sneakoscope 10.3.9 → 10.4.0

package/dist/core/codex/codex-cli-update.js

@@ -10,8 +10,6 @@ const CODEX_CLI_UPDATE_JSON_OUTPUT_LIMIT_BYTES = 60 * 1024;
 const CODEX_CLI_UPDATE_RAW_OUTPUT_LIMIT_BYTES = 20 * 1024;
 const CODEX_CLI_UPDATE_ARRAY_LIMIT = 12;
 const CODEX_CLI_UPDATE_ARRAY_ITEM_LIMIT_BYTES = 768;
-const CODEX_STANDALONE_INSTALLER_URL = 'https://chatgpt.com/codex/install.sh';
-const CODEX_STANDALONE_INSTALLER_PS1_URL = 'https://chatgpt.com/codex/install.ps1';
 export function codexCliUpdateConsoleLines(result) {
     return [
         `Codex CLI update: ${safeUpdateText(result.status, 64)}${result.after_version ? ` (${safeUpdateText(result.before_version || 'unknown', 128)} -> ${safeUpdateText(result.after_version, 128)})` : ''}`,
@@ -180,15 +178,7 @@ export async function updateCodexCliNow(opts = {}) {
     const capabilityOutput = `${capability.stdout || ''}${capability.stderr || ''}`.trim();
     const nativeSelfUpdateSupported = capability.code === 0
         && /Usage:\s+codex\s+update\b/i.test(capabilityOutput);
-    const updatePlan = nativeSelfUpdateSupported
-        ? {
-            method: 'native-self-update',
-            command: 'codex update',
-            executable: before.path,
-            args: ['update']
-        }
-        : await detectCodexCliUpdatePlan({ before, env, deps, run });
-    if (!updatePlan) {
+    if (!nativeSelfUpdateSupported) {
         return updateResult({
             ok: false,
             status: 'failed',
@@ -200,18 +190,17 @@ export async function updateCodexCliNow(opts = {}) {
             updateMethod: 'unknown',
             blockers: ['codex_cli_update_method_unverified'],
             guidance: [
-                'The selected Codex CLI neither advertises native self-update nor maps safely to the official standalone installer, npm global package, or Homebrew cask.',
-                'Reinstall Codex with an official supported method, then retry.'
+                'The selected Codex CLI does not advertise native self-update (codex update).',
+                'Reinstall or update Codex with its official installer, then retry.'
             ]
         });
     }
-    const result = updatePlan.method === 'standalone-installer'
-        ? await runStandaloneInstallerUpdate({ before, env, deps, run })
-        : await run(updatePlan.executable, updatePlan.args, {
-            timeoutMs: 180_000,
-            maxOutputBytes: 128 * 1024,
-            env
-        }).catch((err) => failedProcessResult(err));
+    const updatePlan = { method: 'native-self-update', command: 'codex update' };
+    const result = await run(before.path, ['update'], {
+        timeoutMs: 180_000,
+        maxOutputBytes: 128 * 1024,
+        env
+    }).catch((err) => failedProcessResult(err));
     const rawOutput = `${result.stdout || ''}${result.stderr || ''}`.trim();
     if (result.code !== 0) {
         return updateResult({
@@ -223,7 +212,7 @@ export async function updateCodexCliNow(opts = {}) {
             updateStatus: null,
             command: updatePlan.command,
             updateMethod: updatePlan.method,
-            blockers: [updateFailureBlocker(updatePlan.method)],
+            blockers: ['codex_cli_self_update_failed'],
             guidance: [`Run the detected updater in a terminal to review its output: ${updatePlan.command}`]
         });
     }
@@ -365,153 +354,6 @@ export function compareCodexCliVersions(left, right) {
         return -1;
     return aPre.localeCompare(bPre, undefined, { numeric: true });
 }
-async function detectCodexCliUpdatePlan(input) {
-    const selectedPath = path.resolve(input.before.path);
-    const selectedRealPath = await realPathOrResolved(selectedPath);
-    const codexHome = await realPathOrResolved(input.env.CODEX_HOME || path.join(input.env.HOME || os.homedir(), '.codex'));
-    const standaloneRoot = await realPathOrResolved(path.join(codexHome, 'packages', 'standalone'));
-    if (isWithin(selectedRealPath, standaloneRoot)) {
-        return {
-            method: 'standalone-installer',
-            command: process.platform === 'win32'
-                ? `powershell -NoProfile -Command "irm ${CODEX_STANDALONE_INSTALLER_PS1_URL} | iex"`
-                : `curl -fsSL ${CODEX_STANDALONE_INSTALLER_URL} | CODEX_NON_INTERACTIVE=1 sh`,
-            executable: '',
-            args: []
-        };
-    }
-    const brew = await resolveUpdateExecutable('brew', input.env, input.deps);
-    if (brew) {
-        const caskPrefixResult = await input.run(brew, ['--prefix', '--cask', 'codex'], {
-            timeoutMs: 10_000,
-            maxOutputBytes: 16 * 1024,
-            env: input.env
-        }).catch((err) => failedProcessResult(err));
-        const caskPrefix = caskPrefixResult.code === 0
-            ? String(caskPrefixResult.stdout || '').trim().split(/\r?\n/).find(Boolean) || ''
-            : '';
-        if (caskPrefix && isWithin(selectedRealPath, await realPathOrResolved(caskPrefix))) {
-            return {
-                method: 'homebrew-cask',
-                command: 'brew upgrade --cask codex',
-                executable: brew,
-                args: ['upgrade', '--cask', 'codex']
-            };
-        }
-    }
