sneakoscope 10.1.2 → 10.1.3

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.1.2**. Install the latest stable release from npm.
+Current package: **SKS 10.1.3**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 
@@ -176,6 +176,7 @@ freshness semantics.
 - [Essential Trust](docs/essential-trust.md) — verification profiles and safety boundaries.
 - [Astra guidance](docs/astra-guidance.md) — how SKS applies the official model recommendations.
 - [Agent Bridge](docs/AGENT-BRIDGE.md) — integrate through the CLI or MCP interface.
+- [Codex-LB priority](docs/codex-lb-priority.md) — how Codex App WebSockets follow the Center priority setting.
 - [Release readiness](docs/release-readiness.md) — build, verify, and publish a release.
 - [Release evidence](docs/release-proof-truth.md) — what each verification result proves.
 - [Changelog](CHANGELOG.md) — changes by version.

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.1.2"
+version = "10.1.3"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.1.2"
+version = "10.1.3"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.1.2",
+  "package_version": "10.1.3",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-lb/desktop-bridge/responses-websocket.js

@@ -0,0 +1,286 @@
+import net from 'node:net';
+import tls from 'node:tls';
+import WebSocket, { WebSocketServer } from 'ws';
+import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
+import { buildOfficialPassthroughWebSocketHeaders, buildProviderWebSocketHeaders } from './header-policy.js';
+import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
+import { assertDesktopBridgeRouteContext, ensureDesktopBridgeRemoteTarget, isUnreachableUpstreamError, refreshDesktopBridgeRemoteTarget, resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode } from './security.js';
+import { DesktopBridgeError } from './types.js';
+const MAX_PENDING_MESSAGES = 256;
+const CLOSE_GRACE_MS = 1_000;
+const INITIAL_CREATE_TIMEOUT_MS = 60 * 60_000;
+const logRejection = createDesktopBridgeRejectionLogger();
+export function isResponsesWebSocketRequest(req) {
+    const pathname = new URL(req.url || '/', 'http://bridge.invalid').pathname;
+    return ['/backend-api/codex/responses', '/api/v1/responses', '/v1/responses'].includes(pathname);
+}
+function bytes(data) {
+    return Buffer.isBuffer(data) ? data : Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data);
+}
+export function forwardResponsesWebSocket(req, socket, head, config) {
+    const upgradeIdentity = resolveCodexSessionIdentity(req.headers);
+    const maxBytes = config.maxRequestBodyBytes ?? 16 * 1024 * 1024;
+    const server = new WebSocketServer({ noServer: true, clientTracking: false, perMessageDeflate: false, maxPayload: maxBytes });
+    try {
+        server.handleUpgrade(req, socket, head, (client) => {
+            bridge(client);
+        });
+    }
+    finally {
+        server.close();
+    }
+    function bridge(client) {
+        let identity = upgradeIdentity;
+        let upstream = null;
+        let upstreamSocket = null;
+        let bound = null;
+        let boundBaseUrl = null;
+        let boundCredentialGeneration = null;
+        let boundCredentialFingerprint = null;
+        let stopped = false;
+        let processing = false;
+        let pendingBytes = 0;
+        const pending = [];
+        let closeTimer = null;
+        let handshakeTimer = null;
+        const initialTimer = setTimeout(closeUnbound, config.websocketInitialCreateTimeoutMs ?? INITIAL_CREATE_TIMEOUT_MS);
+        initialTimer.unref();
+        const localSocket = socket;
+        localSocket.setKeepAlive?.(true, 30_000);
+        function stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            clearTimeout(initialTimer);
+            if (handshakeTimer)
+                clearTimeout(handshakeTimer);
+            pending.length = 0;
+            pendingBytes = 0;
+            closeTimer = setTimeout(() => { client.terminate(); upstream?.terminate(); upstreamSocket?.destroy(); }, CLOSE_GRACE_MS);
+            closeTimer.unref();
+        }
+        function fail(error) {
+            if (stopped)
+                return;
+            const code = safeBridgeErrorCode(error);
+            logRejection({ code, transport: 'websocket', ...(req.method ? { method: req.method } : {}), ...(req.url ? { url: req.url } : {}) });
+            stop();
+            if (client.readyState === WebSocket.OPEN) {
+                if (client.bufferedAmount < maxBytes)
+                    client.send(JSON.stringify({ type: 'error', error: { type: 'sks_bridge_error', code, message: code } }), () => undefined);
+                client.close(1011, code.slice(0, 123));
+            }
+            upstream?.terminate();
+            upstreamSocket?.destroy();
+        }
+        function closeUnbound() {
+            if (stopped || bound)
+                return;
+            logRejection({ code: 'bridge_websocket_initial_create_timeout', transport: 'websocket', ...(req.method ? { method: req.method } : {}), ...(req.url ? { url: req.url } : {}) });
+            stop();
+            if (client.readyState === WebSocket.OPEN)
+                client.close(1000, 'bridge_websocket_initial_create_timeout');
+        }
+        function relay(destination, data, binary) {
+            if (destination.readyState !== WebSocket.OPEN)
