sneakoscope 2.0.17 → 3.0.0

package/dist/core/doctor/codex-0138-doctor.js

@@ -0,0 +1,104 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { detectCodex0138Capability } from '../codex-control/codex-0138-capability.js';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+export async function runCodex0138Doctor(root, input = {}) {
+    const capability = await detectCodex0138Capability();
+    const fixed = [];
+    const checks = {
+        bash_fallback: await bashFallbackCheck(),
+        linux_proxy_socket_path: linuxProxySocketCheck(root),
+        oauth_mcp_prerefresh: oauthMcpPrerefreshCheck(capability),
+        agents_logical_path: await agentsLogicalPathCheck(root),
+        plugin_discovery_cache: await pluginDiscoveryCacheCheck(root, input.fix === true, fixed)
+    };
+    const warnings = [
+        ...(capability.ok ? [] : ['codex_0_138_not_detected']),
+        ...Object.values(checks).flatMap((check) => Array.isArray(check.warnings) ? check.warnings : [])
+    ];
+    const blockers = Object.values(checks).flatMap((check) => Array.isArray(check.blockers) ? check.blockers : []);
+    const report = {
+        schema: 'sks.codex-0138-doctor.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        codex_0138_capability: capability,
+        checks,
+        fixed,
+        warnings,
+        blockers
+    };
+    await writeJsonAtomic(path.join(root, '.sneakoscope', 'codex-0138-doctor.json'), report);
+    return report;
+}
+async function bashFallbackCheck() {
+    const candidates = ['/bin/bash', '/usr/bin/bash'];
+    const existing = [];
+    for (const candidate of candidates) {
+        try {
+            await fs.access(candidate);
+            existing.push(candidate);
+        }
+        catch { }
+    }
+    return {
+        ok: existing.length > 0,
+        candidates,
+        existing,
+        blockers: existing.length ? [] : ['bash_fallback_missing'],
+        warnings: []
+    };
+}
+function linuxProxySocketCheck(root) {
+    if (process.platform !== 'linux')
+        return { ok: true, status: 'not_linux', warnings: [], blockers: [] };
+    const candidate = path.join(os.tmpdir(), 'sks-proxy', path.basename(root), 'proxy.sock');
+    return {
+        ok: candidate.length < 100,
+        candidate,
+        length: candidate.length,
+        warnings: candidate.length < 100 ? [] : ['linux_proxy_socket_path_long'],
+        blockers: []
+    };
+}
+function oauthMcpPrerefreshCheck(capability) {
+    return {
+        ok: true,
+        supported: capability.supports_oauth_mcp_prerefresh === true,
+        warnings: capability.supports_oauth_mcp_prerefresh ? [] : ['oauth_mcp_prerefresh_requires_codex_0_138'],
+        blockers: []
+    };
+}
+async function agentsLogicalPathCheck(root) {
+    const agents = path.join(root, 'AGENTS.md');
+    const realRoot = await fs.realpath(root).catch(() => root);
+    const exists = await fs.stat(agents).then((st) => st.isFile()).catch(() => false);
+    return {
+        ok: exists,
+        logical_path: agents,
+        real_root: realRoot,
+        warnings: exists ? [] : ['agents_md_missing_or_unreadable'],
+        blockers: []
+    };
+}
+async function pluginDiscoveryCacheCheck(root, fix, fixed) {
+    const cacheDir = path.join(root, '.sneakoscope', 'cache', 'codex-plugin-discovery');
+    const exists = await fs.stat(cacheDir).then((st) => st.isDirectory()).catch(() => false);
+    if (!exists && fix) {
+        await fs.mkdir(cacheDir, { recursive: true });
+        await writeJsonAtomic(path.join(cacheDir, 'README.json'), {
+            schema: 'sks.codex-plugin-discovery-cache.v1',
+            repaired_at: nowIso(),
+            purpose: 'Codex 0.138 plugin discovery cache placeholder; safe to refresh from codex plugin list --json.'
+        });
+        fixed.push('plugin_discovery_cache');
+    }
+    const after = exists || fix;
+    return {
+        ok: after,
+        path: cacheDir,
+        warnings: after ? [] : ['plugin_discovery_cache_missing_repair_available'],
+        blockers: []
+    };
+}
+//# sourceMappingURL=codex-0138-doctor.js.map

