sneakoscope 0.7.78 → 0.8.2

package/src/cli/maintenance-commands.mjs

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import fsp from 'node:fs/promises';
-import { readJson, readText, writeJsonAtomic, writeTextAtomic, appendJsonlBounded, nowIso, exists, ensureDir, packageRoot, dirSize, formatBytes, PACKAGE_VERSION, sksRoot, readStdin } from '../core/fsx.mjs';
+import { createHash } from 'node:crypto';
+import { readJson, readText, writeJsonAtomic, writeTextAtomic, appendJsonlBounded, nowIso, exists, ensureDir, packageRoot, dirSize, formatBytes, PACKAGE_VERSION, sksRoot, readStdin, runProcess } from '../core/fsx.mjs';
 import { initProject } from '../core/init.mjs';
 import { getCodexInfo, runCodexExec } from '../core/codex-adapter.mjs';
 import { createMission, loadMission, findLatestMission, missionDir, setCurrent, stateFile } from '../core/mission.mjs';
@@ -42,7 +43,7 @@ const flag = (args, name) => args.includes(name);
 const promptOf = (args) => args.filter((x) => !String(x).startsWith('--')).join(' ').trim();
 const TEAM_SESSION_CLEANUP_ARTIFACT = 'team-session-cleanup.json';
 const REPOSITORY_URL = 'https://github.com/mandarange/Sneakoscope-Codex.git';
-const RESEARCH_DEFAULT_MAX_CYCLES = 3;
+const RESEARCH_DEFAULT_MAX_CYCLES = 12;
 const RESEARCH_DEFAULT_CYCLE_TIMEOUT_MINUTES = 120;
 const RESEARCH_MIN_CYCLE_TIMEOUT_MINUTES = 15;
 const RESEARCH_MAX_CYCLE_TIMEOUT_MINUTES = 240;
@@ -495,6 +496,7 @@ async function researchPrepare(args) {
   console.log(`Source skill: ${RESEARCH_SOURCE_SKILL_ARTIFACT}`);
   console.log('Ledgers: source-ledger.json, scout-ledger.json, debate-ledger.json, novelty-ledger.json, falsification-ledger.json');
   console.log(`Run: sks research run ${id} --max-cycles ${RESEARCH_DEFAULT_MAX_CYCLES} --cycle-timeout-minutes ${RESEARCH_DEFAULT_CYCLE_TIMEOUT_MINUTES}`);
+  console.log('Loop: Research runs until the gate records unanimous scout consensus, or pauses at the explicit safety cap.');
 }
 
 async function researchRun(args) {
@@ -546,13 +548,36 @@ async function researchRun(args) {
     return;
   }
   let last = '';
+  const researchCodexArgs = ['-c', 'service_tier="fast"', '-c', 'model_reasoning_effort="xhigh"'];
+  const sourceMutationBaseline = await researchCodeMutationSnapshot(root, id);
   for (let cycle = 1; cycle <= maxCycles; cycle++) {
     const cycleDir = path.join(dir, 'research', `cycle-${cycle}`);
     const outputFile = path.join(cycleDir, 'final.md');
-    await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'research.cycle.start', cycle, timeoutMinutes: cycleTimeoutMinutes });
+    await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'research.cycle.start', cycle, timeoutMinutes: cycleTimeoutMinutes, profile: 'sks-research', enforced_reasoning_effort: 'xhigh' });
     const prompt = buildResearchPrompt({ id, mission, plan, cycle, previous: last });
-    const result = await runCodexExec({ root, prompt, outputFile, json: true, profile: 'sks-research', logDir: cycleDir, timeoutMs: cycleTimeoutMs });
+    const result = await runCodexExec({ root, prompt, outputFile, json: true, profile: 'sks-research', extraArgs: researchCodexArgs, logDir: cycleDir, timeoutMs: cycleTimeoutMs });
     await writeJsonAtomic(path.join(cycleDir, 'process.json'), { code: result.code, stdout_tail: result.stdout, stderr_tail: result.stderr, stdout_bytes: result.stdoutBytes, stderr_bytes: result.stderrBytes, truncated: result.truncated, timed_out: result.timedOut });
+    const mutation = await researchCodeMutationDelta(root, sourceMutationBaseline, id);
+    if (mutation.blocked) {
+      const blocker = {
+        schema_version: 1,
+        mission_id: id,
+        ts: nowIso(),
+        phase: 'RESEARCH_BLOCKED_CODE_MUTATION',
+        reason: 'Research mode must not modify repository source files. Only route-local mission artifacts are allowed.',
+        changed_paths: mutation.changed_paths,
+        allowed_prefixes: mutation.allowed_prefixes,
+        required_action: 'Review the changed paths, keep or revert them manually as appropriate, then rerun Research after the worktree is clean for source files.',
+        implementation_allowed: false
+      };
+      await writeJsonAtomic(path.join(dir, 'research-code-mutation-blocker.json'), blocker);
+      await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: blocker.ts, type: 'research.blocked.code_mutation', changed_paths: mutation.changed_paths });
+      await setCurrent(root, { mission_id: id, mode: 'RESEARCH', phase: 'RESEARCH_BLOCKED_CODE_MUTATION', questions_allowed: true, implementation_allowed: false, blocker: 'research-code-mutation-blocker.json' });
+      console.error('Research cannot continue: source-code mutation detected outside the route-local mission artifacts.');
+      console.error(JSON.stringify(mutation.changed_paths, null, 2));
+      process.exitCode = 2;
+      return;
+    }
     last = await safeReadText(outputFile, result.stdout || result.stderr || '');
     if (containsUserQuestion(last)) {
       await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'research.guard.question_blocked', cycle });
@@ -570,7 +595,7 @@ async function researchRun(args) {
     await appendJsonlBounded(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'research.cycle.continue', cycle, reasons: gate.reasons });
   }
   await setCurrent(root, { mission_id: id, mode: 'RESEARCH', phase: 'RESEARCH_PAUSED_MAX_CYCLES', questions_allowed: true, implementation_allowed: false });
-  console.log(`Research paused after max cycles: ${id}`);
+  console.log(`Research paused after max cycles without unanimous scout consensus: ${id}`);
 }
 
