sneakoscope 10.6.2 → 10.7.1

package/dist/cli/commands-fast.js

@@ -1,4 +1,5 @@
-import { COMMAND_MANIFEST_LITE } from './command-manifest-lite.js';
+import { COMMAND_MANIFEST_LITE, visibleCommandManifest } from './command-manifest-lite.js';
+import { sksTextLogo } from './output.js';
 export function commandsJsonFast() {
     const commands = COMMAND_MANIFEST_LITE
         .map((entry) => fastCommandRow(entry))
@@ -9,10 +10,18 @@ export function commandsJsonFast() {
         commands
     }, null, 2));
 }
+export function commandsTextFast() {
+    const commands = visibleCommandManifest();
+    console.log(`${sksTextLogo()}\n\nCommands\n`);
+    const width = Math.max(...commands.map((entry) => entry.name.length)) + 2;
+    for (const entry of commands)
+        console.log(`sks ${entry.name.padEnd(width)}${entry.summary}`);
+    console.log('\nRun `sks help <command>` for its usage.');
+}
 function fastCommandRow(entry) {
     const row = {
         name: entry.name,
-        usage: `sks ${entry.name}`,
+        usage: entry.usage || `sks ${entry.name}`,
         description: entry.summary,
         maturity: entry.maturity
     };
@@ -20,8 +29,6 @@ function fastCommandRow(entry) {
         row.readonly = true;
     if (entry.mutatesRouteState === true)
         row.mutating = true;
-    if (entry.deprecated === true)
-        row.deprecated = true;
     if (entry.hidden === true)
         row.hidden = true;
     return row;

package/dist/cli/help-fast.js

@@ -1,35 +1,24 @@
-import { COMMAND_MANIFEST_LITE } from './command-manifest-lite.js';
+import { visibleCommandManifest } from './command-manifest-lite.js';
 import { PACKAGE_VERSION } from '../core/version.js';
 export function helpFast() {
     console.log(`SKS
 SNEAKOSCOPE CODEX v${PACKAGE_VERSION}
 
-3-pillar frontdoor
+Ask Codex for work directly; the main agent does ordinary work and SKS hooks keep it safe.
 
   $sks-plan "task"          plan only; writes .sneakoscope/plans, no code edits
   $sks-work                 execute the latest plan with Naruto child agents
 
-Local surfaces
-
   sks review --staged       machine-first diff review
-  sks doctor --fix          repair/validate the harness
-
-Discovery
+  sks doctor --fix          repair and validate the install
+  sks help <command>        usage of one command (or a $ route)
+  sks dollar-commands       every Codex App $ route
 
-  sks commands [--json]     all commands
-  sks dollar-commands       all Codex App $ routes
-  sks help [topic]          focused help
+Commands
 `);
-    for (const row of commandRows().filter((entry) => entry.maturity !== 'labs').slice(0, 18)) {
-        console.log(`  ${row.usage.padEnd(58)} ${row.description}`);
-    }
-    console.log('\nRun `sks commands` for the full catalog.');
-}
-function commandRows() {
-    return COMMAND_MANIFEST_LITE.map((entry) => ({
-        name: entry.name,
-        usage: `sks ${entry.name}`,
-        description: entry.summary,
-        maturity: entry.maturity
-    })).sort((a, b) => a.name.localeCompare(b.name));
+    const commands = visibleCommandManifest().filter((entry) => entry.maturity !== 'labs');
+    const width = Math.max(...commands.map((entry) => entry.name.length)) + 2;
+    for (const entry of commands)
+        console.log(`  sks ${entry.name.padEnd(width)}${entry.summary}`);
+    console.log('\nLabs commands (optional routes) are listed by `sks commands`.');
 }

package/dist/cli/help.js

@@ -6,10 +6,10 @@ export function isHelpRequest(args) {
 export function renderManifestHelp(command, entry) {
     if (!entry)
         return `Usage: sks ${command}\n\nNo manifest entry is registered for this command.`;
-    const lines = [`Usage: sks ${entry.name} [options]`, '', entry.summary];
+    const lines = [`Usage: ${entry.usage || `sks ${entry.name} [options]`}`, '', entry.summary];
+    if (entry.description && entry.description !== entry.summary)
+        lines.push(entry.description);
     const notes = [];
-    if (entry.deprecated)
-        notes.push('deprecated — kept only for compatibility');
     if (entry.maturity !== 'stable')
         notes.push(`maturity: ${entry.maturity}`);
     if (entry.readonly)

