sneakoscope 10.3.5 → 10.3.6

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.5**. Install the latest stable release from npm.
+Current package: **SKS 10.3.6**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 
@@ -195,7 +195,7 @@ also picks the pipeline for each prompt; an explicit SKS `<div align="center">
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.5**. Install the latest stable release from npm.
+Current package: **SKS 10.3.6**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.3.5"
+version = "10.3.6"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.3.5"
+version = "10.3.6"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.3.5",
+  "package_version": "10.3.6",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/init/skills.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import fsp from 'node:fs/promises';
 import os from 'node:os';
-import { exists, nowIso, PACKAGE_VERSION, readJson, readText, sha256, withScratchDir, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { exists, nowIso, PACKAGE_VERSION, packageRoot, readJson, readText, sha256, which, withScratchDir, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { buildSksCoreSkillManifest, isCoreSkillName, legacyCoreSkillNames } from '../codex-native/core-skill-manifest.js';
 import { syncCoreSkillsIntegrity } from '../codex-native/core-skill-integrity.js';
 import { managedSkillGenerationLockPath, withManagedSkillGenerationLock } from '../codex-native/managed-skill-generation-lock.js';
@@ -682,11 +682,14 @@ async function reconcileSkillsUnlocked(opts) {
         if (installedMarker?.generated_by === 'sneakoscope') {
             const installedVersion = String(installedMarker?.version || '').trim();
             const versionOrder = compareSemVer(installedVersion, PACKAGE_VERSION);
-            if (versionOrder === 1) {
+            const activeNewer = versionOrder === 1 ? await activeNewerSksOnPath(PACKAGE_VERSION) : null;
+            if (activeNewer) {
                 report.ok = false;
-                report.warnings.push(`managed_skill_generation_downgrade_refused:${installedVersion}:runtime_${PACKAGE_VERSION}`);
+                report.warnings.push(`managed_skill_generation_downgrade_refused:${installedVersion}:runtime_${PACKAGE_VERSION}:path_${activeNewer}`);
                 return report;
             }
+            if (versionOrder === 1)
+                report.warnings.push(`managed_skill_generation_reclaimed_from_${installedVersion}`);
             const installedBuildTime = Number(installedMarker?.runtime_build_source_time);
             const currentBuildTime = await runtimeBuildSourceTime();
             const installedGeneration = String(installedMarker?.skill_generation_sha256 || '');
@@ -697,7 +700,8 @@ async function reconcileSkillsUnlocked(opts) {
                 && Number.isFinite(installedBuildTime)
                 && installedBuildTime > 0
                 && currentBuildTime !== null
-                && installedBuildTime > currentBuildTime) {
+                && installedBuildTime > currentBuildTime
+                && await activeNewerSksOnPath(PACKAGE_VERSION, installedBuildTime)) {
                 report.ok = false;
                 report.warnings.push(`managed_skill_same_version_older_build_refused:${currentBuildTime}:installed_${installedBuildTime}`);
                 return report;
@@ -1384,3 +1388,29 @@ async function removeEmptyGeneratedParents(root, rel) {
     if (rel.startsWith('.codex/skills/'))
         await removeDirIfEmpty(path.join(root, '.codex', 'skills'));
 }
+async function activeNewerSksOnPath(runtimeVersion, sameVersionBuildTime = null) {
+    const bin = await which('sks').catch(() => null);
+    if (!bin)
+        return null;
+    let dir = path.dirname(await fsp.realpath(bin).catch(() => bin));
+    for (let depth = 0; depth < 5; depth += 1) {
+        const manifest = await readJson(path.join(dir, 'package.json'), null).catch(() => null);
+        if (manifest?.name === 'sneakoscope' && typeof manifest.version === 'string') {
+            const order = compareSemVer(manifest.version, runtimeVersion);
+            if (order === 1)
+                return manifest.version;
+            if (order === 0 && sameVersionBuildTime !== null && path.resolve(dir) !== path.resolve(packageRoot())) {
+                const stamp = await readJson(path.join(dir, 'dist', '.sks-build-stamp.json'), null).catch(() => null);
+                const built = Number(stamp?.built_at_source_time);
+                if (Number.isFinite(built) && built >= sameVersionBuildTime)
+                    return manifest.version;
+            }
+            return null;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}

