sneakoscope 10.1.1 → 10.1.3

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.1.1**. Install the latest stable release from npm.
+Current package: **SKS 10.1.3**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 
@@ -56,6 +56,13 @@ for setup boundaries and reported execution evidence.
 
 ## Everyday commands
 
+SKS enables experimental Astra context management by default during setup and
+repair. Turn it off in **SKS Center → Settings → Astra context management**, or
+use `sks codex-app context-management off`. Updates preserve an explicit opt-out.
+Start a new task after changing the setting. Availability depends on a supported
+Codex client and eligible ChatGPT sign-in; API-key and custom-provider sessions
+may not activate it. See [OpenAI's context management guidance](https://learn.chatgpt.com/docs/models#experimental-context-management).
+
 Use these inside a Codex conversation:
 
 | Command | Purpose |
@@ -169,6 +176,7 @@ freshness semantics.
 - [Essential Trust](docs/essential-trust.md) — verification profiles and safety boundaries.
 - [Astra guidance](docs/astra-guidance.md) — how SKS applies the official model recommendations.
 - [Agent Bridge](docs/AGENT-BRIDGE.md) — integrate through the CLI or MCP interface.
+- [Codex-LB priority](docs/codex-lb-priority.md) — how Codex App WebSockets follow the Center priority setting.
 - [Release readiness](docs/release-readiness.md) — build, verify, and publish a release.
 - [Release evidence](docs/release-proof-truth.md) — what each verification result proves.
 - [Changelog](CHANGELOG.md) — changes by version.

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.1.1"
+version = "10.1.3"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.1.1"
+version = "10.1.3"
 edition = "2021"
 
 [dependencies]

package/dist/cli/router.js

@@ -302,7 +302,7 @@ export function safeReadOnlySubcommand(command, args) {
     if (command === 'mcp' && sub === 'config' && ['list', 'test', 'backups', 'show'].includes(nested)) {
         return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
     }
-    if (command === 'codex-app' && sub === 'context-1m' && (nested === 'status' || nested === '' || nested.startsWith('--'))) {
+    if (command === 'codex-app' && ['context-1m', 'context-management'].includes(sub) && (nested === 'status' || nested === '' || nested.startsWith('--'))) {
         return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
     }
     if (command === 'remote' && ['readiness', 'status', 'show'].includes(sub)) {

package/dist/commands/codex-app.js

@@ -14,6 +14,17 @@ import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
 import { resetRoleModelPreference, roleModelPreferencesStatus, setRoleModelPreference } from '../core/subagents/role-model-preferences.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'check';
+    if (action === 'context-management') {
+        const { contextManagementCommand } = await import('../core/codex-app/context-management-command.js');
+        const result = await contextManagementCommand(args.slice(1));
+        if (flag(args, '--json'))
+            printJson(result);
+        else
+            console.log(`${result.ok ? (result.enabled ? 'Enabled' : 'Disabled') : 'Unavailable'}: ${result.message}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
     if (action === 'restart')
         return printCodexAppResult(args, await restartCodexApp());
     if (action === 'context-1m') {
@@ -137,7 +148,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex-app check|status|restart|context-1m [status|on|off] [--no-restart]|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|role-models|set-role-model --role <name> [--provider <id>] --model <catalog-slug> --reasoning <effort>|reset-role-model --role <name>|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
+    console.error('Usage: sks codex-app check|status|restart|context-management [status|on|off]|context-1m [status|on|off] [--no-restart]|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|role-models|set-role-model --role <name> [--provider <id>] --model <catalog-slug> --reasoning <effort>|reset-role-model --role <name>|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
     console.error('Provider routing moved to: sks bridge provider configure|validate|enable; sks bridge catalog sync; sks bridge route set-default.');
     process.exitCode = 1;
 }

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.1.1",
+  "package_version": "10.1.3",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex/context-management.js

@@ -0,0 +1,55 @@
+import { parse } from 'smol-toml';
+import { isDeepStrictEqual } from 'node:util';
+export function contextManagementValue(text) {
+    const value = parse(text).features?.context_management?.experimental_mode;
+    if (value !== undefined && typeof value !== 'boolean')
+        throw new Error('context_management_invalid_boolean');
+    return value;
+}
+export function setContextManagement(text, enabled, onlyIfAbsent = false) {
+    const before = parse(text);
+    const current = contextManagementValue(text);
+    if (current === enabled || (onlyIfAbsent && current !== undefined))
+        return text;
+    const expected = structuredClone(before);
+    expected.features ??= {};
+    expected.features.context_management ??= {};
+    expected.features.context_management.experimental_mode = enabled;
+    const valid = (candidate) => {
+        try {
+            return isDeepStrictEqual(parse(candidate), expected);
+        }
+        catch {
+            return false;
+        }
+    };
+    if (current !== undefined) {
+        for (const match of text.matchAll(/\b(?:true|false)\b/g)) {
+            const candidate = text.slice(0, match.index) + String(enabled) + text.slice(match.index + match[0].length);
+            if (valid(candidate))
+                return candidate;
+        }
+    }
+    else {
+        const suffix = `\n[features.context_management]\nexperimental_mode = ${enabled}\n`;
+        if (valid(text + suffix))
+            return text + suffix;
+        const candidates = [
+            `features.context_management.experimental_mode = ${enabled}\n${text}`,
+            ...[...text.matchAll(/\{/g)].flatMap(match => {
+                const offset = match.index + 1;
+                const separator = /^\s*\}/.test(text.slice(offset)) ? '' : ', ';
+                return [`experimental_mode = ${enabled}`, `context_management = { experimental_mode = ${enabled} }`]
+                    .map(value => text.slice(0, offset) + value + separator + text.slice(offset));
+            }),
+            ...[...text.matchAll(/^\s*\[[^\n]+\][^\n]*(?:\n|$)/gm)].flatMap(match => {
+                const offset = match.index + match[0].length;
+                return ['experimental_mode', 'context_management.experimental_mode'].map(key => text.slice(0, offset) + `\n${key} = ${enabled}\n` + text.slice(offset));
+            }),
+        ];
+        for (const candidate of candidates)
+            if (valid(candidate))
+                return candidate;
+    }
+    throw new Error('context_management_config_edit_unsupported');
+}

