sneakoscope 10.3.8 → 10.3.10

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.8**. Install the latest stable release from npm.
+Current package: **SKS 10.3.10**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 
@@ -29,7 +29,10 @@ npm exec --yes --package=sneakoscope@latest -- sneakoscope install --yes
 The installer resolves the latest release, installs it globally, runs setup and
 Doctor, and checks that `sks` on your PATH points to the installed version.
 
-To set up a project, run this from its root, then open it in Codex:
+SKS turns on in every project you open in Codex. Its hooks live in the
+user-level `~/.codex/hooks.json`, and `sks update` keeps them installed and
+trusted. To add a project's own SKS files (TriWiki context, ignore rules), run
+this from its root:
 
 ```sh
 sks bootstrap --yes
@@ -43,7 +46,7 @@ sks bootstrap --yes
 | Project context | TriWiki indexes repository code and supplies bounded context that can be checked against source. |
 | Verification | Tests, diagnostics, and release evidence support completion claims. Security and data-integrity checks stay in place. |
 | Native controls | SKS Center brings connections, updates, MCP servers, and diagnostics together on macOS. |
-| Consistent setup | `sks update` installs the latest release, runs Doctor, and reconciles SKS-managed files and legacy assets. |
+| Consistent setup | `sks update` installs the latest release, runs Doctor, turns SKS hooks on for every Codex project, and reconciles SKS-managed files and legacy assets. |
 
 The default `essential` profile avoids repetitive completion rituals. `strict`
 adds stronger completion requirements. See [Essential Trust](docs/essential-trust.md).
@@ -56,8 +59,8 @@ for setup boundaries and reported execution evidence.
 
 ## Everyday commands
 
-SKS enables experimental Astra context management by default during setup and
-repair. Turn it off in **SKS Center → Settings → Astra context management**, or
+SKS enables experimental Codex context management by default during setup and
+repair. Turn it off in **SKS Center → Settings → Context management**, or
 use `sks codex-app context-management off`. Updates preserve an explicit opt-out.
 Start a new task after changing the setting. Availability depends on a supported
 Codex client and eligible ChatGPT sign-in; API-key and custom-provider sessions
@@ -180,8 +183,8 @@ soon as Codex lists it:
 | Work | Tier | Effort | Today |
 | --- | --- | --- | --- |
 | Tiny mechanical tasks | fast | low | `gpt-6-luna` |
-| Instructed implementation | balanced | low | `gpt-6-sol` |
-| Exploration, large-context reads, and direct tool operation | context | medium | `gpt-6-sol` |
+| Instructed implementation | balanced | low | `gpt-6.1-sol` |
+| Exploration, large-context reads, and direct tool operation | context | medium | `gpt-6.1-sol` |
 | Planning, review, debugging, and focused judgment | deep | max | `gpt-6-astra` |
 
 With Jev mode on, Jev picks the tier for every spawn, every gated parent edit,

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.3.8"
+version = "10.3.10"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.3.8"
+version = "10.3.10"
 edition = "2021"
 
 [dependencies]

package/dist/bin/sks-dispatch.js

@@ -29,7 +29,7 @@ async function runSks(args) {
     }
     else if (args[0] === 'hook' && args[1] && (await import('../core/verification-profile.js')).hookDaemonEnabled()) {
         const { hookDaemonInline } = await import('../core/daemon/sksd-hook-dispatch.js');
-        await hookDaemonInline(args[1]);
+        await hookDaemonInline(args[1], args.slice(2));
     }
     else if (args.length === 3 && args[0] === 'naruto' && args[1] === 'help' && args[2] === '--json') {
         const { narutoHelpJsonFastInline } = await import('./fast-inline.js');

package/dist/cli/command-registry.js

@@ -338,7 +338,6 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
     }
 });
 export const COMMANDS = applyCommandManifestContract(COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES);
-export const TYPED_COMMANDS = COMMANDS;
 export const LEGACY_COMMAND_ALIASES = {};
 export const COMMAND_ALIASES = {
     ...LEGACY_COMMAND_ALIASES,
@@ -356,11 +355,3 @@ export const COMMAND_ALIASES = {
 export function commandNames() {
     return Object.keys(COMMANDS).sort();
 }
-export function typedCommandNames() {
-    return commandNames();
-}
-export function assertCommandModule(value) {
-    if (!value || typeof value !== 'object' || typeof value.run !== 'function') {