package/dist/core/doctor/doctor-readiness-matrix.js

@@ -52,6 +52,14 @@ export function buildDoctorReadinessMatrix(input = {}) {
         blockers.add('codex_app_fast_ui_repair_requires_confirmation');
     if (input.codex_app_ui?.fast_selector === 'repaired')
         warnings.add('codex_app_fast_selector_repaired_restart_app_if_needed');
+    const codex0138Doctor = input.codex_0138_doctor || null;
+    if (codex0138Doctor?.ok === false)
+        for (const blocker of normalizeList(codex0138Doctor.blockers))
+            warnings.add(blocker);
+    for (const warning of normalizeList(codex0138Doctor?.warnings))
+        warnings.add(warning);
+    for (const warning of normalizeList(input.codex_plugin_app_template_policy?.doctor_warnings))
+        warnings.add(warning);
     if (input.codex_lb?.ok === false)
         warnings.add(`codex_lb_${input.codex_lb?.circuit?.state || 'blocked'}`);
     const localModel = input.local_model || {};
@@ -107,6 +115,9 @@ export function buildDoctorReadinessMatrix(input = {}) {
             replacement: 'zellij'
         },
         codex_doctor: codexDoctor || null,
+        codex_0138_doctor: codex0138Doctor,
+        codex_plugin_inventory: input.codex_plugin_inventory || null,
+        codex_plugin_app_template_policy: input.codex_plugin_app_template_policy || null,
         fast_mode_ready: input.fast_mode_ready !== false,
         codex_app_ui: input.codex_app_ui || null,
         hooks_ready: input.hooks_ready !== false,

package/dist/core/effort-orchestrator.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { nowIso, writeJsonAtomic } from './fsx.js';
 import { ARTIFACT_FILES } from './artifact-schemas.js';
+import { codexModelEffortCapability, modelEffortAtLeast } from './codex-control/codex-model-capabilities.js';
 export const EFFORT_POLICY_VERSION = 1;
 export function selectEffort(task = {}) {
     const route = String(task.route || task.command || '').toLowerCase();
@@ -39,11 +40,19 @@ export function selectEffort(task = {}) {
         selected = 'medium';
         reasonCodes.push('default_medium');
     }
+    const modelCapability = codexModelEffortCapability({
+        model: task.model || task.model_id,
+        advertisedEfforts: task.advertised_efforts || task.model_advertised_efforts,
+        defaultEffort: task.model_reasoning_effort || task.default_effort
+    });
+    const modelReasoningEffort = modelEffortAtLeast(selected, modelCapability);
     return {
         schema_version: EFFORT_POLICY_VERSION,
         mission_id: task.mission_id || 'unassigned',
         task_id: task.task_id || 'TASK-001',
         selected_effort: selected,
+        model_reasoning_effort: modelReasoningEffort,
+        model_effort_capability: modelCapability,
         reason_codes: reasonCodes,
         risk_scores: risks,
         demotion_allowed_after: demotionPolicy(selected),

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '2.0.17';
+export const PACKAGE_VERSION = '3.0.0';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/hooks-runtime.js

