sneakoscope 10.3.3 → 10.3.5

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.3**. Install the latest stable release from npm.
+Current package: **SKS 10.3.5**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 
@@ -39,7 +39,7 @@ sks bootstrap --yes
 
 | Capability | What you get |
 | --- | --- |
-| Focused execution | Small tasks stay lightweight; independent work can use official Codex subagents with parent-owned integration. |
+| Focused execution | Answers and tiny edits stay lightweight; implementation work runs through official Codex subagents while the parent orchestrates and integrates. |
 | Project context | TriWiki indexes repository code and supplies bounded context that can be checked against source. |
 | Verification | Tests, diagnostics, and release evidence support completion claims. Security and data-integrity checks stay in place. |
 | Native controls | SKS Center brings connections, updates, MCP servers, and diagnostics together on macOS. |
@@ -104,6 +104,7 @@ home directory; set `SKS_POSTINSTALL_MENUBAR=1` to force the build in a script,
 | Connections | Connect Codex-LB or OpenRouter, choose authentication priority, and manage exposed models. |
 | Updates | Check and update SKS and Codex CLI, with operation progress and recovery details. |
 | MCP Servers | Manage server configuration, health checks, and authentication. |
+| Image Generation | Keep Codex's default image generation, or route it through the Desktop Bridge to an OpenRouter image model you pick. |
 | Diagnostics | Inspect issues and run targeted checks. |
 | Settings | Configure lifecycle behavior, notifications, and advanced options. |
 | Remote Coding | Find the independent [Paseo companion](https://paseo.sh/docs) and its setup guidance. |
@@ -136,18 +137,227 @@ Enter credentials through the native connection dialog or the CLI's
 `--api-key-stdin` option. See the [provider guide](docs/codex-lb.md) for
 configuration, transport checks, and recovery commands.
 
+## Image generation
+
+SKS image routes (image generation, UX-Review callouts, PPT assets, slide
+reviews) follow one image mode. By default they use Codex's own image
+generation. Turn on a custom image model on the **Image Generation** page to
+send every SKS image through the Desktop Bridge to an OpenRouter image model
+you pick. SKS pins no image model and records which model made each image.
+
+```sh
+sks imagegen status --json
+sks imagegen models --json
+sks imagegen enable --model black-forest-labs/flux.2-klein-4b
+sks imagegen generate --prompt "App icon, flat, blue" --out icon.png
+sks imagegen disable
+```
+
+See [Image generation](docs/image-generation.md) for both modes, evidence
+sidecars, and the Jev choices.
+
 ## Naruto workflow
 
