sneakoscope 10.3.4 → 10.3.6

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.3.4",
+  "package_version": "10.3.6",
   "skills": [
     {
       "canonical_name": "sks",
@@ -17,8 +17,9 @@
     {
       "canonical_name": "sks-align",
       "type": "core",
-      "content_sha256": "b9db40d6e1dd2fc6e4665a2b30738d370da955cd4d6e86c88bd85059c7faa08c",
+      "content_sha256": "9eef36214be7e07a963eb36bb1df2c025cd0578b7419ddf4fd307081a2b62093",
       "hash_history": [
+        "b9db40d6e1dd2fc6e4665a2b30738d370da955cd4d6e86c88bd85059c7faa08c",
         "c485f39d4873adb9793672f7dcf4e956595ffb9dcbb032b3ffb0515b5857d31d",
         "e98e1b67e228bec5c37d00c0206a2e01d2da698a83c80b527105bf04a19c136a"
       ],
@@ -69,8 +70,9 @@
     {
       "canonical_name": "sks-commit",
       "type": "official",
-      "content_sha256": "aa2eeaa6be6d635170a8ecfc76353db95552f543cca107f239054c492409e3a9",
+      "content_sha256": "63cad87de9187f67e001949b0edcf39344626748f8f168bed257316dc1684d53",
       "hash_history": [
+        "aa2eeaa6be6d635170a8ecfc76353db95552f543cca107f239054c492409e3a9",
         "aea41328993b11e26e26ae94df6ed44312d1570ed39448531428b53ade9d7461",
         "943c6dcf822df086b320140e74404d4c7bcfd531264e25ada6624b5009f26207"
       ],
@@ -79,8 +81,9 @@
     {
       "canonical_name": "sks-commit-and-push",
       "type": "official",
-      "content_sha256": "acd6c7845c58d72234776e4608e1440583c62c38b513625d1272e4a413a40fb6",
+      "content_sha256": "2307093e26513a26e71ac6cdfcf3fd1598979c6035525ee5d3de58820cb4adda",
       "hash_history": [
+        "acd6c7845c58d72234776e4608e1440583c62c38b513625d1272e4a413a40fb6",
         "8e4ff7a39440c82e6c67a67d5bb267c69f508cedb5d9d5a93261f4dcdf8e8a1a",
         "b005b4a7456b80b95768ad358fe5950bf517483c6de71aec14ee3d1c600cc074"
       ],
@@ -155,8 +158,9 @@
     {
       "canonical_name": "sks-design-artifact-expert",
       "type": "official",
-      "content_sha256": "6db9a7088e5f8d21dec9c8eed00abe665e1e89f19dcbb6d8472d77e4551cb556",
+      "content_sha256": "6881c1acff42b3cc760f089165a6ea753c774882bf0ec989b71f14936e894690",
       "hash_history": [
+        "6db9a7088e5f8d21dec9c8eed00abe665e1e89f19dcbb6d8472d77e4551cb556",
         "a09daba0a2e479a68ed81ec6fba8d70e54c8398ed86f3d1879f874b98480b97c",
         "4a28d166eaf0bc4477b566b056034f972a7034165e36d8186daa9947bf92e3cf"
       ],
@@ -165,8 +169,9 @@
     {
       "canonical_name": "sks-design-system-builder",
       "type": "official",
-      "content_sha256": "47654c9f74317abbd0a5a75f89cd2d563708e8234e8887cc7ab39bf49030abaa",
+      "content_sha256": "9075bc17039da34ddd7d798009fdbcdedb8d03358a29c9a925d194bd76e9dcc4",
       "hash_history": [
+        "47654c9f74317abbd0a5a75f89cd2d563708e8234e8887cc7ab39bf49030abaa",
         "0a41e6ace960abaaf6abf5e7b1e53fd39f414e1e00b59fa725f2db9e3eb05b58",
         "c4f0007cad5774510bdc55e2815ce0911c220afa8d5dd4efc327ba1231c8f3da"
       ],
@@ -175,8 +180,9 @@
     {
       "canonical_name": "sks-design-ui-editor",
       "type": "official",
-      "content_sha256": "2f9087664d8abe938a6dfbeaef5301ef00531e34a15506508e1d6d6b7132b894",
+      "content_sha256": "c3bc8bbaac134f7d742cd5e4bed7dd61a99655c54a6bd42f669e6bdd033156fb",
       "hash_history": [
+        "2f9087664d8abe938a6dfbeaef5301ef00531e34a15506508e1d6d6b7132b894",
         "6c24e950a12dec52c625964069c7c21a0220a58e0f69f977d802f44fdb03a940",
         "83a806cc93a3c5342e0dccfc6a45983382d5bf74d1226c4e3288228db22b737a",
         "1b65f0028a6dcb2f7eeab0b0df411a75546bc3aefa8a76067e1818da000c2249"
@@ -248,8 +254,9 @@
     {
       "canonical_name": "sks-goal",
       "type": "official",
-      "content_sha256": "36c12285a339f9505fd88d6d9ea5691e451449f0bf8f55c21f51f0d715623235",
+      "content_sha256": "942c5e8db400cc1cd2b5ca9527124135fb4b8d9e8289338632d8929691aa54ed",
       "hash_history": [
+        "36c12285a339f9505fd88d6d9ea5691e451449f0bf8f55c21f51f0d715623235",
         "5ab1ac18fc265c375bae92ff23ddbd80c378484d6629c378f0e9270e660ded11",
         "867544877ac04df6e0232d6d425797e7fab2cceff9a7176a3c9e61f8c4a416d7",
         "0db0c58e72c0d58b24163371efe7a647c67d5d232020b2b4ed2557f19fe648d7"
@@ -342,8 +349,9 @@
     {
       "canonical_name": "sks-image-ux-review",
       "type": "core",
-      "content_sha256": "c7a5ea91adb0d45e652066cdb73f514cc7fcb47121cc13cce5e177f94630a42a",
+      "content_sha256": "643400c1682aaa4a84782e3740eb14efb0ddb905a84c086bd9a0f8afdabd5f02",
       "hash_history": [
+        "c7a5ea91adb0d45e652066cdb73f514cc7fcb47121cc13cce5e177f94630a42a",
         "54d4169dc7f362ac9fe2d090bd2612e41d30acbc3e883d6bd382929bdfb9459e",
         "9293346873b5fb25a9d93b630064a2c8ceede2bfdfa4c6ffe7fbb7f64da6595c"
       ],
@@ -352,8 +360,9 @@
     {
       "canonical_name": "sks-imagegen",
       "type": "official",
-      "content_sha256": "ebad63dae59ff70a4404148d09bffaca69e6c43e88d6e9f6f3d0dc4d5a4c65f6",
+      "content_sha256": "0f3ba271f2977d1124b8236e25f5e05a3d03af234652e39601dc5054346e306c",
       "hash_history": [
+        "ebad63dae59ff70a4404148d09bffaca69e6c43e88d6e9f6f3d0dc4d5a4c65f6",
         "478e3d8f805eed55c3f3e6c2069142482a7dbd8fa5d9a59f03b136e0e1cb77d0",
         "a7f466ba1829a757f38432fbe8c3a672e22e91948537dafe8f8ce09561d2256e",