package/dist/core/codex-app/context-management-command.js

@@ -0,0 +1,38 @@
+import fs from 'node:fs/promises';
+import { codexUserConfigPath } from './codex-model-catalog.js';
+import { writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
+import { contextManagementValue, setContextManagement } from '../codex/context-management.js';
+export async function contextManagementCommand(args, options = {}) {
+    const configPath = codexUserConfigPath(options);
+    const action = args[0] || 'status';
+    try {
+        if (!['status', 'on', 'off'].includes(action) || args.slice(1).some(arg => arg !== '--json'))
+            throw new Error('context_management_invalid_arguments');
+        let exists = true;
+        const before = await fs.readFile(configPath, 'utf8').catch(error => { if (error.code !== 'ENOENT')
+            throw error; exists = false; return ''; });
+        let after = before;
+        let changed = false;
+        if (action !== 'status') {
+            const next = setContextManagement(before, action === 'on');
+            const write = await writeCodexConfigGuarded({
+                configPath, before, cause: 'context-management', removeTopLevelModeLocks: false,
+                verifyUnchangedBeforeWrite: true, expectedBeforeExists: exists, mutate: () => next,
+            });
+            if (!write.ok)
+                throw new Error(`context_management_write_${write.status}`);
+            after = await fs.readFile(configPath, 'utf8');
+            if (contextManagementValue(after) !== (action === 'on'))
+                throw new Error('context_management_readback_mismatch');
+            changed = write.changed;
+        }
+        const value = contextManagementValue(after);
+        return { schema: 'sks.context-management.v1', ok: true, enabled: value === true, configured: value !== undefined,
+            default_enabled: true, changed, config_path: configPath,
+            message: 'Applies to new tasks on supported Codex clients with eligible ChatGPT sign-in. API-key and custom-provider sessions may not activate it.' };
+    }
+    catch {
+        return { schema: 'sks.context-management.v1', ok: false, enabled: null, config_path: configPath,
+            message: 'Could not read or update the setting. Check the Codex configuration; existing content was not replaced without validation.' };
+    }
+}

