sneakoscope 10.3.6 → 10.3.7

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.6**. Install the latest stable release from npm.
+Current package: **SKS 10.3.7**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 
@@ -195,7 +195,7 @@ also picks the pipeline for each prompt; an explicit SKS `<div align="center">
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.6**. Install the latest stable release from npm.
+Current package: **SKS 10.3.7**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.3.6"
+version = "10.3.7"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.3.6"
+version = "10.3.7"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.3.6",
+  "package_version": "10.3.7",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/doctor/command-alias-cleanup.js

@@ -302,6 +302,7 @@ function emptySkillLegacySurface(fix) {
         removed_other_harness_skill_count: 0,
         preserved_other_harness_skill_count: 0,
         preserved_user_skill_count: 0,
+        quarantined_sks_residue_count: 0,
         remaining_count: 0,
         preserved_clean_count: 0,
         error_count: 0,
@@ -309,6 +310,7 @@ function emptySkillLegacySurface(fix) {
         removed_other_harness_skills: [],
         preserved_other_harness_skills: [],
         preserved_user_skills: [],
+        quarantined_sks_residue: [],
         remaining: [],
         errors: [],
         cleanup_prompt_command: 'sks conflicts cleanup --yes'

package/dist/core/doctor/skill-legacy-surface.js

@@ -1,13 +1,14 @@
 import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { LEGACY_DOLLAR_SKILL_NAMES } from '../routes.js';
+import { LEGACY_DOLLAR_SKILL_NAMES, routeByDollarCommand } from '../routes.js';
 import { legacyCoreSkillNames } from '../codex-native/core-skill-manifest.js';
 import { prefixKnownSksDollarReferences } from '../routes/dollar-prefix.js';
 import { inspectConfinedPath } from '../managed-path-safety.js';
 import { messageOf as errorMessage } from '../errors/message.js';
 import { collectNestedProjectRoots } from './current-project-guidance-nested.js';
 import { containsRetiredPublicSurface } from './current-project-guidance.js';
+import { quarantineUserPath } from './retired-managed-residue-private.js';
 export const SKILL_LEGACY_SURFACE_SCHEMA = 'sks.skill-legacy-surface.v1';
 export const OTHER_HARNESS_SKILL_DIR_NAMES = ['omx', 'dcodex', 'omx-codex', 'dcodex-codex'];
 const TOKEN = 'A-Za-z0-9_.\\-';
@@ -111,6 +112,32 @@ const PREFIX_LEGACY_NAMES = Array.from(new Set([
     'prompt-pipeline',
     'pipeline-runner'
 ]));
+async function isSksRouteSkillResidue(dir, name, text) {
+    if (!routeByDollarCommand(name) && !PREFIX_LEGACY_NAMES.includes(name))
+        return false;
+    const frontmatterName = /^---\n[\s\S]*?^name:\s*(.+?)\s*$[\s\S]*?^---/m.exec(text)?.[1];
+    if (frontmatterName !== name)
+        return false;
+    const files = [];
+    const walk = async (current, relative) => {
+        for (const entry of await fsp.readdir(current, { withFileTypes: true })) {
+            const rel = relative ? `${relative}/${entry.name}` : entry.name;
+            if (entry.isSymbolicLink())
+                return false;
+            if (entry.isDirectory()) {
+                if (!await walk(path.join(current, entry.name), rel))
+                    return false;
+            }
+            else
+                files.push(rel);
+        }
+        return true;
+    };
+    if (!await walk(dir, ''))
+        return false;
+    return files.every((file) => SKS_SKILL_LAYOUT_FILES.has(file));
+}
+const SKS_SKILL_LAYOUT_FILES = new Set(['SKILL.md', 'agents/openai.yaml']);
 export function rewriteSkillLegacySurface(input) {
     let text = String(input || '');
     const hits = [];
@@ -173,6 +200,7 @@ export async function reconcileSkillLegacySurface(opts) {
     const removedOtherHarness = [];
     const preservedOtherHarness = [];
     const preservedUserSkills = [];
+    const quarantinedResidue = [];
     const remaining = [];
     const errors = [];
     let scanned = 0;
@@ -262,6 +290,21 @@ export async function reconcileSkillLegacySurface(opts) {
                 remaining.push(display);
                 continue;
             }
+            if (await isSksRouteSkillResidue(dir, row.name, before).catch(() => false)) {
+                if (!fix) {
+                    remaining.push(display);
+                    continue;
+                }
+                try {
+                    await quarantineUserPath(ownerRoot, dir, path.join(ownerRoot, '.sneakoscope', 'quarantine', 'skill-legacy-surface'));
+                    quarantinedResidue.push(display);
+                }
+                catch (error) {
+                    errors.push(`${display}:${errorMessage(error)}`);
+                    remaining.push(display);
+                }
+                continue;
+            }
             preservedUserSkills.push(display);
             remaining.push(display);
         }
@@ -275,6 +318,7 @@ export async function reconcileSkillLegacySurface(opts) {
         removed_other_harness_skill_count: removedOtherHarness.length,
         preserved_other_harness_skill_count: preservedOtherHarness.length,
         preserved_user_skill_count: preservedUserSkills.length,
+        quarantined_sks_residue_count: quarantinedResidue.length,
         remaining_count: remaining.length,
         preserved_clean_count: preservedClean,
         error_count: errors.length,
@@ -282,6 +326,7 @@ export async function reconcileSkillLegacySurface(opts) {
         removed_other_harness_skills: Array.from(new Set(removedOtherHarness)).sort(),
         preserved_other_harness_skills: Array.from(new Set(preservedOtherHarness)).sort(),
         preserved_user_skills: Array.from(new Set(preservedUserSkills)).sort(),
+        quarantined_sks_residue: Array.from(new Set(quarantinedResidue)).sort(),
         remaining: Array.from(new Set(remaining)).sort(),
         errors: Array.from(new Set(errors)).sort(),
         cleanup_prompt_command: 'sks conflicts cleanup --yes'