-SKS enforces GPT-6 Astra for every managed child and varies effort by task.
-The parent owns decomposition, integration,
-and final verification; children receive bounded tasks and do not spawn children.
+The parent orchestrates: it decomposes the task, spawns a child for each
+disjoint slice, waits, and owns integration and final verification. It does not
+implement slices itself. The SKS PreToolUse hook denies parent source edits
+until the first child starts and while children are still running. Children
+receive bounded tasks and do not spawn children.
+
+No model family is pinned. Every child runs the newest model of the tier its
+work needs, read from the Codex models cache, so a new model family is used as
+soon as Codex lists it:
+
+| Work | Tier | Effort | Today |
+| --- | --- | --- | --- |
+| Tiny mechanical tasks | fast | low | `gpt-6-luna` |
+| Instructed implementation | balanced | low | `gpt-6-sol` |
+| Exploration, large-context reads, and direct tool operation | context | medium | `gpt-6-sol` |
+| Planning, review, debugging, and focused judgment | deep | max | `gpt-6-astra` |
+
+With Jev mode on, Jev picks the tier for every spawn, every gated parent edit,
+the plan, and the context, so the parent spends no time on those choices. It
+also picks the pipeline for each prompt; an explicit SKS `<div align="center">
+
+<img src="docs/assets/sks-logo.svg" alt="Sneakoscope Codex logo" width="120" height="120" />
+
+# Sneakoscope Codex
+
+**Plan, build, and verify with Codex.**
+
+[![npm version](https://img.shields.io/npm/v/sneakoscope?color=cb3837&logo=npm)](https://www.npmjs.com/package/sneakoscope)
+[![node](https://img.shields.io/badge/node-%3E%3D20.11-339933?logo=node.js&logoColor=white)](#requirements)
+[![license](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+</div>
+
+<!-- BEGIN SKS SEARCH VISIBILITY MARKETING -->
+Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
+<!-- END SKS SEARCH VISIBILITY MARKETING -->
+
+Current package: **SKS 10.3.5**. Install the latest stable release from npm.
+
+[Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
+
+## Install in one command
+
+```sh
+npm exec --yes --package=sneakoscope@latest -- sneakoscope install --yes
+```
+
+The installer resolves the latest release, installs it globally, runs setup and
+Doctor, and checks that `sks` on your PATH points to the installed version.
+
+To set up a project, run this from its root, then open it in Codex:
+
+```sh
+sks bootstrap --yes
+```
+
+## What SKS adds
+
+| Capability | What you get |
+| --- | --- |
+| Focused execution | Answers and tiny edits stay lightweight; implementation work runs through official Codex subagents while the parent orchestrates and integrates. |
+| Project context | TriWiki indexes repository code and supplies bounded context that can be checked against source. |
+| Verification | Tests, diagnostics, and release evidence support completion claims. Security and data-integrity checks stay in place. |
+| Native controls | SKS Center brings connections, updates, MCP servers, and diagnostics together on macOS. |
+| Consistent setup | `sks update` installs the latest release, runs Doctor, and reconciles SKS-managed files and legacy assets. |
+
+The default `essential` profile avoids repetitive completion rituals. `strict`
+adds stronger completion requirements. See [Essential Trust](docs/essential-trust.md).
+
+With Codex-LB connected, `sks agent-bridge async --prompt "Check SKS status while
+explaining what the check covers" --tools status --json` runs native Astra Async
+tool calling with selected read-only SKS tools, using WebSocket first and safe
+HTTP fallback. See [Astra guidance](docs/astra-guidance.md)
+for setup boundaries and reported execution evidence.
+
+## Everyday commands
+
+SKS enables experimental Astra context management by default during setup and
+repair. Turn it off in **SKS Center → Settings → Astra context management**, or
+use `sks codex-app context-management off`. Updates preserve an explicit opt-out.
+Start a new task after changing the setting. Availability depends on a supported
+Codex client and eligible ChatGPT sign-in; API-key and custom-provider sessions
+may not activate it. See [OpenAI's context management guidance](https://learn.chatgpt.com/docs/models#experimental-context-management).
+
+Use these inside a Codex conversation:
+
+| Command | Purpose |
+| --- | --- |
+| `$sks-plan "task"` | Create a plan without editing product code. |
+| `$sks-work` | Execute the latest plan. |
+| `$sks-naruto "task"` | Run an official subagent workflow. |
+| `$sks-review` | Review the current changes. |
+| `$sks-help` | Explore available SKS workflows. |
+
+Use these in your terminal:
+
+```sh
+sks --help
+sks status --json
+sks review --staged
+sks doctor --json
+sks update-check
+sks update
+```
+
+`sks update` runs setup reconciliation even when the package is already current.
+It preserves user-authored configuration and cleans up recognized SKS-owned
+legacy assets. If a check needs attention, follow its reported recovery action
+in your terminal.
+
+## SKS Center (macOS)
+
+Open **SKS Control Center** from the SKS menu bar.
+The Menu Bar app (with the Control Center) is built from source on macOS when you run
+`npm i -g sneakoscope` interactively in a terminal, and by `sks install`, `sks doctor --fix`,
+`sks update`, or `sks menubar install`. Dependency, CI, and piped installs never touch your
+home directory; set `SKS_POSTINSTALL_MENUBAR=1` to force the build in a script, or
+`SKS_POSTINSTALL_NO_MENUBAR=1` to skip it.
+
+| Page | Use it to |
+| --- | --- |
+| Overview | Check local health and find the next action. |
+| Connections | Connect Codex-LB or OpenRouter, choose authentication priority, and manage exposed models. |
+| Updates | Check and update SKS and Codex CLI, with operation progress and recovery details. |
+| MCP Servers | Manage server configuration, health checks, and authentication. |
+| Image Generation | Keep Codex's default image generation, or route it through the Desktop Bridge to an OpenRouter image model you pick. |
+| Diagnostics | Inspect issues and run targeted checks. |
+| Settings | Configure lifecycle behavior, notifications, and advanced options. |
+| Remote Coding | Find the independent [Paseo companion](https://paseo.sh/docs) and its setup guidance. |
+
+Connection controls appear first. Model catalogs, bridge diagnostics, and
+advanced settings expand when you need them.
+
+## Desktop Bridge
+
+One local bridge manages routing for independent **Codex-LB** and **OpenRouter**
+profiles. ChatGPT sign-in remains owned by Codex. Provider choices and existing
+session pins remain authoritative; unavailable routes are reported explicitly.
+
+In **Connections**, turn on **Prefer Codex-LB** to use the saved Codex-LB
+connection first for eligible models. The switch distinguishes a saved preference
+from connection readiness: **on but unavailable** means setup needs attention.
+Turning it off restores the configured official-model routing preference.
+
+The same controls are available from the CLI:
+
+```sh
+sks bridge auth-priority status --json
+sks bridge auth-priority on --json
+sks bridge auth-priority off --json
+sks bridge status --json
+sks bridge route explain gpt-6-astra --json
+```
+
+Enter credentials through the native connection dialog or the CLI's
+`--api-key-stdin` option. See the [provider guide](docs/codex-lb.md) for
+configuration, transport checks, and recovery commands.
+
+## Image generation
+
+SKS image routes (image generation, UX-Review callouts, PPT assets, slide
+reviews) follow one image mode. By default they use Codex's own image
+generation. Turn on a custom image model on the **Image Generation** page to
+send every SKS image through the Desktop Bridge to an OpenRouter image model
+you pick. SKS pins no image model and records which model made each image.
+
+```sh
+sks imagegen status --json
+sks imagegen models --json
+sks imagegen enable --model black-forest-labs/flux.2-klein-4b
+sks imagegen generate --prompt "App icon, flat, blue" --out icon.png
+sks imagegen disable
+```
+
+See [Image generation](docs/image-generation.md) for both modes, evidence
+sidecars, and the Jev choices.
+
+## Naruto workflow
 