-        throw new Error('Command module must expose run(command, args)');
-    }
-}

package/dist/cli/feature-commands.js

@@ -11,8 +11,8 @@ import { codexSchemaSnapshotReport } from '../core/codex-compat/codex-schema-sna
 import { validateCodexFixtureOutputs } from '../core/codex-compat/codex-hook-schema.js';
 import { codexHookWarningCheck } from '../core/codex-compat/codex-hook-warning-detector.js';
 import { codexHookTrustDoctor } from '../core/codex-hooks/codex-hook-trust-doctor.js';
-import { writeTrustedHashStateForHooksFile } from '../core/codex-hooks/codex-hook-state-writer.js';
-import { installManagedCodexHooks } from '../core/codex-hooks/codex-hook-managed-install.js';
+import { activateSksCodexHooks } from '../core/codex-hooks/codex-project-hooks.js';
+import { globalHookPaths, readGlobalSksHookState } from '../core/codex-hooks/codex-global-hooks.js';
 import { writeCodexHookOfficialParityReport } from '../core/codex-hooks/codex-hook-official-parity.js';
 const flag = (args, name) => args.includes(name);
 export async function featuresCommand(sub = 'list', args = []) {
@@ -111,7 +111,7 @@ export async function hooksCommand(sub = 'explain', args = []) {
         const report = await hooksStatusReport(root);
         if (flag(args, '--json'))
             return console.log(JSON.stringify(report, null, 2));
-        console.log(`Hooks: ${report.ok ? 'ok' : 'missing'}`);
+        console.log(`Hooks: ${report.ok ? 'active for every project' : 'not active (run: sks doctor --fix)'}`);
         for (const file of report.hooks_files)
             console.log(`- ${file.path}: ${file.exists ? 'present' : 'missing'}`);
         return;
@@ -153,63 +153,27 @@ export async function hooksCommand(sub = 'explain', args = []) {
             process.exitCode = 1;
         return;
     }
-    if (action === 'repair') {
-        if (flag(args, '--trusted')) {
-            const parity = await writeCodexHookOfficialParityReport(root);
-            if (!parity.official_hash_available) {
-                const blocked = {
-                    schema: 'sks.codex-hooks-repair.v1',
-                    ok: false,
-                    mode: 'trusted',
-                    status: 'blocked',
-                    blocker: 'official_hash_oracle_unavailable',
-                    next_command: 'sks hooks repair --managed --json',
-                    parity
-                };
-                if (flag(args, '--json'))
-                    return console.log(JSON.stringify(blocked, null, 2));
-                console.log('Hooks trusted repair blocked: official hash oracle unavailable. Run `sks hooks repair --managed --json`.');
-                process.exitCode = 1;
-                return;
-            }
-        }
-        const projectReport = await installManagedCodexHooks(root);
-        const userReport = await installManagedCodexHooks(root, {
-            requirementsPath: path.join(os.homedir(), '.codex', 'requirements.toml'),
-            managedDir: path.join(os.homedir(), '.codex', 'managed-hooks')
-        });
+    if (action === 'repair' || action === 'install') {
+        const activation = await activateSksCodexHooks({ root });
         const actual = await codexHookTrustDoctor(root, { actual: true });
         const result = {
-            schema: 'sks.codex-hooks-repair.v1',
-            ok: Boolean(projectReport.ok && userReport.ok && actual.ok),
-            mode: 'managed',
+            schema: action === 'repair' ? 'sks.codex-hooks-repair.v2' : 'sks.codex-hooks-install.v2',
+            ok: activation.ok && activation.active,
+            mode: 'user_level',
             root,
-            project_install: projectReport,
-            user_install: userReport,
+            activation,
             actual_trust: actual.trust,
-            managed_dirs: actual.managed_dirs || [],
-            blockers: actual.blockers || [],
-            next_command: 'sks hooks trust-doctor --actual --json',
-            actions: ['project_requirements_toml_managed_install', 'user_requirements_toml_managed_install']
+            blockers: activation.blockers,
+            warnings: activation.warnings,
+            next_command: 'sks hooks status --json'
         };
         if (flag(args, '--json'))
             return console.log(JSON.stringify(result, null, 2));
-        console.log(`Hooks managed repair: ${result.ok ? 'ok' : 'blocked'}`);
+        console.log(`SKS Codex hooks: ${result.ok ? 'active for every project' : 'blocked'}${result.blockers.length ? ` (${result.blockers.join(', ')})` : ''}`);
