sneakoscope 10.3.2 → 10.3.4

package/dist/core/update/update-migration-state.js

@@ -17,6 +17,7 @@ import { runSessionStateSplitStage } from './update-migration-state/session-stat
 import { runRetiredLocalDecisionStage } from './update-migration-state/retired-local-decision.js';
 import { runHookTrustRefreshStage, runOtherHarnessCleanupStage } from './update-migration-state/simple-stages.js';
 import { compareSemVer } from './semver.js';
+import { repairManagedPermissions } from './managed-permission-repair.js';
 export const UPDATE_MIGRATION_SCHEMA = 'sks.project-migration-receipt.v2';
 export const INSTALLATION_EPOCH_SCHEMA = 'sks.installation-epoch.v1';
 export function installationEpochPath() {
@@ -95,8 +96,11 @@ export async function clearPendingUpdateMigration() {
 export async function writeProjectUpdateMigrationReceipt(input) {
     const receiptPath = projectUpdateMigrationReceiptPath(input.root);
     const epoch = await ensureInstallationEpoch(input.source);
+    const fromVersion = input.fromVersion || null;
+    const permissionStage = await runManagedPermissionRepairStage(input.root, fromVersion);
     const retentionCleanup = await runUpdateRetentionCleanup(input.root, input.source);
-    const migrationStageRuns = await runUpdateMigrationStages(input.root, { fromVersion: input.fromVersion || null });
+    const stageRuns = await retryStagesAfterPermissionRepair(input.root, fromVersion, await runUpdateMigrationStages(input.root, { fromVersion }));
+    const migrationStageRuns = [permissionStage, ...stageRuns];
     const migrationStages = migrationStageRuns.map(summarizeMigrationStage);
     const stageBlockers = migrationStageRuns.flatMap((stage) => stage.blockers.map((blocker) => `${stage.id}:${blocker}`));
     const stageWarnings = migrationStageRuns.flatMap((stage) => stage.warnings.map((warning) => `${stage.id}:${warning}`));
@@ -144,8 +148,64 @@ export async function writeProjectUpdateMigrationReceipt(input) {
         warnings: optionalWarnings
     };
     await writeReceiptRotated(receiptPath, receipt, { keep: 5 });
+    if (process.getuid?.() === 0) {
+        await repairManagedPermissions({ root: input.root, env: process.env, explicit: true, reportPath: null }).catch(() => null);
+    }
     return receipt;
 }
+export const MANAGED_PERMISSION_REPAIR_STAGE_ID = 'managed-permission-repair';
+function migrationRunIsExplicit(env) {
+    return env.SKS_UPDATE_DEFER_MENUBAR_RESTART === '1' || env.SKS_UPDATE_MIGRATION_GATE_DISABLED !== '1';
+}
+async function runManagedPermissionRepairStage(root, fromVersion) {
+    const base = {
+        schema: 'sks.update-migration-stage.v2',
+        id: MANAGED_PERMISSION_REPAIR_STAGE_ID,
+        min_from_version: '0.0.0',
+        from_version: fromVersion
+    };
+    try {
+        const report = await repairManagedPermissions({ root, env: process.env, explicit: migrationRunIsExplicit(process.env) });
+        const elevation = report.elevation;
+        return {
+            ...base,
+            ok: true,
+            status: 'ok',
+            actions: [
+                ...(report.user_fixed ? [`fixed_user_permissions:${report.user_fixed}`] : []),
+                ...(elevation.needed ? [`elevation:${elevation.channel}:${elevation.ok === true ? 'granted' : elevation.declined ? 'declined' : 'not_granted'}`] : [])
+            ],
+            blockers: [],
+            warnings: report.warnings,
+            detail: {
+                issues_found: report.issues_found,
+                user_fixed: report.user_fixed,
+                elevation,
+                remaining: report.remaining,
+                operator_actions: report.operator_actions
+            }
+        };
+    }
+    catch (err) {
+        return { ...base, ok: true, status: 'ok', actions: [], blockers: [], warnings: [`managed_permission_repair_failed:${err?.message || String(err)}`] };
+    }
+}
+async function retryStagesAfterPermissionRepair(root, fromVersion, runs) {
+    const failed = runs.filter((run) => !run.ok);
+    if (!failed.length)
+        return runs;
+    const report = await repairManagedPermissions({
+        root,
+        env: process.env,
+        explicit: migrationRunIsExplicit(process.env),
+        reportPath: path.join(root, '.sneakoscope', 'reports', 'managed-permission-repair-retry.json')
+    }).catch(() => null);
+    if (!report || (report.user_fixed === 0 && report.elevation.ok !== true))
+        return runs;
+    const rerun = await runUpdateMigrationStages(root, { fromVersion, only: new Set(failed.map((run) => run.id)) });
+    const byId = new Map(rerun.map((run) => [run.id, { ...run, warnings: [...run.warnings, 'rerun_after_permission_repair'] }]));
+    return runs.map((run) => byId.get(run.id) || run);
+}
 function summarizeMigrationStage(stage) {
     return {
         id: stage.id,
@@ -283,6 +343,8 @@ export async function runUpdateMigrationStages(root, opts = {}) {
     const fromVersion = opts.fromVersion || null;
     const runs = [];
     for (const stage of UPDATE_MIGRATION_STAGES) {
+        if (opts.only && !opts.only.has(stage.id))
+            continue;
         if (!legacyStageApplies(fromVersion, stage.min_from_version)) {
             runs.push({
                 schema: 'sks.update-migration-stage.v2',