         "7a1f9372b03975886233a623031f41e06fd782b1e7a3409517bb428d9c6b76dd"
@@ -363,8 +372,9 @@
     {
       "canonical_name": "sks-imagegen-source-scout",
       "type": "official",
-      "content_sha256": "b306134faf487b86e11a9736ea1ed60d2335eef858e58bedc80fd3dc4ff7137c",
+      "content_sha256": "84957463d326f0f7028fc47aabb3f1857c76f13534e3aed1c9fc1b075896dbd1",
       "hash_history": [
+        "b306134faf487b86e11a9736ea1ed60d2335eef858e58bedc80fd3dc4ff7137c",
         "440f361fb29afcbb6f6cdc88c6a7318953b4c8fd3181ef7c6d8187f091d18745",
         "95faf4358f1c6567ca6894bfb577629f14a23d623716be70325c0ff9a893d42e",
         "95e71d4431a4c1f6911f0f76eaa1c2b475c52fd22d35c0a6c241e21e090507ad",
@@ -394,15 +404,15 @@
     {
       "canonical_name": "sks-naruto",
       "type": "core",
-      "content_sha256": "b2eb207b2773ab1995ee6e113ba6f3b64de43389e76aef4a0f06d4845ff86223",
+      "content_sha256": "c88999663811a50d096b7cbb696fbea5b8f72707bcbf4a232bb07fe3a10cb2a6",
       "hash_history": [
+        "b2eb207b2773ab1995ee6e113ba6f3b64de43389e76aef4a0f06d4845ff86223",
         "65e19a5d16f486b13541048c239e828f8039bfc6e38bafd7949d9c936fe4b5b2",
         "da43debf97f0b4a1583d8202a7306aca97ac97865accf9bca8f41d75c84a1cb9",
         "b981bea4183376c6c0204941ad6c2e78782e2cdea4f8d25cc85630c609faaf95",
         "5df9c9678eb68fd79ceb998ae7a52dd54dc92336ad5169e8a01acca89f76bd60",
         "a1219f6dbad9c8c185953125ef0b8dccf081aa01efb8e8acaa543c6214ac049c",
         "d0d5968e78ac25e1d3e588735de1ddbcf149cfb3165edebca5dec1ed7c7a5c46",
-        "34222c72e4e1ead3584907f4d905444b7de820283ee7348018f110d5e6b04461",
         "49b5e3dcc1b537b49c2cf09e5b875cb16acb05c622b22798e265e64dacd8ac90"
       ],
       "deprecated_aliases": []
@@ -420,8 +430,9 @@
     {
       "canonical_name": "sks-pipeline-runner",
       "type": "official",
-      "content_sha256": "6f38d3387e4ab020291afe7f74713b135543e52707f5bfbffa6b3584542f45a5",
+      "content_sha256": "15159b6f6edea91be29612fe3cee2047d8ec47f4f7c95a33601198a9bfec3eda",
       "hash_history": [
+        "6f38d3387e4ab020291afe7f74713b135543e52707f5bfbffa6b3584542f45a5",
         "7749638f1e8393f3beb1f7b0c37195dd0463abdb6fd7da5d31b3d816ee91fa37",
         "fd06dfb27be41e5ffec3e3ec8c5362289f5919cf2afa9da5ab6b97e7baa4a0ac",
         "66e105773b8e042eec5d5679b97b7cb305cad8d45671034907fbfa728fc4d68a",
@@ -433,8 +444,9 @@
     {
       "canonical_name": "sks-plan",
       "type": "official",
-      "content_sha256": "7795867b38a5f169924125850f137c31995cf28000f74284839530a68ace156a",
+      "content_sha256": "81b49b026cd6761a1b63029d8d39b830e0801a7f3d2f9a8609127769173ddd4e",
       "hash_history": [
+        "7795867b38a5f169924125850f137c31995cf28000f74284839530a68ace156a",
         "b6f3b09230e9809acf4e13df2de6af3c75a8534e8890d6560664ebfc2e4072f8"
       ],
       "deprecated_aliases": []
@@ -442,8 +454,9 @@
     {
       "canonical_name": "sks-ppt",
       "type": "official",
-      "content_sha256": "fba3f438b9f22dae0813cd12bf310539a7d2b71c8cd9322eb840514e24884eaf",
+      "content_sha256": "a25e537ff49b5bffdc093a5f772a8d218003ca1bb81e0aa304561684a9551b31",
       "hash_history": [
+        "fba3f438b9f22dae0813cd12bf310539a7d2b71c8cd9322eb840514e24884eaf",
         "c9a0d90e12560dd3f04959869051370e6baf46eda6eb63f708ea1661c5c9d041",
         "1d4de05afd42ee5739c0ed925af9e0ac4785fc746e659c60d3d908d465e6386c",
         "02e8a0758ec6d056ce9851a5a4505b1d32e302e730be3eb169a41392a5d6b2e2",
@@ -454,8 +467,9 @@
     {
       "canonical_name": "sks-prompt-pipeline",
       "type": "official",
-      "content_sha256": "f82a103e7962e416961add515d7b3e65df89848dec1fbb9319bd49d7f1dac982",
+      "content_sha256": "5e423981384fc3825c74327c4ca0fe09905a0dc81a533676c7e76ebb385348fc",
       "hash_history": [
+        "f82a103e7962e416961add515d7b3e65df89848dec1fbb9319bd49d7f1dac982",
         "93fd938dccd65d9b4d1dd140b60e1baedc627e7fcc54f9afd95eb2e44efd1143",
         "033bb114ec1fac3f8c312f698b1861ed4c2ce6f65c06f4f1a872c4b101b74b92",
         "e7c8ef56d38fdc4879c983f7d6706f26fc1cf0a60c508836bd628e815700bcc3",
@@ -476,8 +490,9 @@
     {
       "canonical_name": "sks-reasoning-router",
       "type": "official",
-      "content_sha256": "41e14e8d5b93d743096664869ee68c41c86e911b0bbc165bdcd10e4a45faa4b6",
+      "content_sha256": "b0f458caa1c3bd7bb7241a09b80fce5700aeb99b340e84c08a9b2b66bc875ba7",
       "hash_history": [
+        "41e14e8d5b93d743096664869ee68c41c86e911b0bbc165bdcd10e4a45faa4b6",
         "03d68436e568b3cee2bffc6ca58819019ca406f7b648ef4704e3465c7c83c114",
         "647f730520a1c7dc89c2642f5b8502624c65a861ae41aecf1fb137db40fd0611",
         "da0ddb58adc68ddeebdb9c45bf111c26eaa64d3e9dffe1dd39d7f30b943b8b88",
@@ -511,8 +526,9 @@
     {
       "canonical_name": "sks-research",
       "type": "core",
-      "content_sha256": "d61163446ebc429974aad8467653ddb5948739978600e9c27bff385fc53968ba",
+      "content_sha256": "b7280ca8a5ccf4304d25e97522d57968d20af6ec9f03f7d55a251ebcf8666236",
       "hash_history": [
+        "d61163446ebc429974aad8467653ddb5948739978600e9c27bff385fc53968ba",
         "8903022e98fa470cd764f7c8d1b28d4f996d6daf146260f20548acbe1276c55a",
         "2e96f95315d99b645d4171ba4648d9f9218ec3e98dcd6d363b5de522d2e1bfe3"
       ],