package/dist/cli/install-helpers-codex-lb-config.js

@@ -4,13 +4,16 @@ import { escapeRegExp } from '../core/text/regex.js';
 export const DESKTOP_BRIDGE_MANAGED_MARKER = '# sks-desktop-bridge-managed';
 export const DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER = '# sks-desktop-bridge-managed-base-url';
 export const DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER = '# sks-desktop-bridge-managed-model-catalog';
-export function bindCodexClientProvider(text, provider) {
-    const selected = topLevelTomlString(text, 'model_provider');
-    if (selected && selected !== 'openai' && selected !== 'codex-lb')
-        return text;
-    if (selected === provider)
-        return text;
-    return upsertTopLevelTomlString(String(text || ''), 'model_provider', provider);
+export function repairManagedCodexLbClientSelection(text) {
+    const source = String(text || '');
+    if (topLevelTomlString(source, 'model_provider') !== 'codex-lb')
+        return source;
+    if (!topLevelHasLine(source, DESKTOP_BRIDGE_MANAGED_MARKER) || hasCodexLbProviderTable(source))
+        return source;
+    return upsertTopLevelTomlString(source, 'model_provider', 'openai');
+}
+export function hasCodexLbProviderTable(text) {
+    return /^\s*\[model_providers\.(?:"codex-lb"|codex-lb)\]\s*(?:#.*)?$/m.test(text);
 }
 export function upsertDesktopBridgeManagedConfig(text, input) {
     const bridgeBaseUrl = normalizeManagedBridgeBaseUrl(input.bridgeBaseUrl);
@@ -39,7 +42,7 @@ export function upsertDesktopBridgeManagedConfig(text, input) {
     if (existingCatalog && !catalogOwned) {
         throw new Error('historical_user_owned_config_conflict:model_catalog_json');
     }
-    const keepCodexLb = selectedProvider === 'codex-lb';
+    const keepCodexLb = selectedProvider === 'codex-lb' && hasCodexLbProviderTable(next);
     next = removeManagedBridgeTopLevelBindings(next);
     next = upsertTopLevelTomlString(next, 'model_provider', keepCodexLb ? 'codex-lb' : 'openai');
     next = addTopLevelMarkerBeforeKey(next, 'model_provider', DESKTOP_BRIDGE_MANAGED_MARKER);

package/dist/cli/install-helpers.js

@@ -24,7 +24,7 @@ export async function postinstall({ bootstrap }) {
         if (menuBar.status === 'skipped')
             console.log(describePostinstallMenuBar(menuBar));
         console.log('Next: run `sks bootstrap` when you are ready to initialize SKS.');
-        console.log('Dependency diagnostics remain explicit: sks deps check');
+        console.log('Dependency diagnostics remain explicit: sks doctor');
         console.log('Explicit lifecycle opt-in: SKS_POSTINSTALL_BOOTSTRAP=1 npm i -g sneakoscope');
         console.log('Optional Homebrew/npm-global tool repair remains off unless SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS=1 is also set.');
         const reason = process.env.SKS_POSTINSTALL_NO_BOOTSTRAP === '1'