-| Work | Managed model | Effort |
-| --- | --- | --- |
-| Tiny mechanical tasks | GPT-6 Astra | low |
-| Exploration, large-context reads, and direct tool operation | GPT-6 Astra | medium |
-| Implementation | GPT-6 Astra | high |
-| Review, debugging, and focused judgment | GPT-6 Astra | max |
+The parent orchestrates: it decomposes the task, spawns a child for each
+disjoint slice, waits, and owns integration and final verification. It does not
+implement slices itself. The SKS PreToolUse hook denies parent source edits
+until the first child starts and while children are still running. Children
+receive bounded tasks and do not spawn children.
+
+No model family is pinned. Every child runs the newest model of the tier its
+work needs, read from the Codex models cache, so a new model family is used as
+soon as Codex lists it:
+
+| Work | Tier | Effort | Today |
+| --- | --- | --- | --- |
+| Tiny mechanical tasks | fast | low | `gpt-6-luna` |
+| Instructed implementation | balanced | low | `gpt-6-sol` |
+| Exploration, large-context reads, and direct tool operation | context | medium | `gpt-6-sol` |
+| Planning, review, debugging, and focused judgment | deep | max | `gpt-6-astra` |
+
+With Jev mode on, Jev picks the tier for every spawn, every gated parent edit,
+the plan, and the context, so the parent spends no time on those choices. It
+ command always
+wins. A stored role-model preference on a current model wins in both modes.
 
 An active Codex task keeps the user's selected main model, effort, and service
 tier. Codex native `/goal` remains the persisted goal owner. Parallelism depends