package/dist/core/update-check.js

@@ -12,6 +12,7 @@ import { compareSemVer, extractSemVer, parseSemVer } from './update/semver.js';
 import { countUpdates, emptyUpdateStatus, resolveSksUpdateStatus, UpdateStatusRefreshError } from './update/update-status.js';
 import { acquireUpdateOperationLock, authorizeUpdateRollback, buildUpdateNowCommand, buildUpdateRollbackCommand, canonicalUpdateRegistry, UpdateOperationRecorder, updateOperationLastInstallPath, updateReceiptHasConfirmedGlobalInstall } from './update/update-operation.js';
 import { runTemporaryInstallSmoke } from './update/temporary-install-smoke.js';
+import { npmGlobalInstallTargets, repairManagedPermissions } from './update/managed-permission-repair.js';
 import { updateStageFailureDiagnostics } from './update/update-stage-diagnostics.js';
 import { executableOnInjectedPath, inspectInstalledCliResolution } from './update/installed-cli-resolution.js';
 import { ui as cliUi, withHeartbeat } from '../cli/cli-theme.js';
@@ -400,6 +401,7 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
     const stages = [];
     let temporaryInstallSmoke = null;
     await options.beforeOperationLock?.();
+    await repairManagedPermissions({ root: projectReceiptRoot, env, explicit: true, interactive: true }).catch(() => null);
     const operationLock = await acquireUpdateOperationLock(env);
     if (!operationLock.ok) {
         stages.push({
@@ -887,18 +889,43 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                 command,
                 target_version: installVersion
             });
-        const install = alreadyCurrent
+        const runGlobalInstall = () => updateHeartbeat(machineOutput, `npm install -g ${packageName}`, guardedPackageInstall(guardContextForRoute(mutationLedgerRoot, installContract, command || `npm global install ${packageName}`), `${packageName}@${installVersion}`, installOptions), 60_000).catch((err) => ({
+            code: 1,
+            stdout: '',
+            stderr: err instanceof Error ? err.message : String(err),
+            timedOut: false
+        }));
+        let install = alreadyCurrent
             ? { code: 0, stdout: '', stderr: '', timedOut: false }
             : env.SKS_UPDATE_FAKE_INSTALL === '1'
                 ? { code: 0, stdout: 'fake install ok', stderr: '', timedOut: false }
-                : await updateHeartbeat(machineOutput, `npm install -g ${packageName}`, guardedPackageInstall(guardContextForRoute(mutationLedgerRoot, installContract, command || `npm global install ${packageName}`), `${packageName}@${installVersion}`, installOptions), 60_000).catch((err) => ({
-                    code: 1,
-                    stdout: '',
-                    stderr: err instanceof Error ? err.message : String(err),
-                    timedOut: false
-                }));
+                : await runGlobalInstall();
+        let installPermissionRepair = null;
+        if (install.code !== 0 && !alreadyCurrent && globalRoot && /\b(EACCES|EPERM)\b/.test(`${install.stderr}\n${install.stdout}`)) {
+            const targets = await npmGlobalInstallTargets(globalRoot, packageName).catch(() => []);
+            const repair = targets.length
+                ? await repairManagedPermissions({
+                    root: projectReceiptRoot,
+                    env,
+                    explicit: true,
+                    interactive: true,
+                    targets,
+                    reason: 'SKS update needs administrator permission to let npm replace the installed SKS package.',
+                    reportPath: null
+                }).catch(() => null)
+                : null;
+            const repaired = Boolean(repair && (repair.user_fixed > 0 || repair.elevation.ok === true));
+            installPermissionRepair = { channel: repair?.elevation.channel || 'unavailable', granted: repair?.elevation.ok ?? null, retried: repaired };
+            if (repaired)
+                install = await runGlobalInstall();
+        }
         const installOk = install.code === 0;
-        stage('global_install', installOk, alreadyCurrent ? 'skipped_current' : installOk ? env.SKS_UPDATE_FAKE_INSTALL === '1' ? 'fake_installed' : 'installed' : 'failed', { command, code: install.code, timed_out: install.timedOut === true });
+        stage('global_install', installOk, alreadyCurrent ? 'skipped_current' : installOk ? env.SKS_UPDATE_FAKE_INSTALL === '1' ? 'fake_installed' : 'installed' : 'failed', {
+            command,
+            code: install.code,
+            timed_out: install.timedOut === true,
+            ...(installPermissionRepair ? { permission_repair: installPermissionRepair } : {})
+        });
         let newBinary = null;
         let newVersion = null;
         let installedCliResolution = null;