package/dist/cli/router.js

@@ -1,4 +1,3 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
 import { createHash } from 'node:crypto';
 import { COMMAND_ALIASES_LITE, COMMAND_MANIFEST_BY_NAME, COMMAND_NAME_SET, } from './command-manifest-lite.js';
 import { ui as cliUi } from './cli-theme.js';
@@ -6,7 +5,6 @@ import { helpResult, isHelpRequest, renderManifestHelp } from './help.js';
 import { findRetiredGlobalExecutionArgumentErrors } from './global-mode-router.js';
 import { normalizeIntentCommand, } from '../core/commands/intent-normalization/normalizer.js';
 import { narutoUsesCurrentSession } from '../core/subagents/naruto-execution-mode.js';
-const routerIntentStorage = new AsyncLocalStorage();
 export function prepareRouterExecutionIntent(argv, inheritance = {}) {
     const effectiveArgv = argv.length ? [...argv] : ['doctor'];
     const rawCommand = effectiveArgv[0]?.startsWith('$')
@@ -66,9 +64,8 @@ export function normalizeCommand(args = []) {
 export async function dispatch(args) {
     const argv = args ?? process.argv.slice(2);
     try {
-        let intent = null;
         try {
-            intent = prepareRouterExecutionIntent(argv);
+            prepareRouterExecutionIntent(argv);
         }
         catch (error) {
             const code = error instanceof Error ? error.message : String(error);
@@ -85,9 +82,7 @@ export async function dispatch(args) {
                 throw error;
             }
         }
-        return intent
-            ? await routerIntentStorage.run(intent.contract, () => dispatchInner(argv))
-            : await dispatchInner(argv);
+        return await dispatchInner(argv);
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -178,16 +173,14 @@ async function dispatchInner(argv) {
             process.exitCode = 1;
             return commandGate;
         }
-        const { ensureCurrentMigrationBeforeCommand } = await import('../core/update/update-migration-state.js');
-        const migrationGate = await ensureCurrentMigrationBeforeCommand({
-            command,
-            args: rest,
-            skipMigrationGate: entry.skipMigrationGate === true
-                || entry.readonly === true
-                || safeReadOnlySubcommand(command, rest)
-                || safeActiveRouteVisualQuery(command, rest)
-        });
-        if (!migrationGate.ok) {
+        const skipMigrationGate = entry.skipMigrationGate === true
+            || entry.readonly === true
+            || safeReadOnlySubcommand(command, rest)
+            || safeActiveRouteVisualQuery(command, rest);
+        const migrationGate = skipMigrationGate
+            ? null
+            : await (await import('../core/update/update-migration-state.js')).ensureCurrentMigrationBeforeCommand({ command, args: rest, skipMigrationGate: false });
+        if (migrationGate && !migrationGate.ok) {
             console.error('SKS project migration blocked.');
             console.error(`Scope: ${migrationGate.scope || 'project'}`);
             console.error(`Stage: ${migrationGate.failed_stage_id || migrationGate.status}`);
@@ -306,12 +299,6 @@ export function safeReadOnlySubcommand(command, args) {
     if (command === 'codex-app' && ['context-1m', 'context-management'].includes(sub) && (nested === 'status' || nested === '' || nested.startsWith('--'))) {
         return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
     }
-    if (command === 'remote' && ['readiness', 'status', 'show'].includes(sub)) {
-        return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
-    }
-    if (command === 'remote' && ['machines', 'machine'].includes(sub) && ['list', 'validate'].includes(nested)) {
-        return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
-    }
     if (!['status', 'show', 'list', 'observe', 'watch', 'doctor', 'help'].includes(sub))
         return false;
     return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
@@ -367,8 +354,7 @@ export function safeActiveRouteContinuation(command, args, state = {}) {
         return subcommand === 'run' && !requestedMission;
     }
     const expectedRoutes = new Map([
-        ['research', ['RESEARCH']],
-        ['autoresearch', ['AUTORESEARCH', 'RESEARCH']],
+        ['research', ['RESEARCH', 'AUTORESEARCH']],
         ['qa-loop', ['QALOOP']]
     ]).get(command);
     if (!expectedRoutes)
@@ -410,5 +396,5 @@ function activeRouteStateBlocksCommand(state = {}) {
         return false;
     if (/(?:DONE|COMPLETE|CLOSED|BLOCKED|FAILED)$/i.test(String(state.phase || '')))
         return false;
-    return Boolean(state.route || state.route_command || ['NARUTO', 'QALOOP', 'RESEARCH', 'MADSKS', 'GOAL'].includes(mode));
+    return Boolean(state.route || state.route_command || ['NARUTO', 'QALOOP', 'RESEARCH', 'MADSKS'].includes(mode));
 }

