sneakoscope 3.0.2 → 3.0.4

package/dist/core/codex-control/codex-0139-plugin-real-probes.js

@@ -0,0 +1,119 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeJsonAtomic } from '../fsx.js';
+import { marketplaceSourcesPresent } from './codex-0139-capability.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139MarketplaceSourceRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `marketplace-${Date.now()}`);
+    await ensureDir(tempDir);
+    const result = await runProcess(codexBin, ['plugin', 'marketplace', 'list', '--json'], {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const rows = parseRows(result.stdout);
+    const missingSourceRows = rows
+        .map((row, index) => ({ index, name: String(row?.name || row?.id || row?.pluginId || `row-${index + 1}`), keys: Object.keys(row || {}), root: typeof row?.root === 'string' ? row.root : null }))
+        .filter((row, index) => !rowHasMarketplaceSourceLocator(rows[index]));
+    const ok = result.code === 0 && marketplaceSourcesPresent(result.stdout);
+    const artifact = path.join(input.root, '.sneakoscope', 'codex-0139-plugin-marketplace-real.json');
+    await writeJsonAtomic(artifact, {
+        schema: 'sks.codex-0139-plugin-marketplace-real.v1',
+        ok,
+        generated_at: new Date().toISOString(),
+        command_line: [codexBin, 'plugin', 'marketplace', 'list', '--json'],
+        empty_marketplace_list: rows.length === 0,
+        row_count: rows.length,
+        rows_have_source: rows.every(rowHasMarketplaceSource),
+        rows_have_source_locator: rows.every(rowHasMarketplaceSourceLocator),
+        missing_source_rows: missingSourceRows,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr)
+    });
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, 'plugin', 'marketplace', 'list', '--json'],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [artifact],
+        evidence: {
+            empty_marketplace_list: rows.length === 0,
+            row_count: rows.length,
+            rows_have_source: rows.every(rowHasMarketplaceSource),
+            rows_have_source_locator: rows.every(rowHasMarketplaceSourceLocator),
+            missing_source_rows: missingSourceRows
+        },
+        blockers: ok ? [] : ['codex_plugin_marketplace_source_real_probe_failed']
+    };
+}
+function rowHasMarketplaceSource(row) {
+    return typeof row?.source === 'string' && row.source.length > 0
+        || typeof row?.marketplaceSource?.source === 'string' && row.marketplaceSource.source.length > 0;
+}
+function rowHasMarketplaceSourceLocator(row) {
+    return rowHasMarketplaceSource(row) || typeof row?.root === 'string' && row.root.length > 0;
+}
+export async function runCodex0139PluginCacheRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `plugin-cache-${Date.now()}`);
+    await ensureDir(tempDir);
+    const firstStarted = Date.now();
+    const first = await runProcess(codexBin, ['plugin', 'list', '--json'], {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const firstMs = Date.now() - firstStarted;
+    const secondStarted = Date.now();
+    const second = await runProcess(codexBin, ['plugin', 'list', '--json'], {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const secondMs = Date.now() - secondStarted;
+    const marker = /cache|cached|catalog|remote/i.test(`${first.stdout}\n${second.stdout}\n${first.stderr}\n${second.stderr}`);
+    const secondNotMuchSlower = secondMs <= Math.max(firstMs * 2, firstMs + 1000);
+    const ok = first.code === 0 && second.code === 0 && secondNotMuchSlower;
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, 'plugin', 'list', '--json'],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(`${first.stdout || ''}\n${second.stdout || ''}`),
+        stderr_tail: codex0139ProbeTail(`${first.stderr || ''}\n${second.stderr || ''}`),
+        artifact_paths: [tempDir],
+        evidence: {
+            first_duration_ms: firstMs,
+            second_duration_ms: secondMs,
+            second_not_slower_than_2x: secondNotMuchSlower,
+            cache_marker_seen: marker,
+            cache_marker_warning: marker ? null : 'cache marker unavailable; timing success accepted'
+        },
+        blockers: ok ? [] : ['codex_plugin_catalog_cache_real_probe_failed']
+    };
+}
+function parseRows(stdout) {
+    try {
+        const parsed = JSON.parse(String(stdout || ''));
+        if (Array.isArray(parsed))
+            return parsed;
+        if (Array.isArray(parsed?.marketplaces))
+            return parsed.marketplaces;
+        if (Array.isArray(parsed?.items))
+            return parsed.items;
+        return [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=codex-0139-plugin-real-probes.js.map