package/dist/core/update/registry-availability.js

@@ -0,0 +1,58 @@
+import { compareSemVer } from './semver.js';
+export async function versionDownloadability(input) {
+    const env = input.env || process.env;
+    if (!probeEnabled(env))
+        return 'unknown';
+    const fetchImpl = input.fetchImpl || fetch;
+    const timeoutMs = input.timeoutMs ?? 4000;
+    const base = input.registry.replace(/\/+$/, '');
+    const name = input.packageName.replace('/', '%2F');
+    try {
+        const doc = await timed(fetchImpl, `${base}/${name}/${encodeURIComponent(input.version)}`, { headers: { accept: 'application/json' } }, timeoutMs);
+        if (doc.status === 404)
+            return 'not_yet_downloadable';
+        if (!doc.ok)
+            return 'unknown';
+        const tarball = (await doc.json().catch(() => null))?.dist?.tarball;
+        if (typeof tarball !== 'string' || !/^https?:\/\//.test(tarball))
+            return 'unknown';
+        const head = await timed(fetchImpl, tarball, { method: 'HEAD' }, timeoutMs);
+        if (head.ok)
+            return 'downloadable';
+        return head.status === 404 ? 'not_yet_downloadable' : 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+export async function offeredUpdateVersion(input) {
+    const { listed, current } = input;
+    if (!listed || (compareSemVer(listed, current) ?? 0) <= 0)
+        return { latest: listed, pending: null };
+    const state = await versionDownloadability({
+        registry: input.registry,
+        packageName: input.packageName,
+        version: listed,
+        ...(input.env ? { env: input.env } : {}),
+        ...(input.fetchImpl ? { fetchImpl: input.fetchImpl } : {})
+    });
+    return state === 'not_yet_downloadable' ? { latest: current, pending: listed } : { latest: listed, pending: null };
+}
+function probeEnabled(env) {
+    const flag = env.SKS_UPDATE_TARBALL_PROBE;
+    if (flag === '0')
+        return false;
+    if (flag === '1')
+        return true;
+    return !(env.NODE_TEST_CONTEXT || env.SKS_TEST_ISOLATION === '1');
+}
+async function timed(fetchImpl, url, init, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetchImpl(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/core/update-check.js

@@ -12,6 +12,7 @@ import { compareSemVer, extractSemVer, parseSemVer } from './update/semver.js';
 import { countUpdates, emptyUpdateStatus, resolveSksUpdateStatus, UpdateStatusRefreshError } from './update/update-status.js';
 import { acquireUpdateOperationLock, authorizeUpdateRollback, buildUpdateNowCommand, buildUpdateRollbackCommand, canonicalUpdateRegistry, UpdateOperationRecorder, updateOperationLastInstallPath, updateReceiptHasConfirmedGlobalInstall } from './update/update-operation.js';
 import { runTemporaryInstallSmoke } from './update/temporary-install-smoke.js';
+import { offeredUpdateVersion } from './update/registry-availability.js';
 import { npmGlobalInstallTargets, repairManagedPermissions } from './update/managed-permission-repair.js';
 import { updateStageFailureDiagnostics } from './update/update-stage-diagnostics.js';
 import { executableOnInjectedPath, inspectInstalledCliResolution } from './update/installed-cli-resolution.js';
@@ -150,7 +151,7 @@ async function runSksUpdateCheckLive(options = {}) {
         });
     }
     const result = await latestPromise;
-    if (!result) {
+    if (!result || result.code !== 0) {
         return buildResult({
             packageName,
             current,
@@ -160,33 +161,14 @@ async function runSksUpdateCheckLive(options = {}) {
             npmBin,
             projectRoot: options.projectRoot,
             commandRegistry: options.registry,
-            error: 'npm view failed'
+            error: result ? `${result.stderr || result.stdout || 'npm view failed'}`.trim() : 'npm view failed'
         });
     }
-    if (result.code !== 0) {
-        return buildResult({
-            packageName,
-            current,
-            effective,
-            latest: null,
-            registry,
-            npmBin,
-            projectRoot: options.projectRoot,
-            commandRegistry: options.registry,
-            error: `${result.stderr || result.stdout || 'npm view failed'}`.trim()
-        });
-    }
-    const latest = extractSemVer(String(result.stdout || '').trim().split(/\s+/).pop() || '');
-    return buildResult({
-        packageName,
-        current,
-        effective,
-        latest,
-        registry,
-        npmBin,
-        projectRoot: options.projectRoot,
-        commandRegistry: options.registry
-    });
+    const offered = await offeredUpdateVersion({ listed: extractSemVer(String(result.stdout || '').trim().split(/\s+/).pop() || ''), current, registry, packageName, env });
+    return {
+        ...buildResult({ packageName, current, effective, latest: offered.latest, registry, npmBin, projectRoot: options.projectRoot, commandRegistry: options.registry }),
+        pending_latest: offered.pending
+    };
 }
 function buildUpdateStatusSnapshot(input) {
     const currentParsed = parseSemVer(input.check.current);

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '10.3.6';
+export const PACKAGE_VERSION = '10.3.7';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "10.3.6",
+  "version": "10.3.7",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",