package/dist/core/agents/native-worker-backend-router.js

@@ -12,6 +12,7 @@ import { categoryForWorkerRole, isNarutoGpt56Model, modelRouteReason, routeModel
 import { codexTimeoutClassForRoute } from '../codex-control/codex-reliability-shield.js';
 import { decideSubagentModel } from '../subagents/model-policy.js';
 import { latestTierModelSet } from '../subagents/model-tiers.js';
+import { consultJevTurnModel } from '../decisions/integration.js';
 export const NATIVE_WORKER_BACKEND_ROUTER_SCHEMA = 'sks.native-worker-backend-router.v1';
 export async function runNativeWorkerBackendRouter(input) {
     const root = path.resolve(input.agentRoot);
@@ -254,7 +255,15 @@ export async function resolveWorkerModelRouting(input, deps = {}) {
         ? String(input.agent.routed_model || '').trim()
         : '';
     const jevEffort = jevModel ? normalizeModelReasoning(input.agent?.routed_model_reasoning_effort) : null;
-    const selectedModel = explicitModel || jevModel || savedPreferenceModel;
+    const consult = deps.consultJev === false ? null : deps.consultJev || consultJevTurnModel;
+    const liveJev = consult && !explicitModel && !jevModel && !savedPreferenceModel
+        ? await consult({ root: deps.root || process.cwd(), prompt: `${taskKindText}\n${riskText}`.trim().slice(0, 1200), roleId: 'spawn', env }).catch(() => null)
+        : null;
+    const liveJevServed = Boolean(liveJev?.model && currentModels.has(liveJev.model)
+        && (!narutoOnly || (Array.isArray(lbCatalog?.models) && lbCatalog.models.includes(liveJev.model))));
+    const liveJevModel = liveJevServed ? String(liveJev.model) : '';
+    const liveJevEffort = liveJevModel ? normalizeModelReasoning(liveJev?.effort) : null;
+    const selectedModel = explicitModel || jevModel || savedPreferenceModel || liveJevModel;
     const taskPolicy = decideSubagentModel({ title: taskKindText, description: riskText, role: input.agent?.role });
     const routed = narutoOnly
         ? await routeModel(category, {
@@ -262,14 +271,14 @@ export async function resolveWorkerModelRouting(input, deps = {}) {
             narutoOnly: true,
             taskText: taskKindText,
             riskText,
-            reasoningEffort: jevEffort || savedAstraEffort,
+            reasoningEffort: jevEffort || savedAstraEffort || liveJevEffort,
             availableModels: lbCatalog?.models || [],
             availableModelEfforts: lbCatalog?.model_efforts || {},
             ...(selectedModel ? { model: selectedModel } : {})
         })
         : {
-            model: (explicitModel && currentModels.has(explicitModel) ? explicitModel : '') || savedPreferenceModel || taskPolicy.model,
-            reasoning: explicitReasoning || savedAstraEffort || taskPolicy.modelReasoningEffort,
+            model: (explicitModel && currentModels.has(explicitModel) ? explicitModel : '') || savedPreferenceModel || liveJevModel || taskPolicy.model,
+            reasoning: explicitReasoning || savedAstraEffort || liveJevEffort || taskPolicy.modelReasoningEffort,
             serviceTier: explicitTier || input.fastModePolicy.service_tier || 'fast'
         };
     const blockers = [

package/dist/core/agents/official-subagent-helper-policy.js

@@ -1,4 +1,3 @@
-import { IMAGEGEN_MODEL } from '../imagegen/imagegen-model-policy.js';
 import path from 'node:path';
 import { nowIso, readJson, readText, writeJsonAtomic } from '../fsx.js';
 export const OFFICIAL_SUBAGENT_HELPER_POLICY_SCHEMA = 'sks.official-subagent-helper-policy.v1';
@@ -43,7 +42,7 @@ export async function writeOfficialSubagentHelperPolicy(root, input = {}) {
         built_in_agents_allowed: builtInAgentsAllowed,
         codex_app_capabilities_allowed: codexAppCapabilitiesAllowed,
         codex_builtin_imagegen_helper_allowed: true,
-        preferred_image_generation_surface: ("Selected image provider: " + IMAGEGEN_MODEL + ""),
+        preferred_image_generation_surface: 'Active SKS image mode via sks imagegen generate',
         codex_app_builtin_evidence_class: 'codex_app_builtin',
         api_fallback_evidence_class: 'api_fallback',
         provider_surface_evidence_required: true,