+                throw new DesktopBridgeError('bridge_websocket_upstream_unavailable');
+            if (destination.bufferedAmount + data.length > maxBytes)
+                throw new DesktopBridgeError('bridge_websocket_backpressure_exceeded');
+            destination.send(data, { binary }, (error) => { if (error)
+                fail(error); });
+        }
+        function routeRequest(model) {
+            return { public_model: model, session_id: identity.thread_id, pathname: new URL(req.url || '/', 'http://bridge.invalid').pathname, transport: 'websocket', headers: req.headers };
+        }
+        function assertBinding(route) {
+            if (!bound)
+                return;
+            const official = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID;
+            const provider = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID ? null : config.providers[route.provider_id];
+            const baseUrl = official ? config.officialRemote?.baseUrl : provider?.base_url;
+            if (route.provider_id !== bound.provider_id || baseUrl !== boundBaseUrl
+                || (provider && (provider.credential_generation !== boundCredentialGeneration || provider.credential_fingerprint !== boundCredentialFingerprint))) {
+                throw new DesktopBridgeError('bridge_websocket_route_change_forbidden');
+            }
+        }
+        async function resolveCreate(message) {
+            const model = message.create?.model;
+            if (typeof model !== 'string' || !model.trim())
+                throw new DesktopBridgeError('bridge_websocket_model_required');
+            const nextIdentity = resolveCodexSessionIdentity(req.headers, message.create);
+            if (bound && ((nextIdentity.thread_id && nextIdentity.thread_id !== identity.thread_id)
+                || (nextIdentity.session_id && nextIdentity.session_id !== identity.session_id))) {
+                throw new DesktopBridgeError('bridge_codex_session_identity_conflict');
+            }
+            if (!bound)
+                identity = nextIdentity;
+            const request = routeRequest(model);
+            assertBinding(assertDesktopBridgeRouteContext(request, config));
+            const route = await resolveAndBindDesktopBridgeRouteContext(request, config);
+            if (stopped || client.readyState !== WebSocket.OPEN)
+                return;
+            assertBinding(route);
+            if (!bound) {
+                bound = route;
+                await connect(route);
+            }
+            if (route.upstream_model !== model)
+                message.data = Buffer.from(JSON.stringify({ ...message.create, model: route.upstream_model }));
+        }
+        async function connect(route) {
+            const official = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID;
+            const provider = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID ? null : config.providers[route.provider_id];
+            const remote = official ? config.officialRemote : provider?.remote;
+            if (!remote)
+                throw new DesktopBridgeError('bridge_websocket_upstream_unavailable');
+            boundBaseUrl = official ? remote.baseUrl : provider.base_url;
+            boundCredentialGeneration = provider?.credential_generation ?? null;
+            boundCredentialFingerprint = provider?.credential_fingerprint ?? null;
+            const credential = provider ? await config.resolveProviderCredential(provider.provider_id, provider.credential_generation) : null;
+            if (credential && (credential.provider_id !== provider.provider_id || credential.generation !== boundCredentialGeneration
+                || (boundCredentialFingerprint && credential.fingerprint !== boundCredentialFingerprint)))
+                throw new DesktopBridgeError('bridge_provider_credential_generation_mismatch');
+            await ensureDesktopBridgeRemoteTarget(remote, config.remoteLookup);
+            if (stopped || client.readyState !== WebSocket.OPEN)
+                return;
+            const target = resolveDesktopBridgeTarget(req.url, remote);
+            const outgoing = official ? buildOfficialPassthroughWebSocketHeaders(req.headers, target.host)
+                : buildProviderWebSocketHeaders(req.headers, { providerId: provider.provider_id, authTransport: provider.auth_transport, credential: credential }, target.host);
+            const headers = {};
+            for (const [name, value] of Object.entries(outgoing)) {
+                if (name.startsWith('sec-websocket-') || name === 'connection' || name === 'upgrade' || name === 'content-length')
+                    continue;
+                if (value !== undefined)
+                    headers[name] = Array.isArray(value) ? value.join(', ') : String(value);
+            }
+            target.protocol = remote.secure ? 'wss:' : 'ws:';
+            let connected = false;
+            handshakeTimer = setTimeout(() => {
+                if (!connected)
+                    void refreshDesktopBridgeRemoteTarget(remote, config.remoteLookup);
+                fail(new DesktopBridgeError('bridge_websocket_upstream_handshake_timeout'));
+            }, config.connectTimeoutMs);
+            handshakeTimer.unref();
+            upstream = new WebSocket(target, client.protocol ? [client.protocol] : [], {
+                headers, perMessageDeflate: false, maxPayload: maxBytes,