@@ -3,7 +3,7 @@ import { projectRoot, readJson, readText, writeJsonAtomic, appendJsonl, readStdi
 import { looksInteractiveCommand, interactiveCommandReason } from './no-question-guard.js';
 import { missionDir, setCurrent, stateFile } from './mission.js';
 import { checkDbOperation, dbBlockReason, handleMadSksUserConfirmation } from './db-safety.js';
-import { readLatestPendingMadDbLifecycleHook, recordMadDbToolResult } from './mad-db/mad-db-result-lifecycle.js';
+import { maybeRecordMadDbToolResultFromToolUse } from './mad-db/mad-db-result-lifecycle.js';
 import { checkHarnessModification, harnessGuardBlockReason, isHarnessSourceProject } from './harness-guard.js';
 import { isMadSksRouteState } from './permission-gates.js';
 import { classifyMadSksShellCommand } from './mad-sks/write-guard.js';
@@ -163,6 +163,8 @@ function toolFailed(payload = {}) {
         if (Number.isFinite(n))
             return n !== 0;
     }
+    if (payload.isError === true || payload.tool_response?.isError === true || payload.toolResponse?.isError === true || payload.result?.isError === true)
+        return true;
     if (payload.success === false || payload.tool_response?.success === false || payload.toolResponse?.success === false || payload.result?.success === false)
         return true;
     if (payload.executed === false)
@@ -450,16 +452,11 @@ async function hookPostTool(root, state, payload, noQuestion) {
 async function recordMadDbPostToolLifecycle(root, state = {}, payload = {}) {
     if (!state?.mission_id)
         return null;
-    const hook = await readLatestPendingMadDbLifecycleHook(root, String(state.mission_id), payload);
-    if (!hook)
-        return null;
-    return recordMadDbToolResult({
+    return maybeRecordMadDbToolResultFromToolUse({
         root,
         missionId: String(state.mission_id),
-        hook,
-        ok: !toolFailed(payload),
-        rowCount: extractRowCount(payload),
-        error: toolFailed(payload) ? extractToolError(payload) : null
+        toolCallPayload: payload,
+        toolResult: payload
     });
 }
 function extractRowCount(payload = {}) {

package/dist/core/image/image-artifact-path-contract.js

@@ -0,0 +1,101 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { imageDimensions } from '../wiki-image/image-hash.js';
+export async function buildImageArtifactPathContract(root, input) {
+    const images = [];
+    const blockers = [];
+    for (const [index, image] of input.images.entries()) {
+        const filePath = path.resolve(root, image.filePath || '');
+        const exists = await fileExists(filePath);
+        if (!exists)
+            blockers.push(`${image.kind}_file_path_missing:${image.id || index + 1}`);
+        const dims = exists ? await imageDimensions(filePath).catch(() => null) : null;
+        images.push({
+            id: image.id || `image-${index + 1}`,
+            kind: image.kind,
+            file_path: filePath,
+            relative_path: path.relative(root, filePath),
+            route: image.route || null,
+            stage: image.stage || null,
+            exists,
+            mime_type: mimeForPath(filePath),
+            width: dims?.width ?? null,
+            height: dims?.height ?? null,
+            model_visible_path: filePath,
+            followup_edit_hint: exists
+                ? `Use this saved local path for follow-up image edits: ${filePath}`
+                : 'Image file path missing; do not run visual QA until a real saved file path exists.'
+        });
+    }
+    if (images.some((image) => image.kind === 'generated_image' && !image.exists))
+        blockers.push('image_generated_file_path_missing');
+    return {
+        schema: 'sks.image-artifact-path-contract.v1',
+        mission_id: input.missionId,
+        generated_at: nowIso(),
+        images,
+        blockers: [...new Set(blockers)]
+    };
+}
+export async function writeImageArtifactPathContract(root, input) {
+    const contract = await buildImageArtifactPathContract(root, input);
+    const artifactPath = input.artifactPath || path.join(root, '.sneakoscope', 'missions', input.missionId, 'image-artifact-path-contract.json');
+    await writeJsonAtomic(artifactPath, contract);
+    return { contract, artifact_path: artifactPath };
+}
+export async function discoverImageArtifactsInDir(dir) {
+    const out = [];
+    await walk(dir, async (file) => {
+        if (!/\.(png|jpe?g|webp|gif)$/i.test(file))
+            return;
+        out.push({
+            id: path.basename(file).replace(/[^0-9A-Za-z._-]/g, '_'),
+            kind: /generated|gpt-image|callout/i.test(file) ? 'generated_image' : 'visual_qa_snapshot',
+            filePath: file
+        });
+    });
+    return out;
+}
+function mimeForPath(file) {
+    const ext = path.extname(file).toLowerCase();
+    if (ext === '.png')
+        return 'image/png';
+    if (ext === '.jpg' || ext === '.jpeg')
+        return 'image/jpeg';
+    if (ext === '.webp')
+        return 'image/webp';
+    if (ext === '.gif')
+        return 'image/gif';
+    return null;
+}
+async function fileExists(file) {
+    try {
+        const st = await fs.stat(file);
+        return st.isFile();
+    }
+    catch {
+        return false;
+    }
+}
+async function walk(dir, visit) {
+    let entries;
+    try {
+        entries = await fs.readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (['node_modules', '.git', 'dist'].includes(entry.name))
+                continue;
+            await walk(full, visit);
+        }
+        else {
+            await visit(full);
+        }
+    }
+}
+//# sourceMappingURL=image-artifact-path-contract.js.map