package/dist/commands/codex-app.js

@@ -70,7 +70,7 @@ export async function run(_command, args = []) {
     if (action === 'agent-role-sync')
         return printCodexAppResult(args, await syncCodexAgentRoles({ root: await sksRoot(), apply: flag(args, '--apply') || flag(args, '--fix') }));
     if (action === 'init-deep')
-        return printCodexAppResult(args, await runCodexInitDeep({ root: await sksRoot(), apply: !flag(args, '--check-only') && !flag(args, '--dry-run') }));
+        return printCodexAppResult(args, await runCodexInitDeep({ root: await sksRoot(), apply: !flag(args, '--check-only') && !flag(args, '--dry-run'), directoryLocal: flag(args, '--directory-local') }));
     if (action === 'hook-lifecycle')
         return printCodexAppResult(args, await buildCodexHookLifecycle({ root: await sksRoot(), apply: flag(args, '--apply') || flag(args, '--fix') }));
     if (action === 'execution-profile')
@@ -151,7 +151,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex-app check|status|restart|context-management [status|on|off]|context-1m [status|on|off] [--no-restart]|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|role-models|set-role-model --role <name> [--provider <id>] --model <catalog-slug> --reasoning <effort>|reset-role-model --role <name>|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
+    console.error('Usage: sks codex-app check|status|restart|context-management [status|on|off]|context-1m [status|on|off] [--no-restart]|harness-matrix|skill-sync|agent-role-sync|init-deep [--directory-local]|hook-lifecycle|execution-profile|role-models|set-role-model --role <name> [--provider <id>] --model <catalog-slug> --reasoning <effort>|reset-role-model --role <name>|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
     console.error('Provider routing moved to: sks bridge provider configure|validate|enable; sks bridge catalog sync; sks bridge route set-default.');
     process.exitCode = 1;
 }

package/dist/commands/doctor-helpers.js

@@ -19,7 +19,7 @@ export function buildRuntimeReadiness(matrix) {
         ].join(' '));
     }
     if (matrix?.features?.project_memory?.ok !== true)
-        repairActions.push('Project memory: sks codex-native init-deep --apply --directory-local');
+        repairActions.push('Project memory: sks codex-app init-deep --directory-local');
     return {
         schema: 'sks.runtime-readiness-story.v1',
         codex_native: codexNative,

package/dist/commands/mad-sks.js

@@ -1,6 +1,6 @@
-import { madHighCommand } from '../core/commands/mad-sks-command.js';
-import { PACKAGE_VERSION } from '../core/fsx.js';
 export async function run(_command, args = []) {
+    const { madHighCommand } = await import('../core/commands/mad-sks-command.js');
+    const { PACKAGE_VERSION } = await import('../core/version.js');
     return madHighCommand(['--mad-sks', ...args], {
         packageVersion: PACKAGE_VERSION
     });