-    const npm = await resolveUpdateExecutable('npm', input.env, input.deps);
-    if (npm) {
-        const [rootResult, prefixResult] = await Promise.all([
-            input.run(npm, ['root', '-g'], {
-                timeoutMs: 10_000,
-                maxOutputBytes: 16 * 1024,
-                env: input.env
-            }).catch((err) => failedProcessResult(err)),
-            input.run(npm, ['prefix', '-g'], {
-                timeoutMs: 10_000,
-                maxOutputBytes: 16 * 1024,
-                env: input.env
-            }).catch((err) => failedProcessResult(err))
-        ]);
-        const npmRoot = rootResult.code === 0
-            ? String(rootResult.stdout || '').trim().split(/\r?\n/).find(Boolean) || ''
-            : '';
-        const npmPrefix = prefixResult.code === 0
-            ? String(prefixResult.stdout || '').trim().split(/\r?\n/).find(Boolean) || ''
-            : '';
-        const packageDir = npmRoot ? await realPathOrResolved(path.resolve(npmRoot, '@openai', 'codex')) : '';
-        const npmBinCandidates = npmPrefix
-            ? process.platform === 'win32'
-                ? ['codex.cmd', 'codex.exe', 'codex'].map((name) => path.resolve(npmPrefix, name))
-                : [path.resolve(npmPrefix, 'bin', 'codex')]
-            : [];
-        const packageInstalled = Boolean(packageDir) && await exists(packageDir);
-        if (packageInstalled && (isWithin(selectedRealPath, packageDir)
-            || npmBinCandidates.includes(selectedPath))) {
-            return {
-                method: 'npm-global',
-                command: 'npm install -g @openai/codex@latest',
-                executable: npm,
-                args: ['install', '-g', '@openai/codex@latest']
-            };
-        }
-    }
-    return null;
-}
-async function runStandaloneInstallerUpdate(input) {
-    if (process.platform === 'win32') {
-        const powershell = await resolveUpdateExecutable('pwsh', input.env, input.deps)
-            || await resolveUpdateExecutable('powershell', input.env, input.deps);
-        if (!powershell)
-            return failedProcessResult(new Error('codex_cli_standalone_update_prerequisite_missing'));
-        const codexHome = path.resolve(input.env.CODEX_HOME || path.join(input.env.HOME || os.homedir(), '.codex'));
-        return input.run(powershell, [
-            '-NoProfile',
-            '-NonInteractive',
-            '-ExecutionPolicy',
-            'Bypass',
-            '-Command',
-            `$ErrorActionPreference='Stop'; Invoke-RestMethod '${CODEX_STANDALONE_INSTALLER_PS1_URL}' | Invoke-Expression`
-        ], {
-            timeoutMs: 180_000,
-            maxOutputBytes: 128 * 1024,
-            env: {
-                ...input.env,
-                CODEX_HOME: codexHome,
-                CODEX_INSTALL_DIR: path.dirname(input.before.path),
-                CODEX_NON_INTERACTIVE: '1'
-            }
-        }).catch((err) => failedProcessResult(err));
-    }
-    const curl = await resolveUpdateExecutable('curl', input.env, input.deps);
-    const shell = await resolveUpdateExecutable('sh', input.env, input.deps);
-    if (!curl || !shell) {
-        return failedProcessResult(new Error('codex_cli_standalone_update_prerequisite_missing'));
-    }
-    const download = await input.run(curl, ['-fsSL', CODEX_STANDALONE_INSTALLER_URL], {
-        timeoutMs: 30_000,
-        maxOutputBytes: 512 * 1024,
-        env: input.env
-    }).catch((err) => failedProcessResult(err));
-    const installer = String(download.stdout || '');
-    if (download.code !== 0 || !/^#!\/bin\/sh\s*$/m.test(installer) || !installer.includes('CODEX_NON_INTERACTIVE')) {
-        return {
-            ...download,
-            code: download.code === 0 ? 1 : download.code,
-            stderr: String(download.stderr || 'codex_cli_standalone_installer_download_untrusted')
-        };
-    }
-    const codexHome = path.resolve(input.env.CODEX_HOME || path.join(input.env.HOME || os.homedir(), '.codex'));
-    return input.run(shell, ['-s', '--'], {
-        timeoutMs: 180_000,
-        maxOutputBytes: 128 * 1024,
-        input: installer,
-        env: {
-            ...input.env,
-            CODEX_HOME: codexHome,
-            CODEX_INSTALL_DIR: path.dirname(input.before.path),
-            CODEX_NON_INTERACTIVE: '1'
-        }
-    }).catch((err) => failedProcessResult(err));
-}
-async function resolveUpdateExecutable(command, env, deps) {
-    return deps.whichImpl
-        ? deps.whichImpl(command).catch(() => null)
-        : resolveOperatorExecutable(command, env);
-}
-function updateFailureBlocker(method) {
-    if (method === 'native-self-update')
-        return 'codex_cli_self_update_failed';
-    if (method === 'standalone-installer')
-        return 'codex_cli_standalone_update_failed';
-    if (method === 'homebrew-cask')
-        return 'codex_cli_homebrew_cask_update_failed';
-    return 'codex_cli_npm_global_update_failed';
-}
-async function realPathOrResolved(value) {
-    const resolved = path.resolve(value);
-    return fsp.realpath(resolved).catch(() => resolved);
-}
 async function operatorCodexCandidates(explicitBin, env) {
     const candidates = [];
     const seen = new Set();