 async function researchStatus(args) {
@@ -606,6 +631,8 @@ async function researchStatus(args) {
     eureka_moments: scoutRows.length ? scoutRows.filter((scout) => scout.eureka?.exclamation === 'Eureka!' && String(scout.eureka?.idea || '').trim()).length : null,
     scout_findings: scoutRows.length ? scoutRows.reduce((sum, scout) => sum + (Array.isArray(scout.findings) ? scout.findings.length : 0), 0) : null,
     debate_exchanges: debateLedger?.exchanges?.length ?? null,
+    consensus_iterations: gate?.metrics?.consensus_iterations ?? gate?.consensus_iterations ?? debateLedger?.consensus_iterations ?? null,
+    unanimous_consensus: gate?.metrics?.unanimous_consensus ?? gate?.unanimous_consensus ?? debateLedger?.unanimous_consensus ?? false,
     research_source_skill_present: Boolean(sourceSkillText.trim()),
     genius_opinion_summary_present: Boolean(geniusSummaryText.trim()),
     paper_present: Boolean(paperText.trim()),
@@ -662,6 +689,71 @@ async function safeReadText(file, fallback = '') {
   try { return await fsp.readFile(file, 'utf8'); } catch { return fallback; }
 }
 
+async function researchCodeMutationSnapshot(root, missionId = null) {
+  const tracked = await runProcess('git', ['ls-files'], { cwd: root, timeoutMs: 15000, maxOutputBytes: 2 * 1024 * 1024 }).catch((err) => ({ code: 1, stderr: err.message, stdout: '' }));
+  const status = await runProcess('git', ['status', '--porcelain=v1', '--untracked-files=all'], { cwd: root, timeoutMs: 15000, maxOutputBytes: 2 * 1024 * 1024 }).catch((err) => ({ code: 1, stderr: err.message, stdout: '' }));
+  if (tracked.code !== 0 || status.code !== 0) return { ok: false, reason: 'git_unavailable', hashes: {}, status_rows: [], error: tracked.stderr || status.stderr };
+  const allowedPrefixes = researchAllowedMutationPrefixes(missionId);
+  const hashes = {};
+  for (const rel of tracked.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean)) {
+    if (researchMutationAllowedPath(rel, allowedPrefixes)) continue;
+    const file = path.join(root, rel);
+    try {
+      const bytes = await fsp.readFile(file);
+      hashes[rel] = createHash('sha256').update(bytes).digest('hex');
+    } catch {
+      hashes[rel] = null;
+    }
+  }
+  return {
+    ok: true,
+    hashes,
+    status_rows: status.stdout.split(/\r?\n/).filter(Boolean),
+    allowed_prefixes: allowedPrefixes
+  };
+}
+
+async function researchCodeMutationDelta(root, baseline, missionId) {
+  if (!baseline?.ok) return { blocked: false, changed_paths: [], reason: baseline?.reason || 'baseline_unavailable' };
+  const current = await researchCodeMutationSnapshot(root, missionId);
+  if (!current.ok) return { blocked: false, changed_paths: [], reason: current.reason || 'current_snapshot_unavailable' };
+  const changed = new Set();
+  for (const [rel, hash] of Object.entries(current.hashes)) {
+    if (baseline.hashes[rel] !== hash) changed.add(rel);
+  }
+  for (const rel of Object.keys(baseline.hashes)) {
+    if (!(rel in current.hashes)) changed.add(rel);
+  }
+  const baselineRows = new Set(baseline.status_rows || []);
+  for (const row of current.status_rows || []) {
+    if (baselineRows.has(row)) continue;
+    const rel = porcelainStatusPath(row);
+    if (rel && !researchMutationAllowedPath(rel, current.allowed_prefixes)) changed.add(rel);
+  }
+  const changedPaths = [...changed].sort();
+  return {
+    blocked: changedPaths.length > 0,
+    changed_paths: changedPaths,
+    allowed_prefixes: current.allowed_prefixes
+  };
+}
+
+function researchAllowedMutationPrefixes(missionId = null) {
+  return missionId ? [`.sneakoscope/missions/${missionId}/`] : ['.sneakoscope/missions/'];
+}
+
+function researchMutationAllowedPath(rel = '', prefixes = []) {
+  const normalized = String(rel || '').replace(/\\/g, '/').replace(/^\.\//, '');
+  return prefixes.some((prefix) => normalized.startsWith(prefix));
+}
+
+function porcelainStatusPath(row = '') {
+  const payload = String(row || '').slice(3).trim();
+  if (!payload) return '';
+  const renamed = payload.split(' -> ').pop();
+  return String(renamed || '').replace(/^"|"$/g, '');
+}
+
 function readBoundedIntegerFlag(args, name, fallback, min, max) {
   const i = args.indexOf(name);
   const raw = i >= 0 && args[i + 1] ? Number(args[i + 1]) : Number(fallback);
@@ -1909,7 +2001,7 @@ export function buildTeamPlan(id, prompt, opts = {}) {
     reasoning: teamReasoningPolicy(prompt, roster),
     codex_config_required: {
       service_tier: 'fast',
-      features: { multi_agent: true, hooks: true, fast_mode: true, fast_mode_ui: true, codex_git_commit: true, computer_use: true, apps: true, plugins: true },
+      features: { multi_agent: true, hooks: true, remote_control: true, fast_mode: true, fast_mode_ui: true, codex_git_commit: true, computer_use: true, browser_use: true, browser_use_external: true, image_generation: true, in_app_browser: true, guardian_approval: true, tool_suggest: true, apps: true, plugins: true },
       agents: { max_threads: 6, max_depth: 1 },
       custom_agents_dir: '.codex/agents'
     },