+                handshakeTimeout: config.connectTimeoutMs, followRedirects: false,
+                createConnection: () => {
+                    const connection = remote.secure
+                        ? tls.connect({ host: remote.address, port: remote.port, ...(remote.tlsServername ? { servername: remote.tlsServername } : {}) })
+                        : net.connect({ host: remote.address, port: remote.port, family: remote.family });
+                    upstreamSocket = connection;
+                    connection.setKeepAlive(true, 30_000);
+                    connection.once(remote.secure ? 'secureConnect' : 'connect', () => { connected = true; });
+                    return connection;
+                },
+            });
+            const peer = upstream;
+            peer.on('error', (error) => {
+                if (isUnreachableUpstreamError(error))
+                    void refreshDesktopBridgeRemoteTarget(remote, config.remoteLookup);
+                fail(new DesktopBridgeError('bridge_websocket_upstream_unavailable'));
+            });
+            peer.on('unexpected-response', (_request, response) => {
+                response.destroy();
+                fail(new DesktopBridgeError(`bridge_websocket_upgrade_failed_${response.statusCode || 502}`));
+            });
+            peer.on('message', (data, binary) => {
+                if (stopped)
+                    return;
+                try {
+                    relay(client, bytes(data), binary);
+                }
+                catch (error) {
+                    fail(error);
+                }
+            });
+            peer.on('close', (code, reason) => {
+                upstreamSocket?.destroy();
+                stop();
+                if (client.readyState === WebSocket.OPEN) {
+                    if (code === 1005)
+                        client.close();
+                    else
+                        client.close(code === 1006 ? 1011 : code, code === 1006 ? 'bridge_websocket_upstream_closed' : reason);
+                }
+                clearCloseTimer();
+            });
+            await new Promise((resolve, reject) => {
+                peer.once('open', resolve);
+                peer.once('error', reject);
+                peer.once('close', () => reject(new DesktopBridgeError('bridge_websocket_upstream_closed')));
+            });
+            if (handshakeTimer)
+                clearTimeout(handshakeTimer);
+            clearTimeout(initialTimer);
+        }
+        async function drain() {
+            if (processing || stopped)
+                return;
+            processing = true;
+            try {
+                if (!bound) {
+                    const firstCreate = pending.find((message) => message.create);
+                    if (!firstCreate)
+                        return;
+                    await resolveCreate(firstCreate);
+                    firstCreate.create = null;
+                }
+                while (!stopped && client.readyState === WebSocket.OPEN && pending.length) {
+                    const message = pending[0];
+                    if (message.create)
+                        await resolveCreate(message);
+                    if (stopped || client.readyState !== WebSocket.OPEN)
+                        return;
+                    relay(upstream, message.data, message.binary);
+                    pending.shift();
+                    pendingBytes -= message.originalBytes;
+                }
+            }
+            catch (error) {
+                fail(error);
+            }
+            finally {
+                processing = false;
+            }
+        }
+        function clearCloseTimer() {
+            if (client.readyState === WebSocket.CLOSED && (!upstream || upstream.readyState === WebSocket.CLOSED) && closeTimer)
+                clearTimeout(closeTimer);
+        }
+        client.on('message', (data, binary) => {
+            if (stopped)
+                return;
+            const payload = bytes(data);
+            let create = null;
+            try {
+                const parsed = JSON.parse(payload.toString('utf8'));
+                if (parsed && typeof parsed === 'object' && parsed.type === 'response.create')
+                    create = parsed;
+            }
+            catch { }
+            if (pending.length >= MAX_PENDING_MESSAGES || pendingBytes + payload.length > maxBytes) {
+                fail(new DesktopBridgeError('bridge_websocket_pending_limit_exceeded'));
+                return;
+            }
+            pending.push({ data: payload, binary, create, originalBytes: payload.length });
+            pendingBytes += payload.length;
+            void drain();
+        });
+        client.on('error', () => { stop(); upstream?.terminate(); upstreamSocket?.destroy(); client.terminate(); });
+        client.once('close', (code, reason) => {
+            stop();
+            if (upstream?.readyState === WebSocket.OPEN) {
+                if (code === 1005)
+                    upstream.close();
+                else
+                    upstream.close(code === 1006 ? 1011 : code, reason);
+            }
+            else if (upstream?.readyState === WebSocket.CONNECTING) {
+                upstream.terminate();
+                upstreamSocket?.destroy();
+            }
+            clearCloseTimer();
+        });
+    }
+}