package/config/skills-hash-ledger.v1.json

@@ -4,6 +4,7 @@
     {
       "canonical_name": "sks",
       "trusted_sha256": [
+        "8aa34586ba331f0447668c2ce863fe6c9ec4f881828ebed26ca5ecc754d66840",
         "d0288d27c8bc1c89decb258c6805ed4286cd0d65371ef0eec453be233b39a2a1",
         "905fc5472d36f0780b56f0e09404f42ea20293b1a4615d2050b7db3043231dbd",
         "6d90142f3617a8ae92d9af8cb2fc18ab58a7d0070868504e1fe89e0effc305a5",
@@ -13,6 +14,7 @@
     {
       "canonical_name": "sks-align",
       "trusted_sha256": [
+        "9eef36214be7e07a963eb36bb1df2c025cd0578b7419ddf4fd307081a2b62093",
         "b9db40d6e1dd2fc6e4665a2b30738d370da955cd4d6e86c88bd85059c7faa08c",
         "c485f39d4873adb9793672f7dcf4e956595ffb9dcbb032b3ffb0515b5857d31d",
         "e98e1b67e228bec5c37d00c0206a2e01d2da698a83c80b527105bf04a19c136a"
@@ -55,6 +57,7 @@
     {
       "canonical_name": "sks-commit",
       "trusted_sha256": [
+        "63cad87de9187f67e001949b0edcf39344626748f8f168bed257316dc1684d53",
         "aa2eeaa6be6d635170a8ecfc76353db95552f543cca107f239054c492409e3a9",
         "aea41328993b11e26e26ae94df6ed44312d1570ed39448531428b53ade9d7461",
         "943c6dcf822df086b320140e74404d4c7bcfd531264e25ada6624b5009f26207"
@@ -63,6 +66,7 @@
     {
       "canonical_name": "sks-commit-and-push",
       "trusted_sha256": [
+        "2307093e26513a26e71ac6cdfcf3fd1598979c6035525ee5d3de58820cb4adda",
         "acd6c7845c58d72234776e4608e1440583c62c38b513625d1272e4a413a40fb6",
         "8e4ff7a39440c82e6c67a67d5bb267c69f508cedb5d9d5a93261f4dcdf8e8a1a",
         "b005b4a7456b80b95768ad358fe5950bf517483c6de71aec14ee3d1c600cc074"
@@ -125,6 +129,7 @@
     {
       "canonical_name": "sks-design-artifact-expert",
       "trusted_sha256": [
+        "6881c1acff42b3cc760f089165a6ea753c774882bf0ec989b71f14936e894690",
         "6db9a7088e5f8d21dec9c8eed00abe665e1e89f19dcbb6d8472d77e4551cb556",
         "a09daba0a2e479a68ed81ec6fba8d70e54c8398ed86f3d1879f874b98480b97c",
         "4a28d166eaf0bc4477b566b056034f972a7034165e36d8186daa9947bf92e3cf"
@@ -133,6 +138,7 @@
     {
       "canonical_name": "sks-design-system-builder",
       "trusted_sha256": [
+        "9075bc17039da34ddd7d798009fdbcdedb8d03358a29c9a925d194bd76e9dcc4",
         "47654c9f74317abbd0a5a75f89cd2d563708e8234e8887cc7ab39bf49030abaa",
         "0a41e6ace960abaaf6abf5e7b1e53fd39f414e1e00b59fa725f2db9e3eb05b58",
         "c4f0007cad5774510bdc55e2815ce0911c220afa8d5dd4efc327ba1231c8f3da"
@@ -141,6 +147,7 @@
     {
       "canonical_name": "sks-design-ui-editor",
       "trusted_sha256": [
+        "c3bc8bbaac134f7d742cd5e4bed7dd61a99655c54a6bd42f669e6bdd033156fb",
         "2f9087664d8abe938a6dfbeaef5301ef00531e34a15506508e1d6d6b7132b894",
         "6c24e950a12dec52c625964069c7c21a0220a58e0f69f977d802f44fdb03a940",
         "83a806cc93a3c5342e0dccfc6a45983382d5bf74d1226c4e3288228db22b737a",
@@ -200,6 +207,7 @@
     {
       "canonical_name": "sks-goal",
       "trusted_sha256": [
+        "942c5e8db400cc1cd2b5ca9527124135fb4b8d9e8289338632d8929691aa54ed",
         "36c12285a339f9505fd88d6d9ea5691e451449f0bf8f55c21f51f0d715623235",
         "5ab1ac18fc265c375bae92ff23ddbd80c378484d6629c378f0e9270e660ded11",
         "867544877ac04df6e0232d6d425797e7fab2cceff9a7176a3c9e61f8c4a416d7",
@@ -276,6 +284,7 @@
     {
       "canonical_name": "sks-image-ux-review",
       "trusted_sha256": [
+        "643400c1682aaa4a84782e3740eb14efb0ddb905a84c086bd9a0f8afdabd5f02",
         "c7a5ea91adb0d45e652066cdb73f514cc7fcb47121cc13cce5e177f94630a42a",
         "54d4169dc7f362ac9fe2d090bd2612e41d30acbc3e883d6bd382929bdfb9459e",
         "9293346873b5fb25a9d93b630064a2c8ceede2bfdfa4c6ffe7fbb7f64da6595c"
@@ -284,6 +293,7 @@
     {
       "canonical_name": "sks-imagegen",
       "trusted_sha256": [
+        "0f3ba271f2977d1124b8236e25f5e05a3d03af234652e39601dc5054346e306c",
         "ebad63dae59ff70a4404148d09bffaca69e6c43e88d6e9f6f3d0dc4d5a4c65f6",
         "478e3d8f805eed55c3f3e6c2069142482a7dbd8fa5d9a59f03b136e0e1cb77d0",