package/dist/core/codex-app/menubar/constants.js

@@ -34,6 +34,8 @@ export const NATIVE_SOURCE_FILES = [
     'SettingsViewController.swift',
     'LocalDecisionModels.swift',
     'LocalDecisionViewController.swift',
+    'ImageGenerationModels.swift',
+    'ImageGenerationViewController.swift',
     'OperationModels.swift',
     'ProviderRouteExplanation.swift',
     'OperationCoordinator.swift',

package/dist/core/codex-app.js

@@ -1,4 +1,4 @@
-import { IMAGEGEN_MODEL, CODEX_BUILTIN_IMAGEGEN_MODEL } from './imagegen/imagegen-model-policy.js';
+import { CODEX_BUILTIN_IMAGEGEN_MODEL } from './imagegen/imagegen-model-policy.js';
 import path from 'node:path';
 import os from 'node:os';
 import fsp from 'node:fs/promises';
@@ -484,7 +484,7 @@ function codexNativeSksMenuStatus() {
 export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, requiredFeatureFlags = {}, requiredFeatureFlagsOk = true, defaultPlugins = { ok: true, missing_enabled: [] }, productDesignPlugin = null, pluginSkillShadows = { ok: true, blocking: [] }, fastModeConfig = { ok: true, blockers: [] }, providerModelUi = null, nativeSksMenu = null, gitActions = { ok: true, blockers: [] }, imageGenerationReady, inAppBrowserReady, browserUseFeatureReady, computerUseReady, browserUseReady, browserToolReady, computerUseMcpListed, browserUseMcpListed, chromeExtension, remoteControl }) {
     const lines = [];
     if (!appInstalled) {
-        lines.push(("Install and open Codex App for first-party MCP/plugin tools. Base Codex CLI flows remain available, but Codex Computer Use requires the App; imagegen/" + IMAGEGEN_MODEL + " evidence will be unavailable until Codex App is ready."));
+        lines.push(("Install and open Codex App for first-party MCP/plugin tools. Base Codex CLI flows remain available, but Codex Computer Use requires the App; imagegen evidence from Codex App will be unavailable until Codex App is ready; `sks imagegen generate` still works through the SKS Desktop Bridge."));
         lines.push(`Docs: ${CODEX_APP_DOCS_URL}`);
     }
     if (!codex?.bin)
@@ -572,10 +572,10 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
         lines.push('Codex Chrome Extension is ready; SKS web/browser/webapp QA and UX review should use it before any other web surface.');
     }
     if (imageGenerationReady) {
-        lines.push(("The built-in image tool is enabled. Current-model image work requires a provider that explicitly selects " + IMAGEGEN_MODEL + " and record real output."));
+        lines.push("The built-in image tool is enabled. SKS image work follows the active SKS image mode (`sks imagegen status`) and records real output.");
     }
     else if (appInstalled || codex?.bin) {
-        lines.push(("Codex image_generation was not visible from `codex features list`. Required imagegen/" + IMAGEGEN_MODEL + " evidence must stay blocked or unverified until $imagegen is available in Codex App."));
+        lines.push(("Codex image_generation was not visible from `codex features list`. Codex-default image evidence stays unverified until $imagegen is available in Codex App; `sks imagegen generate` can still produce it through the SKS Desktop Bridge, and the custom OpenRouter image mode does not need it."));
         lines.push('Run: sks doctor --fix to attempt Codex CLI/App image_generation repair, then rerun the blocked visual route.');
     }
     if (computerUseReady && !computerUseMcpListed) {
@@ -589,7 +589,7 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
         lines.push('Browser Use plugin files are installed, but `codex mcp list` does not list a browser-use MCP server. Treat Browser Use as plugin-scoped, not as SKS browser verification evidence.');
     }
     if (!lines.length)
-        lines.push(("Codex App, Codex CLI, Chrome Extension, native Computer Use, Browser tooling, and built-in image feature checks look configured. Web UI E2E uses the Chrome Extension path; native non-web visual evidence uses Computer Use; generated image evidence still requires $imagegen/" + IMAGEGEN_MODEL + " output."));
+        lines.push(("Codex App, Codex CLI, Chrome Extension, native Computer Use, Browser tooling, and built-in image feature checks look configured. Web UI E2E uses the Chrome Extension path; native non-web visual evidence uses Computer Use; generated image evidence still requires real output from the active SKS image mode."));
     return lines;
 }
 export function formatCodexAppStatus(status, { includeRaw = false } = {}) {
@@ -610,7 +610,7 @@ export function formatCodexAppStatus(status, { includeRaw = false } = {}) {
         `Chrome Ext: ${status.chrome_extension?.ok ? 'ok' : `setup ${(status.chrome_extension?.blockers || []).join(', ') || 'required'}`}`,
         `Computer Use:${status.mcp.has_computer_use ? status.mcp.computer_use_source === 'plugin_cache' ? ' installed (verify @Computer in thread)' : ' ok' : ' missing'}`,
         `Browser:     ${status.features?.browser_tool_ready ? `ok (${status.features.browser_tool_source})` : status.mcp.has_browser_use ? status.mcp.browser_use_source === 'plugin_cache' ? 'installed (plugin scoped)' : 'ok' : 'missing'}`,
-        `Image Gen:   ${status.features?.image_generation ? (`enabled (${CODEX_BUILTIN_IMAGEGEN_MODEL}; ${IMAGEGEN_MODEL} provider unverified)`) : status.features?.checked ? 'missing' : 'not checked'}`,
+        `Image Gen:   ${status.features?.image_generation ? (`enabled (Codex built-in, documented engine ${CODEX_BUILTIN_IMAGEGEN_MODEL}; SKS image mode: sks imagegen status)`) : status.features?.checked ? 'missing' : 'not checked'}`,
         `Ready:       ${status.ok ? 'yes' : 'no'}`,
         '',
         ...status.guidance.map((line) => `- ${line}`)