         if (!result.ok)
             process.exitCode = 1;
         return;
     }
-    if (action === 'install') {
-        const report = flag(args, '--managed')
-            ? await installManagedCodexHooks(root)
-            : await writeTrustedHashStateForHooksFile(root, undefined, undefined, { allowSksHashFallback: flag(args, '--trusted'), reason: 'Use --managed unless you intentionally accept SKS-only trusted_hash fallback with --trusted.' });
-        if (flag(args, '--json'))
-            return console.log(JSON.stringify({ ...report, schema: flag(args, '--managed') ? 'sks.codex-hooks-managed-install.v1' : 'sks.codex-hook-install-command.v2', mode: flag(args, '--managed') ? 'managed' : flag(args, '--project') ? 'project' : 'trust-state-only', trusted: flag(args, '--trusted') }, null, 2));
-        console.log(flag(args, '--managed') ? `Hooks managed install: ${report.ok ? 'ok' : 'blocked'}` : `Hooks install trust state: ${report.ok ? 'ok' : 'blocked'}`);
-        if (!report.ok)
-            process.exitCode = 1;
-        return;
-    }
     if (action === 'actual-parity' || action === 'official-parity' || (action === 'parity' && flag(args, '--official'))) {
         const report = await writeCodexHookOfficialParityReport(root);
         if (flag(args, '--json'))
@@ -289,8 +253,9 @@ export async function hooksCommand(sub = 'explain', args = []) {
         console.log(`- ${source.title}: ${source.url}`);
 }
 async function hooksStatusReport(root) {
+    const global = await readGlobalSksHookState();
     const files = [
-        path.join(os.homedir(), '.codex', 'hooks.json'),
+        globalHookPaths().hooksPath,
         path.join(root, '.codex', 'hooks.json')
     ];
     const hooksFiles = [];
@@ -298,9 +263,10 @@ async function hooksStatusReport(root) {
         hooksFiles.push({ path: file, exists: await exists(file) });
     }
     return {
-        schema: 'sks.hooks-status.v1',
+        schema: 'sks.hooks-status.v2',
         hooks_files: hooksFiles,
-        ok: hooksFiles.some((file) => file.exists)
+        global,
+        ok: global.active
     };
 }
 async function hooksTrustReport(root) {

package/dist/cli/global-mode-router.js

@@ -1,4 +1,3 @@
-const RESERVED_COMMANDS = new Set(['help', '--help', '-h', 'version', '--version', '-v']);
 const RETIRED_NARUTO_OPTION = ['--', 'naruto'].join('');
 const RETIRED_AGENT_OPTION = ['--', 'agent'].join('');
 const RETIRED_CLONES_OPTION = ['--', 'clones'].join('');

package/dist/cli/install-helpers-codex-lb-shared.js

@@ -3,9 +3,6 @@ import os from 'node:os';
 export function codexLbConfigPath(home = process.env.HOME || os.homedir()) {
     return path.join(String(home), '.codex', 'config.toml');
 }
-export function codexLbEnvPath(home = process.env.HOME || os.homedir()) {
-    return path.join(String(home), '.codex', 'sks-codex-lb.env');
-}
 export function codexAuthPath(home = process.env.HOME || os.homedir()) {
     return path.join(String(home), '.codex', 'auth.json');
 }

package/dist/cli/install-helpers-install-support.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import os from 'node:os';
 import fsp from 'node:fs/promises';
-import { ensureDir, exists, packageRoot, PACKAGE_VERSION, runProcess, tmpdir, writeTextAtomic } from '../core/fsx.js';
+import { ensureDir, exists, packageRoot, PACKAGE_VERSION, runProcess, writeTextAtomic } from '../core/fsx.js';
 import { EMPTY_CODEX_INFO, getCodexInfo } from '../core/codex-adapter.js';
 import { installGlobalSkills } from '../core/init.js';
 import { context7ConfigToml, DOLLAR_SKILL_NAMES, GETDESIGN_REFERENCE, hasContext7ConfigText, RECOMMENDED_SKILLS } from '../core/routes.js';
@@ -51,25 +51,6 @@ export async function ensureSksCommandDuringInstall(opts = {}) {
         return { status: 'created_not_on_path', command: createdFallback };
     return { status: 'failed', error: lastError };
 }
-export async function selftestSksShimRepair() {
-    const staleShimTmp = tmpdir();
-    const staleBin = path.join(staleShimTmp, 'old-prefix', 'bin');
-    const stalePkg = path.join(staleShimTmp, 'old-prefix', 'lib', 'node_modules', 'sneakoscope');
-    const staleEntrypoint = path.join(stalePkg, 'dist', 'bin', 'sks.js');
-    await ensureDir(path.dirname(staleEntrypoint));
-    await ensureDir(staleBin);
-    await writeTextAtomic(path.join(stalePkg, 'package.json'), JSON.stringify({ name: 'sneakoscope', version: '0.0.1' }, null, 2));
-    await writeTextAtomic(staleEntrypoint, '#!/usr/bin/env node\nconsole.log("sneakoscope 0.0.1");\n');