package/dist/core/codex-lb/desktop-bridge/security.js

@@ -581,6 +581,10 @@ export function validateDesktopBridgeConfig(config) {
         && (!Number.isInteger(config.maxConnections) || config.maxConnections < 1 || config.maxConnections > 2_048)) {
         throw new DesktopBridgeError('bridge_connection_limit_invalid');
     }
+    if (config.websocketInitialCreateTimeoutMs !== undefined
+        && (!Number.isFinite(config.websocketInitialCreateTimeoutMs) || config.websocketInitialCreateTimeoutMs < 1_000 || config.websocketInitialCreateTimeoutMs > 86_400_000)) {
+        throw new DesktopBridgeError('bridge_websocket_initial_create_timeout_invalid');
+    }
     for (const origin of config.allowedOrigins)
         normalizeAllowedOrigin(origin);
     if (!config.providerRegistry)

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -7,6 +7,7 @@ import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { rewriteLocationHeader } from './location-rewrite.js';
 import { desktopBridgeOfficialPassthroughEnabled, ensureDesktopBridgeRemoteTarget, isUnreachableUpstreamError, refreshDesktopBridgeRemoteTarget, resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader, canonicalSessionId } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
+import { forwardResponsesWebSocket, isResponsesWebSocketRequest } from './responses-websocket.js';
 import { DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL, DesktopBridgeError, } from './types.js';
 const MAX_HEAD = 64 * 1024;
 const REDACTED_RESPONSE_HEADERS = new Set(['authorization', 'cookie', 'proxy-authenticate', 'proxy-authorization', 'set-cookie', 'x-api-key', 'x-codex-lb-api-key']);
@@ -137,6 +138,15 @@ function writeUpgradeFailure(client, error, req) {
         + JSON.stringify({ error: { type: 'sks_bridge_error', code, retryable: !permanent } }));
 }
 export async function forwardWebSocket(req, client, head, config, authenticatedLocalBaseUrl = desktopBridgeListenOrigin(config)) {
+    if (isResponsesWebSocketRequest(req)) {
+        try {
+            forwardResponsesWebSocket(req, client, head, config);
+        }
+        catch (error) {
+            writeUpgradeFailure(client, error, req);
+        }
+        return;
+    }
     let prepared;
     try {
         prepared = await prepareDesktopBridgeWebSocketRequest(req, config);