package/dist/core/codex-lb/desktop-bridge/imagegen-endpoint.js

@@ -0,0 +1,95 @@
+import { readImagegenConfig, isOpenRouterModelId } from '../../imagegen/imagegen-config.js';
+import { generateOpenRouterImages } from '../../imagegen/openrouter-images.js';
+import { resolveOpenRouterApiKey } from '../../providers/openrouter/openrouter-secret-store.js';
+export const DESKTOP_BRIDGE_IMAGEGEN_SCHEMA = 'sks.desktop-bridge-imagegen.v1';
+const MAX_BODY_BYTES = 48 * 1024 * 1024;
+const MAX_REFERENCES = 8;
+class ImagegenEndpointError extends Error {
+    code;
+    status;
+    constructor(code, status) {
+        super(code);
+        this.code = code;
+        this.status = status;
+    }
+}
+async function readBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.length;
+        if (size > MAX_BODY_BYTES)
+            throw new ImagegenEndpointError('imagegen_request_too_large', 413);
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+function references(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > MAX_REFERENCES)
+        throw new ImagegenEndpointError('imagegen_references_invalid', 400);
+    return value.map((row) => {
+        const mime = typeof row?.mime === 'string' ? row.mime.toLowerCase() : '';
+        const base64 = typeof row?.base64 === 'string' ? row.base64 : '';
+        if (!/^image\/[a-z0-9.+-]+$/.test(mime) || !/^[A-Za-z0-9+/=]+$/.test(base64))
+            throw new ImagegenEndpointError('imagegen_references_invalid', 400);
+        return { mime, base64 };
+    });
+}
+function send(res, status, payload) {
+    res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store', connection: 'close' });
+    res.end(JSON.stringify({ schema: DESKTOP_BRIDGE_IMAGEGEN_SCHEMA, ...payload }));
+}
+export async function handleDesktopBridgeImagegen(req, res, deps = {}) {
+    const env = deps.env || process.env;
+    try {
+        if (req.method !== 'POST')
+            throw new ImagegenEndpointError('imagegen_method_not_allowed', 405);
+        let body;
+        try {
+            body = JSON.parse(await readBody(req));
+        }
+        catch (error) {
+            if (error instanceof ImagegenEndpointError)
+                throw error;
+            throw new ImagegenEndpointError('imagegen_request_invalid_json', 400);
+        }
+        const prompt = typeof body?.prompt === 'string' ? body.prompt.trim() : '';
+        if (!prompt)
+            throw new ImagegenEndpointError('imagegen_prompt_required', 400);
+        const config = await readImagegenConfig(env);
+        if (config.mode !== 'openrouter' || !config.openrouter_model)
+            throw new ImagegenEndpointError('imagegen_custom_mode_off', 409);
+        const requested = body?.model === undefined ? config.openrouter_model : body.model;
+        if (!isOpenRouterModelId(requested) || requested !== config.openrouter_model)
+            throw new ImagegenEndpointError('imagegen_model_not_selected', 409);
+        const key = await resolveOpenRouterApiKey({ env });
+        if (!key.key)
+            throw new ImagegenEndpointError('openrouter_key_missing', 424);
+        const result = await (deps.generate || generateOpenRouterImages)({
+            apiKey: key.key,
+            model: requested,
+            prompt,
+            references: references(body?.references),
+            aspectRatio: typeof body?.aspect_ratio === 'string' ? body.aspect_ratio : null,
+            quality: typeof body?.quality === 'string' ? body.quality : null,
+            outputFormat: typeof body?.output_format === 'string' ? body.output_format : null,
+            env
+        });
+        if (!result.ok) {
+            send(res, result.status && result.status >= 400 && result.status < 600 ? result.status : 502, { ok: false, error: result.error, model: requested });
+            return;
+        }
+        send(res, 200, { ok: true, model: result.model, requested_model: requested, images: result.images, text: result.text, usage: result.usage, warnings: result.warnings });
+    }
+    catch (error) {
+        const code = error instanceof ImagegenEndpointError ? error.code : 'imagegen_bridge_failed';
+        const status = error instanceof ImagegenEndpointError ? error.status : 500;
+        if (!res.headersSent)
+            send(res, status, { ok: false, error: code });
+        else
+            res.destroy();
+    }
+}

package/dist/core/codex-lb/desktop-bridge/server.js

@@ -7,7 +7,8 @@ import { assertAllowedOrigin, assertAllowedPath, assertLoopbackPeer, assertLoopb
 import { createDesktopBridgePublicState, desktopBridgeListenOrigin, desktopBridgeStatePath, refreshDesktopBridgeState, removeDesktopBridgeStateIfOwned, writeDesktopBridgeState, } from './state.js';
 import { DesktopBridgeError, DesktopBridgeRequestBodyTooLargeError } from './types.js';
 import { PACKAGE_VERSION } from '../../version.js';
-import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL } from './types.js';
+import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL, DESKTOP_BRIDGE_IMAGEGEN_PATH } from './types.js';
+import { handleDesktopBridgeImagegen } from './imagegen-endpoint.js';
 import { forwardWebSocket, safeEndUpgradeSocket } from './websocket-forward.js';
 function authenticateDesktopBridgeClient(req, input) {
     const raw = String(req.url || '/');
@@ -251,6 +252,10 @@ export async function startPreparedDesktopBridge(input, options = {}) {
                     writeDiagnosticHealth(req, res, input);
                     return;
                 }
+                if (authenticated.pathname === DESKTOP_BRIDGE_IMAGEGEN_PATH) {
+                    await handleDesktopBridgeImagegen(req, res);
+                    return;
+                }
                 assertAllowedPath(authenticated.pathname, input.allowedPathPrefixes);
                 const prepared = await prepareDesktopBridgeRequest(req, input);
                 await forwardHttp(req, res, input, prepared, `${desktopBridgeListenOrigin(input)}${authenticated.clientBasePath}`);