-    await fsp.chmod(staleEntrypoint, 0o755).catch(() => { });
-    await fsp.symlink(staleEntrypoint, path.join(staleBin, 'sks'));
-    const repair = await ensureSksCommandDuringInstall({ force: true, pathEnv: staleBin, home: path.join(staleShimTmp, 'home') });
-    if (repair.status !== 'repaired')
-        throw new Error(`selftest: stale global sks shim was not repaired (${repair.status})`);
-    const run = await runProcess(path.join(staleBin, 'sks'), ['--version'], { timeoutMs: 10000, maxOutputBytes: 16 * 1024 });
-    if (run.code !== 0 || !String(run.stdout || '').includes(PACKAGE_VERSION))
-        throw new Error('selftest: repaired stale sks shim does not run current package version');
-    return { ok: true, repaired: repair.repaired || [] };
-}
 async function reconcileSksPathShimsDuringInstall(opts = {}) {
     if (process.env.SKS_SKIP_POSTINSTALL_SHIM_REPAIR === '1' && !opts.force)
         return { status: 'skipped', reason: 'SKS_SKIP_POSTINSTALL_SHIM_REPAIR=1' };

package/dist/cli/install-helpers.js

@@ -237,7 +237,7 @@ async function runPostinstallBootstrap(root, bootstrap, selectedDecision) {
         process.chdir(previousCwd);
     }
 }
-export { checkContext7, ensureCodexCliTool, ensureRelatedCliTools, maybePromptCodexUpdateForLaunch, maybePromptSksUpdateForLaunch, shouldAutoApproveInstall } from './install-tool-helpers.js';
+export { checkContext7, ensureCodexCliTool, ensureRelatedCliTools, maybePromptSksUpdateForLaunch, shouldAutoApproveInstall } from './install-tool-helpers.js';
 export { codexFastModeDesktopStatus, ensureGlobalCodexFastModeDuringInstall, normalizeCodexFastModeUiConfig, safeWriteCodexConfigToml } from '../core/codex-runtime/codex-desktop-config-policy.js';
-export { checkRequiredSkills, context7GlobalMcpStatus, ensureCodexImagegenDuringInstall, ensureGlobalCodexSkillsDuringInstall, ensureProjectContext7Config, ensureSksCommandDuringInstall, globalCodexSkillsRoot, selftestSksShimRepair } from './install-helpers-install-support.js';
-export { codexLbConfigPath, codexLbEnvPath } from './install-helpers-codex-lb-shared.js';
+export { checkRequiredSkills, context7GlobalMcpStatus, ensureCodexImagegenDuringInstall, ensureGlobalCodexSkillsDuringInstall, ensureProjectContext7Config, ensureSksCommandDuringInstall, globalCodexSkillsRoot } from './install-helpers-install-support.js';
+export { codexLbConfigPath } from './install-helpers-codex-lb-shared.js';

package/dist/cli/install-tool-helpers.js

@@ -42,33 +42,6 @@ export async function ensureCodexCliTool({ skip = false, args = [] } = {}) {
         hint: after.bin ? null : 'npm completed, but codex is not on PATH. Restart the shell or set SKS_CODEX_BIN.'
     };
 }
-export async function maybePromptCodexUpdateForLaunch(args = [], opts = {}) {
-    if (hasFlag(args, '--json') || hasFlag(args, '--skip-cli-tools') || hasFlag(args, '--skip-codex-update') || process.env.SKS_SKIP_CODEX_UPDATE === '1')
-        return { status: 'skipped' };
-    const latest = await npmPackageVersion('@openai/codex');
-    const codex = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
-    const current = codexCliVersionNumber(codex.version);
-    const command = 'npm i -g @openai/codex@latest';
-    const label = opts.label || 'Codex launch';
-    const missing = !codex.bin;
-    const updateAvailable = Boolean(latest.version && current && compareVersions(latest.version, current) > 0);
-    if (!missing && !updateAvailable)
-        return { status: 'current', latest: latest.version || null, current, bin: codex.bin || null, error: latest.error || null };
-    const prompt = missing
-        ? `Codex CLI missing. Install @openai/codex${latest.version ? ` ${latest.version}` : '@latest'} before ${label}? [Y/n] `
-        : `Codex CLI ${current} -> ${latest.version} update before ${label}? [Y/n] `;
-    if (shouldAutoApproveInstall(args))
-        return installCodexLatest(command, latest.version, current);
-    if (!canAskYesNo()) {
-        const reason = missing ? 'Codex CLI missing' : `Codex CLI update available: ${current} -> ${latest.version}`;
-        console.log(`${reason}. Run: ${command}`);
-        return { status: missing ? 'missing' : 'available', latest: latest.version || null, current, command, bin: codex.bin || null };
-    }
-    const answer = (await askQuestion(prompt)).trim();
-    if (!(answer === '' || /^(y|yes|예|네|응)$/i.test(answer)))
-        return { status: 'skipped_by_user', latest: latest.version || null, current, command, bin: codex.bin || null };