package/src/cli/recallpulse-command.mjs

@@ -0,0 +1,157 @@
+import path from 'node:path';
+import { readJson, sksRoot } from '../core/fsx.mjs';
+import { findLatestMission, missionDir, stateFile } from '../core/mission.mjs';
+import {
+  EVIDENCE_ENVELOPE_ARTIFACT,
+  MISSION_STATUS_LEDGER_ARTIFACT,
+  RECALLPULSE_DECISION_ARTIFACT,
+  RECALLPULSE_EVAL_ARTIFACT,
+  RECALLPULSE_GOVERNANCE_ARTIFACT,
+  RECALLPULSE_POLICY,
+  RECALLPULSE_TASK_GOAL_LEDGER_ARTIFACT,
+  RECALLPULSE_TASKS_FILE,
+  ROUTE_PROOF_CAPSULE_ARTIFACT,
+  buildRecallPulseGovernanceReport,
+  buildRecallPulseTaskGoalLedger,
+  completeRecallPulseTaskGoal,
+  evaluateRecallPulseFixtures,
+  readMissionStatusLedger,
+  writeRecallPulseArtifacts
+} from '../core/recallpulse.mjs';
+
+function flag(args, name) {
+  return args.includes(name);
+}
+
+export async function recallPulseCommand(sub = 'status', args = []) {
+  const root = await sksRoot();
+  const action = sub || 'status';
+  if (action === 'help' || action === '--help' || action === '-h') return help();
+  const missionArg = args.find((arg) => !String(arg).startsWith('--')) || 'latest';
+  const id = await resolveMissionId(root, missionArg);
+  if (!id) throw new Error('Usage: sks recallpulse run|status|eval|governance|checklist <mission-id|latest> [--json]');
+  const state = await readJson(stateFile(root), {});
+  if (action === 'run') {
+    const result = await writeRecallPulseArtifacts(root, { missionId: id, state, stageId: readOption(args, '--stage', null) });
+    if (flag(args, '--json')) return console.log(JSON.stringify(result, null, 2));
+    console.log('SKS RecallPulse report-only run\n');
+    printSummary(root, id, result.decision);
+    return;
+  }
+  if (action === 'status') {
+    const status = await recallPulseStatus(root, id);
+    if (flag(args, '--json')) return console.log(JSON.stringify(status, null, 2));
+    console.log('SKS RecallPulse status\n');
+    printSummary(root, id, status.decision);
+    console.log(`Status ledger: ${path.relative(root, path.join(missionDir(root, id), MISSION_STATUS_LEDGER_ARTIFACT))}${status.status_ledger ? '' : ' (missing)'}`);
+    console.log(`Proof capsule:  ${path.relative(root, path.join(missionDir(root, id), ROUTE_PROOF_CAPSULE_ARTIFACT))}${status.route_proof_capsule ? '' : ' (missing)'}`);
+    console.log(`Evidence:       ${path.relative(root, path.join(missionDir(root, id), EVIDENCE_ENVELOPE_ARTIFACT))}${status.evidence_envelope ? '' : ' (missing)'}`);
+    return;
+  }
+  if (action === 'eval') {
+    const report = await evaluateRecallPulseFixtures(root, { missionId: id, write: true });
+    if (flag(args, '--json')) return console.log(JSON.stringify(report, null, 2));
+    console.log('SKS RecallPulse fixture eval\n');
+    console.log(`Mission: ${id}`);
+    console.log(`Passed:  ${report.passed ? 'yes' : 'no'}`);
+    console.log(`File:    ${path.relative(root, path.join(missionDir(root, id), RECALLPULSE_EVAL_ARTIFACT))}`);
+    console.log(`Caveat:  ${report.caveat}`);
+    return;
+  }
+  if (action === 'governance') {
+    const report = await buildRecallPulseGovernanceReport(root, { missionId: id, writeDecisions: !flag(args, '--no-samples') });
+    if (flag(args, '--json')) return console.log(JSON.stringify(report, null, 2));
+    console.log('SKS RecallPulse governance report\n');
+    console.log(`Mission: ${id}`);
+    console.log(`Routes inventoried: ${report.route_gate_inventory.length}`);
+    console.log(`Recorded samples:   ${report.rollout.requested_samples.filter((sample) => sample.report_only_decision_recorded).length}/${report.rollout.requested_samples.length}`);
+    console.log(`Enforcement:        ${report.shadow_eval.enforcement_decision}`);
+    console.log(`File:               ${path.relative(root, path.join(missionDir(root, id), RECALLPULSE_GOVERNANCE_ARTIFACT))}`);
+    return;
+  }
+  if (action === 'checklist') {
+    const taskId = readOption(args, '--task', null) || readOption(args, '--id', null);
