, maxOutputBytes: 4096 });
+    const firstRightPane = remainingManaged.length === 0 && opened.length === 0;
+    const direction = firstRightPane ? '-h' : '-v';
+    const split = await tmuxRun(tmuxBin, ['split-window', direction, '-t', rightStackTarget, '-d', '-P', '-F', '#{pane_id}', '-c', resolvedRoot, lane.command || 'pwd'], { timeoutMs: 5000, maxOutputBytes: 4096 });
     const pane_id = paneId(split.stdout);
     if (split.code !== 0 || !pane_id) {
       failed.push({ action: 'split-window', agent: lane.agent, role: lane.role, stderr: split.stderr || split.stdout || 'tmux split-window failed' });
       continue;
     }
+    rightStackTarget = pane_id;
     const optionResult = await setTmuxPaneUserOptions(tmuxBin, pane_id, {
       '@sks_team_managed': '1',
       '@sks_mission_id': id,
@@ -766,9 +782,10 @@ export async function reconcileTmuxTeamCockpit({ root, missionId, plan = {}, pro
   }
   let relayout = null;
   if (opened.length || closed.length) {
-    const tiled = await tmuxRun(tmuxBin, ['select-layout', '-t', target.window_id, 'tiled'], { timeoutMs: 5000 });
+    const selectedMain = mainPaneId ? await tmuxRun(tmuxBin, ['select-pane', '-t', mainPaneId], { timeoutMs: 5000 }) : { code: 0 };
+    const tiled = await tmuxRun(tmuxBin, ['select-layout', '-t', target.window_id, DYNAMIC_TEAM_TMUX_LAYOUT], { timeoutMs: 5000 });
     const even = await tmuxRun(tmuxBin, ['select-layout', '-t', target.window_id, '-E'], { timeoutMs: 5000 });
-    relayout = { ok: tiled.code === 0 && even.code === 0, tiled: tiled.code, even: even.code };
+    relayout = { ok: selectedMain.code === 0 && tiled.code === 0 && even.code === 0, selected_main: selectedMain.code, layout: tiled.code, even: even.code, layout_name: DYNAMIC_TEAM_TMUX_LAYOUT };
   }
   const nextPanes = [
     ...managed.filter((pane) => desiredAgents.has(pane.agent) && !closed.some((entry) => entry.pane_id === pane.pane_id)),
@@ -778,8 +795,10 @@ export async function reconcileTmuxTeamCockpit({ root, missionId, plan = {}, pro
     mission_id: id,
     session: target.session,
     window_id: target.window_id,
-    main_pane_id: target.pane_id,
+    main_pane_id: mainPaneId || target.pane_id,
     mode: 'current_session_dynamic_panes',
+    layout: DYNAMIC_TEAM_TMUX_LAYOUT,
+    right_side_only: true,
     desired_lane_count: lanes.length,
     panes: nextPanes,
     opened,
@@ -791,7 +810,7 @@ export async function reconcileTmuxTeamCockpit({ root, missionId, plan = {}, pro
     mode: 'current_session_dynamic_panes',
     session: target.session,
     window_id: target.window_id,
-    main_pane_id: target.pane_id,
+    main_pane_id: mainPaneId || target.pane_id,
     desired_lane_count: lanes.length,
     opened_lane_count: opened.length,
     closed_lane_count: closed.length,
@@ -825,7 +844,8 @@ export async function launchTmuxTeamView({ root, missionId, plan = {}, promptFil
   const splitUi = {
     mode: 'single_window_split_panes',
     window: 'sks',
-    layout: 'tiled',
+    layout: DYNAMIC_TEAM_TMUX_LAYOUT,
+    right_side_only: true,
     dynamic_resize: true,
     window_size: 'latest',
     resize_hooks: ['client-attached', 'client-resized'],
@@ -866,6 +886,8 @@ export async function launchTmuxTeamView({ root, missionId, plan = {}, promptFil
         mode: cockpit.mode,
         current_session: true,
         window_id: cockpit.window_id,
+        main_pane_id: cockpit.main_pane_id,
+        layout: cockpit.relayout?.layout_name || DYNAMIC_TEAM_TMUX_LAYOUT,
         user_attach_command: cockpit.attach_command
       };
       await writeTmuxTeamRecord(launch.root, {
@@ -902,7 +924,7 @@ export async function launchTmuxTeamView({ root, missionId, plan = {}, promptFil
     }
   }
   const panes = lanes.map((lane, index) => ({ cwd: launch.root, command: lane.command, focused: index === 0, role: lane.role, title: lane.title, vertical: index > 1 }));
-  const created = await createTmuxSession(launch, panes, { layout: 'tiled', recreate: true });
+  const created = await createTmuxSession(launch, panes, { layout: DYNAMIC_TEAM_TMUX_LAYOUT, recreate: true, rightSidePanes: true });
   result.created = Boolean(created.ok);
   result.opened = created;
   result.session = created.session || launch.session;
@@ -1077,7 +1099,7 @@ async function cleanupLegacyTmuxTeamSurfaces(root, missionId, opts = {}) {
         else failed.push({ pane_id: pane.pane_id, title: pane.title, stderr: kill.stderr || kill.stdout || 'tmux kill-pane failed' });
       }
       if (closed.length) {
-        await tmuxRun(tmuxBin, ['select-layout', '-t', current.window_id, 'tiled'], { timeoutMs: 5000 }).catch(() => null);
+        await tmuxRun(tmuxBin, ['select-layout', '-t', current.window_id, DYNAMIC_TEAM_TMUX_LAYOUT], { timeoutMs: 5000 }).catch(() => null);
         await tmuxRun(tmuxBin, ['select-layout', '-t', current.window_id, '-E'], { timeoutMs: 5000 }).catch(() => null);
       }
     }
@@ -1117,7 +1139,7 @@ async function cleanupRecordedTmuxTeamPanes(root, missionId, record = {}) {
     else failed.push({ pane_id: pane.pane_id, agent: pane.agent, stderr: kill.stderr || kill.stdout || 'tmux kill-pane failed' });
   }
   if (closed.length) {
-    await tmuxRun(tmuxBin, ['select-layout', '-t', target, 'tiled'], { timeoutMs: 5000 }).catch(() => null);
+    await tmuxRun(tmuxBin, ['select-layout', '-t', target, DYNAMIC_TEAM_TMUX_LAYOUT], { timeoutMs: 5000 }).catch(() => null);
     await tmuxRun(tmuxBin, ['select-layout', '-t', target, '-E'], { timeoutMs: 5000 }).catch(() => null);
   }
   return {