-    return installCodexLatest(command, latest.version, current);
-}
 export async function maybePromptSksUpdateForLaunch(args = [], opts = {}) {
     void args;
     void opts;
@@ -102,23 +75,6 @@ export async function isProjectSetupCandidate(root) {
     }
     return false;
 }
-export function hasTopLevelCodexModeLock(text = '') {
-    const lines = String(text || '').split('\n');
-    const firstTable = lines.findIndex((line) => /^\s*\[.+\]\s*$/.test(line));
-    const top = (firstTable === -1 ? lines : lines.slice(0, firstTable)).join('\n');
-    return /(^|\n)\s*model_reasoning_effort\s*=/.test(top);
-}
-export function hasDeprecatedCodexHooksFeatureFlag(text = '') {
-    const lines = String(text || '').split('\n');
-    const start = lines.findIndex((line) => line.trim() === '[features]');
-    if (start === -1)
-        return false;
-    const end = lines.findIndex((line, index) => index > start && /^\s*\[.+\]\s*$/.test(line));
-    return lines.slice(start + 1, end === -1 ? lines.length : end).some((line) => /^\s*codex_hooks\s*=/.test(line));
-}
-export function hasCodexUnstableFeatureWarningSuppression(text = '') {
-    return /(^|\n)\s*suppress_unstable_features_warning\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(String(text || ''));
-}
 export async function checkContext7(root) {
     const projectPath = path.join(root, '.codex', 'config.toml');
     const globalPath = path.join(process.env.HOME || '', '.codex', 'config.toml');
@@ -164,38 +120,6 @@ function isAgentRuntime(env = process.env) {
     return ['SKS_OPENCLAW', 'OPENCLAW', 'OPENCLAW_AGENT', 'OPENCLAW_RUN_ID', 'OPENCLAW_SESSION_ID', 'SKS_HERMES', 'HERMES_AGENT', 'HERMES_RUN_ID', 'HERMES_SESSION_ID']
         .some((key) => /^(1|true|yes|y)$/i.test(String(env[key] || '').trim()));
 }
-async function installCodexLatest(command, latestVersion, previousVersion = null) {
-    const npm = await which('npm').catch(() => null);
-    if (!npm)
-        return { status: 'failed', latest: latestVersion || null, previous: previousVersion || null, command, error: 'npm not found on PATH' };
-    const install = await runProcess(npm, ['i', '-g', '@openai/codex@latest'], { timeoutMs: 180000, maxOutputBytes: 128 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
-    if (install.code !== 0)
-        return { status: 'failed', latest: latestVersion || null, previous: previousVersion || null, command, error: `${install.stderr || install.stdout || command + ' failed'}`.trim() };
-    const after = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
-    const afterVersion = codexCliVersionNumber(after.version);
-    if (!after.bin)
-        return { status: 'updated_not_reflected', latest: latestVersion || null, previous: previousVersion || null, version: afterVersion || null, command, error: 'npm completed, but codex is not on PATH. Restart the shell or set SKS_CODEX_BIN.' };
-    if (latestVersion && afterVersion && compareVersions(afterVersion, latestVersion) < 0) {
-        return { status: 'updated_not_reflected', latest: latestVersion, previous: previousVersion || null, version: afterVersion, bin: after.bin, command, error: `npm completed, but PATH still resolves Codex CLI ${afterVersion}; expected ${latestVersion}.` };
-    }
-    console.log(`Codex CLI ready: ${previousVersion || 'missing'} -> ${after.version || after.bin}`);
-    return { status: previousVersion ? 'updated' : 'installed', latest: latestVersion || null, previous: previousVersion || null, version: afterVersion || null, raw_version: after.version || null, bin: after.bin || null, command };
-}
-function codexCliVersionNumber(versionText = '') {
-    return String(versionText || '').match(/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/)?.[1] || null;
-}
-async function npmPackageVersion(name) {
-    const envName = `SKS_NPM_VIEW_${String(name || '').replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_VERSION`;
-    if (process.env[envName])
-        return { version: process.env[envName] };
-    const npm = await which('npm').catch(() => null);
-    if (!npm)
-        return { error: 'npm not found' };
-    const result = await runProcess(npm, ['view', name, 'version'], { timeoutMs: 5000, maxOutputBytes: 4096 });
-    if (result.code !== 0)
-        return { error: `${result.stderr || result.stdout || 'npm view failed'}`.trim() };
-    return { version: result.stdout.trim().split(/\s+/).pop() };
-}
 async function safeReadText(file) {
     try {