package/dist/core/codex-lb/desktop-bridge/responses-websocket.js

@@ -0,0 +1,286 @@
+import net from 'node:net';
+import tls from 'node:tls';
+import WebSocket, { WebSocketServer } from 'ws';
+import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
+import { buildOfficialPassthroughWebSocketHeaders, buildProviderWebSocketHeaders } from './header-policy.js';
+import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
+import { assertDesktopBridgeRouteContext, ensureDesktopBridgeRemoteTarget, isUnreachableUpstreamError, refreshDesktopBridgeRemoteTarget, resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode } from './security.js';
+import { DesktopBridgeError } from './types.js';
+const MAX_PENDING_MESSAGES = 256;
+const CLOSE_GRACE_MS = 1_000;
+const INITIAL_CREATE_TIMEOUT_MS = 60 * 60_000;
+const logRejection = createDesktopBridgeRejectionLogger();
+export function isResponsesWebSocketRequest(req) {
+    const pathname = new URL(req.url || '/', 'http://bridge.invalid').pathname;
+    return ['/backend-api/codex/responses', '/api/v1/responses', '/v1/responses'].includes(pathname);
+}
+function bytes(data) {
+    return Buffer.isBuffer(data) ? data : Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data);
+}
+export function forwardResponsesWebSocket(req, socket, head, config) {
+    const upgradeIdentity = resolveCodexSessionIdentity(req.headers);
+    const maxBytes = config.maxRequestBodyBytes ?? 16 * 1024 * 1024;
+    const server = new WebSocketServer({ noServer: true, clientTracking: false, perMessageDeflate: false, maxPayload: maxBytes });
+    try {
+        server.handleUpgrade(req, socket, head, (client) => {
+            bridge(client);
+        });
+    }
+    finally {
+        server.close();
+    }
+    function bridge(client) {
+        let identity = upgradeIdentity;
+        let upstream = null;
+        let upstreamSocket = null;
+        let bound = null;
+        let boundBaseUrl = null;
+        let boundCredentialGeneration = null;
+        let boundCredentialFingerprint = null;
+        let stopped = false;
+        let processing = false;
+        let pendingBytes = 0;
+        const pending = [];
+        let closeTimer = null;
+        let handshakeTimer = null;
+        const initialTimer = setTimeout(closeUnbound, config.websocketInitialCreateTimeoutMs ?? INITIAL_CREATE_TIMEOUT_MS);
+        initialTimer.unref();
+        const localSocket = socket;
+        localSocket.setKeepAlive?.(true, 30_000);
+        function stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            clearTimeout(initialTimer);
+            if (handshakeTimer)
+                clearTimeout(handshakeTimer);
+            pending.length = 0;
+            pendingBytes = 0;
+            closeTimer = setTimeout(() => { client.terminate(); upstream?.terminate(); upstreamSocket?.destroy(); }, CLOSE_GRACE_MS);
+            closeTimer.unref();
+        }
+        function fail(error) {
+            if (stopped)
+                return;
+            const code = safeBridgeErrorCode(error);
+            logRejection({ code, transport: 'websocket', ...(req.method ? { method: req.method } : {}), ...(req.url ? { url: req.url } : {}) });
+            stop();
+            if (client.readyState === WebSocket.OPEN) {
+                if (client.bufferedAmount < maxBytes)
+                    client.send(JSON.stringify({ type: 'error', error: { type: 'sks_bridge_error', code, message: code } }), () => undefined);
+                client.close(1011, code.slice(0, 123));
+            }
+            upstream?.terminate();
+            upstreamSocket?.destroy();
+        }
+        function closeUnbound() {
+            if (stopped || bound)
+                return;
+            logRejection({ code: 'bridge_websocket_initial_create_timeout', transport: 'websocket', ...(req.method ? { method: req.method } : {}), ...(req.url ? { url: req.url } : {}) });
+            stop();
+            if (client.readyState === WebSocket.OPEN)
+                client.close(1000, 'bridge_websocket_initial_create_timeout');
+        }
+        function relay(destination, data, binary) {
+            if (destination.readyState !== WebSocket.OPEN)
+                throw new DesktopBridgeError('bridge_websocket_upstream_unavailable');
+            if (destination.bufferedAmount + data.length > maxBytes)
+                throw new DesktopBridgeError('bridge_websocket_backpressure_exceeded');
+            destination.send(data, { binary }, (error) => { if (error)
+                fail(error); });
+        }
+        function routeRequest(model) {
+            return { public_model: model, session_id: identity.thread_id, pathname: new URL(req.url || '/', 'http://bridge.invalid').pathname, transport: 'websocket', headers: req.headers };
+        }
+        function assertBinding(route) {
+            if (!bound)
+                return;
+            const official = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID;
+            const provider = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID ? null : config.providers[route.provider_id];
+            const baseUrl = official ? config.officialRemote?.baseUrl : provider?.base_url;
+            if (route.provider_id !== bound.provider_id || baseUrl !== boundBaseUrl
+                || (provider && (provider.credential_generation !== boundCredentialGeneration || provider.credential_fingerprint !== boundCredentialFingerprint))) {
+                throw new DesktopBridgeError('bridge_websocket_route_change_forbidden');
+            }
+        }
+        async function resolveCreate(message) {
+            const model = message.create?.model;
+            if (typeof model !== 'string' || !model.trim())
+                throw new DesktopBridgeError('bridge_websocket_model_required');
+            const nextIdentity = resolveCodexSessionIdentity(req.headers, message.create);
+            if (bound && ((nextIdentity.thread_id && nextIdentity.thread_id !== identity.thread_id)
+                || (nextIdentity.session_id && nextIdentity.session_id !== identity.session_id))) {
+                throw new DesktopBridgeError('bridge_codex_session_identity_conflict');
+            }
+            if (!bound)
+                identity = nextIdentity;
+            const request = routeRequest(model);
+            assertBinding(assertDesktopBridgeRouteContext(request, config));
+            const route = await resolveAndBindDesktopBridgeRouteContext(request, config);
+            if (stopped || client.readyState !== WebSocket.OPEN)
+                return;
+            assertBinding(route);
+            if (!bound) {
+                bound = route;
+                await connect(route);
+            }
+            if (route.upstream_model !== model)
+                message.data = Buffer.from(JSON.stringify({ ...message.create, model: route.upstream_model }));
+        }
+        async function connect(route) {
+            const official = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID;
+            const provider = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID ? null : config.providers[route.provider_id];
+            const remote = official ? config.officialRemote : provider?.remote;
+            if (!remote)
+                throw new DesktopBridgeError('bridge_websocket_upstream_unavailable');
+            boundBaseUrl = official ? remote.baseUrl : provider.base_url;
+            boundCredentialGeneration = provider?.credential_generation ?? null;
+            boundCredentialFingerprint = provider?.credential_fingerprint ?? null;
+            const credential = provider ? await config.resolveProviderCredential(provider.provider_id, provider.credential_generation) : null;
+            if (credential && (credential.provider_id !== provider.provider_id || credential.generation !== boundCredentialGeneration
+                || (boundCredentialFingerprint && credential.fingerprint !== boundCredentialFingerprint)))
+                throw new DesktopBridgeError('bridge_provider_credential_generation_mismatch');
+            await ensureDesktopBridgeRemoteTarget(remote, config.remoteLookup);
+            if (stopped || client.readyState !== WebSocket.OPEN)
+                return;
+            const target = resolveDesktopBridgeTarget(req.url, remote);
+            const outgoing = official ? buildOfficialPassthroughWebSocketHeaders(req.headers, target.host)
+                : buildProviderWebSocketHeaders(req.headers, { providerId: provider.provider_id, authTransport: provider.auth_transport, credential: credential }, target.host);
+            const headers = {};
+            for (const [name, value] of Object.entries(outgoing)) {
+                if (name.startsWith('sec-websocket-') || name === 'connection' || name === 'upgrade' || name === 'content-length')
+                    continue;
+                if (value !== undefined)
+                    headers[name] = Array.isArray(value) ? value.join(', ') : String(value);
+            }
+            target.protocol = remote.secure ? 'wss:' : 'ws:';
+            let connected = false;
+            handshakeTimer = setTimeout(() => {
+                if (!connected)
+                    void refreshDesktopBridgeRemoteTarget(remote, config.remoteLookup);
+                fail(new DesktopBridgeError('bridge_websocket_upstream_handshake_timeout'));
+            }, config.connectTimeoutMs);
+            handshakeTimer.unref();
+            upstream = new WebSocket(target, client.protocol ? [client.protocol] : [], {
+                headers, perMessageDeflate: false, maxPayload: maxBytes,
+                handshakeTimeout: config.connectTimeoutMs, followRedirects: false,
+                createConnection: () => {
+                    const connection = remote.secure
+                        ? tls.connect({ host: remote.address, port: remote.port, ...(remote.tlsServername ? { servername: remote.tlsServername } : {}) })
+                        : net.connect({ host: remote.address, port: remote.port, family: remote.family });
+                    upstreamSocket = connection;
+                    connection.setKeepAlive(true, 30_000);
+                    connection.once(remote.secure ? 'secureConnect' : 'connect', () => { connected = true; });
+                    return connection;
+                },
+            });
+            const peer = upstream;
+            peer.on('error', (error) => {
+                if (isUnreachableUpstreamError(error))
+                    void refreshDesktopBridgeRemoteTarget(remote, config.remoteLookup);
+                fail(new DesktopBridgeError('bridge_websocket_upstream_unavailable'));
+            });
+            peer.on('unexpected-response', (_request, response) => {
+                response.destroy();
+                fail(new DesktopBridgeError(`bridge_websocket_upgrade_failed_${response.statusCode || 502}`));
+            });
+            peer.on('message', (data, binary) => {
+                if (stopped)
+                    return;
+                try {
+                    relay(client, bytes(data), binary);
+                }
+                catch (error) {
+                    fail(error);
+                }
+            });
+            peer.on('close', (code, reason) => {
+                upstreamSocket?.destroy();
+                stop();
+                if (client.readyState === WebSocket.OPEN) {
+                    if (code === 1005)
+                        client.close();
+                    else
+                        client.close(code === 1006 ? 1011 : code, code === 1006 ? 'bridge_websocket_upstream_closed' : reason);
+                }
+                clearCloseTimer();
+            });
+            await new Promise((resolve, reject) => {
+                peer.once('open', resolve);
+                peer.once('error', reject);
+                peer.once('close', () => reject(new DesktopBridgeError('bridge_websocket_upstream_closed')));
+            });
+            if (handshakeTimer)
+                clearTimeout(handshakeTimer);
+            clearTimeout(initialTimer);
+        }
+        async function drain() {
+            if (processing || stopped)
+                return;
+            processing = true;
+            try {
+                if (!bound) {
+                    const firstCreate = pending.find((message) => message.create);
+                    if (!firstCreate)
+                        return;
+                    await resolveCreate(firstCreate);
+                    firstCreate.create = null;
+                }
+                while (!stopped && client.readyState === WebSocket.OPEN && pending.length) {
+                    const message = pending[0];
+                    if (message.create)
+                        await resolveCreate(message);
+                    if (stopped || client.readyState !== WebSocket.OPEN)
+                        return;
+                    relay(upstream, message.data, message.binary);
+                    pending.shift();
+                    pendingBytes -= message.originalBytes;
+                }
+            }
+            catch (error) {
+                fail(error);
+            }
+            finally {
+                processing = false;
+            }
+        }
+        function clearCloseTimer() {
+            if (client.readyState === WebSocket.CLOSED && (!upstream || upstream.readyState === WebSocket.CLOSED) && closeTimer)
+                clearTimeout(closeTimer);
+        }
+        client.on('message', (data, binary) => {
+            if (stopped)
+                return;
+            const payload = bytes(data);
+            let create = null;
+            try {
+                const parsed = JSON.parse(payload.toString('utf8'));
+                if (parsed && typeof parsed === 'object' && parsed.type === 'response.create')
+                    create = parsed;
+            }
+            catch { }
+            if (pending.length >= MAX_PENDING_MESSAGES || pendingBytes + payload.length > maxBytes) {
+                fail(new DesktopBridgeError('bridge_websocket_pending_limit_exceeded'));
+                return;
+            }
+            pending.push({ data: payload, binary, create, originalBytes: payload.length });
+            pendingBytes += payload.length;
+            void drain();
+        });
+        client.on('error', () => { stop(); upstream?.terminate(); upstreamSocket?.destroy(); client.terminate(); });
+        client.once('close', (code, reason) => {
+            stop();
+            if (upstream?.readyState === WebSocket.OPEN) {
+                if (code === 1005)
+                    upstream.close();
+                else
+                    upstream.close(code === 1006 ? 1011 : code, reason);
+            }
+            else if (upstream?.readyState === WebSocket.CONNECTING) {
+                upstream.terminate();
+                upstreamSocket?.destroy();
+            }
+            clearCloseTimer();
+        });
+    }
+}