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '10.3.2';
+export const PACKAGE_VERSION = '10.3.4';

package/dist/scripts/codex-native-agent-role-content-check.js

@@ -5,6 +5,11 @@ import os from 'node:os';
 import { parse } from 'smol-toml';
 import { syncCodexAgentRoles } from '../core/codex-app/codex-agent-role-sync.js';
 import { MANAGED_OFFICIAL_SUBAGENT_ROLES } from '../core/managed-assets/managed-assets-manifest.js';
+import { latestModelForTier } from '../core/subagents/model-tiers.js';
+const fast = latestModelForTier('fast');
+const balanced = latestModelForTier('balanced');
+const context = latestModelForTier('context');
+const deep = latestModelForTier('deep');
 const root = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'sks-agent-role-content-'));
 const codexHome = path.join(root, 'codex-home');
 const report = await syncCodexAgentRoles({ root, codexHome, apply: true, agentTypeSupported: true });
@@ -12,16 +17,16 @@ const expert = await fs.promises.readFile(path.join(root, '.codex', 'agents', 'e
 const worker = await fs.promises.readFile(path.join(root, '.codex', 'agents', 'worker.toml'), 'utf8');
 const implementation = await fs.promises.readFile(path.join(root, '.codex', 'agents', 'implementation-specialist.toml'), 'utf8');
 const browser = await fs.promises.readFile(path.join(root, '.codex', 'agents', 'browser-use-operator.toml'), 'utf8');
-assertGate(expert.includes('model = "gpt-6-astra"') && expert.includes('model_reasoning_effort = "max"'), 'expert role must use Astra Max');
-assertGate(worker.includes('model = "gpt-6-astra"') && worker.includes('model_reasoning_effort = "low"'), 'worker role must use Astra Low');
-assertGate(implementation.includes('model = "gpt-6-astra"') && implementation.includes('model_reasoning_effort = "low"'), 'implementation role must use Astra Low');
-assertGate(browser.includes('model = "gpt-6-astra"') && browser.includes('model_reasoning_effort = "medium"'), 'browser role must use Astra Medium');
+assertGate(expert.includes(`model = "${deep}"`) && expert.includes('model_reasoning_effort = "max"'), 'expert role must use the deep tier at max');
+assertGate(worker.includes(`model = "${fast}"`) && worker.includes('model_reasoning_effort = "low"'), 'worker role must use the fast tier at low');
+assertGate(implementation.includes(`model = "${balanced}"`) && implementation.includes('model_reasoning_effort = "low"'), 'implementation role must use the balanced tier at low');
+assertGate(browser.includes(`model = "${context}"`) && browser.includes('model_reasoning_effort = "medium"'), 'browser role must use the context tier at medium');
 assertGate(expert.includes('Do not spawn another subagent.') && worker.includes('Do not redesign the task, expand scope, or spawn another subagent.'), 'official roles must prohibit nested delegation');