         return await fsp.readFile(file, 'utf8');

package/dist/cli/router.js

@@ -6,9 +6,6 @@ import { helpResult, isHelpRequest, renderManifestHelp } from './help.js';
 import { findRetiredGlobalExecutionArgumentErrors } from './global-mode-router.js';
 import { normalizeIntentCommand, } from '../core/commands/intent-normalization/normalizer.js';
 const routerIntentStorage = new AsyncLocalStorage();
-export function currentRouterIntentContract() {
-    return routerIntentStorage.getStore() || null;
-}
 export function prepareRouterExecutionIntent(argv, inheritance = {}) {
     const effectiveArgv = argv.length ? [...argv] : ['doctor'];
     const rawCommand = effectiveArgv[0]?.startsWith('$')

package/dist/commands/decision.js

@@ -1,4 +1,4 @@
-import { runDecisionCommand, usage, UsageError } from '../core/decisions/cli.js';
+import { runDecisionCommand } from '../core/decisions/cli.js';
 export { UsageError, parseDecisionArgs, runDecisionCommand, usage } from '../core/decisions/cli.js';
 export async function run(_command, args = []) {
     const code = await runDecisionCommand(args);

package/dist/commands/doctor-helpers.js

@@ -1,5 +1,5 @@
 import { flag } from '../cli/args.js';
-import { projectRoot, exists, nowIso } from '../core/fsx.js';
+import { projectRoot, nowIso } from '../core/fsx.js';
 import { normalizeInstallScope } from '../core/init.js';
 import { appendMigrationEvents, hashConfigText } from '../core/migration/migration-transaction-journal.js';
 import { inspectSksMenuBarStatus, sksMenuBarPaths, sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
@@ -205,25 +205,6 @@ export async function writeFixMigrationJournal(root, preFix, configRepair, setup
         return null;
     return appendMigrationEvents(root, events);
 }
-async function backupProjectConfigBeforeFix() {
-    try {
-        const fsp = await import('node:fs/promises');
-        const path = await import('node:path');
-        const root = await projectRoot();
-        if (!root)
-            return null;
-        const configPath = path.join(root, '.codex', 'config.toml');
-        if (!(await exists(configPath)))
-            return null;
-        const text = await fsp.readFile(configPath, 'utf8');
-        const backupPath = `${configPath}.doctor-pre-fix-${Date.now().toString(36)}.bak`;
-        await fsp.writeFile(backupPath, text);
-        return backupPath;
-    }
-    catch {
-        return null;
-    }
-}
 export function installScopeFromArgs(args = []) {
     if (flag(args, '--project'))
         return 'project';

package/dist/commands/doctor.js

@@ -1,6 +1,6 @@
 import os from 'node:os';
 import path from 'node:path';
-import { projectRoot, exists, formatBytes, nowIso, readText, writeJsonAtomic } from '../core/fsx.js';
+import { projectRoot, exists, formatBytes, nowIso, writeJsonAtomic } from '../core/fsx.js';
 import { flag } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
 import { ui as cliUi } from '../cli/cli-theme.js';
@@ -25,11 +25,10 @@ import { isUpdateMigrationReceiptCurrent, projectUpdateMigrationReceiptPath, wri
 import { inspectSksMenuBarStatus, installSksMenuBar, sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
 import { sweepSksTempDirs } from '../core/retention.js';
 import { detectImagegenCapability } from '../core/imagegen/imagegen-capability.js';
-import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../core/codex-compat/codex-runtime-contract.js';
 import { formatHarnessConflictReport, scanHarnessConflicts } from '../core/harness-conflicts.js';
 import { doctorArgWarnings as baseDoctorArgWarnings, doctorGlobalOnlySelection, doctorMenuBarInstallPolicy, doctorPhaseIdsForProfile, doctorProfileFromArgs, doctorProfileRequiresDesktopBridgeReadiness } from './doctor-profile.js';
 import { renderDoctorConsoleReport } from './doctor-console.js';
-import { buildCodexAppUiDiagnosticFailure, buildRuntimeReadiness, captureCodexConfigSnapshot, deferredNativeRepair, doctorDedupeStatus, doctorSkillStatus, fallbackCodexNativeFeatureMatrix, formatCodexDoctorConsoleStatus, installScopeFromArgs, isMigrationUserOwnedProjectConfigBlocker, mergeObservedCodexStartupWarnings, nativeCapabilityStatus, readOption, rebootstrapSksMenuBarLaunchdForDoctorFix, sksMenuBarRunningVersionConsoleLines, uniqueNativeManualActions, writeFixMigrationJournal, writeJsonReportFile } from './doctor-helpers.js';