package/dist/core/codex-lb/desktop-bridge/security.js

@@ -581,6 +581,10 @@ export function validateDesktopBridgeConfig(config) {
         && (!Number.isInteger(config.maxConnections) || config.maxConnections < 1 || config.maxConnections > 2_048)) {
         throw new DesktopBridgeError('bridge_connection_limit_invalid');
     }
+    if (config.websocketInitialCreateTimeoutMs !== undefined
+        && (!Number.isFinite(config.websocketInitialCreateTimeoutMs) || config.websocketInitialCreateTimeoutMs < 1_000 || config.websocketInitialCreateTimeoutMs > 86_400_000)) {
+        throw new DesktopBridgeError('bridge_websocket_initial_create_timeout_invalid');
+    }
     for (const origin of config.allowedOrigins)
         normalizeAllowedOrigin(origin);
     if (!config.providerRegistry)

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -7,6 +7,7 @@ import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { rewriteLocationHeader } from './location-rewrite.js';
 import { desktopBridgeOfficialPassthroughEnabled, ensureDesktopBridgeRemoteTarget, isUnreachableUpstreamError, refreshDesktopBridgeRemoteTarget, resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader, canonicalSessionId } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
+import { forwardResponsesWebSocket, isResponsesWebSocketRequest } from './responses-websocket.js';
 import { DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL, DesktopBridgeError, } from './types.js';
 const MAX_HEAD = 64 * 1024;
 const REDACTED_RESPONSE_HEADERS = new Set(['authorization', 'cookie', 'proxy-authenticate', 'proxy-authorization', 'set-cookie', 'x-api-key', 'x-codex-lb-api-key']);
@@ -137,6 +138,15 @@ function writeUpgradeFailure(client, error, req) {
         + JSON.stringify({ error: { type: 'sks_bridge_error', code, retryable: !permanent } }));
 }
 export async function forwardWebSocket(req, client, head, config, authenticatedLocalBaseUrl = desktopBridgeListenOrigin(config)) {
+    if (isResponsesWebSocketRequest(req)) {
+        try {
+            forwardResponsesWebSocket(req, client, head, config);
+        }
+        catch (error) {
+            writeUpgradeFailure(client, error, req);
+        }
+        return;
+    }
     let prepared;
     try {
         prepared = await prepareDesktopBridgeWebSocketRequest(req, config);