package/dist/config/skills-manifest.json

@@ -1,12 +1,14 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.6.2",
+  "package_version": "10.7.1",
   "skills": [
     {
       "canonical_name": "sks",
       "type": "official",
-      "content_sha256": "d5adbf63047d4882258d70bb46017e4aa7b6d5804154c68ef4204d0e0e5916d6",
+      "content_sha256": "eb09af342c2f2bc3d269e6d1c2f92d718ed069582d1165bfe46600b5c2225a8b",
       "hash_history": [
+        "32d97c9b68a0a97794f48bd2f200bb3c0cd68816c00fef3397e86df671342ac5",
+        "d5adbf63047d4882258d70bb46017e4aa7b6d5804154c68ef4204d0e0e5916d6",
         "8aa34586ba331f0447668c2ce863fe6c9ec4f881828ebed26ca5ecc754d66840",
         "d0288d27c8bc1c89decb258c6805ed4286cd0d65371ef0eec453be233b39a2a1",
         "905fc5472d36f0780b56f0e09404f42ea20293b1a4615d2050b7db3043231dbd",
@@ -309,8 +311,9 @@
     {
       "canonical_name": "sks-help",
       "type": "official",
-      "content_sha256": "17c2a63b163b266dc0d0a503a275d41a5388e1f44be9250b84017f1a549159d4",
+      "content_sha256": "3a20901121eb9a11a31ea797a44c8136a09f26f9862f52a923634aba0767dc0c",
       "hash_history": [
+        "17c2a63b163b266dc0d0a503a275d41a5388e1f44be9250b84017f1a549159d4",
         "8b6d7f0cffbd3b141f53a6937fb3d58ba363d495d6da561d8f463ee3b265d975",
         "0b67a2ed2eb1f3f80cf1645bee0c189ecc442d2ec84b1e0b218d800298487920"
       ],
@@ -456,8 +459,9 @@
     {
       "canonical_name": "sks-ppt",
       "type": "official",
-      "content_sha256": "a25e537ff49b5bffdc093a5f772a8d218003ca1bb81e0aa304561684a9551b31",
+      "content_sha256": "93887312718febbb795cab3d09b1d47a30485eee7c6416fb02c78c65ab5c4686",
       "hash_history": [
+        "a25e537ff49b5bffdc093a5f772a8d218003ca1bb81e0aa304561684a9551b31",
         "fba3f438b9f22dae0813cd12bf310539a7d2b71c8cd9322eb840514e24884eaf",
         "c9a0d90e12560dd3f04959869051370e6baf46eda6eb63f708ea1661c5c9d041",
         "1d4de05afd42ee5739c0ed925af9e0ac4785fc746e659c60d3d908d465e6386c",
@@ -493,16 +497,16 @@
     {
       "canonical_name": "sks-reasoning-router",
       "type": "official",
-      "content_sha256": "2ec66071b1c021e8c2ddd8f1ecefd16502c8325adab2c3c804a9e8d4123b1a8d",
+      "content_sha256": "00403fa829bc673966c2e125d5a2d42111ed6fd8c821b1f0e50176127658b888",
       "hash_history": [
+        "2ec66071b1c021e8c2ddd8f1ecefd16502c8325adab2c3c804a9e8d4123b1a8d",
         "b0f458caa1c3bd7bb7241a09b80fce5700aeb99b340e84c08a9b2b66bc875ba7",
         "41e14e8d5b93d743096664869ee68c41c86e911b0bbc165bdcd10e4a45faa4b6",
         "03d68436e568b3cee2bffc6ca58819019ca406f7b648ef4704e3465c7c83c114",
         "647f730520a1c7dc89c2642f5b8502624c65a861ae41aecf1fb137db40fd0611",
         "da0ddb58adc68ddeebdb9c45bf111c26eaa64d3e9dffe1dd39d7f30b943b8b88",
         "1595beabf2d31397217311fa1323bd62c801cf6c87db9029ff544c457efec8bb",
-        "a7d879d157c6d5b6b81a67dba7b5b731ac18ea986841fe1ab2cafbd6623481c3",
-        "dc0b8c6a4093269c2c36b58432b25409704d06fea8ca558f43b598625ca0d9de"
+        "a7d879d157c6d5b6b81a67dba7b5b731ac18ea986841fe1ab2cafbd6623481c3"
       ],
       "deprecated_aliases": []
     },
@@ -521,8 +525,9 @@
     {
       "canonical_name": "sks-release-review",
       "type": "official",
-      "content_sha256": "36846d6180051c85e3093e7e405ad9d4d447f7295769f71f8450c18afee50e98",
+      "content_sha256": "dfc2af7dd2c41ab2529ed54b2dca0dfd85e2de0d3304afbfe4a420e6627ce01a",
       "hash_history": [
+        "36846d6180051c85e3093e7e405ad9d4d447f7295769f71f8450c18afee50e98",
         "bb6ef28431fd6c390041c9a2855b906fd01a1f6da02111f094258914cf826bb9",
         "7cf879a2efd61822d3dccd4eb69fb704bfbab4b114b820b6dfa0d13b5f20e9fa"
       ],