+    const apply = flag(args, '--apply');
+    if (taskId && apply) {
+      const result = await completeRecallPulseTaskGoal(root, id, taskId, {
+        allowOutOfOrder: flag(args, '--allow-out-of-order'),
+        evidence: readListOption(args, '--evidence'),
+        verification: readListOption(args, '--verification'),
+        notes: readOption(args, '--notes', '')
+      });
+      if (flag(args, '--json')) return console.log(JSON.stringify({ ok: true, applied: true, ...result }, null, 2));
+      console.log(`Checked ${result.task.task_id} as a child $Goal checkpoint.`);
+      console.log(`Ledger: ${path.relative(root, path.join(missionDir(root, id), RECALLPULSE_TASK_GOAL_LEDGER_ARTIFACT))}`);
+      return;
+    }
+    const ledger = await buildRecallPulseTaskGoalLedger(root, id);
+    const result = { ok: true, applied: false, file: path.join(root, RECALLPULSE_TASKS_FILE), ledger_file: path.join(root, '.sneakoscope', 'missions', id, RECALLPULSE_TASK_GOAL_LEDGER_ARTIFACT), next_task: ledger.next_task, counts: ledger.counts };
+    if (flag(args, '--json')) return console.log(JSON.stringify(result, null, 2));
+    console.log(`RecallPulse sequential task-goal ledger: ${ledger.counts.checked}/${ledger.counts.total} checked.`);
+    console.log(`Next: ${ledger.next_task?.id || 'none'} ${ledger.next_task?.title || ''}`.trim());
+    console.log(`Run only after evidence: sks recallpulse checklist ${id} --task ${ledger.next_task?.id || 'T001'} --apply --evidence <path>`);
+    return;
+  }
+  throw new Error(`Unknown recallpulse command: ${action}`);
+}
+
+async function recallPulseStatus(root, id) {
+  const dir = missionDir(root, id);
+  return {
+    mission_id: id,
+    policy: RECALLPULSE_POLICY,
+    decision: await readJson(path.join(dir, RECALLPULSE_DECISION_ARTIFACT), null),
+    status_ledger: await readMissionStatusLedger(root, id),
+    route_proof_capsule: await readJson(path.join(dir, ROUTE_PROOF_CAPSULE_ARTIFACT), null),
+    evidence_envelope: await readJson(path.join(dir, EVIDENCE_ENVELOPE_ARTIFACT), null),
+    eval_report: await readJson(path.join(dir, RECALLPULSE_EVAL_ARTIFACT), null)
+  };
+}
+
+function printSummary(root, id, decision) {
+  console.log(`Mission: ${id}`);
+  if (!decision) {
+    console.log(`Decision: missing (${path.relative(root, path.join(missionDir(root, id), RECALLPULSE_DECISION_ARTIFACT))})`);
+    console.log(`Run:      sks recallpulse run ${id}`);
+    return;
+  }
+  console.log(`Decision: ${decision.recommended_action}`);
+  console.log(`Stage:    ${decision.stage_id}`);
+  console.log(`L1:       ${(decision.l1?.selected || []).map((item) => item.id).join(', ') || 'none'}`);
+  console.log(`L3:       ${(decision.l3?.hydration_requests || []).length} hydration request(s)`);
+  console.log(`Status:   ${decision.user_visible_status_projection?.message || 'report-only decision written'}`);
+}
+
+async function resolveMissionId(root, value = 'latest') {
+  if (!value || value === 'latest') return findLatestMission(root);
+  return value;
+}
+
+function readOption(args = [], name, fallback = null) {
+  const index = args.indexOf(name);
+  if (index < 0 || index + 1 >= args.length) return fallback;
+  return args[index + 1];
+}
+
+function readListOption(args = [], name) {
+  const values = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === name && args[i + 1]) values.push(args[i + 1]);
+  }
+  return values;
+}
+
+function help() {
+  console.log(`SKS RecallPulse
+
+Report-only active recall, durable status, RouteProofCapsule, and EvidenceEnvelope utilities.
+
+Commands:
+  sks recallpulse run <mission-id|latest> [--json] [--stage before_final]
+  sks recallpulse status <mission-id|latest> [--json]
+  sks recallpulse eval <mission-id|latest> [--json]
+  sks recallpulse governance <mission-id|latest> [--json] [--no-samples]
+  sks recallpulse checklist <mission-id|latest> [--json]
+  sks recallpulse checklist <mission-id|latest> --task T001 --apply --evidence <path>
+`);
+}