package/dist/core/codex-lb/desktop-controller-v3/catalog.js

@@ -22,7 +22,7 @@ export async function syncCatalog(options) {
         : {};
     return commandResult('catalog.sync', result.ok === true, status, { catalog_sync: result }, result.ok === true ? [] : stringArray(activation.blockers), options);
 }
-export async function syncCatalogInternal(options) {
+export async function syncCatalogInternal(options, behavior = {}) {
     const paths = controllerPaths(options);
     const historicalIntent = inspectHistoricalDesktopBridgeIntent(await readText(paths.configPath, ''));
     if (historicalIntent.blockers.length > 0)
@@ -155,7 +155,7 @@ export async function syncCatalogInternal(options) {
         };
     }
     const serviceBefore = await (options.serviceStatusImpl || desktopBridgeServiceStatus)({ ...options, home: paths.home });
-    if (serviceBefore.installed || serviceBefore.running) {
+    if (behavior.restartService !== false && (serviceBefore.installed || serviceBefore.running)) {
         await (options.bootstrapServiceImpl || bootstrapExistingDesktopBridgeService)({
             ...options,
             home: paths.home,

package/dist/core/codex-lb/desktop-controller-v3/lifecycle-commands.js

@@ -12,7 +12,7 @@ import { commandResult, controllerPaths, nowIso, persistRuntimeSettings, provide
 import { desktopBridgeStatusV3, loadCore, statusFromCore } from './status.js';
 import { verifyDesktopBridgeV3 } from './verification.js';
 export async function ensureDesktopBridge(options, operation) {
-    const sync = await syncCatalogInternal(options);
+    const sync = await syncCatalogInternal(options, { restartService: false });
     let core = await loadCore(options);
     if (!core.activeCatalog.ok || !core.policy) {
         return commandResult(operation, true, statusFromCore(core, options), { catalog_sync: sync }, syncResultBlockers(sync), options);
@@ -35,7 +35,7 @@ export async function repairDesktopBridge(options) {
     let core = await loadCore(options);
     if (!core.activeCatalog.ok || !core.policy)
         return ensureDesktopBridge(options, 'repair');
-    await persistRuntimeSettings(core, options);
+    await persistRuntimeSettings(core, options, { restartService: false });
     const service = await (options.installServiceImpl || installAndStartDesktopBridgeService)({
         ...options,
         home: core.paths.home,

package/dist/core/codex-lb/desktop-controller-v3/shared.js

@@ -116,11 +116,13 @@ export async function persistRuntimeSettings(core, options, behavior = {}) {
         await stopAfterFailedRestart(restartOptions, options);
         throw error;
     }
-    if (!restarted.ok || !restarted.running) {
+    if (!restarted.running) {
         await stopAfterFailedRestart(restartOptions, options);
         const rootCause = restarted.blockers.find((blocker) => blocker === 'desktop_bridge_entry_macos_protected_folder');
         throw new Error(rootCause || restarted.blockers[0] || 'desktop_bridge_restart_failed');
     }
+    if (!restarted.ok)
+        throw new Error(restarted.blockers[0] || 'desktop_bridge_restart_failed');
 }
 export async function quiesceRunningBridge(core, options) {
     if (!core.service.running)

package/dist/core/codex-lb/desktop-controller-v3/status.js

@@ -287,6 +287,7 @@ export function authPriorityStatusFromCore(core) {
             : profile.state !== 'ready' ? 'codex_lb_route_not_ready'
                 : !core.activeCatalog.ok || core.activeCatalog.route_index.providers['codex-lb'].state !== 'ready' || !core.policy || !Object.entries(core.policy.model_routes).some(([model, route]) => /^(?:gpt-[0-9]|o[0-9]|codex-mini)/.test(model) && !model.includes(':') && route.provider_id === 'codex-lb')
                     ? 'codex_lb_eligible_route_missing'
-                    : !core.service.running ? 'desktop_bridge_not_running' : null;
+                    : !core.service.running ? 'desktop_bridge_not_running'
+                        : !core.service.ok ? 'desktop_bridge_runtime_not_ready' : null;
     return { enabled: true, state: error ? 'unavailable' : 'active', error };
 }