package/dist/core/image/image-artifact-registry.js

@@ -0,0 +1,33 @@
+import path from 'node:path';
+import { readJson, writeJsonAtomic } from '../fsx.js';
+import { buildImageArtifactPathContract } from './image-artifact-path-contract.js';
+export async function registerImageArtifact(root, input) {
+    const artifactPath = imageArtifactRegistryPath(root, input.missionId);
+    const existing = await readJson(artifactPath, null);
+    const id = input.id || path.basename(input.filePath).replace(/[^0-9A-Za-z._-]/g, '_');
+    const rows = [
+        ...(existing?.images || [])
+            .filter((image) => image.id !== id)
+            .map((image) => ({
+            id: image.id,
+            kind: image.kind,
+            filePath: image.file_path,
+            route: image.route || null,
+            stage: image.stage || null
+        })),
+        {
+            id,
+            kind: input.kind,
+            filePath: input.filePath,
+            route: input.route,
+            stage: input.stage
+        }
+    ];
+    const contract = await buildImageArtifactPathContract(root, { missionId: input.missionId, images: rows });
+    await writeJsonAtomic(artifactPath, contract);
+    return contract;
+}
+export function imageArtifactRegistryPath(root, missionId) {
+    return path.join(root, '.sneakoscope', 'missions', missionId, 'image-artifact-path-contract.json');
+}
+//# sourceMappingURL=image-artifact-registry.js.map

