sneakoscope 10.3.5 → 10.3.7

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.5**. Install the latest stable release from npm.
+Current package: **SKS 10.3.7**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 
@@ -195,7 +195,7 @@ also picks the pipeline for each prompt; an explicit SKS `<div align="center">
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.5**. Install the latest stable release from npm.
+Current package: **SKS 10.3.7**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.3.5"
+version = "10.3.7"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.3.5"
+version = "10.3.7"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.3.5",
+  "package_version": "10.3.7",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/doctor/command-alias-cleanup.js

@@ -302,6 +302,7 @@ function emptySkillLegacySurface(fix) {
         removed_other_harness_skill_count: 0,
         preserved_other_harness_skill_count: 0,
         preserved_user_skill_count: 0,
+        quarantined_sks_residue_count: 0,
         remaining_count: 0,
         preserved_clean_count: 0,
         error_count: 0,
@@ -309,6 +310,7 @@ function emptySkillLegacySurface(fix) {
         removed_other_harness_skills: [],
         preserved_other_harness_skills: [],
         preserved_user_skills: [],
+        quarantined_sks_residue: [],
         remaining: [],
         errors: [],
         cleanup_prompt_command: 'sks conflicts cleanup --yes'

package/dist/core/doctor/skill-legacy-surface.js

@@ -1,13 +1,14 @@
 import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { LEGACY_DOLLAR_SKILL_NAMES } from '../routes.js';
+import { LEGACY_DOLLAR_SKILL_NAMES, routeByDollarCommand } from '../routes.js';
 import { legacyCoreSkillNames } from '../codex-native/core-skill-manifest.js';
 import { prefixKnownSksDollarReferences } from '../routes/dollar-prefix.js';
 import { inspectConfinedPath } from '../managed-path-safety.js';
 import { messageOf as errorMessage } from '../errors/message.js';
 import { collectNestedProjectRoots } from './current-project-guidance-nested.js';
 import { containsRetiredPublicSurface } from './current-project-guidance.js';
+import { quarantineUserPath } from './retired-managed-residue-private.js';
 export const SKILL_LEGACY_SURFACE_SCHEMA = 'sks.skill-legacy-surface.v1';
 export const OTHER_HARNESS_SKILL_DIR_NAMES = ['omx', 'dcodex', 'omx-codex', 'dcodex-codex'];
 const TOKEN = 'A-Za-z0-9_.\\-';
@@ -111,6 +112,32 @@ const PREFIX_LEGACY_NAMES = Array.from(new Set([
     'prompt-pipeline',
     'pipeline-runner'
 ]));
+async function isSksRouteSkillResidue(dir, name, text) {
+    if (!routeByDollarCommand(name) && !PREFIX_LEGACY_NAMES.includes(name))
+        return false;
+    const frontmatterName = /^---\n[\s\S]*?^name:\s*(.+?)\s*$[\s\S]*?^---/m.exec(text)?.[1];
+    if (frontmatterName !== name)
+        return false;
+    const files = [];
+    const walk = async (current, relative) => {
+        for (const entry of await fsp.readdir(current, { withFileTypes: true })) {
+            const rel = relative ? `${relative}/${entry.name}` : entry.name;
+            if (entry.isSymbolicLink())
+                return false;
+            if (entry.isDirectory()) {
+                if (!await walk(path.join(current, entry.name), rel))
+                    return false;
+            }
+            else
+                files.push(rel);
+        }
+        return true;
+    };
+    if (!await walk(dir, ''))
+        return false;
+    return files.every((file) => SKS_SKILL_LAYOUT_FILES.has(file));
+}
+const SKS_SKILL_LAYOUT_FILES = new Set(['SKILL.md', 'agents/openai.yaml']);
 export function rewriteSkillLegacySurface(input) {
     let text = String(input || '');
     const hits = [];
@@ -173,6 +200,7 @@ export async function reconcileSkillLegacySurface(opts) {
     const removedOtherHarness = [];
     const preservedOtherHarness = [];
     const preservedUserSkills = [];
+    const quarantinedResidue = [];
     const remaining = [];
     const errors = [];
     let scanned = 0;
@@ -262,6 +290,21 @@ export async function reconcileSkillLegacySurface(opts) {
                 remaining.push(display);
                 continue;
             }
+            if (await isSksRouteSkillResidue(dir, row.name, before).catch(() => false)) {
+                if (!fix) {
+                    remaining.push(display);
+                    continue;
+                }
+                try {
+                    await quarantineUserPath(ownerRoot, dir, path.join(ownerRoot, '.sneakoscope', 'quarantine', 'skill-legacy-surface'));
+                    quarantinedResidue.push(display);
+                }
+                catch (error) {
+                    errors.push(`${display}:${errorMessage(error)}`);
+                    remaining.push(display);
+                }
+                continue;
+            }
             preservedUserSkills.push(display);
             remaining.push(display);
         }
@@ -275,6 +318,7 @@ export async function reconcileSkillLegacySurface(opts) {
         removed_other_harness_skill_count: removedOtherHarness.length,
         preserved_other_harness_skill_count: preservedOtherHarness.length,
         preserved_user_skill_count: preservedUserSkills.length,
+        quarantined_sks_residue_count: quarantinedResidue.length,
         remaining_count: remaining.length,
         preserved_clean_count: preservedClean,
         error_count: errors.length,
@@ -282,6 +326,7 @@ export async function reconcileSkillLegacySurface(opts) {
         removed_other_harness_skills: Array.from(new Set(removedOtherHarness)).sort(),
         preserved_other_harness_skills: Array.from(new Set(preservedOtherHarness)).sort(),
         preserved_user_skills: Array.from(new Set(preservedUserSkills)).sort(),
+        quarantined_sks_residue: Array.from(new Set(quarantinedResidue)).sort(),
         remaining: Array.from(new Set(remaining)).sort(),
         errors: Array.from(new Set(errors)).sort(),
         cleanup_prompt_command: 'sks conflicts cleanup --yes'