         "a7f466ba1829a757f38432fbe8c3a672e22e91948537dafe8f8ce09561d2256e",
@@ -293,6 +303,7 @@
     {
       "canonical_name": "sks-imagegen-source-scout",
       "trusted_sha256": [
+        "84957463d326f0f7028fc47aabb3f1857c76f13534e3aed1c9fc1b075896dbd1",
         "b306134faf487b86e11a9736ea1ed60d2335eef858e58bedc80fd3dc4ff7137c",
         "440f361fb29afcbb6f6cdc88c6a7318953b4c8fd3181ef7c6d8187f091d18745",
         "95faf4358f1c6567ca6894bfb577629f14a23d623716be70325c0ff9a893d42e",
@@ -324,14 +335,14 @@
     {
       "canonical_name": "sks-naruto",
       "trusted_sha256": [
+        "c88999663811a50d096b7cbb696fbea5b8f72707bcbf4a232bb07fe3a10cb2a6",
+        "b2eb207b2773ab1995ee6e113ba6f3b64de43389e76aef4a0f06d4845ff86223",
         "65e19a5d16f486b13541048c239e828f8039bfc6e38bafd7949d9c936fe4b5b2",
         "da43debf97f0b4a1583d8202a7306aca97ac97865accf9bca8f41d75c84a1cb9",
         "b981bea4183376c6c0204941ad6c2e78782e2cdea4f8d25cc85630c609faaf95",
         "5df9c9678eb68fd79ceb998ae7a52dd54dc92336ad5169e8a01acca89f76bd60",
         "a1219f6dbad9c8c185953125ef0b8dccf081aa01efb8e8acaa543c6214ac049c",
         "d0d5968e78ac25e1d3e588735de1ddbcf149cfb3165edebca5dec1ed7c7a5c46",
-        "34222c72e4e1ead3584907f4d905444b7de820283ee7348018f110d5e6b04461",
-        "f8e808622e222b4ad7dcb2907e5f06a890db83139ae443ec6c8c33781dfa3e37",
         "49b5e3dcc1b537b49c2cf09e5b875cb16acb05c622b22798e265e64dacd8ac90"
       ]
     },
@@ -346,6 +357,8 @@
     {
       "canonical_name": "sks-pipeline-runner",
       "trusted_sha256": [
+        "15159b6f6edea91be29612fe3cee2047d8ec47f4f7c95a33601198a9bfec3eda",
+        "6f38d3387e4ab020291afe7f74713b135543e52707f5bfbffa6b3584542f45a5",
         "7749638f1e8393f3beb1f7b0c37195dd0463abdb6fd7da5d31b3d816ee91fa37",
         "fd06dfb27be41e5ffec3e3ec8c5362289f5919cf2afa9da5ab6b97e7baa4a0ac",
         "66e105773b8e042eec5d5679b97b7cb305cad8d45671034907fbfa728fc4d68a",
@@ -356,6 +369,7 @@
     {
       "canonical_name": "sks-plan",
       "trusted_sha256": [
+        "81b49b026cd6761a1b63029d8d39b830e0801a7f3d2f9a8609127769173ddd4e",
         "7795867b38a5f169924125850f137c31995cf28000f74284839530a68ace156a",
         "b6f3b09230e9809acf4e13df2de6af3c75a8534e8890d6560664ebfc2e4072f8"
       ]
@@ -363,6 +377,7 @@
     {
       "canonical_name": "sks-ppt",
       "trusted_sha256": [
+        "a25e537ff49b5bffdc093a5f772a8d218003ca1bb81e0aa304561684a9551b31",
         "fba3f438b9f22dae0813cd12bf310539a7d2b71c8cd9322eb840514e24884eaf",
         "c9a0d90e12560dd3f04959869051370e6baf46eda6eb63f708ea1661c5c9d041",
         "1d4de05afd42ee5739c0ed925af9e0ac4785fc746e659c60d3d908d465e6386c",
@@ -373,6 +388,8 @@
     {
       "canonical_name": "sks-prompt-pipeline",
       "trusted_sha256": [
+        "5e423981384fc3825c74327c4ca0fe09905a0dc81a533676c7e76ebb385348fc",
+        "f82a103e7962e416961add515d7b3e65df89848dec1fbb9319bd49d7f1dac982",
         "93fd938dccd65d9b4d1dd140b60e1baedc627e7fcc54f9afd95eb2e44efd1143",
         "033bb114ec1fac3f8c312f698b1861ed4c2ce6f65c06f4f1a872c4b101b74b92",
         "e7c8ef56d38fdc4879c983f7d6706f26fc1cf0a60c508836bd628e815700bcc3",
@@ -390,6 +407,7 @@
     {
       "canonical_name": "sks-reasoning-router",
       "trusted_sha256": [
+        "b0f458caa1c3bd7bb7241a09b80fce5700aeb99b340e84c08a9b2b66bc875ba7",
         "41e14e8d5b93d743096664869ee68c41c86e911b0bbc165bdcd10e4a45faa4b6",
         "03d68436e568b3cee2bffc6ca58819019ca406f7b648ef4704e3465c7c83c114",
         "647f730520a1c7dc89c2642f5b8502624c65a861ae41aecf1fb137db40fd0611",
@@ -419,6 +437,7 @@
     {
       "canonical_name": "sks-research",
       "trusted_sha256": [
+        "b7280ca8a5ccf4304d25e97522d57968d20af6ec9f03f7d55a251ebcf8666236",
         "d61163446ebc429974aad8467653ddb5948739978600e9c27bff385fc53968ba",
         "8903022e98fa470cd764f7c8d1b28d4f996d6daf146260f20548acbe1276c55a",
         "2e96f95315d99b645d4171ba4648d9f9218ec3e98dcd6d363b5de522d2e1bfe3"