package/dist/core/image-ux-review/imagegen-adapter.js

@@ -1,12 +1,14 @@
 import path from 'node:path';
 import fsp from 'node:fs/promises';
 import { parseShellEnvValue } from '../codex-lb/codex-lb-env.js';
-import { ensureDir, exists, nowIso, readJson, readText, writeJsonAtomic } from '../fsx.js';
+import { ensureDir, exists, nowIso, projectRoot, readJson, readText, writeJsonAtomic } from '../fsx.js';
 import { sha256File, imageDimensions } from '../wiki-image/image-hash.js';
 import { detectImagegenCapability } from '../imagegen/imagegen-capability.js';
 import { validateGptImage2Request } from '../imagegen/gpt-image-2-request-validator.js';
 import { withResponsesRetry } from '../responses-retry-policy.js';
 import { discoverCodexAppGeneratedImage } from './codex-app-generated-image-discovery.js';
+import { writeImageArtifactPathContract } from '../image/image-artifact-path-contract.js';
+import { registerImageArtifact } from '../image/image-artifact-registry.js';
 const DEFAULT_OPENAI_IMAGE_EDITS_ENDPOINT = 'https://api.openai.com/v1/images/edits';
 export function buildCalloutPrompt(sourceScreenId, context = {}) {
     return [
@@ -124,6 +126,7 @@ export function createCodexAppImagegenAdapter(opts = {}) {
                     real_generated: true
                 });
                 const outputSource = manualOutput ? 'manual_attach' : 'auto_discovered_generated_images';
+                const imageContract = await writeGeneratedImagePathContract(input, dest, 'codex_app_imagegen').catch(() => null);
                 await writeJsonAtomic(responseArtifact, {
                     schema: 'sks.image-ux-gpt-image-2-response.v1',
                     created_at: nowIso(),
@@ -135,6 +138,7 @@ export function createCodexAppImagegenAdapter(opts = {}) {
                     output_image_sha256: meta.sha256,
                     output_id: meta.output_id,
                     output_source: outputSource,
+                    image_artifact_path_contract: imageContract?.artifact_path || null,
                     discovered_from: discovery?.selected?.path || null,
                     discovery: discovery ? { candidates_considered: discovery.candidates_considered, since_ms: discovery.since_ms, max_age_ms: discovery.max_age_ms } : null,
                     local_only: true
@@ -149,6 +153,7 @@ export function createCodexAppImagegenAdapter(opts = {}) {
                     output_source: outputSource,
                     request_artifact: requestArtifact,
                     response_artifact: responseArtifact,
+                    image_artifact_path_contract: imageContract?.artifact_path || null,
                     latency_ms: null
                 };
             }
@@ -241,6 +246,7 @@ export function createFakeImagegenAdapter(opts = {}) {
                 real_generated: false,
                 mock: true
             });
+            const imageContract = await writeGeneratedImagePathContract(input, out, 'fake_imagegen_adapter').catch(() => null);
             await writeJsonAtomic(responseArtifact, {
                 schema: 'sks.image-ux-gpt-image-2-response.v1',
                 created_at: nowIso(),
@@ -251,6 +257,7 @@ export function createFakeImagegenAdapter(opts = {}) {
                 output_image_path: out,
                 output_image_sha256: meta.sha256,
                 output_id: meta.output_id,
+                image_artifact_path_contract: imageContract?.artifact_path || null,
                 dimensions: { width: meta.width, height: meta.height, format: meta.format },
                 latency_ms: Date.now() - started,
                 fake_adapter: true,
@@ -259,7 +266,7 @@ export function createFakeImagegenAdapter(opts = {}) {
                 mock: true,
                 local_only: true
             });
-            return { ok: true, status: 'generated', generated_image_path: out, output_id: meta.output_id, blocker: null, provider: 'fake_imagegen_adapter', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
+            return { ok: true, status: 'generated', generated_image_path: out, output_id: meta.output_id, blocker: null, provider: 'fake_imagegen_adapter', request_artifact: requestArtifact, response_artifact: responseArtifact, image_artifact_path_contract: imageContract?.artifact_path || null, latency_ms: Date.now() - started };
         }
     };
 }
@@ -385,6 +392,7 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                         output_id: generated.id || payload?.id || null,
                         real_generated: true
                     });
+                    const imageContract = await writeGeneratedImagePathContract(input, out, 'openai_responses_image_generation').catch(() => null);
                     await writeJsonAtomic(responseArtifact, {
                         schema: 'sks.image-ux-gpt-image-2-response.v1',
                         created_at: nowIso(),
@@ -397,12 +405,13 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                         output_image_path: out,
                         output_image_sha256: meta.sha256,
                         output_id: meta.output_id,
+                        image_artifact_path_contract: imageContract?.artifact_path || null,
                         dimensions: { width: meta.width, height: meta.height, format: meta.format },
                         latency_ms: Date.now() - started,
                         token_cost_metadata: payload?.usage || null,
                         local_only: true
                     });
-                    return { ok: true, status: 'generated', generated_image_path: out, output_id: meta.output_id, blocker: null, provider: 'openai_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