package/dist/core/codex-control/codex-0139-probe-runner.js

@@ -0,0 +1,117 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+import { runProcess } from '../fsx.js';
+import { runCodex0139DoctorEnvRealProbe } from './codex-0139-doctor-real-probe.js';
+import { runCodex0139ImageReferencedPathRealProbe } from './codex-0139-image-path-real-probe.js';
+import { runCodex0139InterruptAgentRealProbe } from './codex-0139-multi-agent-real-probe.js';
+import { runCodex0139MarketplaceSourceRealProbe, runCodex0139PluginCacheRealProbe } from './codex-0139-plugin-real-probes.js';
+import { buildCodex0139RealProbeResult, CODEX_0139_REAL_PROBE_NAMES, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+import { runCodex0139RichSchemaRealProbe } from './codex-0139-rich-schema-real-probe.js';
+import { runCodex0139SandboxProfileAliasProbe, runCodex0139SandboxProxyPreservationProbe } from './codex-0139-sandbox-real-probe.js';
+import { runCodex0139WebSearchRealProbe } from './codex-0139-web-search-probe.js';
+export async function runCodex0139RealProbes(input) {
+    const timeoutMs = Math.max(1, Number(input.timeoutMs || 120000) || 120000);
+    const requireReal = input.requireReal === true;
+    const codexBin = input.codexBin || await findCodex0139RealProbeBinary();
+    const versionText = await readCodexVersionText(codexBin, timeoutMs);
+    const parsedVersion = parseCodexVersionText(versionText);
+    const atLeast139 = Boolean(parsedVersion && compareSemverLike(parsedVersion, '0.139.0') >= 0);
+    const requested = new Set((input.probes?.length ? input.probes : CODEX_0139_REAL_PROBE_NAMES).filter((name) => CODEX_0139_REAL_PROBE_NAMES.includes(name)));
+    const probes = Object.fromEntries(CODEX_0139_REAL_PROBE_NAMES.map((name) => [name, skippedCodex0139Probe('probe_not_requested')]));
+    const extraBlockers = [];
+    if (!codexBin)
+        extraBlockers.push('codex_cli_missing');
+    if (!atLeast139)
+        extraBlockers.push('codex_0_139_required');
+    if (!codexBin || !atLeast139) {
+        for (const name of requested) {
+            probes[name] = skippedCodex0139Probe(!codexBin ? 'codex_cli_missing' : 'codex_0_139_required', { parsed_version: parsedVersion });
+        }
+        return buildCodex0139RealProbeResult({ codexBin, versionText, parsedVersion, requireReal, timeoutMs, probes, extraBlockers });
+    }
+    for (const name of requested) {
+        probes[name] = await runOne(name, {
+            root: input.root,
+            requireReal,
+            timeoutMs,
+            codexBin,
+            allowNetwork: input.allowNetwork,
+            allowDesktop: input.allowDesktop
+        });
+    }
+    return buildCodex0139RealProbeResult({ codexBin, versionText, parsedVersion, requireReal, timeoutMs, probes, extraBlockers });
+}
+async function runOne(name, input) {
+    switch (name) {
+        case 'code_mode_web_search':
+            return runCodex0139WebSearchRealProbe(input);
+        case 'rich_tool_schema':
+            return runCodex0139RichSchemaRealProbe(input);
+        case 'doctor_env_redaction':
+            return runCodex0139DoctorEnvRealProbe(input);
+        case 'marketplace_source_json':
+            return runCodex0139MarketplaceSourceRealProbe(input);
+        case 'plugin_catalog_cache':
+            return runCodex0139PluginCacheRealProbe(input);
+        case 'sandbox_profile_alias':
+            return runCodex0139SandboxProfileAliasProbe(input);
+        case 'interrupt_agent_event':
+            return runCodex0139InterruptAgentRealProbe(input);
+        case 'image_referenced_path':
+            return runCodex0139ImageReferencedPathRealProbe(input);
+        case 'sandbox_proxy_preservation':
+            return runCodex0139SandboxProxyPreservationProbe(input);
+    }
+}
+async function readCodexVersionText(codexBin, timeoutMs) {
+    if (!codexBin)
+        return null;
+    const result = await runProcess(codexBin, ['--version'], { timeoutMs: Math.min(timeoutMs, 30000), maxOutputBytes: 16 * 1024 }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err?.message || String(err)
+    }));
+    const text = `${result.stdout || ''}${result.stderr || ''}`.trim();
+    return text || null;
+}
+export async function findCodex0139RealProbeBinary() {
+    const candidates = await codexBinaryCandidates();
+    let firstExisting = null;
+    for (const candidate of candidates) {
+        if (!firstExisting)
+            firstExisting = candidate;
+        const versionText = await readCodexVersionText(candidate, 30000);
+        const parsed = parseCodexVersionText(versionText);
+        if (parsed && compareSemverLike(parsed, '0.139.0') >= 0)
+            return candidate;
+    }
+    return firstExisting || await findCodexBinary();
+}
+async function codexBinaryCandidates() {
+    const raw = [
+        process.env.SKS_CODEX_BIN,
+        process.env.DCODEX_CODEX_BIN,
+        process.env.CODEX_BIN,
+        ...pathCandidates('codex'),
+        path.join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'codex.cmd' : 'codex')
+    ].filter(Boolean).map(String);
+    const out = [];
+    for (const candidate of raw) {
+        if (out.includes(candidate))
+            continue;
+        try {
+            const st = await fs.stat(candidate);
+            if (st.isFile())
+                out.push(candidate);
+        }
+        catch { }
+    }
+    return out;
+}
+function pathCandidates(command) {
+    const exts = process.platform === 'win32' ? ['.cmd', '.exe', '.bat', ''] : [''];
+    return (process.env.PATH || '').split(path.delimiter).flatMap((dir) => exts.map((ext) => path.join(dir, `${command}${ext}`)));
+}
+//# sourceMappingURL=codex-0139-probe-runner.js.map