+import { buildCodexAppUiDiagnosticFailure, buildRuntimeReadiness, captureCodexConfigSnapshot, deferredNativeRepair, fallbackCodexNativeFeatureMatrix, formatCodexDoctorConsoleStatus, installScopeFromArgs, isMigrationUserOwnedProjectConfigBlocker, mergeObservedCodexStartupWarnings, readOption, rebootstrapSksMenuBarLaunchdForDoctorFix, sksMenuBarRunningVersionConsoleLines, writeFixMigrationJournal, writeJsonReportFile } from './doctor-helpers.js';
 export { doctorMenuBarInstallPolicy, doctorProfileFromArgs, doctorProfileRequiresDesktopBridgeReadiness } from './doctor-profile.js';
 export { buildCodexAppUiDiagnosticFailure, buildRuntimeReadiness, formatCodexDoctorConsoleStatus, rebootstrapSksMenuBarLaunchdForDoctorFix, sksMenuBarRunningVersionConsoleLines };
 export function doctorArgWarnings(args = []) {
@@ -582,7 +581,6 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
     const requireActualCodexProbe = flag(args, '--require-actual-codex') || (deepDiagnostics && doctorFix);
     const shouldEvaluateCodexAppUiRepair = doctorFix || deepDiagnostics || flag(args, '--repair-codex-app-ui');
     const nativeCapabilityDiagnosticsRequested = deepDiagnostics || flag(args, '--repair-native-capabilities');
-    const requireLegacyGlobalHookCleanup = doctorFix && doctorProfile === 'migration';
     const migrationReceiptOwnsReconcile = doctorFix && doctorProfile === 'migration';
     const doctorPhaseIds = doctorPhaseIdsForProfile(doctorProfile);
     const { runDoctorCommandAliasCleanup } = await import('../core/doctor/command-alias-cleanup.js');
@@ -654,8 +652,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
         fix: nativeCapabilityDiagnosticsRequested && doctorFix,
         yes: flag(args, '--yes') || flag(args, '-y'),
         flags: args.map((arg) => String(arg)),
-        skipNativeCapabilities: !nativeCapabilityDiagnosticsRequested,
-        requireLegacyGlobalHookCleanup
+        skipNativeCapabilities: !nativeCapabilityDiagnosticsRequested
     }).catch((err) => ({
         schema: 'sks.doctor-native-capability-repair.v1',
         ok: false,
@@ -665,19 +662,13 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
         core_skills: null,
         skill_dedupe: null,
         native_capabilities: null,
-        legacy_global_hooks: {
-            ok: false,
-            blockers: [`cleanup_failed_before_report:${err?.message || String(err)}`],
-            warnings: []
-        },
+        sks_codex_hooks: null,
         secret_preservation_guard: '.sneakoscope/reports/secret-preservation-guard.json',
         core_blockers: [err?.message || String(err)],
         route_blockers: {},
         optional_manual_required: [],
         optional_warnings: [],
-        required_blockers: requireLegacyGlobalHookCleanup
-            ? [`legacy_global_hooks:cleanup_failed_before_report:${err?.message || String(err)}`]
-            : [],
+        required_blockers: [],
         blockers: [err?.message || String(err)]
     }));
     const configProbeOpts = {
@@ -901,13 +892,11 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
     const hookTrustRepair = doctorFix
         && !migrationReceiptOwnsReconcile
         && doctorPhaseIds.includes('hook_trust_repair')
-        ? await (await import('../core/codex-hooks/codex-hook-trust-doctor.js')).codexHookTrustDoctor(root, { fix: true, managed: true, actual: true }).catch((err) => ({
-            schema: 'sks.codex-hook-trust-doctor.v2',
+        ? await (await import('../core/codex-hooks/codex-project-hooks.js')).activateSksCodexHooks({ root }).catch((err) => ({
+            schema: 'sks.codex-hook-activation.v1',
             ok: false,
-            actual: true,
             blockers: [`hook_trust_repair_failed:${err?.message || String(err)}`],
-            warnings: [],
-            repair_actions: ['sks codex trust-doctor --fix --managed --actual']
+            warnings: []
         }))
         : null;
     const doctorFixTransaction = doctorFix
@@ -1014,7 +1003,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                         warnings: hookTrustRepair?.warnings || [],
                         rollback_evidence: migrationReceiptOwnsReconcile
                             ? 'project_migration_receipt_owns_hook_trust_refresh'
-                            : hookTrustRepair?.fixed?.managed_hook_file || 'codex_hook_trust_repair_idempotent'
+                            : hookTrustRepair?.global?.hooks_path || 'codex_hook_trust_repair_idempotent'
                     })
                 },
                 {
@@ -1384,7 +1373,6 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
         doctor_fix_postcheck: doctorFixPostcheck,