package/dist/core/codex-lb/desktop-controller-v3/catalog.js

@@ -22,7 +22,7 @@ export async function syncCatalog(options) {
         : {};
     return commandResult('catalog.sync', result.ok === true, status, { catalog_sync: result }, result.ok === true ? [] : stringArray(activation.blockers), options);
 }
-export async function syncCatalogInternal(options) {
+export async function syncCatalogInternal(options, behavior = {}) {
     const paths = controllerPaths(options);
     const historicalIntent = inspectHistoricalDesktopBridgeIntent(await readText(paths.configPath, ''));
     if (historicalIntent.blockers.length > 0)
@@ -155,7 +155,7 @@ export async function syncCatalogInternal(options) {
         };
     }
     const serviceBefore = await (options.serviceStatusImpl || desktopBridgeServiceStatus)({ ...options, home: paths.home });
-    if (serviceBefore.installed || serviceBefore.running) {
+    if (behavior.restartService !== false && (serviceBefore.installed || serviceBefore.running)) {
         await (options.bootstrapServiceImpl || bootstrapExistingDesktopBridgeService)({
             ...options,
             home: paths.home,

package/dist/core/codex-lb/desktop-controller-v3/lifecycle-commands.js

@@ -12,7 +12,7 @@ import { commandResult, controllerPaths, nowIso, persistRuntimeSettings, provide
 import { desktopBridgeStatusV3, loadCore, statusFromCore } from './status.js';
 import { verifyDesktopBridgeV3 } from './verification.js';
 export async function ensureDesktopBridge(options, operation) {
-    const sync = await syncCatalogInternal(options);
+    const sync = await syncCatalogInternal(options, { restartService: false });
     let core = await loadCore(options);
     if (!core.activeCatalog.ok || !core.policy) {
         return commandResult(operation, true, statusFromCore(core, options), { catalog_sync: sync }, syncResultBlockers(sync), options);
@@ -35,7 +35,7 @@ export async function repairDesktopBridge(options) {
     let core = await loadCore(options);
     if (!core.activeCatalog.ok || !core.policy)
         return ensureDesktopBridge(options, 'repair');
-    await persistRuntimeSettings(core, options);
+    await persistRuntimeSettings(core, options, { restartService: false });
     const service = await (options.installServiceImpl || installAndStartDesktopBridgeService)({
         ...options,
         home: core.paths.home,

package/dist/core/codex-lb/desktop-controller-v3/shared.js

@@ -116,11 +116,13 @@ export async function persistRuntimeSettings(core, options, behavior = {}) {
         await stopAfterFailedRestart(restartOptions, options);
         throw error;
     }
-    if (!restarted.ok || !restarted.running) {
+    if (!restarted.running) {
         await stopAfterFailedRestart(restartOptions, options);
         const rootCause = restarted.blockers.find((blocker) => blocker === 'desktop_bridge_entry_macos_protected_folder');
         throw new Error(rootCause || restarted.blockers[0] || 'desktop_bridge_restart_failed');
     }
+    if (!restarted.ok)
+        throw new Error(restarted.blockers[0] || 'desktop_bridge_restart_failed');
 }
 export async function quiesceRunningBridge(core, options) {
     if (!core.service.running)

package/dist/core/codex-lb/desktop-controller-v3/status.js

@@ -287,6 +287,7 @@ export function authPriorityStatusFromCore(core) {
             : profile.state !== 'ready' ? 'codex_lb_route_not_ready'
                 : !core.activeCatalog.ok || core.activeCatalog.route_index.providers['codex-lb'].state !== 'ready' || !core.policy || !Object.entries(core.policy.model_routes).some(([model, route]) => /^(?:gpt-[0-9]|o[0-9]|codex-mini)/.test(model) && !model.includes(':') && route.provider_id === 'codex-lb')
                     ? 'codex_lb_eligible_route_missing'
-                    : !core.service.running ? 'desktop_bridge_not_running' : null;
+                    : !core.service.running ? 'desktop_bridge_not_running'
+                        : !core.service.ok ? 'desktop_bridge_runtime_not_ready' : null;
     return { enabled: true, state: error ? 'unavailable' : 'active', error };
 }

package/dist/core/codex-lb/desktop-service.js

@@ -373,22 +373,24 @@ export async function installAndStartDesktopBridgeService(options = {}) {
         return failedStatus(paths, settings, service, 'missing', 'desktop_bridge_launchd_bootstrap_failed');
     await run(ctl, ['kickstart', '-k', service], { timeoutMs: 10_000, maxOutputBytes: 32 * 1024 }).catch(() => undefined);
     const status = await waitForBridge({ ...options, home });
-    if (!status.ok) {
-        await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
-        if (await launchTargetsProtectedFolder([command.executable, ...command.arguments], home)) {
-            return withProtectedFolderBlocker(status);
+    if (status.running) {
+        if (!status.ok)
+            return status;
+        try {
+            await cleanupRetiredDesktopBridgeRuntime(retired);
+            return status;
+        }
+        catch (error) {
+            await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
+            await removeStaleState(paths.state_path, options.processExists);
+            return failedStatus(paths, settings, service, 'missing', safeServiceError(error));
         }
-        return status;
-    }
-    try {
-        await cleanupRetiredDesktopBridgeRuntime(retired);
-        return status;
     }
-    catch (error) {
-        await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
-        await removeStaleState(paths.state_path, options.processExists);
-        return failedStatus(paths, settings, service, 'missing', safeServiceError(error));
+    await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
+    if (await launchTargetsProtectedFolder([command.executable, ...command.arguments], home)) {
+        return withProtectedFolderBlocker(status);
     }
+    return status;
 }
 export async function bootstrapExistingDesktopBridgeService(options = {}) {
     const home = options.home || options.env?.HOME || process.env.HOME || os.homedir();
@@ -710,6 +712,11 @@ function normalizeProviderRegistrySnapshot(value) {
 function overridePaths(base, options) { return { settings_path: options.settingsPath || base.settings_path, state_path: options.statePath || base.state_path, client_capability_path: options.clientCapabilityPath || base.client_capability_path, launch_agent_path: options.launchAgentPath || base.launch_agent_path, stdout_log_path: options.stdoutLogPath || base.stdout_log_path, stderr_log_path: options.stderrLogPath || base.stderr_log_path }; }
 function launchDomain(uid = typeof process.getuid === 'function' ? process.getuid() : 0) { return `gui/${uid}`; }
 function launchService(uid) { return `${launchDomain(uid)}/${DESKTOP_BRIDGE_LAUNCHD_LABEL}`; }
+export function launchCommandForExecutable(executable, resolved, execPath = process.execPath) {
+    return /\.[cm]?js$/i.test(resolved)
+        ? { executable: path.resolve(execPath), arguments: [path.resolve(resolved)] }
+        : { executable: path.resolve(executable), arguments: [] };
+}
 async function resolveLaunchCommand(options, home) {
     if (options.executablePath) {
         return await exists(path.resolve(options.executablePath))
@@ -723,7 +730,7 @@ async function resolveLaunchCommand(options, home) {
     }
     const sks = await which('sks').catch(() => null);
     if (sks)
-        candidates.push({ executable: path.resolve(sks), arguments: [] });
+        candidates.push(launchCommandForExecutable(sks, await fsp.realpath(sks).catch(() => sks)));
     let rejectedProtected = false;
     for (const candidate of candidates) {
         if (await launchTargetsProtectedFolder([candidate.executable, ...candidate.arguments], home)) {
@@ -783,7 +790,7 @@ export async function bootstrapLaunchdWithRetry(options, domain, service, plistP
 async function inspectLaunchd(options, service) { if ((options.platform || process.platform) !== 'darwin')
     return { loaded: false, running: false }; const result = await (options.run || runProcess)(options.launchctl || '/bin/launchctl', ['print', service], { timeoutMs: 3_000, maxOutputBytes: 32 * 1024 }).catch(() => null); if (!result || result.code !== 0)
     return { loaded: false, running: false }; const text = `${result.stdout}\n${result.stderr}`; return { loaded: true, running: /state = running/.test(text) && /pid = \d+/.test(text) }; }
-async function waitForBridge(options) { let status = await desktopBridgeServiceStatus(options); for (let i = 0; i < 150 && !status.ok; i += 1) {
+async function waitForBridge(options) { let status = await desktopBridgeServiceStatus(options); for (let i = 0; i < 150 && !status.running; i += 1) {
     await delay(100);
     status = await desktopBridgeServiceStatus(options);
 } return status; }