package/dist/core/codex-control/codex-0139-real-probe-summary.js

@@ -0,0 +1,37 @@
+import path from 'node:path';
+import { codex0139ProbeArtifactPath } from './codex-0139-real-probes.js';
+import { readJson, writeJsonAtomic } from '../fsx.js';
+export async function buildCodex0139RealProbeSummary(root) {
+    const result = await readJson(codex0139ProbeArtifactPath(root));
+    const probes = Object.fromEntries(Object.entries(result.probes || {}).map(([name, probe]) => [name, {
+            ok: probe.ok === true,
+            mode: probe.mode,
+            blockers: probe.blockers || []
+        }]));
+    const values = Object.values(result.probes || {});
+    const skippedCount = values.filter((probe) => probe.mode === 'skipped').length;
+    const failedCount = values.filter((probe) => probe.ok !== true && probe.mode !== 'skipped').length;
+    return {
+        schema: 'sks.codex-0139-real-probe-summary.v1',
+        ok: result.require_real ? skippedCount === 0 && failedCount === 0 : result.overall_ok === true,
+        require_real: result.require_real,
+        codex_bin: result.codex_bin,
+        parsed_version: result.parsed_version,
+        actual_cli_probe_count: values.filter((probe) => probe.mode === 'actual-cli').length,
+        actual_sdk_probe_count: values.filter((probe) => probe.mode === 'actual-sdk').length,
+        actual_app_server_probe_count: values.filter((probe) => probe.mode === 'actual-app-server').length,
+        actual_sks_bridge_probe_count: values.filter((probe) => probe.mode === 'actual-sks-bridge').length,
+        skipped_count: skippedCount,
+        failed_count: failedCount,
+        probes
+    };
+}
+export async function writeCodex0139RealProbeSummary(root) {
+    const summary = await buildCodex0139RealProbeSummary(root);
+    const rootArtifact = path.join(root, '.sneakoscope', 'codex-0139-real-probe-summary.json');
+    const distArtifact = path.join(root, 'dist', 'codex-0139-real-probe-summary.json');
+    await writeJsonAtomic(rootArtifact, summary);
+    await writeJsonAtomic(distArtifact, summary);
+    return { summary, root_artifact: rootArtifact, dist_artifact: distArtifact };
+}
+//# sourceMappingURL=codex-0139-real-probe-summary.js.map