+                    return { ok: true, status: 'generated', generated_image_path: out, output_id: meta.output_id, blocker: null, provider: 'openai_responses_image_generation', request_artifact: requestArtifact, response_artifact: responseArtifact, image_artifact_path_contract: imageContract?.artifact_path || null, latency_ms: Date.now() - started };
                 }
                 const sourceBytes = await fsp.readFile(sourcePath);
                 const qualityParam = imagegenQualityParam(opts);
@@ -440,6 +449,7 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                     output_id: image?.id || payload?.id || null,
                     real_generated: true
                 });
+                const imageContract = await writeGeneratedImagePathContract(input, out, 'openai_images_api').catch(() => null);
                 await writeJsonAtomic(responseArtifact, {
                     schema: 'sks.image-ux-gpt-image-2-response.v1',
                     created_at: nowIso(),
@@ -451,12 +461,13 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
                     output_image_path: out,
                     output_image_sha256: meta.sha256,
                     output_id: meta.output_id,
+                    image_artifact_path_contract: imageContract?.artifact_path || null,
                     dimensions: { width: meta.width, height: meta.height, format: meta.format },
                     latency_ms: Date.now() - started,
                     token_cost_metadata: payload?.usage || null,
                     local_only: true
                 });
-                return { ok: true, status: 'generated', generated_image_path: out, output_id: meta.output_id, blocker: null, provider: 'openai_images_api', request_artifact: requestArtifact, response_artifact: responseArtifact, latency_ms: Date.now() - started };
+                return { ok: true, status: 'generated', generated_image_path: out, output_id: meta.output_id, blocker: null, provider: 'openai_images_api', request_artifact: requestArtifact, response_artifact: responseArtifact, image_artifact_path_contract: imageContract?.artifact_path || null, latency_ms: Date.now() - started };
             }
             catch (err) {
                 const provider = useResponsesImageTool ? 'openai_responses_image_generation' : 'openai_images_api';
@@ -468,6 +479,37 @@ export function createOpenAIImagesApiAdapter(opts = {}) {
         }
     };
 }
+async function writeGeneratedImagePathContract(input, outputPath, provider) {
+    const root = await resolveImageArtifactRoot(input);
+    if (input.mission_id) {
+        await registerImageArtifact(root, {
+            missionId: input.mission_id,
+            id: `${provider}-${input.source_screen_id || 'screen'}`,
+            kind: 'generated_image',
+            filePath: outputPath,
+            route: '$Image-UX-Review',
+            stage: provider
+        });
+    }
+    return writeImageArtifactPathContract(root, {
+        missionId: input.mission_id || 'unassigned',
+        images: [{
+                id: `${provider}-${input.source_screen_id || 'screen'}`,
+                kind: 'generated_image',
+                filePath: outputPath,
+                route: '$Image-UX-Review',
+                stage: provider
+            }],
+        artifactPath: path.join(input.output_dir, 'image-artifact-path-contract.json')
+    });
+}
+async function resolveImageArtifactRoot(input) {
+    const cwdRoot = await projectRoot(process.cwd()).catch(() => process.cwd());
+    const resolvedCwd = path.resolve(process.cwd());
+    if (path.resolve(cwdRoot) !== resolvedCwd)
+        return cwdRoot;
+    return projectRoot(input.output_dir || process.cwd()).catch(() => cwdRoot);
+}
 export async function generateGptImage2CalloutReview(input, opts = {}) {
     if (opts.fake === true || process.env.SKS_TEST_FAKE_IMAGEGEN === '1') {
         return createFakeImagegenAdapter(opts.fakeAdapter || {}).generateCalloutReview(input);
@@ -479,21 +521,11 @@ export async function generateGptImage2CalloutReview(input, opts = {}) {
     // allowApiFallback:false or SKS_IMAGEGEN_ALLOW_API_FALLBACK=0.
     const openAiKeyPresent = Boolean(opts.openai?.apiKey || process.env.OPENAI_API_KEY);
     const explicitDisableApiFallback = opts.allowApiFallback === false || process.env.SKS_IMAGEGEN_ALLOW_API_FALLBACK === '0';
-    // codex-lb imagegen routes gpt-image-2 through the same Codex /responses
-    // backend the LB already proxies (base_url ends in /backend-api/codex, so the
-    // image_generation tool call is just another Responses request). When codex-lb
-    // is the active, fully-configured auth (selected provider + key + base_url) and
-    // there is no direct OPENAI_API_KEY, enable it BY DEFAULT so image generation
-    // works for users authenticated only through codex-lb — that is the common case
-    // and a hard block here is the bug the user hit. It still never overrides a real
-    // OpenAI key, and SKS_IMAGEGEN_ALLOW_CODEX_LB_API_FALLBACK=0 (or
-    // allowCodexLbApiFallback:false) opts out for callers that require Codex App
-    // built-in evidence only.
-    const codexLbAuthActive = capability?.codex_lb?.available === true;
+    // codex-lb imagegen is a direct API fallback, not Codex App imagegen evidence.
+    // It must be explicitly enabled by the caller or environment.
     const explicitDisableCodexLbFallback = opts.allowCodexLbApiFallback === false || process.env.SKS_IMAGEGEN_ALLOW_CODEX_LB_API_FALLBACK === '0';
     const allowCodexLbApiFallback = !explicitDisableCodexLbFallback && (opts.allowCodexLbApiFallback === true
-        || process.env.SKS_IMAGEGEN_ALLOW_CODEX_LB_API_FALLBACK === '1'
-        || (codexLbAuthActive && !openAiKeyPresent));
+        || process.env.SKS_IMAGEGEN_ALLOW_CODEX_LB_API_FALLBACK === '1');
     const allowApiFallback = !explicitDisableApiFallback && (opts.allowApiFallback === true
         || process.env.SKS_IMAGEGEN_ALLOW_API_FALLBACK === '1'
         || openAiKeyPresent