package/dist/core/init/skills.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import fsp from 'node:fs/promises';
 import os from 'node:os';
-import { exists, nowIso, PACKAGE_VERSION, readJson, readText, sha256, withScratchDir, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { exists, nowIso, PACKAGE_VERSION, packageRoot, readJson, readText, sha256, which, withScratchDir, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { buildSksCoreSkillManifest, isCoreSkillName, legacyCoreSkillNames } from '../codex-native/core-skill-manifest.js';
 import { syncCoreSkillsIntegrity } from '../codex-native/core-skill-integrity.js';
 import { managedSkillGenerationLockPath, withManagedSkillGenerationLock } from '../codex-native/managed-skill-generation-lock.js';
@@ -682,11 +682,14 @@ async function reconcileSkillsUnlocked(opts) {
         if (installedMarker?.generated_by === 'sneakoscope') {
             const installedVersion = String(installedMarker?.version || '').trim();
             const versionOrder = compareSemVer(installedVersion, PACKAGE_VERSION);
-            if (versionOrder === 1) {
+            const activeNewer = versionOrder === 1 ? await activeNewerSksOnPath(PACKAGE_VERSION) : null;
+            if (activeNewer) {
                 report.ok = false;
-                report.warnings.push(`managed_skill_generation_downgrade_refused:${installedVersion}:runtime_${PACKAGE_VERSION}`);
+                report.warnings.push(`managed_skill_generation_downgrade_refused:${installedVersion}:runtime_${PACKAGE_VERSION}:path_${activeNewer}`);
                 return report;
             }
+            if (versionOrder === 1)
+                report.warnings.push(`managed_skill_generation_reclaimed_from_${installedVersion}`);
             const installedBuildTime = Number(installedMarker?.runtime_build_source_time);
             const currentBuildTime = await runtimeBuildSourceTime();
             const installedGeneration = String(installedMarker?.skill_generation_sha256 || '');
@@ -697,7 +700,8 @@ async function reconcileSkillsUnlocked(opts) {
                 && Number.isFinite(installedBuildTime)
                 && installedBuildTime > 0
                 && currentBuildTime !== null
-                && installedBuildTime > currentBuildTime) {
+                && installedBuildTime > currentBuildTime
+                && await activeNewerSksOnPath(PACKAGE_VERSION, installedBuildTime)) {
                 report.ok = false;
                 report.warnings.push(`managed_skill_same_version_older_build_refused:${currentBuildTime}:installed_${installedBuildTime}`);
                 return report;
@@ -1384,3 +1388,29 @@ async function removeEmptyGeneratedParents(root, rel) {
     if (rel.startsWith('.codex/skills/'))
         await removeDirIfEmpty(path.join(root, '.codex', 'skills'));
 }
+async function activeNewerSksOnPath(runtimeVersion, sameVersionBuildTime = null) {
+    const bin = await which('sks').catch(() => null);
+    if (!bin)
+        return null;
+    let dir = path.dirname(await fsp.realpath(bin).catch(() => bin));
+    for (let depth = 0; depth < 5; depth += 1) {
+        const manifest = await readJson(path.join(dir, 'package.json'), null).catch(() => null);
+        if (manifest?.name === 'sneakoscope' && typeof manifest.version === 'string') {
+            const order = compareSemVer(manifest.version, runtimeVersion);
+            if (order === 1)
+                return manifest.version;
+            if (order === 0 && sameVersionBuildTime !== null && path.resolve(dir) !== path.resolve(packageRoot())) {
+                const stamp = await readJson(path.join(dir, 'dist', '.sks-build-stamp.json'), null).catch(() => null);
+                const built = Number(stamp?.built_at_source_time);
+                if (Number.isFinite(built) && built >= sameVersionBuildTime)
+                    return manifest.version;
+            }
+            return null;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}