package/src/core/codex-app.mjs

@@ -7,7 +7,30 @@ import { getCodexInfo } from './codex-adapter.mjs';
 export const CODEX_APP_DOCS_URL = 'https://developers.openai.com/codex/app/features';
 export const CODEX_CHANGELOG_URL = 'https://developers.openai.com/codex/changelog';
 export const CODEX_REMOTE_CONTROL_MIN_VERSION = '0.130.0';
-const REQUIRED_CODEX_APP_FEATURE_FLAGS = ['codex_git_commit', 'hooks', 'fast_mode', 'computer_use', 'apps', 'plugins'];
+const REQUIRED_CODEX_APP_FEATURE_FLAGS = [
+  'codex_git_commit',
+  'hooks',
+  'remote_control',
+  'fast_mode',
+  'computer_use',
+  'browser_use',
+  'browser_use_external',
+  'image_generation',
+  'in_app_browser',
+  'guardian_approval',
+  'tool_suggest',
+  'apps',
+  'plugins'
+];
+const DEFAULT_CODEX_APP_PLUGINS = [
+  { name: 'browser', marketplace: 'openai-bundled' },
+  { name: 'chrome', marketplace: 'openai-bundled' },
+  { name: 'computer-use', marketplace: 'openai-bundled' },
+  { name: 'latex', marketplace: 'openai-bundled' },
+  { name: 'documents', marketplace: 'openai-primary-runtime' },
+  { name: 'presentations', marketplace: 'openai-primary-runtime' },
+  { name: 'spreadsheets', marketplace: 'openai-primary-runtime' }
+];
 