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.3.3"
+version = "10.3.5"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.3.3"
+version = "10.3.5"
 edition = "2021"
 
 [dependencies]

package/dist/cli/command-manifest-lite.js

@@ -96,7 +96,8 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'bench', summary: 'Run core trust-kernel benchmark budgets', maturity: 'beta' },
     { name: 'mcp-server', summary: 'Run a stdio MCP server exposing SKS commands as tools for MCP-capable agent hosts', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true },
     { name: 'agent-bridge', summary: 'Register SKS tools or run read-only tools with native Astra async calling', maturity: 'beta', readonly: true, diagnostic: true },
-    { name: 'decision', summary: 'Manage optional Jev decisions through OpenRouter: status, enable, disable, probe, evaluate', maturity: 'labs', skipMigrationGate: true, allowedDuringActiveRoute: true }
+    { name: 'decision', summary: 'Manage optional Jev decisions through OpenRouter: status, enable, disable, probe, evaluate', maturity: 'labs', skipMigrationGate: true, allowedDuringActiveRoute: true },
+    { name: 'imagegen', summary: 'Generate images with the active SKS image mode (Codex default or a custom OpenRouter model): status, models, enable, disable, generate', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true }
 ];
 const SAFE_COMMAND_CONTRACT_LITE = {
     risk: 'R2',
@@ -109,6 +110,7 @@ const SAFE_COMMAND_CONTRACT_LITE = {
 const COMMAND_CONTRACT_OVERRIDES_LITE = {
     align: { latency: 'long', supportsJson: true, inputProfile: 'json-only' },
     decision: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
+    imagegen: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     cleanup: { risk: 'R3', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     autoresearch: { latency: 'long' },
     bench: { latency: 'long' },