package/dist/core/codex-lb/desktop-service.js

@@ -373,22 +373,24 @@ export async function installAndStartDesktopBridgeService(options = {}) {
         return failedStatus(paths, settings, service, 'missing', 'desktop_bridge_launchd_bootstrap_failed');
     await run(ctl, ['kickstart', '-k', service], { timeoutMs: 10_000, maxOutputBytes: 32 * 1024 }).catch(() => undefined);
     const status = await waitForBridge({ ...options, home });
-    if (!status.ok) {
-        await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
-        if (await launchTargetsProtectedFolder([command.executable, ...command.arguments], home)) {
-            return withProtectedFolderBlocker(status);
+    if (status.running) {
+        if (!status.ok)
+            return status;
+        try {
+            await cleanupRetiredDesktopBridgeRuntime(retired);
+            return status;
+        }
+        catch (error) {
+            await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
+            await removeStaleState(paths.state_path, options.processExists);
+            return failedStatus(paths, settings, service, 'missing', safeServiceError(error));
         }
-        return status;
-    }
-    try {
-        await cleanupRetiredDesktopBridgeRuntime(retired);
-        return status;
     }
-    catch (error) {
-        await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
-        await removeStaleState(paths.state_path, options.processExists);
-        return failedStatus(paths, settings, service, 'missing', safeServiceError(error));
+    await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
+    if (await launchTargetsProtectedFolder([command.executable, ...command.arguments], home)) {
+        return withProtectedFolderBlocker(status);
     }
+    return status;
 }
 export async function bootstrapExistingDesktopBridgeService(options = {}) {
     const home = options.home || options.env?.HOME || process.env.HOME || os.homedir();
@@ -710,6 +712,11 @@ function normalizeProviderRegistrySnapshot(value) {
 function overridePaths(base, options) { return { settings_path: options.settingsPath || base.settings_path, state_path: options.statePath || base.state_path, client_capability_path: options.clientCapabilityPath || base.client_capability_path, launch_agent_path: options.launchAgentPath || base.launch_agent_path, stdout_log_path: options.stdoutLogPath || base.stdout_log_path, stderr_log_path: options.stderrLogPath || base.stderr_log_path }; }
 function launchDomain(uid = typeof process.getuid === 'function' ? process.getuid() : 0) { return `gui/${uid}`; }
 function launchService(uid) { return `${launchDomain(uid)}/${DESKTOP_BRIDGE_LAUNCHD_LABEL}`; }
+export function launchCommandForExecutable(executable, resolved, execPath = process.execPath) {
+    return /\.[cm]?js$/i.test(resolved)
+        ? { executable: path.resolve(execPath), arguments: [path.resolve(resolved)] }
+        : { executable: path.resolve(executable), arguments: [] };
+}
 async function resolveLaunchCommand(options, home) {
     if (options.executablePath) {
         return await exists(path.resolve(options.executablePath))
@@ -723,7 +730,7 @@ async function resolveLaunchCommand(options, home) {
     }
     const sks = await which('sks').catch(() => null);
     if (sks)
-        candidates.push({ executable: path.resolve(sks), arguments: [] });
+        candidates.push(launchCommandForExecutable(sks, await fsp.realpath(sks).catch(() => sks)));
     let rejectedProtected = false;
     for (const candidate of candidates) {
         if (await launchTargetsProtectedFolder([candidate.executable, ...candidate.arguments], home)) {
@@ -783,7 +790,7 @@ export async function bootstrapLaunchdWithRetry(options, domain, service, plistP
 async function inspectLaunchd(options, service) { if ((options.platform || process.platform) !== 'darwin')
     return { loaded: false, running: false }; const result = await (options.run || runProcess)(options.launchctl || '/bin/launchctl', ['print', service], { timeoutMs: 3_000, maxOutputBytes: 32 * 1024 }).catch(() => null); if (!result || result.code !== 0)
     return { loaded: false, running: false }; const text = `${result.stdout}\n${result.stderr}`; return { loaded: true, running: /state = running/.test(text) && /pid = \d+/.test(text) }; }
-async function waitForBridge(options) { let status = await desktopBridgeServiceStatus(options); for (let i = 0; i < 150 && !status.ok; i += 1) {
+async function waitForBridge(options) { let status = await desktopBridgeServiceStatus(options); for (let i = 0; i < 150 && !status.running; i += 1) {
     await delay(100);
     status = await desktopBridgeServiceStatus(options);
 } return status; }