         command_aliases: migrationReceiptOwnsReconcile ? commandAliasCleanupBeforeReceipt : undefined,
         doctor_native_capability: doctorNativeCapabilityRepair,
-        require_legacy_global_hook_cleanup: requireLegacyGlobalHookCleanup,
         require_legacy_generation_convergence: doctorFix && !migrationReceiptOwnsReconcile,
         skills: skillsReconcile,
         agent_role_config: agentRoleConfigRepair,

package/dist/commands/hook.js

@@ -1,5 +1,6 @@
 import { emitHook } from '../core/hooks-runtime.js';
+import { hookLayerFromArgs } from '../core/hooks-runtime/hook-layer.js';
 export async function run(_command, args = []) {
-    const [name = 'user-prompt-submit'] = args;
-    return emitHook(name);
+    const [name = 'user-prompt-submit', ...rest] = args;
+    return emitHook(name, { layer: hookLayerFromArgs(rest) });
 }

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.3.8",
+  "package_version": "10.3.10",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/agent-bridge/async-command.js

@@ -8,6 +8,7 @@ import { desktopBridgeStatusV3 } from '../codex-lb/desktop-controller-v3.js';
 import { bridgeClientUrl } from '../codex-lb/desktop-controller-v3/shared.js';
 import { runProcess } from '../fsx.js';
 import { createResponsesTransport } from './responses-transport.js';
+import { latestModelForTier } from '../subagents/model-tiers.js';
 const USAGE = 'sks agent-bridge async --prompt "task" [--tools status,stats] [--json]';
 const MAX_PROMPT_BYTES = 16 * 1024;
 export function redactAsyncToolOutput(stdout) {
@@ -55,7 +56,7 @@ export function parseAsyncCommandArgs(args) {
 export async function agentBridgeAsyncCommand(args) {
     const json = args.includes('--json');
     if (args.includes('--help')) {
-        const help = { schema: 'sks.async-tool-run.v1', ok: true, status: 'help', usage: USAGE, model: 'gpt-6-astra', provider: 'codex-lb', tools: 'Explicitly selected R0 remote-readable SKS command contracts only.' };
+        const help = { schema: 'sks.async-tool-run.v1', ok: true, status: 'help', usage: USAGE, model: latestModelForTier('deep'), provider: 'codex-lb', tools: 'Explicitly selected R0 remote-readable SKS command contracts only.' };
         console.log(json ? JSON.stringify(help, null, 2) : USAGE);
         return help;
     }
@@ -63,9 +64,10 @@ export async function agentBridgeAsyncCommand(args) {
         const parsed = parseAsyncCommandArgs(args);
         const home = homedir();
         const status = await desktopBridgeStatusV3({ home });
-        const model = 'codex-lb:gpt-6-astra';
+        const deepModel = latestModelForTier('deep');
+        const model = `codex-lb:${deepModel}`;
         const route = status.routing.policy?.model_routes[model];
-        if (!status.service.running || !status.service.loopback_origin || route?.provider_id !== 'codex-lb' || route.upstream_model !== 'gpt-6-astra') {
+        if (!status.service.running || !status.service.loopback_origin || route?.provider_id !== 'codex-lb' || route.upstream_model !== deepModel) {
             throw new Error('async_astra_bridge_route_unavailable');
         }
         const endpoint = await bridgeClientUrl(status.service.loopback_origin, '/backend-api/codex/responses', { home });

package/dist/core/agent-bridge/host-capability-runtime.js

@@ -212,9 +212,6 @@ export function sanitizeHostCapabilityPostToolUse(payload) {
         artifacts
     };
 }
-export function mergeHostCapabilityPreToolObservation(input) {
-    return authorizeAndMergeHostCapabilityPreToolObservation(input).observations;
-}
 export function authorizeAndMergeHostCapabilityPreToolObservation(input) {
     const current = normalizeHostCapabilityHookObservations(input.current, input.binding)
         || emptyHookObservations(input.binding);

package/dist/core/agents/agent-codex-cockpit.js

@@ -22,7 +22,6 @@ export async function buildAgentCodexCockpitState(missionDir, opts = {}) {
     const roster = await readJson(path.join(root, 'agent-roster.json'), null);
     const leases = await readJson(path.join(root, 'agent-leases.json'), null);
     const proof = await readJson(path.join(root, 'agent-proof-evidence.json'), null);
-    const consensus = await readJson(path.join(root, 'agent-consensus.json'), null);
     const cleanup = await readJson(path.join(root, 'agent-cleanup.json'), null);
     const janitor = await readJson(path.join(root, 'agent-janitor-report.json'), null);
     const namespace = await readJson(path.join(missionDir, 'project-session-namespace.json'), null);