package/dist/cli/command-registry.js

@@ -254,11 +254,19 @@ const COMMAND_DEFINITIONS = {
             activeRoutePolicy: 'always'
         })),
         packageRequiredFiles: ['dist/commands/decision.js']
+    },
+    imagegen: {
+        ...skipMigrationGate(entry('beta', 'Generate images with the active SKS image mode (Codex default or a custom OpenRouter model): status, models, enable, disable, generate', 'dist/commands/imagegen.js', directCommand(() => import('../commands/imagegen.js'), 'dist/commands/imagegen.js'), {
+            allowedDuringActiveRoute: true,
+            activeRoutePolicy: 'always'
+        })),
+        packageRequiredFiles: ['dist/commands/imagegen.js']
     }
 };
 const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(COMMAND_DEFINITIONS, {
     align: { latency: 'long', supportsJson: true, inputProfile: 'json-only' },
     decision: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
+    imagegen: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     cleanup: { risk: 'R3', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     autoresearch: { latency: 'long' },
     bench: { latency: 'long' },

package/dist/cli/install-helpers.js

@@ -1,4 +1,3 @@
-import { IMAGEGEN_MODEL } from '../core/imagegen/imagegen-model-policy.js';
 import path from 'node:path';
 import fsp from 'node:fs/promises';
 import { stdin as input, stdout as output } from 'node:process';
@@ -70,7 +69,7 @@ export async function postinstall({ bootstrap }) {
         console.log('Configure providers explicitly with `sks bridge provider configure codex-lb ...` or `sks bridge provider configure openrouter ...`.');
         const imagegenRepair = await ensureCodexImagegenDuringInstall();
         if (imagegenRepair.status === 'ready')
-            console.log(("Image generation provider capability ready (requested model: " + IMAGEGEN_MODEL + "; output not verified)."));
+            console.log('Image generation ready for the active SKS image mode (output not verified).');
         else if (imagegenRepair.status === 'recovered')
             console.log('Codex App Image Gen: recovered and re-detected. Start a new Codex/Work task; restart the desktop app only if the new task still lacks $imagegen.');
         else if (imagegenRepair.status === 'blocked')

package/dist/commands/doctor.js

@@ -1,4 +1,3 @@
-import { IMAGEGEN_MODEL } from '../core/imagegen/imagegen-model-policy.js';
 import os from 'node:os';
 import path from 'node:path';
 import { projectRoot, exists, formatBytes, nowIso, readText, writeJsonAtomic } from '../core/fsx.js';
@@ -127,7 +126,8 @@ export async function run(_command, args = [], deps = {}) {
     const doctorFix = flag(args, '--fix');
     const homeDir = path.resolve(deps.home || process.env.HOME || os.homedir());
     const globalOnly = doctorGlobalOnlySelection({ args, doctorFix, root, home: homeDir }).global_only;
-    if (doctorFix) {
+    const doctorProfile = doctorProfileFromArgs(args, doctorFix);
+    if (doctorFix && doctorProfile !== 'migration') {
         const conflictScan = await scanHarnessConflicts(root);
         if (conflictScan.hard_block) {
             const blocked = {
@@ -151,7 +151,6 @@ export async function run(_command, args = [], deps = {}) {
             return blocked;
         }
     }
-    const doctorProfile = doctorProfileFromArgs(args, doctorFix);
     if (!flag(args, '--json')) {
         cliUi.banner('doctor');
         cliUi.step(doctorFix ? 'repairing and validating' : 'validating');
@@ -1189,7 +1188,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 blockers: ['codex_imagegen_current_task_tool_manifest_unverified', 'codex_imagegen_real_output_unverified'],
                 manual_actions: [
                     'Start a fresh Codex/Work task so $imagegen is present in its tool manifest.',
-                    ("Invoke $imagegen with " + IMAGEGEN_MODEL + " and bind the selected raster output path to route evidence.")
+                    'Run `sks imagegen generate` (it follows the active SKS image mode) and bind the raster output path to route evidence.'
                 ],
                 communication_test: {
                     level: 'flag_level',