package/dist/core/mad-db/mad-db-result-lifecycle.js

@@ -74,6 +74,24 @@ export async function recordMadDbToolResult(input) {
         event
     };
 }
+export async function maybeRecordMadDbToolResultFromToolUse(input) {
+    const payload = input.toolResult ?? input.toolCallPayload ?? {};
+    const hook = lifecycleHookFromUnknown(input.decision)
+        || lifecycleHookFromUnknown(input.toolCallPayload)
+        || lifecycleHookFromUnknown(input.toolResult)
+        || await readLatestPendingMadDbLifecycleHook(input.root, input.missionId, input.toolCallPayload || payload);
+    if (!hook)
+        return null;
+    const ok = !madDbToolUseFailed(payload);
+    return recordMadDbToolResult({
+        root: input.root,
+        missionId: input.missionId,
+        hook,
+        ok,
+        rowCount: extractRowCount(payload),
+        error: ok ? null : extractToolError(payload)
+    });
+}
 export function lifecycleHookFromUnknown(value) {
     const candidate = value?.ledger_result_hook || value?.mad_db?.ledger_result_hook || value;
     const missionId = stringOrNull(candidate?.mission_id || candidate?.missionId);
@@ -107,6 +125,59 @@ function hookMatchesPayload(hook, payload) {
         return true;
     return toolText.includes(String(hook.tool_name).toLowerCase()) || String(hook.tool_name).toLowerCase().includes(toolText);
 }
+function madDbToolUseFailed(payload = {}) {
+    if (payload?.isError === true || payload?.tool_response?.isError === true || payload?.toolResponse?.isError === true || payload?.result?.isError === true)
+        return true;
+    const candidates = [
+        payload.exit_code,
+        payload.exitCode,
+        payload.tool_response?.exit_code,
+        payload.toolResponse?.exitCode,
+        payload.result?.exit_code,
+        payload.result?.exitCode
+    ];
+    for (const candidate of candidates) {
+        if (candidate === undefined || candidate === null || candidate === '')
+            continue;
+        const n = Number(candidate);
+        if (Number.isFinite(n))
+            return n !== 0;
+    }
+    if (payload.success === false || payload.tool_response?.success === false || payload.toolResponse?.success === false || payload.result?.success === false)
+        return true;
+    if (payload.executed === false)
+        return true;
+    return false;
+}
+function extractRowCount(payload = {}) {
+    const candidates = [
+        payload.row_count,
+        payload.rowCount,
+        payload.tool_response?.row_count,
+        payload.tool_response?.rowCount,
+        payload.toolResponse?.rowCount,
+        payload.result?.row_count,
+        payload.result?.rowCount,
+        payload.result?.rows_affected,
+        payload.tool_response?.rows_affected
+    ];
+    for (const candidate of candidates) {
+        if (candidate === undefined || candidate === null || candidate === '')
+            continue;
+        const parsed = Number(candidate);
+        if (Number.isFinite(parsed))
+            return parsed;
+    }
+    return null;
+}
+function extractToolError(payload = {}) {
+    if (payload?.result?.isError === true && Array.isArray(payload.result.content)) {
+        const text = payload.result.content.map((entry) => entry?.text || entry?.message || '').filter(Boolean).join('\n');
+        if (text.trim())
+            return text.trim();
+    }
+    return String(payload.error || payload.message || payload.stderr || payload.tool_response?.stderr || payload.toolResponse?.stderr || payload.result?.stderr || payload.result?.error || 'tool_failed');
+}
 async function hasTerminalLifecycleEvent(root, missionId, operationId) {
     const ledger = path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl');
     const text = await readText(ledger, '').catch(() => '');