 assertGate(MANAGED_OFFICIAL_SUBAGENT_ROLES.length === 25, 'official role catalog must contain all 25 roles');
 for (const role of MANAGED_OFFICIAL_SUBAGENT_ROLES) {
     const text = await fs.promises.readFile(path.join(root, '.codex', 'agents', role.filename), 'utf8');
     const doc = parse(text);
-    assertGate(doc.model === 'gpt-6-astra', `official role managed model mismatch:${role.codex_name}`);
+    assertGate([fast, balanced, context, deep].includes(String(doc.model)), `official role managed model is not a current tier model:${role.codex_name}`);
     assertGate(doc.name === role.codex_name && doc.model === role.model && doc.model_reasoning_effort === role.model_reasoning_effort, `official role policy mismatch:${role.codex_name}`);
     assertGate(Object.hasOwn(doc, 'sandbox_mode') === (role.sandbox === 'read-only'), `official role sandbox inheritance mismatch:${role.codex_name}`);
     assertGate(doc.sandbox_mode === role.sandbox, `official role sandbox value mismatch:${role.codex_name}`);

package/dist/scripts/codex-native-gate-lib.js

@@ -281,7 +281,9 @@ async function agentRoleContent(id) {
         const codexHome = path.join(tmp, 'codex-home');
         const report = await mod.syncCodexAgentRoles({ root: tmp, codexHome, apply: true });
         const role = fs.readFileSync(path.join(tmp, '.codex', 'agents', 'worker.toml'), 'utf8');
-        assertGate(role.includes('model = "gpt-6-astra"') && role.includes('Work only on the exact slice assigned by the parent agent.'), 'official worker role content incomplete', { role, report });
+        const tiers = await importDist('core/subagents/model-tiers.js');
+        const fastModel = String(tiers.latestModelForTier('fast'));
+        assertGate(role.includes(`model = "${fastModel}"`) && role.includes('Work only on the exact slice assigned by the parent agent.'), 'official worker role content incomplete', { role, report, fastModel });
         assertGate(!fs.existsSync(path.join(codexHome, 'agents')), 'agent role content gate must not create global directive roles', report);
     }
     finally {

package/dist/scripts/current-surface-update-e2e-check.js

@@ -8,6 +8,7 @@ import { PACKAGE_VERSION, packageRoot, readJson, writeReceiptRotated } from '../
 import { runSksUpdateNow } from '../core/update-check.js';
 import { ensureCurrentMigrationBeforeCommand, projectUpdateMigrationReceiptPath, runPackageLocalDoctor } from '../core/update/update-migration-state.js';
 const REQUIRED_MIGRATION_STAGES = [
+    'managed-permission-repair',
     'other-harness-cleanup',
     'retired-local-decision',
     'current-public-surface-reconcile',