package/dist/core/codex/codex-permission-profiles.js

@@ -1,6 +1,3 @@
-import path from 'node:path';
-import { nowIso, readText, writeJsonAtomic } from '../fsx.js';
-export const CODEX_PERMISSION_PROFILES_SCHEMA = 'sks.codex-permission-profiles.v1';
 export const SKS_CODEX_PERMISSION_PROFILES = {
     'sks-safe': {
         name: 'sks-safe',
@@ -52,39 +49,3 @@ export function selectSksCodexPermissionProfile(input = {}) {
         return SKS_CODEX_PERMISSION_PROFILES['sks-fast'];
     return SKS_CODEX_PERMISSION_PROFILES['sks-safe'];
 }
-export async function inventoryCodexPermissionProfiles(root, opts = {}) {
-    const codexHome = opts.codexHome || process.env.CODEX_HOME || path.join(process.env.HOME || '', '.codex');
-    const configPath = path.join(codexHome, 'config.toml');
-    const text = await readText(configPath, '');
-    const customProfiles = extractProfileNames(String(text));
-    const sksProfiles = Object.values(SKS_CODEX_PERMISSION_PROFILES);
-    const profileNames = new Set(customProfiles);
-    const missing = sksProfiles.filter((profile) => !profileNames.has(profile.name)).map((profile) => profile.name);
-    const report = {
-        schema: CODEX_PERMISSION_PROFILES_SCHEMA,
-        generated_at: nowIso(),
-        ok: true,
-        root: path.resolve(root),
-        codex_home: codexHome,
-        config_path: configPath,
-        codex_config_profile_field: 'codex_config_profile',
-        codex_permission_profile_field: 'codex_permission_profile',
-        sks_profiles: sksProfiles,
-        custom_profiles: customProfiles,
-        missing_sks_named_profiles: missing,
-        blockers: [],
-        warnings: missing.length ? ['sks_permission_profiles_not_all_declared_in_codex_config'] : []
-    };
-    if (opts.writeReport !== false) {
-        await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-permission-profiles.json'), report);
-    }
-    return report;
-}
-function extractProfileNames(text) {
-    const names = new Set();
-    for (const match of text.matchAll(/^\s*\[(?:permissions_profiles|permission_profiles|profiles)\.([A-Za-z0-9_.:-]+)\]\s*$/gm)) {
-        if (match[1])
-            names.add(match[1]);
-    }
-    return [...names].sort();
-}