package/dist/core/codex-lb/desktop-bridge/types.js

@@ -4,6 +4,7 @@ export const DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH = '/__sks/diagnostics/health'
 export const DESKTOP_BRIDGE_DIAGNOSTIC_PATH = '/__sks/diagnostics/websocket';
 export const DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL = 'sks.desktop-bridge.probe.v2';
 export const DESKTOP_BRIDGE_CLIENT_PATH_PREFIX = '/__sks/client';
+export const DESKTOP_BRIDGE_IMAGEGEN_PATH = '/__sks/imagegen/generations';
 export const DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES = [
     '/backend-api/codex/',
     '/backend-api/files',

package/dist/core/codex-native/core-skill-manifest.js

@@ -1,4 +1,3 @@
-import { IMAGEGEN_MODEL } from '../imagegen/imagegen-model-policy.js';
 import { PACKAGE_VERSION, nowIso, sha256 } from '../fsx.js';
 import { coreEngineeringDirectiveReference } from '../lean-engineering-policy.js';
 import { normalizeDollarSkillName, prefixKnownSksDollarReferences, sksPrefixedDollarCommand, sksPrefixedSkillName } from '../routes/dollar-prefix.js';
@@ -17,7 +16,7 @@ const CORE_SKILL_DEFINITIONS = [
         discovery: 'Run $sks-naruto to delegate implementation to child subagents.',
         when: 'Use when the user invokes $sks-naruto or $sks-work, or the selected route is Naruto: ordinary implementation work, where the parent orchestrates and children implement.',
         workflow: 'Run sks naruto run "<task>" [--agents N] [--max-threads N] [--json] with Codex official subagent threads only. The parent orchestrates only: decompose, assign disjoint slices, spawn, integrate, and verify. Do not implement slice work in the parent thread; the SKS PreToolUse gate denies parent-thread source edits until the first child thread starts and while children are still running, and .sneakoscope artifacts stay parent-writable. The parent owns decomposition, per-wave capacity, later root-owned waves, integration, and final verification. Automatic targets begin at 4/6/8/16 by task size: bounded, explicit parallel, large-scale, then mass mechanical or exploration fan-out. After decomposition both lanes may expand to the SKS-owned 256-child ceiling when independent useful slices and real host capacity remain positive; max_threads defaults to a 256-child frame budget cap, never a target. A measured lower Codex host cap or explicit provider/API budget remains authoritative, and multi-wave scheduling reuses returned capacity. Every child runs the newest model of the tier its work needs (fast, balanced, context, or deep); no model family is pinned. When Jev mode is on, Jev picks the tier for each new spawn and SKS seals it. A user role preference stays authoritative. Do not choose child models yourself. Keep the four task-class profiles and compatibility IDs; max_depth=1 blocks nested delegation. Wait for every planned thread before final. In an active Codex App Naruto mission, commit the strict parent evidence with sks naruto parent-summary --mission <id> --stdin, then return localized Markdown without exposing the JSON.',
-        safety: 'Preserve user-authored content, inherit the parent permission mode, do not spawn nested subagents, do not inject the full pack or the full TriWiki context into every child, and do not fall back to another model, process runtime, custom scheduler, or worker pool. The historical Naruto process runtime is removed; stop with explicit blocker evidence when the official path is unavailable.',
+        safety: 'Preserve user-authored content, inherit the parent permission mode, do not spawn nested subagents, do not inject the full pack or the full TriWiki context into every child, and do not fall back to another model, process runtime, custom scheduler, or worker pool. Official Codex subagent threads are the only worker runtime; stop with explicit blocker evidence when the official path is unavailable.',
         cli: 'sks naruto run "<task>" [--agents N] [--max-threads N] [--json]; sks naruto status|subagents|proof [--mission <id>] [--json]; sks naruto parent-summary --mission <id> --stdin [--json]',
         evidence: 'subagent-plan.json, subagent-events.jsonl, subagent-parent-summary.json, subagent-evidence.json, naruto-summary.json, and naruto-gate.json.',
         fallback: 'When official subagents are unavailable, report the explicit availability blocker; the orchestration gate releases parent edits only after its bounded denials, and that release is recorded. Never fabricate process, PID, or subagent evidence.'
@@ -42,7 +41,7 @@ const CORE_SKILL_DEFINITIONS = [
         purpose: 'run evidence-bound discovery, source ledgers, and synthesis cycles.',
         discovery: 'Run $sks-research for evidence-bound discovery, not code edits.',
         when: 'Use when the user invokes $Research or asks for evidence-bound discovery, hypotheses, or falsification.',
-        workflow: 'Frame the research criteria and map assumptions before retrieval. Run layered Super Search first and accept only source rows correlated to verified proof, source-ledger, and hydrated-content artifacts. Then run three independent official research_reviewer threads covering evidence integrity, method validity, and falsification or replication. Each reviewer must return source ids, falsifiers, and cheap probes. Critical, major, or required revisions trigger a mission-local research_synthesizer revision and a fresh bounded review cycle; minor concerns remain advisory. agent-ledger.json and debate-ledger.json are compatibility projections only; do not launch a removed legacy scheduler or a custom debate pool.',
+        workflow: 'Frame the research criteria and map assumptions before retrieval. Run layered Super Search first and accept only source rows correlated to verified proof, source-ledger, and hydrated-content artifacts. Then run three independent official research_reviewer threads covering evidence integrity, method validity, and falsification or replication. Each reviewer must return source ids, falsifiers, and cheap probes. Critical, major, or required revisions trigger a mission-local research_synthesizer revision and a fresh bounded review cycle; minor concerns remain advisory. The reviewer and synthesizer threads are the only research workers; agent-ledger.json and debate-ledger.json are compatibility projections of them.',
         safety: 'Preserve user-authored content, keep research route state bounded, and do not edit repository source. Do not overclaim novelty, breakthrough, publication acceptance, or experimental support beyond recorded evidence.',
         evidence: 'research plan, source ledger, cycle record, synthesis, and final review.',
         fallback: 'State source/tool unavailability and avoid unsupported live-accuracy claims.'
@@ -66,7 +65,7 @@ const CORE_SKILL_DEFINITIONS = [
         purpose: 'run one screenshot-to-generated-annotation-to-UX-report pipeline without duplicate picker skills.',
         discovery: 'Run $sks-image-ux-review for screenshot-to-UX annotation.',
         when: 'Use for $Image-UX-Review, $UX-Review, $Visual-Review, or $UI-UX-Review requests; all aliases resolve to this one canonical skill.',
-        workflow: ("Capture or attach the real source screenshot first; web/browser/webapp capture must pass the Codex Chrome Extension readiness gate first, while Computer Use is reserved for native Mac/non-web surfaces. Send the source image as the I2I reference to the selected Codex imagegen provider with " + IMAGEGEN_MODEL + " and a senior Toss UI/UX designer prompt that visibly adds numbered P0/P1/P2/P3 callouts, hierarchy, contrast, alignment, density, affordance, eye-flow arrows, and a corrected mini-comp. Then analyze the generated annotated image pixels with vision/OCR, not the source screenshot, and write the issue ledger, extraction report, and UX/UI change report with the generated image path and sha256."),
+        workflow: ("Capture or attach the real source screenshot first; web/browser/webapp capture must pass the Codex Chrome Extension readiness gate first, while Computer Use is reserved for native Mac/non-web surfaces. Send the source image as the I2I reference with `sks imagegen generate --reference` (the active SKS image mode) and a senior Toss UI/UX designer prompt that visibly adds numbered P0/P1/P2/P3 callouts, hierarchy, contrast, alignment, density, affordance, eye-flow arrows, and a corrected mini-comp. Then analyze the generated annotated image pixels with vision/OCR, not the source screenshot, and write the issue ledger, extraction report, and UX/UI change report with the generated image path and sha256."),
         safety: 'Do not substitute text-only critique, a source-screenshot-only report, placeholders, partial image frames, mock evidence, or an unrelated API provider for the selected real imagegen path. Apply fixes only when requested and recheck changed screens.',
         cli: 'sks ux-review run --image <path> [--fix] --json; legacy $sks-ux-review, $sks-visual-review, and $sks-ui-ux-review inputs route here internally.',
         evidence: 'image-ux-screen-inventory.json, image-ux-imagegen-request.json, image-ux-imagegen-response.json, image-ux-generated-review-ledger.json, image-ux-issue-ledger.json, image-ux-callout-extraction-report.json, image-ux-iteration-report.json, and image-ux-review-gate.json.',
@@ -144,7 +143,7 @@ const CORE_SKILL_DEFINITIONS = [
         purpose: 'create or replace TriWiki with an exhaustive repository code-navigation index so an LLM can find the purpose, file, symbol, exact coordinate, and supported directed relationships of current code quickly.',
         discovery: 'Run $sks-align to rebuild TriWiki from current repository code.',
         when: 'Use when the user invokes $Align or asks to reread the current codebase and rebuild or repair TriWiki strictly from current code. Cleanup is optional and independent.',
-        workflow: 'Run sks align run directly against either an absent or existing TriWiki. Align ignores all prior TriWiki state as index input, walks every accepted current source file without incremental or fragment cache reuse, derives purpose only from source comments/docstrings, records exact file and symbol coordinates plus extractor-supported source relations, rechecks the full source inventory digest, validates graph/meta/manifest/code-pack/context-pack in temporary staging, transactionally replaces the active generation, then deletes the temporary prior-state handle. context-graph.json is the exhaustive authority; context-pack.json and managed AGENTS.md blocks are bounded fast-lookup projections. Keep align-ledger.json and align-gate.json truthful, then finish reflection and Honest Mode.',
+        workflow: 'Run sks align run directly against either an absent or existing TriWiki. Align ignores all prior TriWiki state as index input, walks every accepted current source file without incremental or fragment cache reuse, derives purpose only from source comments/docstrings, records exact file and symbol coordinates plus extractor-supported source relations, rechecks the full source inventory digest, validates graph/meta/manifest/code-pack/context-pack in temporary staging, transactionally replaces the active generation, then deletes the temporary prior-state handle. context-graph.json is the exhaustive authority; context-pack.json and managed AGENTS.md blocks are bounded fast-lookup projections. Keep align-ledger.json and align-gate.json truthful, then state what was verified and what remains.',
         safety: 'Never read prior TriWiki memory, wrongness, mission prompts, ordinary docs, external docs, proof cards, or LLM inference as index input. Refuse caps, extraction-limit violations, unreadable/oversized/binary supported-source files, symlink escapes, source drift during the scan, partial staging, non-code extractors, or incomplete file coverage. Do not retain a previous generation.',
         cli: 'sks align prepare|run|status|proof [mission|"scope"] [--json]',
         evidence: 'work-order-ledger.json, align-plan.json, align-ledger.json, align-gate.json, .sneakoscope/wiki/context-graph.json, context-graph.meta.json, code-navigation-manifest.json, code-pack.json, context-pack.json, managed AGENTS.md projections, completion-proof.json, trust-report.json, and Honest Mode.',