package/dist/core/codex-control/codex-0139-real-probes.js

@@ -0,0 +1,74 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+export const CODEX_0139_REAL_PROBE_NAMES = [
+    'code_mode_web_search',
+    'rich_tool_schema',
+    'doctor_env_redaction',
+    'marketplace_source_json',
+    'plugin_catalog_cache',
+    'sandbox_profile_alias',
+    'interrupt_agent_event',
+    'image_referenced_path',
+    'sandbox_proxy_preservation'
+];
+export function codex0139ProbeArtifactPath(root) {
+    return path.join(root, '.sneakoscope', 'codex-0139-real-probes.json');
+}
+export function codex0139MissionProbeArtifactPath(root, missionId) {
+    return path.join(root, '.sneakoscope', 'missions', missionId, 'codex-0139-real-probes.json');
+}
+export function codex0139DistProbeArtifactPath(root) {
+    return path.join(root, 'dist', 'codex-0139-real-probes.json');
+}
+export async function writeCodex0139RealProbeResult(root, result, opts = {}) {
+    const rootArtifact = codex0139ProbeArtifactPath(root);
+    await writeJsonAtomic(rootArtifact, result);
+    let missionArtifact = null;
+    if (opts.missionId) {
+        missionArtifact = codex0139MissionProbeArtifactPath(root, opts.missionId);
+        await writeJsonAtomic(missionArtifact, result);
+    }
+    let distArtifact = null;
+    if (opts.writeDist !== false) {
+        distArtifact = codex0139DistProbeArtifactPath(root);
+        await writeJsonAtomic(distArtifact, result);
+    }
+    return { root_artifact: rootArtifact, mission_artifact: missionArtifact, dist_artifact: distArtifact };
+}
+export function skippedCodex0139Probe(blocker, evidence = {}) {
+    return {
+        ok: false,
+        mode: 'skipped',
+        duration_ms: 0,
+        artifact_paths: [],
+        evidence,
+        blockers: [blocker]
+    };
+}
+export function codex0139ProbeTail(text, limit = 4000) {
+    const raw = String(text || '');
+    return raw.length <= limit ? raw : raw.slice(raw.length - limit);
+}
+export function buildCodex0139RealProbeResult(input) {
+    const skipped = CODEX_0139_REAL_PROBE_NAMES.filter((name) => input.probes[name]?.mode === 'skipped');
+    const failed = CODEX_0139_REAL_PROBE_NAMES.filter((name) => input.probes[name] && input.probes[name].ok !== true && input.probes[name].mode !== 'skipped');
+    const blockers = [
+        ...(input.extraBlockers || []),
+        ...CODEX_0139_REAL_PROBE_NAMES.flatMap((name) => input.probes[name]?.blockers || []),
+        ...(input.requireReal && skipped.length ? skipped.map((name) => `require_real_skipped:${name}`) : [])
+    ];
+    return {
+        schema: 'sks.codex-0139-real-probe-result.v1',
+        generated_at: nowIso(),
+        codex_bin: input.codexBin,
+        version_text: input.versionText,
+        parsed_version: input.parsedVersion,
+        require_real: input.requireReal,
+        overall_ok: input.requireReal ? blockers.length === 0 && failed.length === 0 && skipped.length === 0 : failed.length === 0,
+        probe_timeout_ms: input.timeoutMs,
+        probes: input.probes,
+        skipped,
+        blockers: [...new Set(blockers)]
+    };
+}
+//# sourceMappingURL=codex-0139-real-probes.js.map