package/dist/core/codex-app/codex-agent-role-sync.js

@@ -3,12 +3,10 @@ import os from 'node:os';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { repairAgentRoleConfigs } from '../agents/agent-role-config.js';
 import { MANAGED_OFFICIAL_SUBAGENT_ROLES } from '../managed-assets/managed-assets-manifest.js';
-import { agentRolePayloadFor, probeCodexAgentTypeSupport } from './codex-agent-type-probe.js';
 import { messageOf } from '../errors/message.js';
 const OFFICIAL_ROLES = MANAGED_OFFICIAL_SUBAGENT_ROLES.map((role) => role.codex_name);
 export async function syncCodexAgentRoles(input) {
     const root = path.resolve(input.root);
-    const env = input.env || process.env;
     const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
     const baseRepair = await repairAgentRoleConfigs({
         root,
@@ -16,49 +14,17 @@ export async function syncCodexAgentRoles(input) {
         codexHome,
         reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json')
     }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
-    const agentTypeProbe = input.agentTypeSupported === undefined
-        ? await probeCodexAgentTypeSupport(root, { env }).catch((err) => ({
-            schema: 'sks.codex-agent-type-probe.v1',
-            generated_at: nowIso(),
-            ok: false,
-            supported: false,
-            source: 'unknown',
-            spawn_tool_name: 'unknown',
-            schema_path: null,
-            evidence: [],
-            blockers: [messageOf(err)],
-            warnings: ['agent_type_probe_failed_message_role_fallback']
-        }))
-        : {
-            schema: 'sks.codex-agent-type-probe.v1',
-            generated_at: nowIso(),
-            ok: true,
-            supported: input.agentTypeSupported,
-            source: 'fixture',
-            spawn_tool_name: input.agentTypeSupported ? 'spawn_agent' : 'unknown',
-            schema_path: input.agentTypeSupported ? 'input.agentTypeSupported' : null,
-            evidence: [`input.agentTypeSupported=${input.agentTypeSupported}`],
-            blockers: [],
-            warnings: []
-        };
-    const rolePayloads = Object.fromEntries(OFFICIAL_ROLES.map((role) => [role, agentRolePayloadFor(role, agentTypeProbe)]));
     const created = stringList(baseRepair, 'created');
     const updated = stringList(baseRepair, 'repaired');
     const report = {
         schema: 'sks.codex-agent-role-sync.v1',
         generated_at: nowIso(),
-        ok: recordOk(baseRepair) !== false && agentTypeProbe.ok !== false,
+        ok: recordOk(baseRepair) !== false,
         apply: input.apply === true,
-        agent_type_supported: agentTypeProbe.supported,
-        fallback: agentTypeProbe.supported ? 'agent_type' : 'message-role',
-        strategy: agentTypeProbe.supported ? 'agent_type' : 'message-role',
-        probe_artifact_path: '.sneakoscope/reports/codex-agent-type-probe.json',
         clobbered_user_roles: false,
         codex_home: codexHome,
         official_roles: [...OFFICIAL_ROLES],
         directive_roles: [],
-        role_payloads: rolePayloads,
-        agent_type_probe: agentTypeProbe,
         created,
         updated,
         base_repair: baseRepair,