 export function codexAppCandidatePaths(home = os.homedir(), env = process.env) {
   const candidates = [];
@@ -104,15 +127,20 @@ export async function codexAppIntegrationStatus(opts = {}) {
   const featureText = `${featureList.stdout}\n${featureList.stderr}`;
   const browserUsePath = await findPluginCache('browser-use', opts);
   const computerUsePath = await findPluginCache('computer-use', opts);
+  const defaultPlugins = await codexDefaultPluginStatus(opts);
+  const fastModeConfig = await codexFastModeConfigStatus(opts);
   const computerUseMcpListed = /computer[-_ ]?use/i.test(mcpText);
   const browserUseMcpListed = /browser[-_ ]?use/i.test(mcpText);
   const imageGenerationReady = codexFeatureEnabled(featureText, 'image_generation');
+  const inAppBrowserReady = codexFeatureEnabled(featureText, 'in_app_browser');
+  const browserUseFeatureReady = codexFeatureEnabled(featureText, 'browser_use');
   const requiredFeatureFlags = Object.fromEntries(REQUIRED_CODEX_APP_FEATURE_FLAGS.map((name) => [name, codexFeatureEnabled(featureText, name)]));
   const requiredFeatureFlagsOk = Object.values(requiredFeatureFlags).every(Boolean);
   const computerUseReady = computerUseMcpListed || Boolean(computerUsePath);
   const browserUseReady = browserUseMcpListed || Boolean(browserUsePath);
+  const browserToolReady = inAppBrowserReady || browserUseFeatureReady || browserUseReady;
   const appInstalled = Boolean(appPath);
-  const ready = appInstalled && Boolean(codex.bin) && mcpList.ok && featureList.ok && requiredFeatureFlagsOk && imageGenerationReady && computerUseReady && browserUseReady;
+  const ready = appInstalled && Boolean(codex.bin) && mcpList.ok && featureList.ok && requiredFeatureFlagsOk && defaultPlugins.ok && fastModeConfig.ok && imageGenerationReady && computerUseReady && browserToolReady;
   return {
     ok: ready,
     app: {
@@ -142,16 +170,30 @@ export async function codexAppIntegrationStatus(opts = {}) {
       ...requiredFeatureFlags,
       required_flags: requiredFeatureFlags,
       required_flags_ok: requiredFeatureFlagsOk,
+      fast_mode_config: fastModeConfig,
       image_generation: imageGenerationReady,
       image_generation_source: imageGenerationReady ? 'codex_features_list' : 'missing',
+      in_app_browser: inAppBrowserReady,
+      browser_use: browserUseFeatureReady,
+      browser_tool_ready: browserToolReady,
+      browser_tool_source: inAppBrowserReady
+        ? 'codex_features_list:in_app_browser'
+        : browserUseFeatureReady
+          ? 'codex_features_list:browser_use'
+          : browserUseMcpListed
+            ? 'mcp_list:browser_use'
+            : browserUsePath
+              ? 'plugin_cache:browser-use'
+              : 'missing',
       stdout: featureList.stdout,
       stderr: featureList.stderr
     },
     plugins: {
       computer_use_cache: computerUsePath,
-      browser_use_cache: browserUsePath
+      browser_use_cache: browserUsePath,
+      default_plugins: defaultPlugins
     },
-    guidance: codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags, requiredFeatureFlagsOk, imageGenerationReady, computerUseReady, browserUseReady, computerUseMcpListed, browserUseMcpListed, remoteControl })
+    guidance: codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags, requiredFeatureFlagsOk, defaultPlugins, fastModeConfig, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, remoteControl })
   };
 }
 
@@ -206,7 +248,7 @@ export function formatCodexRemoteControlStatus(status) {
   return lines.filter(Boolean).join('\n');
 }
 