package/dist/core/codex-native/native-capability-repair-matrix.js

@@ -1,4 +1,3 @@
-import { IMAGEGEN_MODEL } from '../imagegen/imagegen-model-policy.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
@@ -80,16 +79,16 @@ async function stateForCapability(root, id, imageCapability, nativeFeatureMatrix
             repair_actions: verified
                 ? ['postcheck-imagegen-path-contract']
                 : builtInConfigured
-                    ? [("Use the selected model-capable image provider with " + IMAGEGEN_MODEL + " in a fresh task and record the selected raster output path before retrying the image route.")]
-                    : [("Select a provider supporting " + IMAGEGEN_MODEL + " surface, then verify it with a real generated raster output before retrying the image route.")],
+                    ? ['Run `sks imagegen generate --prompt <text> --out <file>` (it follows the active SKS image mode) and record the raster output path before retrying the image route.']
+                    : ['Check `sks imagegen status --json`, then verify the active image mode with one real generated raster before retrying the image route.'],
             after: null,
             artifact_path: path.join(reports, 'native-capability-repair-matrix.json'),
             core_blockers: [],
             route_blockers: verified ? {} : { 'route-image': [routeBlocker] },
             manual_actions: verified ? [] : [
                 builtInConfigured
-                    ? ("Generate one real raster with the selected model-capable provider: " + IMAGEGEN_MODEL + " and bind its output path to the route evidence.")
-                    : ("Select a provider supporting " + IMAGEGEN_MODEL + " surface before image routes.")
+                    ? 'Generate one real raster with `sks imagegen generate` and bind its output path to the route evidence.'
+                    : 'Check `sks imagegen status --json` before image routes.'
             ],
             blockers: [],
             warnings: verified ? [] : [