package/dist/core/codex-control/codex-0139-rich-schema-real-probe.js

@@ -0,0 +1,43 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeJsonAtomic } from '../fsx.js';
+import { buildCodex0139RichToolSchemaFixture, evaluateCodex0139RichToolSchemaPreservation } from './codex-tool-schema-fixtures.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139RichSchemaRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin && input.requireReal)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `rich-schema-${Date.now()}`);
+    await ensureDir(tempDir);
+    const capturedSchemaPath = path.join(tempDir, 'captured-tool-schema.json');
+    const schema = buildCodex0139RichToolSchemaFixture();
+    await writeJsonAtomic(capturedSchemaPath, schema);
+    const evalResult = evaluateCodex0139RichToolSchemaPreservation(schema);
+    const versionRun = codexBin
+        ? await runProcess(codexBin, ['--version'], { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 64 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }))
+        : { code: 0, stdout: '', stderr: '' };
+    const actualBridge = Boolean(codexBin && versionRun.code === 0);
+    const ok = evalResult.ok === true && (!input.requireReal || actualBridge);
+    const probe = {
+        ok,
+        mode: actualBridge ? 'actual-sks-bridge' : 'skipped',
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(versionRun.stdout),
+        stderr_tail: codex0139ProbeTail(versionRun.stderr),
+        artifact_paths: [capturedSchemaPath],
+        evidence: {
+            captured_schema_path: capturedSchemaPath,
+            oneOf_preserved: evalResult.top_level_oneOf_preserved,
+            allOf_preserved: evalResult.top_level_allOf_preserved,
+            nested_target_preserved: evalResult.nested_structure_preserved,
+            required_fields_retained: evalResult.required_fields_retained,
+            adapter_path: actualBridge ? 'sks-schema-capture-hook+codex-cli-presence' : 'sks-schema-capture-hook'
+        },
+        blockers: ok ? [] : ['codex_rich_tool_schema_real_probe_failed']
+    };
+    if (codexBin)
+        probe.command_line = [codexBin, '--version'];
+    return probe;
+}
+//# sourceMappingURL=codex-0139-rich-schema-real-probe.js.map