package/dist/scripts/mutation-callsite-coverage-check.js

@@ -215,9 +215,9 @@ function risksForCall(call) {
             && /\b(?:install|i|add|uninstall|remove|publish)\b/.test(call.normalized_call)) {
             risks.push({ kind: 'package_install', token: 'runProcess(npm/brew)' });
         }
-        if (/^['"]xattr['"]$/.test(firstArgument.trim()))
+        if (/^['"](?:\/usr\/bin\/)?xattr['"]$/.test(firstArgument.trim()))
             risks.push({ kind: 'xattr', token: 'xattr' });
-        if (/^['"]chflags['"]$/.test(firstArgument.trim()))
+        if (/^['"](?:\/usr\/bin\/)?chflags['"]$/.test(firstArgument.trim()))
             risks.push({ kind: 'chflags', token: 'chflags' });
     }
     if (callee && ['spawn', 'spawnSync', 'child_process.spawn', 'child_process.spawnSync'].includes(callee)

package/dist/scripts/release-affected-selector-check.js

@@ -85,8 +85,7 @@ for (const changedFile of [
     'src/core/routes.ts',
     'src/core/subagents/naruto-help-contract.ts',
     'src/core/commands/naruto-command.ts',
-    'src/bin/fast-inline.ts',
-    'test/blackbox/official-subagent-workflow-packed.test.mjs'
+    'src/bin/fast-inline.ts'
 ]) {
     const selectedForPolicy = selectorMod.selectAffectedReleaseGates(root, manifest, gates, {
         changedFiles: [changedFile],

package/dist/scripts/typed-routing-gate-lib.js

@@ -230,7 +230,9 @@ async function richContentGate(id) {
         const codexHome = path.join(rootDir, 'codex-home');
         const report = await mod.syncCodexAgentRoles({ root: rootDir, codexHome, apply: true });
         const role = fs.readFileSync(path.join(rootDir, '.codex', 'agents', 'expert.toml'), 'utf8');
-        assertGate(role.includes('model = "gpt-6-astra"') && role.includes('Do not spawn another subagent.'), 'official expert role must include Astra Max and no-nesting instructions', { role, report });
+        const tiers = await importDist('core/subagents/model-tiers.js');
+        const deep = tiers.latestModelForTier('deep');
+        assertGate(role.includes(`model = "${deep}"`) && role.includes('Do not spawn another subagent.'), 'official expert role must use the latest deep-tier model and no-nesting instructions', { role, report });
         assertGate(!fs.existsSync(path.join(codexHome, 'agents')), 'rich-content sync must not create global directive roles', report);
         emitGate(id, { roles: report.created.length });
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "10.3.2",
+  "version": "10.3.4",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",

package/release-gates.v2.json

@@ -2203,8 +2203,7 @@
           "src/core/proof/**",
           "src/core/trust-kernel/**",
           "src/scripts/proof-root-cause-policy-check.ts",
-          "test/unit/route-completion-contract.test.mjs",
-          "test/integration/route-proof-adapters.test.mjs"
+          "test/unit/route-completion-contract.test.mjs"
         ]
       },
       "isolation": {
@@ -3240,7 +3239,6 @@
           "src/cli/__tests__/router-active-naruto.test.ts",
           "src/bin/fast-inline.ts",
           "src/bin/sks-dispatch.ts",
-          "test/blackbox/official-subagent-workflow-packed.test.mjs",
           "src/core/release/release-gate-affected-selector.ts",
           "src/core/release/__tests__/release-gate-affected-selector.test.ts"
         ]
@@ -4556,9 +4554,7 @@
           "src/scripts/all-feature-deep-completion-check.ts",
           "docs/feature-inventory.md",
           "test/unit/feature-registry.test.mjs",
-          "test/unit/all-feature-deep-completion.test.mjs",
-          "test/integration/all-feature-deep-completion.test.mjs",
-          "test/blackbox/all-feature-deep-completion-packed.test.mjs"
+          "test/unit/all-feature-deep-completion.test.mjs"
         ]
       },
       "isolation": {