package/dist/core/commands/image-ux-review-command.js

@@ -1,4 +1,4 @@
-import { IMAGEGEN_MODEL, CODEX_BUILTIN_IMAGEGEN_MODEL } from '../imagegen/imagegen-model-policy.js';
+import { CODEX_DEFAULT_IMAGEGEN_LABEL } from '../imagegen/imagegen-config.js';
 import path from 'node:path';
 import fsp from 'node:fs/promises';
 import { registerPathImageReference, upsertImageReferenceRegistry } from '../image/reference-evidence/reference-registry.js';
@@ -122,7 +122,7 @@ async function runImageUxReview(root, command, args = []) {
             process.exitCode = 1;
             if (flag(args, '--json'))
                 return printJson(result);
-            console.error(("UX Review blocked: no selected Codex imagegen/" + IMAGEGEN_MODEL + " provider is ready."));
+            console.error('UX Review blocked: the active SKS image mode could not generate an image (see `sks imagegen status --json`).');
             for (const action of imagegenRequired.blocker?.next_actions || [])
                 console.error(`- ${action}`);
             return result;
@@ -156,6 +156,7 @@ async function runImageUxReview(root, command, args = []) {
     }
     if (!generatedImage && shouldGenerateCallouts) {
         const outputDir = path.join(dir, 'generated-callouts');
+        const responsesModel = readOption(args, '--responses-model', null);
         const result = await generateImagegenCalloutReview({
             mission_id: id,
             source_screen_id: 'screen-1',
@@ -166,9 +167,7 @@ async function runImageUxReview(root, command, args = []) {
             }),
             requested_fidelity: 'original',
             privacy: 'local-only'
-        }, {
-            openai: { responsesModel: readOption(args, '--responses-model', null) }
-        });
+        }, responsesModel ? { env: { ...process.env, SKS_IMAGEGEN_RESPONSES_MODEL: responsesModel } } : {});
         if (result.request_artifact)
             await fsp.copyFile(result.request_artifact, path.join(dir, IMAGE_UX_REVIEW_IMAGEGEN_REQUEST_ARTIFACT));
         if (result.response_artifact)
@@ -640,7 +639,7 @@ async function attachGeneratedReviewImage(root, dir, contract, imagePath, opts =
         id: opts.mock ? 'generated-review-fixture-1' : undefined,
         source_screen_id: sourceScreen.id || 'screen-1',
         provider_surface: opts.providerSurface || 'Codex App $imagegen',
-        provider_model: response?.model || (opts.mock ? IMAGEGEN_MODEL : CODEX_BUILTIN_IMAGEGEN_MODEL),
+        provider_model: response?.model || (opts.mock ? 'mock-imagegen' : CODEX_DEFAULT_IMAGEGEN_LABEL),
         evidence_class: evidenceClass,
         output_source: outputSource,
         output_sha256: outputSha256 || undefined,
@@ -947,7 +946,7 @@ export async function stageImageReference(root, dir, imagePath, subdir, preferre
 }
 function promptForRun(command, args) {
     const source = readOption(args, '--image', null) || readOption(args, '--screenshot', null) || readOption(args, '--mission', null) || 'latest Codex Chrome Extension or native Computer Use screenshot';
-    return `$${routeForCommand(command).replace(/^\$/, '')} ${source} with ${IMAGEGEN_MODEL} callouts${flag(args, '--fix') ? ', then fix the issues' : ''}`;
+    return `$${routeForCommand(command).replace(/^\$/, '')} ${source} with generated image callouts${flag(args, '--fix') ? ', then fix the issues' : ''}`;
 }
 function sourceImageFromContract(contract) {
     const sources = contract?.answers?.IMAGE_UX_REVIEW_SOURCE_IMAGES;

package/dist/core/commands/ppt-command.js

@@ -1,4 +1,3 @@
-import { IMAGEGEN_MODEL } from '../imagegen/imagegen-model-policy.js';
 import path from 'node:path';
 import { exists, projectRoot, readJson, writeJsonAtomic } from '../fsx.js';
 import { createMission, findLatestMission, loadMission } from '../mission.js';
@@ -48,7 +47,7 @@ export async function pptCommand(command, args = []) {
                 process.exitCode = 1;
                 if (flag(args, '--json'))
                     return printJson(result);
-                console.error(("PPT build blocked: no selected Codex imagegen/" + IMAGEGEN_MODEL + " provider is ready."));
+                console.error('PPT build blocked: the active SKS image mode could not generate an image (see `sks imagegen status --json`).');
                 for (const action of imagegenRequired.blocker?.next_actions || [])
                     console.error(`- ${action}`);
                 return result;
@@ -160,7 +159,7 @@ async function pptImagegenReview(root, command, action, args = []) {
             process.exitCode = 1;
             if (flag(args, '--json'))
                 return printJson(result);
-            console.error(("PPT imagegen review blocked: no selected Codex imagegen/" + IMAGEGEN_MODEL + " provider is ready."));
+            console.error('PPT imagegen review blocked: the active SKS image mode could not generate an image (see `sks imagegen status --json`).');
             for (const action of imagegenRequired.blocker?.next_actions || [])
                 console.error(`- ${action}`);
             return result;
@@ -263,7 +262,7 @@ function nextActionForPptGate(gate = {}) {
     if (blockers.includes('slide_export_unavailable'))
         return 'Attach exported slide images with --manual-slide-images, then rerun the PPT review.';
     if (blockers.includes('ppt_imagegen_callouts_missing'))
-        return ("Generate slide callout review images with the selected model-capable provider: " + IMAGEGEN_MODEL + " and rerun extraction.");
+        return 'Generate slide callout review images with `sks imagegen generate --reference <slide image>` and rerun extraction.';
     if (blockers.includes('ppt_slide_issue_extraction_missing'))
         return 'Run `sks ppt extract-issues --generated-slide <path> --session <id> --json`, or configure Structured Outputs fallback.';
     if (blockers.includes('ppt_slide_recheck_missing'))