package/dist/core/update/registry-availability.js

@@ -0,0 +1,58 @@
+import { compareSemVer } from './semver.js';
+export async function versionDownloadability(input) {
+    const env = input.env || process.env;
+    if (!probeEnabled(env))
+        return 'unknown';
+    const fetchImpl = input.fetchImpl || fetch;
+    const timeoutMs = input.timeoutMs ?? 4000;
+    const base = input.registry.replace(/\/+$/, '');
+    const name = input.packageName.replace('/', '%2F');
+    try {
+        const doc = await timed(fetchImpl, `${base}/${name}/${encodeURIComponent(input.version)}`, { headers: { accept: 'application/json' } }, timeoutMs);
+        if (doc.status === 404)
+            return 'not_yet_downloadable';
+        if (!doc.ok)
+            return 'unknown';
+        const tarball = (await doc.json().catch(() => null))?.dist?.tarball;
+        if (typeof tarball !== 'string' || !/^https?:\/\//.test(tarball))
+            return 'unknown';
+        const head = await timed(fetchImpl, tarball, { method: 'HEAD' }, timeoutMs);
+        if (head.ok)
+            return 'downloadable';
+        return head.status === 404 ? 'not_yet_downloadable' : 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+export async function offeredUpdateVersion(input) {
+    const { listed, current } = input;
+    if (!listed || (compareSemVer(listed, current) ?? 0) <= 0)
+        return { latest: listed, pending: null };
+    const state = await versionDownloadability({
+        registry: input.registry,
+        packageName: input.packageName,
+        version: listed,
+        ...(input.env ? { env: input.env } : {}),
+        ...(input.fetchImpl ? { fetchImpl: input.fetchImpl } : {})
+    });
+    return state === 'not_yet_downloadable' ? { latest: current, pending: listed } : { latest: listed, pending: null };
+}
+function probeEnabled(env) {
+    const flag = env.SKS_UPDATE_TARBALL_PROBE;
+    if (flag === '0')
+        return false;
+    if (flag === '1')
+        return true;
+    return !(env.NODE_TEST_CONTEXT || env.SKS_TEST_ISOLATION === '1');
+}
+async function timed(fetchImpl, url, init, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetchImpl(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/core/update/temporary-install-smoke.js