-export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags = {}, requiredFeatureFlagsOk = true, imageGenerationReady, computerUseReady, browserUseReady, computerUseMcpListed, browserUseMcpListed, remoteControl }) {
+export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags = {}, requiredFeatureFlagsOk = true, defaultPlugins = { ok: true, missing_enabled: [] }, fastModeConfig = { ok: true, blockers: [] }, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, remoteControl }) {
   const lines = [];
   if (!appInstalled) {
     lines.push('Install and open Codex App for first-party MCP/plugin tools. SKS tmux launch can still run with Codex CLI alone, but Codex Computer Use and imagegen/gpt-image-2 evidence will be unavailable until Codex App is ready.');
@@ -229,13 +271,21 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
   }
   if (featureList?.checked && featureList.ok && !requiredFeatureFlagsOk) {
     const missing = missingRequiredFeatureFlags(requiredFeatureFlags);
-    lines.push(`Codex App feature flag(s) disabled or missing: ${missing.join(', ')}. Commit message generation and app-only tool paths can fail even when CLI chat works.`);
-    lines.push('Verify with: codex features list | rg "codex_git_commit|hooks|fast_mode|computer_use|apps|plugins"');
+    lines.push(`Codex App feature flag(s) disabled or missing: ${missing.join(', ')}. Commit message generation, mobile/remote-control, and app-only tool paths can fail even when CLI chat works.`);
+    lines.push('Verify with: codex features list | rg "codex_git_commit|hooks|remote_control|fast_mode|computer_use|browser_use|browser_use_external|image_generation|in_app_browser|guardian_approval|tool_suggest|apps|plugins"');
   }
-  if (appInstalled && (!computerUseReady || !browserUseReady)) {
+  if (defaultPlugins?.missing_enabled?.length) {
+    lines.push(`Codex default plugin(s) installed but not enabled: ${defaultPlugins.missing_enabled.join(', ')}. Composer/tool UI can hide built-in surfaces even while feature flags look green.`);
+    lines.push('Run: sks doctor --fix');
+  }
+  if (fastModeConfig?.blockers?.length) {
+    lines.push(`Codex App speed selector can be hidden or locked by config: ${fastModeConfig.blockers.join(', ')}.`);
+    lines.push('Run: sks doctor --fix');
+  }
+  if (appInstalled && (!computerUseReady || !browserToolReady)) {
     lines.push('Open Codex App settings and enable recommended MCP/plugin tools. Codex CLI 0.130.0+ remote-control/app-server sessions can pick up config changes live; restart older CLI/TUI sessions.');
-    lines.push('Required for SKS QA-LOOP UI/browser evidence: Codex Computer Use only. Browser Use can support non-UI browser context, but it does not satisfy UI-level E2E verification.');
-    lines.push('Verify with: codex mcp list');
+    lines.push('Required for SKS QA-LOOP UI/browser evidence: Codex Computer Use only. Browser tools can support browsing context, but they do not satisfy UI-level E2E verification.');
+    lines.push('Verify with: codex features list; codex mcp list');
   }
   if (imageGenerationReady) {
     lines.push('Image generation is enabled; required raster assets and generated image-review evidence must invoke $imagegen/gpt-image-2 and record real output.');
@@ -245,6 +295,10 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
   if (computerUseReady && !computerUseMcpListed) {
     lines.push('Computer Use plugin files are installed, but this check cannot prove the current thread exposes the live Computer Use tools. Start a new Codex App thread and invoke @Computer or @AppName for the actual target app or screen; Codex App readiness itself should stay on `codex features list`, `codex mcp list`, and `sks codex-app check`.');
   }
+  if (browserToolReady) {
+    const source = inAppBrowserReady ? 'in-app browser feature' : browserUseFeatureReady ? 'browser_use feature' : 'Browser Use plugin';
+    lines.push(`Browser tooling is visible via ${source}; prefer the first-party in-app browser for local web apps, and keep Codex Computer Use as the only accepted UI verification evidence source.`);
+  }
   if (browserUseReady && !browserUseMcpListed) {
     lines.push('Browser Use plugin files are installed, but `codex mcp list` does not list a browser-use MCP server. Treat Browser Use as plugin-scoped, not as SKS UI verification evidence.');
   }
@@ -260,8 +314,10 @@ export function formatCodexAppStatus(status, { includeRaw = false } = {}) {
     `Codex CLI:   ${status.codex_cli.ok ? 'ok' : 'missing'}${status.codex_cli.version ? ` ${status.codex_cli.version}` : ''}`,
     `Remote Ctrl: ${status.remote_control?.ok ? 'ok' : 'missing'}${status.remote_control?.codex_cli?.version_number ? ` min ${status.remote_control.min_version}` : ''}`,
     `App Flags:  ${status.features?.required_flags_ok ? 'ok' : `missing ${missingRequiredFeatureFlags(status.features?.required_flags).join(', ') || 'required flags'}`}`,
+    `Fast UI:    ${status.features?.fast_mode_config?.ok ? 'ok' : `locked ${(status.features?.fast_mode_config?.blockers || []).join(', ') || 'config'}`}`,
+    `Default Plugins:${status.plugins?.default_plugins?.ok ? ' ok' : ` missing ${(status.plugins?.default_plugins?.missing_enabled || []).join(', ') || 'enabled plugin config'}`}`,
     `Computer Use:${status.mcp.has_computer_use ? status.mcp.computer_use_source === 'plugin_cache' ? ' installed (verify @Computer in thread)' : ' ok' : ' missing'}`,
-    `Browser Use: ${status.mcp.has_browser_use ? status.mcp.browser_use_source === 'plugin_cache' ? 'installed (plugin scoped)' : 'ok' : 'missing'}`,
+    `Browser:     ${status.features?.browser_tool_ready ? `ok (${status.features.browser_tool_source})` : status.mcp.has_browser_use ? status.mcp.browser_use_source === 'plugin_cache' ? 'installed (plugin scoped)' : 'ok' : 'missing'}`,
     `Image Gen:   ${status.features?.image_generation ? 'ok ($imagegen/gpt-image-2)' : status.features?.checked ? 'missing' : 'not checked'}`,
     `Ready:       ${status.ok ? 'yes' : 'no'}`,
     '',
@@ -296,6 +352,120 @@ function missingRequiredFeatureFlags(flags = {}) {
   return REQUIRED_CODEX_APP_FEATURE_FLAGS.filter((name) => flags?.[name] !== true);
 }
 