package/dist/core/codex-control/codex-0139-sandbox-real-probe.js

@@ -0,0 +1,79 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess } from '../fsx.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139SandboxProfileAliasProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const help = await runProcess(codexBin, ['--help'], { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 256 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const sandboxHelp = await runProcess(codexBin, ['sandbox', '--help'], { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 256 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const helpText = `${help.stdout || ''}\n${help.stderr || ''}`;
+    const sandboxHelpText = `${sandboxHelp.stdout || ''}\n${sandboxHelp.stderr || ''}`;
+    const topLevelHelpMentionsAlias = /(^|\s)-P\b/.test(helpText);
+    const sandboxHelpMentionsAlias = /(^|\s)-P,\s+--permissions-profile\b/.test(sandboxHelpText) || /(^|\s)-P\b/.test(sandboxHelpText);
+    const dryArgs = sandboxHelpMentionsAlias ? ['sandbox', '-P', ':read-only', '--', 'true'] : ['-P', ':read-only', '--version'];
+    const dry = await runProcess(codexBin, dryArgs, { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 64 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const dryAccepted = dry.code === 0;
+    const ok = topLevelHelpMentionsAlias || sandboxHelpMentionsAlias;
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...(sandboxHelpMentionsAlias ? ['sandbox', '--help'] : ['--help'])],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(`${help.stdout || ''}\n${sandboxHelp.stdout || ''}\n${dry.stdout || ''}`),
+        stderr_tail: codex0139ProbeTail(`${help.stderr || ''}\n${sandboxHelp.stderr || ''}\n${dry.stderr || ''}`),
+        artifact_paths: [],
+        evidence: {
+            help_mentions_P: topLevelHelpMentionsAlias || sandboxHelpMentionsAlias,
+            top_level_help_mentions_P: topLevelHelpMentionsAlias,
+            sandbox_help_mentions_P: sandboxHelpMentionsAlias,
+            dry_command_attempted: true,
+            dry_command_line: [codexBin, ...dryArgs],
+            dry_command_accepted: dryAccepted,
+            dry_command_warning: dryAccepted ? null : 'help proof accepted; dry no-op unsupported in this CLI shape'
+        },
+        blockers: ok ? [] : ['codex_sandbox_profile_alias_help_missing']
+    };
+}
+export async function runCodex0139SandboxProxyPreservationProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `sandbox-proxy-${Date.now()}`);
+    await ensureDir(tempDir);
+    const args = ['sandbox', '-P', ':read-only', '-C', tempDir, '--', 'true'];
+    const result = await runProcess(codexBin, args, {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 30000,
+        maxOutputBytes: 64 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const safeNoopRan = result.code === 0;
+    const proxyMarkerAvailable = Boolean(process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY);
+    const approvedEscalationPreservationScriptable = process.env.SKS_CODEX_0139_SANDBOX_PROXY_APPROVED_ESCALATION_RETRY === '1';
+    const ok = safeNoopRan && (!input.requireReal || approvedEscalationPreservationScriptable);
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...args],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [tempDir],
+        evidence: {
+            safe_noop_ran: safeNoopRan,
+            proxy_marker_available: proxyMarkerAvailable,
+            proxy_marker_checked: proxyMarkerAvailable,
+            approved_escalation_preservation_scriptable: approvedEscalationPreservationScriptable,
+            approved_escalation_retry_env: 'SKS_CODEX_0139_SANDBOX_PROXY_APPROVED_ESCALATION_RETRY=1',
+            permissions_profile: ':read-only'
+        },
+        blockers: ok ? [] : [
+            ...(safeNoopRan ? [] : ['codex_sandbox_proxy_safe_noop_failed']),
+            ...(input.requireReal && !approvedEscalationPreservationScriptable ? ['codex_sandbox_proxy_escalation_preservation_not_safely_scriptable'] : [])
+        ]
+    };
+}
+//# sourceMappingURL=codex-0139-sandbox-real-probe.js.map