@@ -4,6 +4,11 @@ import path from 'node:path';
 import { readJson, runProcess } from '../fsx.js';
 import { runPackageLocalDoctor } from './update-migration-state.js';
 import { compareSemVer, extractSemVer } from './semver.js';
+export function isPublishPropagationError(text) {
+    return /\bE404\b|\bETARGET\b|No matching version found|404 Not Found - GET [^\s]+\.tgz/i.test(text);
+}
+export const PUBLISH_PROPAGATION_WAIT_MS = 6 * 60 * 1000;
+const PUBLISH_PROPAGATION_RETRY_MS = 20 * 1000;
 export async function runTemporaryInstallSmoke(input) {
     const npmArgs = [];
     if (input.env.SKS_UPDATE_SKIP_TEMP_INSTALL_SMOKE === '1') {
@@ -19,21 +24,38 @@ export async function runTemporaryInstallSmoke(input) {
             entrypoint = path.resolve(fixtureEntrypoint);
         }
         else {
-            npmArgs.push('install', '--prefix', temp, `${input.packageName}@${input.version}`, '--registry', input.registry, '--ignore-scripts', '--no-audit', '--no-fund');
-            const install = await runProcess(input.npmBin, npmArgs, {
-                cwd: temp,
-                env: input.env,
-                timeoutMs: input.timeoutMs ?? 3 * 60 * 1000,
-                maxOutputBytes: input.maxOutputBytes ?? 128 * 1024
-            }).catch((error) => ({
-                code: 1,
-                stdout: '',
-                stderr: error instanceof Error ? error.message : String(error),
-                timedOut: false
-            }));
+            npmArgs.push('install', '--prefix', temp, `${input.packageName}@${input.version}`, '--registry', input.registry, '--ignore-scripts', '--no-audit', '--no-fund', '--prefer-online');
+            const waitBudget = publishWaitBudgetMs(input.env);
+            const sleep = input.sleep || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+            const started = Date.now();
+            let install;
+            for (;;) {
+                install = await runProcess(input.npmBin, npmArgs, {
+                    cwd: temp,
+                    env: input.env,
+                    timeoutMs: input.timeoutMs ?? 3 * 60 * 1000,
+                    maxOutputBytes: input.maxOutputBytes ?? 128 * 1024
+                }).catch((error) => ({
+                    code: 1,
+                    stdout: '',
+                    stderr: error instanceof Error ? error.message : String(error),
+                    timedOut: false
+                }));
+                const output = `${install.stderr || ''}\n${install.stdout || ''}`;
+                const waited = Date.now() - started;
+                if (install.code === 0 || !isPublishPropagationError(output) || waited >= waitBudget)
+                    break;
+                input.onPublishWait?.(waited);
+                await sleep(Math.min(PUBLISH_PROPAGATION_RETRY_MS, waitBudget - waited));
+            }
             installCode = install.code;
+            const waitedMs = Date.now() - started;
             if (install.code !== 0) {
-                return result(input, npmArgs, false, 'install_failed', installCode, null, null, null, null, String(install.stderr || install.stdout || 'temporary npm install failed').trim());
+                const output = String(install.stderr || install.stdout || 'temporary npm install failed').trim();
+                const pendingMessage = `${input.packageName}@${input.version} is published but npm has not finished distributing it (waited ${Math.round(waitedMs / 1000)}s). Your current version keeps working; run sks update again in a few minutes.`;
+                return isPublishPropagationError(output)
+                    ? { ...result(input, npmArgs, false, 'not_yet_downloadable', installCode, null, null, null, null, pendingMessage), publish_wait_ms: waitedMs }
+                    : { ...result(input, npmArgs, false, 'install_failed', installCode, null, null, null, null, output), publish_wait_ms: waitedMs };
             }
             const packageRoot = path.join(temp, 'node_modules', input.packageName);
             const manifest = await readJson(path.join(packageRoot, 'package.json'), null).catch(() => null);
@@ -89,6 +111,13 @@ function result(input, npmArgs, ok, status, installCode, entrypoint, manifestVer
         error
     };
 }
+function publishWaitBudgetMs(env) {
+    const raw = env.SKS_UPDATE_PUBLISH_WAIT_MS;
+    if (raw === undefined || raw === '')
+        return PUBLISH_PROPAGATION_WAIT_MS;
+    const value = Number(raw);
+    return Number.isFinite(value) && value >= 0 ? value : PUBLISH_PROPAGATION_WAIT_MS;
+}
 async function regularFile(file) {
     const stat = await fs.stat(file).catch(() => null);
     return Boolean(stat?.isFile());