package/dist/core/mcp/mcp-plugin-inventory.js

@@ -0,0 +1,29 @@
+import path from 'node:path';
+import { buildCodexPluginInventory } from '../codex-plugins/codex-plugin-json.js';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { policyForPluginMcpServer } from './mcp-server-policy.js';
+export function buildMcpPluginServerCandidates(inventory) {
+    const candidates = inventory.plugins.flatMap((plugin) => plugin.remote_mcp_servers.map((server) => policyForPluginMcpServer({
+        pluginId: plugin.id,
+        name: server.name,
+        url: server.url,
+        authType: server.auth_type
+    })));
+    return {
+        schema: 'sks.mcp-plugin-server-candidates.v1',
+        generated_at: nowIso(),
+        candidates,
+        candidate_only: true,
+        blockers: []
+    };
+}
+export async function writeMcpPluginInventoryArtifacts(root, input = {}) {
+    const inventory = input.inventory || await buildCodexPluginInventory();
+    const candidates = buildMcpPluginServerCandidates(inventory);
+    const pluginArtifact = path.join(root, '.sneakoscope', 'codex-plugin-inventory.json');
+    const candidateArtifact = path.join(root, '.sneakoscope', 'mcp-plugin-server-candidates.json');
+    await writeJsonAtomic(pluginArtifact, inventory);
+    await writeJsonAtomic(candidateArtifact, candidates);
+    return { inventory, candidates, plugin_artifact: pluginArtifact, candidate_artifact: candidateArtifact };
+}
+//# sourceMappingURL=mcp-plugin-inventory.js.map

package/dist/core/mcp/mcp-server-policy.js

@@ -0,0 +1,24 @@
+export function policyForPluginMcpServer(input) {
+    const haystack = `${input.name} ${input.url || ''}`.toLowerCase();
+    const dbRelated = /supabase|postgres|database|sql|db\b/.test(haystack);
+    const oauth = /oauth/i.test(String(input.authType || ''));
+    return {
+        name: input.name,
+        plugin_id: input.pluginId,
+        url: input.url || null,
+        auth_type: input.authType || null,
+        candidate_only: true,
+        auto_enable: false,
+        destructive_tools_auto_enabled: false,
+        db_safety_required: dbRelated,
+        mad_db_required_for_destructive: dbRelated,
+        oauth_prerefresh_recommended: oauth,
+        policy_notes: [
+            'Remote MCP servers from plugin detail are candidate only.',
+            'Do not auto-enable destructive MCP tools.',
+            dbRelated ? 'DB MCP servers require DB safety and Mad-DB for destructive operations.' : 'Non-DB MCP candidate still requires explicit operator enablement.',
+            oauth ? 'OAuth-backed MCP should trigger pre-refresh doctor check.' : ''
+        ].filter(Boolean)
+    };
+}
+//# sourceMappingURL=mcp-server-policy.js.map