package/dist/core/codex-runtime/codex-desktop-config-policy.js

@@ -1,4 +1,5 @@
 import os from 'node:os';
+import { setContextManagement } from '../codex/context-management.js';
 import path from 'node:path';
 import { DEFAULT_CODEX_APP_PLUGINS } from '../routes.js';
 import { ensureDir, PACKAGE_VERSION, readText, writeTextAtomic } from '../fsx.js';
@@ -95,6 +96,7 @@ function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
                 next = upsertTomlTable(next, table, `[${table}]\nenabled = true`);
         }
     }
+    next = setContextManagement(next, true, true);
     return ensureTrailingNewline(next);
 }
 function removeTopLevelTomlKey(text = '', key = '') {

package/dist/core/routes.js

@@ -644,7 +644,7 @@ export const COMMAND_CATALOG = [
     { name: 'uninstall', usage: 'sks uninstall [--dry-run] [--yes] [--keep-config] [--keep-data] [--purge-projects] [--json]', description: 'Remove SKS global skills, hooks, menu bar, state, temp files, and optional project residue while preserving user-owned content by default.' },
     { name: 'deps', usage: 'sks deps check [--json] [--yes]', description: 'Check Node/npm and Codex CLI readiness; pass --yes to repair missing Codex CLI tooling when supported.' },
     { name: 'codex', usage: 'sks codex compatibility|version|update-status [--refresh]|update|doctor|schema|current [--json]', description: 'Check Codex CLI compatibility/version/update status, run the official `codex update`, and inspect current manifest, capability, and hook-schema evidence.' },
-    { name: 'codex-app', usage: 'sks codex-app [check|status|restart|context-1m [status|on|off]|product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App integration, Desktop Bridge readiness, Product Design plugin readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, Codex CLI remote-control availability, and the opt-in GPT-5.6 Sol 1M context window toggle with automatic Codex restart. Provider routing is managed only by sks bridge.' },
+    { name: 'codex-app', usage: 'sks codex-app [check|status|restart|context-management [status|on|off]|context-1m [status|on|off]|product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App integration, Desktop Bridge readiness, Product Design plugin readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, Codex CLI remote-control availability, and the opt-in GPT-5.6 Sol 1M context window toggle with automatic Codex restart. Provider routing is managed only by sks bridge.' },
     { name: 'codex-native', usage: 'sks codex-native status|feature-broker|invocation-plan|init-deep [--json]', description: 'Inspect Codex Native feature broker readiness, invocation routing, pattern evidence, and managed memory setup.' },
     { name: 'hooks', usage: 'sks hooks explain|status|trust-report|replay|codex-validate|warning-check ... [--json]', description: 'Explain Codex hook events, validate current vendored event output schemas, replay fixtures, and enforce warning-zero SKS hook policies.' },
     { name: 'remote', usage: 'sks remote readiness|machines|worker ... [--json]', description: 'Inspect official Codex Remote readiness and the allowlisted proof-aware SSH stdio worker surface.' },