package/dist/core/agent-bridge/async-command.js

@@ -9,7 +9,7 @@ import { bridgeClientUrl } from '../codex-lb/desktop-controller-v3/shared.js';
 import { runProcess } from '../fsx.js';
 import { createResponsesTransport } from './responses-transport.js';
 import { latestModelForTier } from '../subagents/model-tiers.js';
-const USAGE = 'sks agent-bridge async --prompt "task" [--tools status,stats] [--json]';
+const USAGE = 'sks agent-bridge async --prompt "task" [--tools status,search] [--json]';
 const MAX_PROMPT_BYTES = 16 * 1024;
 export function redactAsyncToolOutput(stdout) {
     try {
@@ -21,7 +21,7 @@ export function redactAsyncToolOutput(stdout) {
 }
 export function parseAsyncCommandArgs(args) {
     let prompt = '';
-    let selected = 'status,stats';
+    let selected = 'status,search';
     const seen = new Set();
     for (let i = 0; i < args.length; i++) {
         const flag = args[i];

package/dist/core/agents/agent-recursion-guard.js

@@ -4,9 +4,7 @@ export const AGENT_RECURSION_GUARD_REPORT_SCHEMA = 'sks.agent-recursion-guard.v1
 export const AGENT_RECURSIVE_COMMAND_DENYLIST = Object.freeze([
     'sks naruto run',
     'sks research run',
-    'sks autoresearch run',
     'sks qa-loop',
-    'sks goal',
     '$Naruto',
     '$Work',
     '$Research',

package/dist/core/agents/agent-role-config.js

@@ -5,6 +5,7 @@ import { nowIso, readText, writeJsonAtomic } from '../fsx.js';
 import { inspectConfinedPath, moveConfinedPath, removeConfinedDirectoryIfEmpty, removeManagedPathVerified, uniqueConfinedPath, walkConfinedEntries } from '../managed-path-safety.js';
 import { MANAGED_OFFICIAL_SUBAGENT_ROLES, RETIRED_MANAGED_AGENT_ROLE_TOMBSTONES, managedAgentRoleOwnsText } from '../managed-assets/managed-assets-manifest.js';
 import { installOfficialSubagentAgentConfigs, refreshGlobalOfficialSubagentAgentConfigs } from '../subagents/official-subagent-config.js';
+import { reconcileStaleSksModelPins } from './sks-model-pin-hygiene.js';
 export const AGENT_ROLE_CONFIG_REPAIR_SCHEMA = 'sks.agent-role-config-repair.v1';
 export async function repairAgentRoleConfigs(input) {
     const root = path.resolve(input.root);
@@ -18,6 +19,7 @@ export async function repairAgentRoleConfigs(input) {
         ...(input.globalRuntimeRoot ? { globalRuntimeRoot: input.globalRuntimeRoot } : {}),
         fix: input.apply === true
     });
+    const modelPinHygiene = await reconcileStaleSksModelPins({ root, codexHome, fix: input.apply === true });
     const officialRepair = await installOfficialSubagentAgentConfigs(root, { apply: input.apply === true });
     const globalRepair = path.join(root, '.codex') === codexHome
         ? null
@@ -38,7 +40,7 @@ export async function repairAgentRoleConfigs(input) {
         schema: AGENT_ROLE_CONFIG_REPAIR_SCHEMA,
         generated_at: nowIso(),
         ok: input.apply
-            ? requiredFixes === appliedFixes && manualBlockers.length === 0 && retiredRoleCleanup.ok
+            ? requiredFixes === appliedFixes && manualBlockers.length === 0 && retiredRoleCleanup.ok && modelPinHygiene.errors.length === 0
             : manualBlockers.length === 0 && retiredRoleCleanup.ok && (globalRepair?.stale.length || 0) === 0,
         apply: input.apply === true,
         missing,
@@ -51,12 +53,14 @@ export async function repairAgentRoleConfigs(input) {
         manual_blockers: manualBlockers,
         manifest_role_ids: MANAGED_OFFICIAL_SUBAGENT_ROLES.map((role) => role.id),
         retired_role_cleanup: retiredRoleCleanup,
+        model_pin_hygiene: modelPinHygiene,
         warnings_suppressed: true,
         blockers: [
             ...manualBlockers,
             ...(!input.apply ? (globalRepair?.stale.map((file) => `stale_global_official_subagent_agent:${globalPath(file)}`) || []) : []),
             ...(input.apply && requiredFixes !== appliedFixes ? ['agent_role_config_repair_incomplete'] : []),
-            ...(!retiredRoleCleanup.ok ? ['retired_agent_role_cleanup_incomplete'] : [])
+            ...(!retiredRoleCleanup.ok ? ['retired_agent_role_cleanup_incomplete'] : []),
+            ...modelPinHygiene.errors.map((error) => `model_pin_hygiene_failed:${error}`)
         ]
     };
     if (input.reportPath)