package/dist/core/update/update-migration-state/desktop-bridge-restage.js

@@ -1,73 +1,69 @@
 import os from 'node:os';
 import path from 'node:path';
-import { exists, PACKAGE_VERSION, readJson, runProcess } from '../../fsx.js';
-import { bootstrapExistingDesktopBridgeService, desktopBridgeServicePaths } from '../../codex-lb/desktop-service.js';
+import { exists, PACKAGE_VERSION } from '../../fsx.js';
+import { executeDesktopBridgeCommandV3 } from '../../codex-lb/desktop-controller-v3.js';
+import { desktopBridgeRuntimeVersion } from '../../codex-lb/desktop-bridge/state.js';
+import { desktopBridgeServicePaths, desktopBridgeServiceStatus } from '../../codex-lb/desktop-service.js';
 export async function desktopBridgeRestage(options = {}) {
     const skip = (reason) => ({ ok: true, status: 'ok', actions: [reason], blockers: [], warnings: [] });
     const warn = (warnings) => ({ ok: true, status: 'ok', actions: [], blockers: [], warnings });
     const env = options.env || process.env;
+    const platform = options.platform || process.platform;
     const version = options.packageVersion || PACKAGE_VERSION;
-    const reachesRealLaunchd = !(options.run && options.bootstrapService);
-    if ((options.platform || process.platform) !== 'darwin')
+    if (platform !== 'darwin')
         return skip('desktop_bridge_restage_not_macos');
-    if (reachesRealLaunchd && (env.NODE_TEST_CONTEXT !== undefined || env.SKS_TEST_ISOLATION === '1')) {
+    const reachesRealLaunchd = !(options.serviceStatus && options.executeCommand);
+    const isolated = [process.env, env].some((candidate) => candidate.NODE_TEST_CONTEXT !== undefined
+        || candidate.SKS_TEST_ISOLATION === '1'
+        || candidate.SKS_RELEASE_UPGRADE_SMOKE === '1');
+    if (reachesRealLaunchd && isolated)
         return skip('desktop_bridge_restage_skipped_under_tests');
-    }
     if (env.SKS_SKIP_BRIDGE_RESTAGE === '1')
         return skip('desktop_bridge_restage_disabled');
     const home = options.home || path.resolve(env.HOME || os.homedir());
     const paths = desktopBridgeServicePaths(home);
     if (!(await exists(paths.launch_agent_path)))
         return skip('desktop_bridge_restage_no_launch_agent');
-    const state = await readJson(paths.state_path, null);
-    const runningVersion = typeof state?.sks_version === 'string' ? state.sks_version : null;
-    const pid = typeof state?.pid === 'number' && Number.isInteger(state.pid) && state.pid > 1 ? state.pid : null;
-    if (pid === null || !(options.processAlive || processAlive)(pid)) {
-        if (!(await exists(paths.settings_path)))
-            return skip('desktop_bridge_restage_no_managed_bridge');
-        const bootstrap = await (options.bootstrapService || bootstrapExistingDesktopBridgeService)({ home })
-            .catch(() => null);
-        if (bootstrap?.running) {
-            return {
-                ok: true,
-                status: 'ok',
-                actions: [`desktop_bridge_bootstrapped:${version}`],
-                blockers: [],
-                warnings: bootstrap.blockers.map((blocker) => `desktop_bridge_restage_bootstrap_incomplete:${blocker}`)
-            };
-        }
-        return warn([
-            ...(bootstrap?.blockers || ['desktop_bridge_restage_bootstrap_failed'])
-                .map((blocker) => `desktop_bridge_restage_bootstrap_incomplete:${blocker}`),
-            'Desktop Bridge is installed but not running: run `sks bridge repair` from your home directory'
-        ]);
-    }
-    if (runningVersion === version)
+    if (!(await exists(paths.settings_path)))
+        return skip('desktop_bridge_restage_no_managed_bridge');
+    const serviceOptions = { home, env, platform };
+    const statusImpl = options.serviceStatus || desktopBridgeServiceStatus;
+    const before = await statusImpl(serviceOptions).catch(() => null);