package/dist/core/update/temporary-install-smoke.js

@@ -4,6 +4,11 @@ import path from 'node:path';
 import { readJson, runProcess } from '../fsx.js';
 import { runPackageLocalDoctor } from './update-migration-state.js';
 import { compareSemVer, extractSemVer } from './semver.js';
+export function isPublishPropagationError(text) {
+    return /\bE404\b|\bETARGET\b|No matching version found|404 Not Found - GET [^\s]+\.tgz/i.test(text);
+}
+export const PUBLISH_PROPAGATION_WAIT_MS = 6 * 60 * 1000;
+const PUBLISH_PROPAGATION_RETRY_MS = 20 * 1000;
 export async function runTemporaryInstallSmoke(input) {
     const npmArgs = [];
     if (input.env.SKS_UPDATE_SKIP_TEMP_INSTALL_SMOKE === '1') {
@@ -19,21 +24,38 @@ export async function runTemporaryInstallSmoke(input) {
             entrypoint = path.resolve(fixtureEntrypoint);
         }
         else {
-            npmArgs.push('install', '--prefix', temp, `${input.packageName}@${input.version}`, '--registry', input.registry, '--ignore-scripts', '--no-audit', '--no-fund');
-            const install = await runProcess(input.npmBin, npmArgs, {
-                cwd: temp,
-                env: input.env,
-                timeoutMs: input.timeoutMs ?? 3 * 60 * 1000,
-                maxOutputBytes: input.maxOutputBytes ?? 128 * 1024
-            }).catch((error) => ({
-                code: 1,
-                stdout: '',
-                stderr: error instanceof Error ? error.message : String(error),
-                timedOut: false
-            }));
+            npmArgs.push('install', '--prefix', temp, `${input.packageName}@${input.version}`, '--registry', input.registry, '--ignore-scripts', '--no-audit', '--no-fund', '--prefer-online');
+            const waitBudget = publishWaitBudgetMs(input.env);
+            const sleep = input.sleep || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+            const started = Date.now();
+            let install;
+            for (;;) {
+                install = await runProcess(input.npmBin, npmArgs, {
+                    cwd: temp,
+                    env: input.env,
+                    timeoutMs: input.timeoutMs ?? 3 * 60 * 1000,
+                    maxOutputBytes: input.maxOutputBytes ?? 128 * 1024
+                }).catch((error) => ({
+                    code: 1,
+                    stdout: '',
+                    stderr: error instanceof Error ? error.message : String(error),
+                    timedOut: false
+                }));
+                const output = `${install.stderr || ''}\n${install.stdout || ''}`;
+                const waited = Date.now() - started;
+                if (install.code === 0 || !isPublishPropagationError(output) || waited >= waitBudget)
+                    break;
+                input.onPublishWait?.(waited);
+                await sleep(Math.min(PUBLISH_PROPAGATION_RETRY_MS, waitBudget - waited));
+            }
             installCode = install.code;
+            const waitedMs = Date.now() - started;
             if (install.code !== 0) {
-                return result(input, npmArgs, false, 'install_failed', installCode, null, null, null, null, String(install.stderr || install.stdout || 'temporary npm install failed').trim());
+                const output = String(install.stderr || install.stdout || 'temporary npm install failed').trim();
+                const pendingMessage = `${input.packageName}@${input.version} is published but npm has not finished distributing it (waited ${Math.round(waitedMs / 1000)}s). Your current version keeps working; run sks update again in a few minutes.`;
+                return isPublishPropagationError(output)
+                    ? { ...result(input, npmArgs, false, 'not_yet_downloadable', installCode, null, null, null, null, pendingMessage), publish_wait_ms: waitedMs }
+                    : { ...result(input, npmArgs, false, 'install_failed', installCode, null, null, null, null, output), publish_wait_ms: waitedMs };
             }
             const packageRoot = path.join(temp, 'node_modules', input.packageName);
             const manifest = await readJson(path.join(packageRoot, 'package.json'), null).catch(() => null);
@@ -89,6 +111,13 @@ function result(input, npmArgs, ok, status, installCode, entrypoint, manifestVer
         error
     };
 }
+function publishWaitBudgetMs(env) {
+    const raw = env.SKS_UPDATE_PUBLISH_WAIT_MS;
+    if (raw === undefined || raw === '')
+        return PUBLISH_PROPAGATION_WAIT_MS;
+    const value = Number(raw);
+    return Number.isFinite(value) && value >= 0 ? value : PUBLISH_PROPAGATION_WAIT_MS;
+}
 async function regularFile(file) {
     const stat = await fs.stat(file).catch(() => null);
     return Boolean(stat?.isFile());

package/dist/core/update-check.js

@@ -823,7 +823,7 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                 registry,
                 env: nestedProcessEnv,
                 ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
-                ...(options.maxOutputBytes === undefined ? {} : { maxOutputBytes: options.maxOutputBytes })
+                ...(options.maxOutputBytes === undefined ? {} : { maxOutputBytes: options.maxOutputBytes }), ...(machineOutput ? {} : { onPublishWait: (waited) => process.stderr.write(`  npm is still publishing ${packageName}@${installVersion}; waiting (${Math.round(waited / 1000)}s)...\n`) })
             });
             stage('temporary_install_smoke', temporaryInstallSmoke.ok, temporaryInstallSmoke.status, {
                 install_code: temporaryInstallSmoke.install_code,
@@ -846,7 +846,7 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                     projectRoot: projectReceiptRoot,
                     registry,
                     globalRoot,
-                    status: 'failed',
+                    status: temporaryInstallSmoke.status === 'not_yet_downloadable' ? 'unavailable' : 'failed',
                     ok: false,
                     installCode: null,
                     oldVersionDoctor,

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '10.3.5';
+export const PACKAGE_VERSION = '10.3.6';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "10.3.5",
+  "version": "10.3.6",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",