package/dist/core/agents/sks-model-pin-hygiene.js

@@ -0,0 +1,150 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { readText, writeTextAtomic } from '../fsx.js';
+import { hasCodexLbProviderTable } from '../../cli/install-helpers-codex-lb-config.js';
+import { hasSksManagedCodexConfigMarker, writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
+import { bridgeRouteIndexPath, combinedBridgeCatalogPath } from '../codex-lb/combined-catalog.js';
+import { readActiveCombinedBridgeCatalog } from '../codex-lb/combined-catalog/persistence.js';
+import { backupInvalidToml } from '../subagents/official-subagent-config.js';
+export const MODEL_PIN_HYGIENE_SCHEMA = 'sks.model-pin-hygiene.v1';
+const LEGACY_ROLE_NAMES = new Set(['sks-planner', 'sks-implementer', 'sks-explorer', 'sks-checker']);
+async function catalogPinState(codexHome) {
+    const read = await readActiveCombinedBridgeCatalog(combinedBridgeCatalogPath(codexHome), bridgeRouteIndexPath(codexHome)).catch(() => null);
+    if (!read?.ok)
+        return null;
+    const rows = new Map();
+    for (const row of read.catalog.models) {
+        for (const id of [row.public_id, row.slug])
+            if (typeof id === 'string' && id)
+                rows.set(id, row);
+    }
+    return (model) => {
+        const row = rows.get(model);
+        if (!row)
+            return 'unlisted';
+        const visibility = String(row.visibility || 'list').toLowerCase();
+        const upgrade = row.upgrade && typeof row.upgrade === 'object' ? row.upgrade.model : null;
+        return visibility === 'hide' || visibility === 'hidden' || (typeof upgrade === 'string' && upgrade) ? 'superseded' : 'current';
+    };
+}
+function topLevelEnd(lines) {
+    const end = lines.findIndex((line) => /^\s*\[/.test(line) || /^\s*developer_instructions\s*=/.test(line));
+    return end === -1 ? lines.length : end;
+}
+function stalePinLines(text, pinState, codexLbProviderDefined) {
+    const lines = text.split('\n');
+    const indexes = [];
+    const labels = [];
+    for (let index = 0; index < topLevelEnd(lines); index += 1) {
+        const match = /^\s*(model|model_provider)\s*=\s*"([^"]*)"\s*(?:#.*)?$/.exec(lines[index] || '');
+        if (!match)
+            continue;
+        const [, key, value] = match;
+        const stale = key === 'model_provider'
+            ? value === 'codex-lb' && !codexLbProviderDefined
+            : pinState !== null && pinState(value) !== 'current';
+        if (!stale)
+            continue;
+        indexes.push(index);
+        labels.push(`${key} = "${value}"`);
+    }
+    return { indexes, labels };
+}
+function withoutLines(text, indexes) {
+    const drop = new Set(indexes);
+    return text.split('\n').filter((_, index) => !drop.has(index)).join('\n');
+}
+const CODEX_LB_SELECTION_EVIDENCE = [
+    /^\s*model_provider\s*=\s*["']codex-lb["']\s*(?:#.*)?$/,
+    /^\s*\[model_providers\.(?:"codex-lb"|codex-lb)\]\s*(?:#.*)?$/
+];
+function sksOwnedProjectConfig(text) {
+    const withoutSelection = text.split('\n')
+        .filter((line) => !CODEX_LB_SELECTION_EVIDENCE.some((pattern) => pattern.test(line)))
+        .join('\n');
+    return hasSksManagedCodexConfigMarker(withoutSelection);
+}
+function isLegacySksRole(file, text) {
+    if (/sks_managed_body_sha256/.test(text))
+        return false;
+    const name = /^\s*name\s*=\s*"([^"]+)"/m.exec(text)?.[1] ?? path.basename(file, '.toml');
+    return /^\s*description\s*=\s*"SKS managed\b/m.test(text) || LEGACY_ROLE_NAMES.has(name);
+}
+async function regularFile(file) {
+    const stat = await fsp.lstat(file).catch(() => null);