+    const runningVersion = desktopBridgeRuntimeVersion(before?.state);
+    if (before?.ok && before.running && before.loaded && runningVersion === version) {
         return skip('desktop_bridge_restage_already_current');
-    const uid = options.uid === undefined
-        ? (typeof process.getuid === 'function' ? process.getuid() : null)
-        : options.uid;
-    if (uid === null)
-        return skip('desktop_bridge_restage_no_uid');
-    const kick = await (options.run || runProcess)('/bin/launchctl', ['kickstart', '-k', `gui/${uid}/com.sneakoscope.desktop-bridge`], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 }).catch(() => null);
-    if (!kick || kick.code !== 0) {
-        return warn([`desktop_bridge_restage_kickstart_failed:${runningVersion || 'pre-8.6.2'}`]);
     }
-    return {
-        ok: true, status: 'ok',
-        actions: [`desktop_bridge_restarted:${runningVersion || 'pre-8.6.2'}:${version}`],
-        blockers: [], warnings: []
-    };
+    const repair = await (options.executeCommand || executeDesktopBridgeCommandV3)({ operation: 'repair' }, serviceOptions).catch(() => null);
+    const after = await statusImpl(serviceOptions).catch(() => null);
+    const repairedVersion = desktopBridgeRuntimeVersion(after?.state);
+    const command = repair?.schema === 'sks.desktop-bridge-command-result.v1' ? repair : null;
+    const commandBlockers = command?.execution.blockers || [];
+    if (command?.ok && command.execution.ok && commandBlockers.length === 0
+        && after?.ok && after.running && after.loaded && repairedVersion === version) {
+        return {
+            ok: true,
+            status: 'ok',
+            actions: [before?.running
+                    ? `desktop_bridge_restarted:${runningVersion || 'pre-8.6.2'}:${version}`
+                    : `desktop_bridge_bootstrapped:${version}`],
+            blockers: [],
+            warnings: []
+        };
+    }
+    const incomplete = [...new Set([
+            ...commandBlockers,
+            ...(after?.blockers || []),
+            ...(!command?.ok || !command.execution.ok ? ['desktop_bridge_repair_failed'] : []),
+            ...(!after?.running || !after.loaded ? ['desktop_bridge_service_not_running'] : []),
+            ...(repairedVersion !== version
+                ? [`desktop_bridge_runtime_version_unverified:${repairedVersion || 'unknown'}:${version}`]
+                : [])
+        ])];
+    return warn([
+        ...incomplete.map((blocker) => `desktop_bridge_restage_incomplete:${blocker}`),
+        'Desktop Bridge update repair incomplete: run `sks bridge repair` from your home directory'
+    ]);
 }
 export function runDesktopBridgeRestageStage() {
     return desktopBridgeRestage();
 }
-function processAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '10.1.2';
+export const PACKAGE_VERSION = '10.1.3';

package/dist/native/sks-menubar/Sources/AuthPriorityState.swift

@@ -26,7 +26,7 @@ struct AuthPriorityState: Equatable {
             switch error {
             case "codex_lb_provider_disabled": return "On, unavailable · enable Codex-LB below"
             case "codex_lb_credential_missing": return "On, unavailable · connect your Codex-LB account below"
-            case "desktop_bridge_not_running": return "On, unavailable · open Bridge diagnostics and repair the bridge service"
+            case "desktop_bridge_not_running", "desktop_bridge_runtime_not_ready": return "On, unavailable · open Bridge diagnostics and repair the bridge service"
             case "codex_lb_route_not_ready", "codex_lb_eligible_route_missing": return "On, unavailable · validate Codex-LB and refresh its model catalog"
             default: return "On, unavailable · check your Codex-LB connection below"
             }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "10.1.2",
+  "version": "10.1.3",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",