+async function codexDefaultPluginStatus(opts = {}) {
+  const home = opts.home || os.homedir();
+  const cwd = opts.cwd || process.cwd();
+  const globalConfigPath = path.join(home || '', '.codex', 'config.toml');
+  const projectConfigPath = path.join(cwd || '', '.codex', 'config.toml');
+  const globalConfig = await readTextIfExists(globalConfigPath);
+  const projectConfig = path.resolve(projectConfigPath) === path.resolve(globalConfigPath)
+    ? ''
+    : await readTextIfExists(projectConfigPath);
+  const configText = `${globalConfig}\n${projectConfig}`;
+  const entries = [];
+  for (const plugin of DEFAULT_CODEX_APP_PLUGINS) {
+    const source = await findDefaultPluginSource(plugin, { home, configText });
+    const enabled = codexPluginEnabled(configText, plugin);
+    entries.push({
+      id: `${plugin.name}@${plugin.marketplace}`,
+      name: plugin.name,
+      marketplace: plugin.marketplace,
+      installed: Boolean(source),
+      source,
+      enabled
+    });
+  }
+  const installed = entries.filter((entry) => entry.installed);
+  const missingEnabled = installed.filter((entry) => !entry.enabled).map((entry) => entry.id);
+  return {
+    ok: missingEnabled.length === 0,
+    checked: true,
+    entries,
+    missing_enabled: missingEnabled
+  };
+}
+
+async function codexFastModeConfigStatus(opts = {}) {
+  const home = opts.home || os.homedir();
+  const cwd = opts.cwd || process.cwd();
+  const globalConfigPath = path.join(home || '', '.codex', 'config.toml');
+  const projectConfigPath = path.join(cwd || '', '.codex', 'config.toml');
+  const configs = [
+    { scope: 'global', path: globalConfigPath, text: await readTextIfExists(globalConfigPath) }
+  ];
+  if (path.resolve(projectConfigPath) !== path.resolve(globalConfigPath)) {
+    configs.push({ scope: 'project', path: projectConfigPath, text: await readTextIfExists(projectConfigPath) });
+  }
+  const blockers = [];
+  for (const config of configs) {
+    if (!config.text) continue;
+    const topLevel = topLevelToml(config.text);
+    if (/(^|\n)\s*model_reasoning_effort\s*=/.test(topLevel)) blockers.push(`${config.scope}:top_level_model_reasoning_effort`);
+    if (/(^|\n)\s*fast_default_opt_out\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(tomlTable(config.text, 'notice'))) blockers.push(`${config.scope}:fast_default_opt_out`);
+  }
+  const merged = configs.map((config) => config.text).join('\n');
+  const fastMode = tomlTable(merged, 'user.fast_mode');
+  if (!/(^|\n)\s*visible\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(fastMode)) blockers.push('user.fast_mode.visible_missing');
+  if (!/(^|\n)\s*enabled\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(fastMode)) blockers.push('user.fast_mode.enabled_missing');
+  if (!/(^|\n)\s*default_profile\s*=\s*"sks-fast-high"\s*(?:#.*)?(?=\n|$)/.test(fastMode)) blockers.push('user.fast_mode.default_profile_missing');
+  return {
+    ok: blockers.length === 0,
+    checked: true,
+    blockers
+  };
+}
+
+async function readTextIfExists(file) {
+  try {
+    return await fsp.readFile(file, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+async function findDefaultPluginSource(plugin, { home, configText }) {
+  const cached = await findPluginCache(plugin.name, { home });
+  if (cached) return cached;
+  for (const source of marketplaceSources(configText, plugin.marketplace)) {
+    const candidate = path.join(source, 'plugins', plugin.name, '.codex-plugin', 'plugin.json');
+    if (await exists(candidate)) return path.dirname(path.dirname(candidate));
+  }
+  return null;
+}
+
+function marketplaceSources(configText = '', marketplaceName = '') {
+  const table = `marketplaces.${marketplaceName}`;
+  const re = new RegExp(`(?:^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`, 'g');
+  const sources = [];
+  for (const match of String(configText || '').matchAll(re)) {
+    const source = match[1].match(/(?:^|\n)\s*source\s*=\s*"([^"]+)"/)?.[1];
+    if (source) sources.push(source);
+  }
+  return Array.from(new Set(sources));
+}
+
+function codexPluginEnabled(configText = '', plugin = {}) {
+  const table = `plugins."${plugin.name}@${plugin.marketplace}"`;
+  const re = new RegExp(`(?:^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`);
+  const block = String(configText || '').match(re)?.[1] || '';
+  return /(?:^|\n)\s*enabled\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(block);
+}
+
+function topLevelToml(text = '') {
+  const lines = String(text || '').split('\n');
+  const firstTable = lines.findIndex((line) => /^\s*\[.+\]\s*$/.test(line));
+  return (firstTable === -1 ? lines : lines.slice(0, firstTable)).join('\n');
+}
+
+function tomlTable(text = '', table = '') {
+  const re = new RegExp(`(?:^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`);
+  return String(text || '').match(re)?.[1] || '';
+}
+
+function escapeRegExp(text = '') {
+  return String(text).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 function remoteControlGuidance(status = {}) {
   if (!status.codex_cli?.ok) return 'Codex remote-control requires Codex CLI 0.130.0+. Install with: npm i -g @openai/codex@latest';
   if (status.reason === 'codex_cli_version_unknown') return 'Codex remote-control requires Codex CLI 0.130.0+, but the installed CLI version could not be parsed. Check: codex --version';

package/src/core/fsx.mjs

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 
-export const PACKAGE_VERSION = '0.7.78';
+export const PACKAGE_VERSION = '0.8.2';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;