package/dist/core/codex-app/codex-app-execution-profile.js

@@ -12,19 +12,17 @@ export async function resolveCodexAppExecutionProfile(input = { root: process.cw
         ? modeFromNative(nativeMatrix)
         : !matrix?.codex_cli.available
             ? 'degraded-no-app'
-            : matrix.app_features.app_handoff_ready && matrix.app_features.agent_type_supported
+            : matrix.app_features.app_handoff_ready
                 ? 'codex-app-native'
                 : matrix.codex_cli.available
                     ? 'codex-cli-headless'
                     : 'sks-loop-headless';
-    const agentRoleStrategy = nativeMatrix?.invocation_defaults.loop_worker_role_strategy || (matrix?.app_features.agent_type_supported ? 'agent_type' : 'message-role');
     const hookApprovalState = hookApprovalStateFrom(nativeMatrix) || matrix?.app_features.hook_approval_state || 'unknown';
     const profile = {
         schema: 'sks.codex-app-execution-profile.v1',
         generated_at: nowIso(),
         ok: mode !== 'degraded-no-app',
         mode,
-        agent_role_strategy: agentRoleStrategy,
         hooks_assumed_running: false,
         hooks_approval_required: hookApprovalState !== 'approved',
         hook_approval_state: hookApprovalState,
@@ -34,7 +32,6 @@ export async function resolveCodexAppExecutionProfile(input = { root: process.cw
         loop_mesh_app_profile_available: true,
         artifact_path: '.sneakoscope/reports/codex-app-execution-profile.json',
         matrix_artifact_path: nativeMatrix ? '.sneakoscope/reports/codex-native-feature-matrix.json' : '.sneakoscope/reports/codex-app-harness-matrix.json',
-        agent_type_probe_artifact_path: '.sneakoscope/reports/codex-agent-type-probe.json',
         hook_approval_probe_artifact_path: '.sneakoscope/reports/codex-hook-approval-probe.json',
         blockers: mode === 'degraded-no-app' ? ['codex_cli_missing'] : [],
         warnings: nativeMatrix?.warnings || matrix?.warnings || []
@@ -45,7 +42,7 @@ export async function resolveCodexAppExecutionProfile(input = { root: process.cw
 function modeFromNative(matrix) {
     if (!matrix.codex_cli.available)
         return 'degraded-no-app';
-    if (matrix.features.app_handoff.ok && matrix.features.agent_type.ok)
+    if (matrix.features.app_handoff.ok)
         return 'codex-app-native';
     return 'codex-cli-headless';
 }

package/dist/core/codex-app/codex-model-catalog.js

@@ -14,9 +14,6 @@ export function codexHomePath(input = {}) {
 export function codexUserConfigPath(input = {}) {
     return path.join(codexHomePath(input), 'config.toml');
 }
-export function defaultOpenCodexCatalogPath(input = {}) {
-    return path.join(codexHomePath(input), 'opencodex-catalog.json');
-}
 export async function readConfiguredCodexModelRoutingContext(input = {}) {
     const configPath = input.configPath || codexUserConfigPath(input);
     let config = '';

package/dist/core/codex-app/openrouter-provider.js

@@ -1,4 +1,3 @@
-export const OPENROUTER_DEFAULT_MODEL = 'z-ai/glm-5.2';
 export function normalizeOpenRouterModelId(value) {
     const model = String(value || '').trim();
     if (!model)