package/dist/core/update/update-migration-state/desktop-bridge-restage.js

@@ -1,73 +1,69 @@
 import os from 'node:os';
 import path from 'node:path';
-import { exists, PACKAGE_VERSION, readJson, runProcess } from '../../fsx.js';
-import { bootstrapExistingDesktopBridgeService, desktopBridgeServicePaths } from '../../codex-lb/desktop-service.js';
+import { exists, PACKAGE_VERSION } from '../../fsx.js';
+import { executeDesktopBridgeCommandV3 } from '../../codex-lb/desktop-controller-v3.js';
+import { desktopBridgeRuntimeVersion } from '../../codex-lb/desktop-bridge/state.js';
+import { desktopBridgeServicePaths, desktopBridgeServiceStatus } from '../../codex-lb/desktop-service.js';
 export async function desktopBridgeRestage(options = {}) {
     const skip = (reason) => ({ ok: true, status: 'ok', actions: [reason], blockers: [], warnings: [] });
     const warn = (warnings) => ({ ok: true, status: 'ok', actions: [], blockers: [], warnings });
     const env = options.env || process.env;
+    const platform = options.platform || process.platform;
     const version = options.packageVersion || PACKAGE_VERSION;
-    const reachesRealLaunchd = !(options.run && options.bootstrapService);
-    if ((options.platform || process.platform) !== 'darwin')
+    if (platform !== 'darwin')
         return skip('desktop_bridge_restage_not_macos');
-    if (reachesRealLaunchd && (env.NODE_TEST_CONTEXT !== undefined || env.SKS_TEST_ISOLATION === '1')) {
+    const reachesRealLaunchd = !(options.serviceStatus && options.executeCommand);
+    const isolated = [process.env, env].some((candidate) => candidate.NODE_TEST_CONTEXT !== undefined
+        || candidate.SKS_TEST_ISOLATION === '1'
+        || candidate.SKS_RELEASE_UPGRADE_SMOKE === '1');
+    if (reachesRealLaunchd && isolated)
         return skip('desktop_bridge_restage_skipped_under_tests');
-    }
     if (env.SKS_SKIP_BRIDGE_RESTAGE === '1')
         return skip('desktop_bridge_restage_disabled');
     const home = options.home || path.resolve(env.HOME || os.homedir());
     const paths = desktopBridgeServicePaths(home);
     if (!(await exists(paths.launch_agent_path)))
         return skip('desktop_bridge_restage_no_launch_agent');
-    const state = await readJson(paths.state_path, null);
-    const runningVersion = typeof state?.sks_version === 'string' ? state.sks_version : null;
-    const pid = typeof state?.pid === 'number' && Number.isInteger(state.pid) && state.pid > 1 ? state.pid : null;
-    if (pid === null || !(options.processAlive || processAlive)(pid)) {
-        if (!(await exists(paths.settings_path)))
-            return skip('desktop_bridge_restage_no_managed_bridge');
-        const bootstrap = await (options.bootstrapService || bootstrapExistingDesktopBridgeService)({ home })
-            .catch(() => null);
-        if (bootstrap?.running) {
-            return {
-                ok: true,
-                status: 'ok',
-                actions: [`desktop_bridge_bootstrapped:${version}`],
-                blockers: [],
-                warnings: bootstrap.blockers.map((blocker) => `desktop_bridge_restage_bootstrap_incomplete:${blocker}`)
-            };
-        }
-        return warn([
-            ...(bootstrap?.blockers || ['desktop_bridge_restage_bootstrap_failed'])
-                .map((blocker) => `desktop_bridge_restage_bootstrap_incomplete:${blocker}`),
-            'Desktop Bridge is installed but not running: run `sks bridge repair` from your home directory'
-        ]);
-    }
-    if (runningVersion === version)
+    if (!(await exists(paths.settings_path)))
+        return skip('desktop_bridge_restage_no_managed_bridge');
+    const serviceOptions = { home, env, platform };
+    const statusImpl = options.serviceStatus || desktopBridgeServiceStatus;
+    const before = await statusImpl(serviceOptions).catch(() => null);
+    const runningVersion = desktopBridgeRuntimeVersion(before?.state);
+    if (before?.ok && before.running && before.loaded && runningVersion === version) {
         return skip('desktop_bridge_restage_already_current');
-    const uid = options.uid === undefined
-        ? (typeof process.getuid === 'function' ? process.getuid() : null)
-        : options.uid;
-    if (uid === null)
-        return skip('desktop_bridge_restage_no_uid');
-    const kick = await (options.run || runProcess)('/bin/launchctl', ['kickstart', '-k', `gui/${uid}/com.sneakoscope.desktop-bridge`], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 }).catch(() => null);
-    if (!kick || kick.code !== 0) {
-        return warn([`desktop_bridge_restage_kickstart_failed:${runningVersion || 'pre-8.6.2'}`]);
     }
-    return {
-        ok: true, status: 'ok',
-        actions: [`desktop_bridge_restarted:${runningVersion || 'pre-8.6.2'}:${version}`],
-        blockers: [], warnings: []
-    };
+    const repair = await (options.executeCommand || executeDesktopBridgeCommandV3)({ operation: 'repair' }, serviceOptions).catch(() => null);
+    const after = await statusImpl(serviceOptions).catch(() => null);
+    const repairedVersion = desktopBridgeRuntimeVersion(after?.state);
+    const command = repair?.schema === 'sks.desktop-bridge-command-result.v1' ? repair : null;
+    const commandBlockers = command?.execution.blockers || [];
+    if (command?.ok && command.execution.ok && commandBlockers.length === 0
+        && after?.ok && after.running && after.loaded && repairedVersion === version) {
+        return {
+            ok: true,
+            status: 'ok',
+            actions: [before?.running
+                    ? `desktop_bridge_restarted:${runningVersion || 'pre-8.6.2'}:${version}`
+                    : `desktop_bridge_bootstrapped:${version}`],
+            blockers: [],
+            warnings: []
+        };
+    }
+    const incomplete = [...new Set([
+            ...commandBlockers,
+            ...(after?.blockers || []),
+            ...(!command?.ok || !command.execution.ok ? ['desktop_bridge_repair_failed'] : []),
+            ...(!after?.running || !after.loaded ? ['desktop_bridge_service_not_running'] : []),
+            ...(repairedVersion !== version
+                ? [`desktop_bridge_runtime_version_unverified:${repairedVersion || 'unknown'}:${version}`]
+                : [])
+        ])];
+    return warn([
+        ...incomplete.map((blocker) => `desktop_bridge_restage_incomplete:${blocker}`),
+        'Desktop Bridge update repair incomplete: run `sks bridge repair` from your home directory'
+    ]);
 }
 export function runDesktopBridgeRestageStage() {
     return desktopBridgeRestage();
 }
-function processAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '10.1.1';
+export const PACKAGE_VERSION = '10.1.3';