package/dist/core/update-check.js

@@ -12,6 +12,7 @@ import { compareSemVer, extractSemVer, parseSemVer } from './update/semver.js';
 import { countUpdates, emptyUpdateStatus, resolveSksUpdateStatus, UpdateStatusRefreshError } from './update/update-status.js';
 import { acquireUpdateOperationLock, authorizeUpdateRollback, buildUpdateNowCommand, buildUpdateRollbackCommand, canonicalUpdateRegistry, UpdateOperationRecorder, updateOperationLastInstallPath, updateReceiptHasConfirmedGlobalInstall } from './update/update-operation.js';
 import { runTemporaryInstallSmoke } from './update/temporary-install-smoke.js';
+import { offeredUpdateVersion } from './update/registry-availability.js';
 import { npmGlobalInstallTargets, repairManagedPermissions } from './update/managed-permission-repair.js';
 import { updateStageFailureDiagnostics } from './update/update-stage-diagnostics.js';
 import { executableOnInjectedPath, inspectInstalledCliResolution } from './update/installed-cli-resolution.js';
@@ -150,7 +151,7 @@ async function runSksUpdateCheckLive(options = {}) {
         });
     }
     const result = await latestPromise;
-    if (!result) {
+    if (!result || result.code !== 0) {
         return buildResult({
             packageName,
             current,
@@ -160,33 +161,14 @@ async function runSksUpdateCheckLive(options = {}) {
             npmBin,
             projectRoot: options.projectRoot,
             commandRegistry: options.registry,
-            error: 'npm view failed'
+            error: result ? `${result.stderr || result.stdout || 'npm view failed'}`.trim() : 'npm view failed'
         });
     }
-    if (result.code !== 0) {
-        return buildResult({
-            packageName,
-            current,
-            effective,
-            latest: null,
-            registry,
-            npmBin,
-            projectRoot: options.projectRoot,
-            commandRegistry: options.registry,
-            error: `${result.stderr || result.stdout || 'npm view failed'}`.trim()
-        });
-    }
-    const latest = extractSemVer(String(result.stdout || '').trim().split(/\s+/).pop() || '');
-    return buildResult({
-        packageName,
-        current,
-        effective,
-        latest,
-        registry,
-        npmBin,
-        projectRoot: options.projectRoot,
-        commandRegistry: options.registry
-    });
+    const offered = await offeredUpdateVersion({ listed: extractSemVer(String(result.stdout || '').trim().split(/\s+/).pop() || ''), current, registry, packageName, env });
+    return {
+        ...buildResult({ packageName, current, effective, latest: offered.latest, registry, npmBin, projectRoot: options.projectRoot, commandRegistry: options.registry }),
+        pending_latest: offered.pending
+    };
 }
 function buildUpdateStatusSnapshot(input) {
     const currentParsed = parseSemVer(input.check.current);
@@ -823,7 +805,7 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                 registry,
                 env: nestedProcessEnv,
                 ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
-                ...(options.maxOutputBytes === undefined ? {} : { maxOutputBytes: options.maxOutputBytes })
+                ...(options.maxOutputBytes === undefined ? {} : { maxOutputBytes: options.maxOutputBytes }), ...(machineOutput ? {} : { onPublishWait: (waited) => process.stderr.write(`  npm is still publishing ${packageName}@${installVersion}; waiting (${Math.round(waited / 1000)}s)...\n`) })
             });
             stage('temporary_install_smoke', temporaryInstallSmoke.ok, temporaryInstallSmoke.status, {
                 install_code: temporaryInstallSmoke.install_code,
@@ -846,7 +828,7 @@ async function runSksUpdateNowInternal(options, rollbackAuthorization) {
                     projectRoot: projectReceiptRoot,
                     registry,
                     globalRoot,
-                    status: 'failed',
+                    status: temporaryInstallSmoke.status === 'not_yet_downloadable' ? 'unavailable' : 'failed',
                     ok: false,
                     installCode: null,
                     oldVersionDoctor,

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '10.3.5';
+export const PACKAGE_VERSION = '10.3.7';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "10.3.5",
+  "version": "10.3.7",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",