package/dist/core/codex-app.js

@@ -14,7 +14,6 @@ export const CODEX_APP_DOCS_URL = 'https://developers.openai.com/codex/app/featu
 export const CODEX_CHANGELOG_URL = 'https://developers.openai.com/codex/changelog';
 export const CODEX_ACCESS_TOKENS_DOCS_URL = 'https://developers.openai.com/codex/enterprise/access-tokens';
 export const CODEX_CHROME_EXTENSION_SETUP_DOCS_URL = CODEX_CHROME_EXTENSION_DOC_URL;
-export const CODEX_REMOTE_CONTROL_MIN_VERSION = '0.130.0';
 const REQUIRED_CODEX_APP_FEATURE_FLAGS = [
     'codex_git_commit',
     'hooks',
@@ -325,27 +324,17 @@ export async function codexRemoteControlStatus(opts = {}) {
     return codexRemoteControlStatusFromInfo(codex);
 }
 export function codexRemoteControlStatusFromInfo(codex = {}) {
-    const current = codexCliVersionNumber(codex.version);
-    const versionKnown = Boolean(current);
-    const supported = Boolean(codex.bin && current && compareVersions(current, CODEX_REMOTE_CONTROL_MIN_VERSION) >= 0);
+    const present = Boolean(codex.bin);
     return {
-        ok: supported,
-        min_version: CODEX_REMOTE_CONTROL_MIN_VERSION,
+        ok: present,
         docs_url: CODEX_CHANGELOG_URL,
         codex_cli: {
-            ok: Boolean(codex.bin),
+            ok: present,
             bin: codex.bin || null,
-            version: codex.version || null,
-            version_number: current
+            version: codex.version || null
         },
         command: codex.bin ? `${codex.bin} remote-control` : 'codex remote-control',
-        reason: supported
-            ? 'available'
-            : !codex.bin
-                ? 'codex_cli_missing'
-                : versionKnown
-                    ? `requires_codex_cli_${CODEX_REMOTE_CONTROL_MIN_VERSION}_or_newer`
-                    : 'codex_cli_version_unknown'
+        reason: present ? 'available' : 'codex_cli_missing'
     };
 }
 export function parseProcessRows(text = '') {
@@ -413,13 +402,12 @@ export function formatCodexRemoteControlStatus(status) {
         'Codex remote-control',
         '',
         `Codex CLI: ${status.codex_cli.ok ? 'ok' : 'missing'}${status.codex_cli.version ? ` ${status.codex_cli.version}` : ''}`,
-        `Minimum:   ${status.min_version}`,
         `Ready:     ${status.ok ? 'yes' : 'no'}`,
         `Command:   ${status.command}`,
         '',
         status.ok
             ? 'Run: sks codex-app remote-control -- <codex remote-control args>'
-            : remoteControlGuidance(status)
+            : remoteControlGuidance()
     ];
     return lines.filter(Boolean).join('\n');
 }
@@ -487,10 +475,6 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
         lines.push('Install Codex CLI too: npm i -g @openai/codex, or set SKS_CODEX_BIN.');
     if (remoteControl?.ok) {
         lines.push('Codex remote-control is available for headless remotely controllable app-server sessions: sks codex-app remote-control.');
-        lines.push('Codex CLI 0.130.0+ app-server threads can pick up config changes without restarting the app-server; restart older CLI/TUI sessions if they were launched before config changes.');
-    }
-    else if (codex?.bin) {
-        lines.push(remoteControlGuidance(remoteControl || codexRemoteControlStatusFromInfo(codex)));
     }
     if (mcpList?.checked && !mcpList.ok) {
         lines.push(`Codex MCP/config check failed: ${summarizeCodexMcpError(mcpList.stderr || mcpList.stdout)}`);
@@ -594,7 +578,7 @@ export function formatCodexAppStatus(status, { includeRaw = false } = {}) {
         '',
         `Codex App:   ${status.app.installed ? 'ok' : 'missing'}${status.app.path ? ` ${status.app.path}` : ''}`,
         `Codex CLI:   ${status.codex_cli.ok ? 'ok' : 'missing'}${status.codex_cli.version ? ` ${status.codex_cli.version}` : ''}`,
-        `Remote Ctrl: ${status.remote_control?.ok ? 'ok' : 'missing'}${status.remote_control?.codex_cli?.version_number ? ` min ${status.remote_control.min_version}` : ''}`,
+        `Remote Ctrl: ${status.remote_control?.ok ? 'ok' : 'missing'}`,
         `App Flags:  ${status.features?.required_flags_ok ? 'ok' : `missing ${missingRequiredFeatureFlags(status.features?.required_flags).join(', ') || 'required flags'}`}`,
         `Fast UI:    ${status.features?.fast_mode_config?.ok ? 'ok' : `locked ${(status.features?.fast_mode_config?.blockers || []).join(', ') || 'config'}`}`,
         `SKS Menu:   ${sksNativeMenuSummary(status.app?.sks_menu)}`,
@@ -680,8 +664,7 @@ export function codexGitActionReadiness({ requiredFeatureFlags = {}, remoteContr
         commit_push: ok,
         pull_request: ok,
         required_flags: ['codex_git_commit', 'hooks'],
-        required_capabilities: ['codex_cli_remote_control'],
-        remote_control_min_version: CODEX_REMOTE_CONTROL_MIN_VERSION
+        required_capabilities: ['codex_cli_remote_control']
     };
 }
 async function codexDefaultPluginStatus(opts = {}) {
@@ -1046,25 +1029,6 @@ function tomlTable(text = '', table = '') {
     const re = new RegExp(`(?:^|\\n)\\[${escapeRegExp(table)}\\]([\\s\\S]*?)(?=\\n\\[[^\\]]+\\]|\\s*$)`);
     return String(text || '').match(re)?.[1] || '';
 }
-function remoteControlGuidance(status = {}) {
-    if (!status.codex_cli?.ok)
-        return 'Codex remote-control needs a Codex CLI that exposes the app-server entrypoint. Install the official latest stable release: npm i -g @openai/codex@latest';
-    if (status.reason === 'codex_cli_version_unknown')
-        return 'Codex remote-control needs a Codex CLI that exposes the app-server entrypoint, but the installed CLI version could not be parsed. Check: codex --version';
-    return 'The installed Codex CLI does not expose remote-control. Update to the official latest stable release: npm i -g @openai/codex@latest';
-}
-function codexCliVersionNumber(versionText = '') {
-    const match = String(versionText || '').match(/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/);
-    return match ? match[1] : null;
-}
-function compareVersions(a, b) {
-    const pa = String(a || '').split(/[.-]/).map((x) => Number.parseInt(x, 10) || 0);
-    const pb = String(b || '').split(/[.-]/).map((x) => Number.parseInt(x, 10) || 0);
-    for (let i = 0; i < Math.max(pa.length, pb.length, 3); i++) {
-        if ((pa[i] || 0) > (pb[i] || 0))
-            return 1;
-        if ((pa[i] || 0) < (pb[i] || 0))
-            return -1;
-    }
-    return 0;
+function remoteControlGuidance() {
+    return 'Codex remote-control needs the Codex CLI. Install the official latest stable release: npm i -g @openai/codex@latest';
 }