package/dist/native/sks-menubar/Sources/AuthPriorityState.swift

@@ -26,7 +26,7 @@ struct AuthPriorityState: Equatable {
             switch error {
             case "codex_lb_provider_disabled": return "On, unavailable · enable Codex-LB below"
             case "codex_lb_credential_missing": return "On, unavailable · connect your Codex-LB account below"
-            case "desktop_bridge_not_running": return "On, unavailable · open Bridge diagnostics and repair the bridge service"
+            case "desktop_bridge_not_running", "desktop_bridge_runtime_not_ready": return "On, unavailable · open Bridge diagnostics and repair the bridge service"
             case "codex_lb_route_not_ready", "codex_lb_eligible_route_missing": return "On, unavailable · validate Codex-LB and refresh its model catalog"
             default: return "On, unavailable · check your Codex-LB connection below"
             }

package/dist/native/sks-menubar/Sources/SettingsViewController.swift

@@ -19,6 +19,11 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
     private var contextEnabled: Bool?
     private var contextBusy = false
     private var contextGeneration = 0
+    private let memoryToggle = NSSwitch()
+    private let memoryStatus = NativeView.detail("Checking saved preference…")
+    private var memoryEnabled: Bool?
+    private var memoryBusy = false
+    private var memoryGeneration = 0
     init(processClient: ProcessClient, operations: OperationCoordinator, notifications: NotificationCoordinator) {
         self.processClient = processClient
         self.operations = operations
@@ -28,6 +33,17 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
     required init?(coder: NSCoder) { nil }
 
     override func loadView() {
+        memoryToggle.target = self
+        memoryToggle.action = #selector(toggleContextManagement)
+        memoryToggle.isEnabled = false
+        memoryToggle.setAccessibilityLabel("Experimental context management")
+        memoryToggle.setAccessibilityIdentifier("sks-context-management-toggle")
+        memoryStatus.setAccessibilityIdentifier("sks-context-management-status")
+        let memoryCard = NativeView.card(
+            title: "Astra context management",
+            subtitle: "Experimental · Keep notes and retrieve earlier messages and tool results. Enabled by default in SKS. Applies to new tasks with supported Codex and eligible ChatGPT sign-in; API-key and custom-provider sessions may not activate it.",
+            views: [NativeView.row([memoryToggle, NativeView.detail("Enable experimental context management")]), memoryStatus]
+        )
         followCodexLifecycle.target = self; followCodexLifecycle.action = #selector(save)
         followCodexLifecycle.setAccessibilityLabel("Show SKS Menu only while Codex is running")
         notificationButton = NativeView.button("Enable Notifications", target: self, action: #selector(enableNotifications))
@@ -50,11 +66,12 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
         )
         view = NativeView.page([
             ControlKit.header("Settings", "Choose how SKS works on this Mac."),
-            lifecycleCard, notificationsCard, NativeDisclosure("Advanced", views: [contextCard])
+            memoryCard, lifecycleCard, notificationsCard, NativeDisclosure("Advanced", views: [contextCard])
         ])
     }
 
     func refreshOnAppear() {
+        refreshContextManagement()
         refreshContext1m()
         let configResult = readConfig()
         switch configResult {
@@ -87,6 +104,53 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
         }
     }
 
+    private func refreshContextManagement() {
+        guard !memoryBusy else { return }
+        memoryGeneration += 1
+        let generation = memoryGeneration
+        processClient.run(["codex-app", "context-management", "status", "--json"], timeout: NativeView.statusTimeout) { [weak self] result in
+            guard let self = self, !self.memoryBusy, generation == self.memoryGeneration else { return }
+            guard result.code == 0, let payload = self.json(result.output),
+                  payload["schema"] as? String == "sks.context-management.v1",
+                  payload["ok"] as? Bool == true, let enabled = payload["enabled"] as? Bool else {
+                self.memoryEnabled = nil
+                self.memoryToggle.isEnabled = false
+                self.memoryStatus.stringValue = "Saved setting unavailable. Check Codex configuration, then reopen Settings."
+                return
+            }
+            self.memoryEnabled = enabled
+            self.memoryToggle.state = enabled ? .on : .off
+            self.memoryToggle.isEnabled = true
+            self.memoryStatus.stringValue = enabled
+                ? "Setting enabled · start a new task to apply. Availability depends on Codex and your sign-in."
+                : "Setting disabled · your choice is preserved during updates."
+        }
+    }
+
+    @objc private func toggleContextManagement() {
+        guard !memoryBusy, let previous = memoryEnabled else { return }
+        let desired = memoryToggle.state == .on
+        guard let operation = operations.begin(kind: "context-management", mutationGroup: "codex-config", summary: "Change experimental context management") else {
+            memoryToggle.state = previous ? .on : .off
+            memoryStatus.stringValue = "Another configuration change is running. Try again when it finishes."
+            return
+        }
+        memoryBusy = true
+        memoryGeneration += 1
+        memoryToggle.isEnabled = false
+        memoryStatus.stringValue = "Saving preference…"
+        processClient.run(["codex-app", "context-management", desired ? "on" : "off", "--json"], timeout: NativeView.mutationTimeout) { [weak self] result in
+            guard let self = self else { return }
+            self.memoryBusy = false
+            let payload = self.json(result.output)
+            let ok = result.code == 0 && payload?["schema"] as? String == "sks.context-management.v1"
+                && payload?["ok"] as? Bool == true && payload?["enabled"] as? Bool == desired
+            _ = self.operations.update(operation, state: ok ? .succeeded : .failed, stage: "complete", progress: 1,
+                summary: ok ? "Preference saved. Start a new Codex task to apply." : "Save could not be confirmed. Rechecking the setting.")
+            self.refreshContextManagement()
+        }
+    }
+
     private func refreshContext1m(preserveStatusText: Bool = false) {
         contextGeneration += 1
         let requestGeneration = contextGeneration

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "10.1.1",
+  "version": "10.1.3",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -196,7 +196,7 @@
   "dependencies": {
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
-    "@openai/codex-sdk": "0.150.1",
+    "@openai/codex-sdk": "0.153.4",
     "smol-toml": "^1.7.0",
     "typescript": "^5.9.3",
     "ws": "^8.21.3"