+    return Boolean(stat?.isFile() && !stat.isSymbolicLink());
+}
+async function roleFiles(dir) {
+    const entries = await fsp.readdir(dir).catch(() => []);
+    return entries.filter((name) => name.endsWith('.toml')).sort().map((name) => path.join(dir, name));
+}
+export async function reconcileStaleSksModelPins(input) {
+    const root = path.resolve(input.root);
+    const codexHome = path.resolve(input.codexHome);
+    const pinState = await catalogPinState(codexHome);
+    const report = {
+        schema: MODEL_PIN_HYGIENE_SCHEMA,
+        fix: input.fix,
+        catalog_available: pinState !== null,
+        changes: [],
+        remaining: [],
+        errors: []
+    };
+    const projectConfig = path.join(root, '.codex', 'config.toml');
+    const projectText = projectConfig !== path.join(codexHome, 'config.toml') && await regularFile(projectConfig)
+        ? await readText(projectConfig, '')
+        : null;
+    const providerDefinedAbove = hasCodexLbProviderTable(await readText(path.join(codexHome, 'config.toml'), ''))
+        || (projectText !== null && hasCodexLbProviderTable(projectText));
+    const agentDirs = [...new Set([path.join(codexHome, 'agents'), path.join(root, '.codex', 'agents')])];
+    for (const dir of agentDirs) {
+        for (const file of await roleFiles(dir)) {
+            if (!(await regularFile(file)))
+                continue;
+            const text = await readText(file, '');
+            if (!isLegacySksRole(file, text))
+                continue;
+            const pins = stalePinLines(text, pinState, providerDefinedAbove || hasCodexLbProviderTable(text));
+            if (!pins.indexes.length)
+                continue;
+            if (!input.fix) {
+                report.remaining.push({ file, removed: pins.labels, backup_path: null });
+                continue;
+            }
+            try {
+                const backup = await backupInvalidToml(file, text, 'model-pin-hygiene');
+                const mode = (await fsp.stat(file)).mode & 0o777;
+                await writeTextAtomic(file, withoutLines(text, pins.indexes), { mode });
+                report.changes.push({ file, removed: pins.labels, backup_path: backup });
+            }
+            catch (error) {
+                report.errors.push(`${file}: ${error instanceof Error ? error.message : String(error)}`);
+                report.remaining.push({ file, removed: pins.labels, backup_path: null });
+            }
+        }
+    }
+    if (projectText !== null) {
+        const text = projectText;
+        const pins = sksOwnedProjectConfig(text) ? stalePinLines(text, pinState, providerDefinedAbove) : { indexes: [], labels: [] };
+        if (pins.indexes.length && !input.fix)
+            report.remaining.push({ file: projectConfig, removed: pins.labels, backup_path: null });
+        else if (pins.indexes.length) {
+            const write = await writeCodexConfigGuarded({
+                root,
+                configPath: projectConfig,
+                before: text,
+                mutate: () => withoutLines(text, pins.indexes),
+                cause: 'model-pin-hygiene',
+                backupTag: 'model-pin-hygiene',
+                verifyUnchangedBeforeWrite: true
+            });
+            if (write.ok)
+                report.changes.push({ file: projectConfig, removed: pins.labels, backup_path: write.backup_path });
+            else {
+                report.errors.push(`${projectConfig}: ${write.status}`);
+                report.remaining.push({ file: projectConfig, removed: pins.labels, backup_path: null });
+            }
+        }
+    }
+    return report;
+}