package/dist/core/codex-compat/codex-compat-report.js

@@ -1,14 +1,13 @@
 import { projectRoot } from '../fsx.js';
 import { detectCodexCurrentCapability } from '../codex-control/codex-current-capability.js';
 import { codexVersionReport } from './codex-version.js';
-import { CODEX_COMPAT_SCHEMA, CODEX_HOOK_SCHEMA_BASELINE_TAG, CODEX_REQUIRED_BASELINE_TAG } from './codex-version-policy.js';
+import { CODEX_COMPAT_SCHEMA, CODEX_HOOK_SCHEMA_BASELINE_TAG } from './codex-version-policy.js';
 import { CURRENT_CODEX_RUNTIME_CONTRACT } from './codex-runtime-contract.js';
 import { codexSchemaSnapshotReport } from './codex-schema-snapshot.js';
 import { codexHookWarningCheck } from './codex-hook-warning-detector.js';
 export async function codexCompatibilityReport(opts = {}) {
     const root = opts.root || await projectRoot();
-    const requiredBaseline = opts.requiredBaseline || opts.require || CODEX_REQUIRED_BASELINE_TAG;
-    const version = await codexVersionReport({ ...opts, requiredBaseline });
+    const version = await codexVersionReport(opts);
     const releaseContract = {
         ok: true,
         dependency_source: CURRENT_CODEX_RUNTIME_CONTRACT.dependencySource,
@@ -18,13 +17,12 @@ export async function codexCompatibilityReport(opts = {}) {
     const hooks = await codexHookWarningCheck(root, { recordWrongness: false });
     const current = await detectCodexCurrentCapability({
         root,
-        codexBin: opts.codexBin || null,
-        requireReal: opts.requireReal === true
+        codexBin: opts.codexBin || null
     });
     const ok = Boolean(version.policy.ok && snapshot.ok && hooks.ok && current.ok);
     return {
         schema: CODEX_COMPAT_SCHEMA,
-        required_baseline: requiredBaseline,
+        min_version: CURRENT_CODEX_RUNTIME_CONTRACT.minVersion,
         release_contract: releaseContract,
         detected: version.detected,
         current_capability: current,

package/dist/core/codex-compat/codex-hook-output-builders.js

@@ -44,6 +44,9 @@ export function buildPermissionRequestAllow(options = {}) {
         }
     }, options.systemMessage);
 }
+export function buildPermissionRequestNoDecision(options = {}) {
+    return withOptionalSystemMessage({ continue: true }, options.systemMessage);
+}
 export function buildPermissionRequestDeny(message, options = {}) {
     const trimmed = requiredReason(message, 'PermissionRequest deny requires a non-empty message');
     return withOptionalSystemMessage({

package/dist/core/codex-compat/codex-runtime-contract.js

@@ -1,56 +1,16 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { packageRoot } from '../fsx.js';
-export const CODEX_RUNTIME_CONTRACT_SCHEMA = 'sks.codex-runtime-contract.v2';
+export const CODEX_RUNTIME_CONTRACT_SCHEMA = 'sks.codex-runtime-contract.v3';
+export const CODEX_MIN_VERSION = '0.153.4';
 const sdkVersion = codexSdkDependencyVersion();
 export const CURRENT_CODEX_RUNTIME_CONTRACT = {
     schema: CODEX_RUNTIME_CONTRACT_SCHEMA,
     targetTag: `rust-v${sdkVersion}`,
-    requiredCliVersion: sdkVersion,
-    preferredCliVersion: sdkVersion,
     sdkVersion,
-    minimumSupportedVersion: sdkVersion,
-    narutoCapabilityFloorVersion: sdkVersion,
-    protocolMode: 'app-server-v2',
-    dependencySource: 'package.json#dependencies.@openai/codex-sdk',
-    featurePolicies: {
-        multiAgentMode: 'delegate',
-        multiAgentV2: 'delegate',
-        agentsMaxConcurrentThreads: 'delegate',
-        indexedWebSearch: 'probe',
-        currentTimeRead: 'wrap',
-        threadListSearchRead: 'probe',
-        pluginCatalogRefresh: 'probe',
-        terminalSubagentErrorPropagation: 'probe',
-        execMcpTransientRecovery: 'probe',
-        remoteNativeEnvironment: 'probe',
-        rolloutTokenBudget: 'probe',
-        mcpStartupToolTimeouts: 'wrap',
-        gpt56TerraLunaSolRouting: 'delegate',
-        mcpPaginatedDiscovery: 'wrap',
-        portableAgentPlugins: 'delegate',
-        automaticApprovalReview: 'delegate'
-    },
-    requiredRealProbes: [
-        'runtime_identity',
-        'protocol_schema_generation',
-        'multi_agent_mode_schema',
-        'indexed_web_search_schema',
-        'current_time_read_schema',
-        'thread_list_search_schema',
-        'terminal_error_schema',
-        'rollout_budget_schema'
-    ],
-    supportedPlatforms: [
-        'darwin-arm64',
-        'darwin-x64',
-        'linux-arm64',
-        'linux-x64',
-        'win32-arm64',
-        'win32-x64'
-    ]
+    minVersion: CODEX_MIN_VERSION,
+    dependencySource: 'package.json#dependencies.@openai/codex-sdk'
 };
-export const NARUTO_REQUIRED_CODEX_VERSION = CURRENT_CODEX_RUNTIME_CONTRACT.narutoCapabilityFloorVersion;
 export function codexSdkDependencyVersion(root = packageRoot()) {
     const packagePath = path.join(root, 'package.json');
     const pkg = JSON.parse(fs.readFileSync(packagePath, 'utf8'));