package/dist/core/codex-control/codex-0139-web-search-probe.js

@@ -0,0 +1,72 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildCodexExecArgs, findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139WebSearchRealProbe(input) {
+    const started = Date.now();
+    if (!input.allowNetwork) {
+        const skipped = skippedCodex0139Probe('codex_web_search_network_not_allowed', { allow_network: false });
+        return input.requireReal ? { ...skipped, blockers: ['codex_web_search_network_not_allowed'] } : skipped;
+    }
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `web-search-${Date.now()}`);
+    await ensureDir(tempDir);
+    await writeTextAtomic(path.join(tempDir, 'README.md'), 'Temporary Codex 0.139 web-search real probe workspace.\n');
+    const outputFile = path.join(tempDir, 'last-message.txt');
+    const prompt = 'In code mode, use standalone web search to find the title of https://example.com or OpenAI Codex release 0.139. Return JSON {"used_web_search":true,"answer":"...","sources":[...]}.';
+    const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs: [] });
+    const result = await runProcess(codexBin, args, {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 120000,
+        maxOutputBytes: 512 * 1024,
+        stdoutFile: path.join(tempDir, 'codex.stdout.log'),
+        stderrFile: path.join(tempDir, 'codex.stderr.log')
+    }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err?.message || String(err)
+    }));
+    const output = await fs.readFile(outputFile, 'utf8').catch(() => '');
+    const combined = `${result.stdout || ''}\n${result.stderr || ''}\n${output}`;
+    const sawWebSearchEvent = /\b(web[_ -]?search|search_result|sources?|tool_call|standalone web search)\b/i.test(combined);
+    const sawPlaintextResult = /(Example Domain|example\.com|OpenAI|Codex|0\.139)/i.test(combined);
+    const resultContainsExpectedMarker = /"used_web_search"\s*:\s*true|used_web_search/i.test(combined) || sawWebSearchEvent;
+    const processExitedSuccessfully = result.code === 0;
+    const ok = sawPlaintextResult && resultContainsExpectedMarker;
+    if (ok) {
+        await writeJsonAtomic(path.join(input.root, '.sneakoscope', 'codex-0139-code-mode-web-search-policy.json'), {
+            schema: 'sks.codex-0139-code-mode-web-search-policy.v1',
+            ok: true,
+            generated_at: new Date().toISOString(),
+            allow_standalone_web_search_in_code_mode: true,
+            real_probe_verified: true,
+            evidence: {
+                saw_web_search_event: sawWebSearchEvent,
+                saw_plaintext_result: sawPlaintextResult,
+                result_contains_expected_marker: resultContainsExpectedMarker
+            }
+        });
+    }
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...args],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [tempDir, outputFile],
+        evidence: {
+            saw_web_search_event: sawWebSearchEvent,
+            saw_plaintext_result: sawPlaintextResult,
+            result_contains_expected_marker: resultContainsExpectedMarker,
+            process_exited_successfully: processExitedSuccessfully,
+            process_warning: processExitedSuccessfully ? null : 'Codex emitted web-search evidence before process timeout/nonzero exit.',
+            output_file: outputFile
+        },
+        blockers: ok ? [] : ['codex_web_search_real_probe_failed']
+    };
+}
+//# sourceMappingURL=codex-0139-web-search-probe.js.map

package/dist/core/codex-control/codex-multi-agent-event-normalizer.js

@@ -0,0 +1,15 @@
+export function normalizeCodexMultiAgentEventName(name) {
+    const sourceName = String(name || '');
+    const normalized = sourceName.trim().toLowerCase().replace(/[-.\s]+/g, '_');
+    if (normalized === 'start_agent' || normalized === 'spawn_agent' || normalized === 'subagent_start') {
+        return { canonical: 'start_agent', stage: 'start', source_name: sourceName };
+    }
+    if (normalized === 'interrupt_agent') {
+        return { canonical: 'interrupt_agent', stage: 'result', source_name: sourceName };
+    }
+    if (normalized === 'close_agent' || normalized === 'subagent_stop') {
+        return { canonical: 'close_agent', stage: 'result', source_name: sourceName };
+    }
+    return { canonical: 'unknown', stage: 'unknown', source_name: sourceName };
+}
+//# sourceMappingURL=codex-multi-agent-event-normalizer.js.map

package/dist/core/codex-control/codex-tool-schema-fixtures.js

@@ -0,0 +1,57 @@
+import { compactMcpToolSchema } from '../mcp/mcp-0-134-policy.js';
+export function buildCodex0139RichToolSchemaFixture() {
+    return {
+        type: 'object',
+        description: 'Codex 0.139 rich tool schema preservation fixture',
+        oneOf: [
+            { required: ['mode'], properties: { mode: { const: 'guided' } } },
+            { required: ['query'], properties: { query: { type: 'string' } } }
+        ],
+        allOf: [
+            { required: ['kind'] },
+            { properties: { kind: { enum: ['search', 'inspect'] } } }
+        ],
+        required: ['kind', 'payload'],
+        properties: {
+            kind: { enum: ['search', 'inspect'] },
+            payload: {
+                type: 'object',
+                required: ['target'],
+                properties: {
+                    target: { type: 'string' },
+                    filters: {
+                        type: 'object',
+                        properties: {
+                            depth: { enum: ['shallow', 'deep'] }
+                        }
+                    }
+                }
+            }
+        }
+    };
+}
+export function passCodex0139RichToolSchemaThroughBridge(schema = buildCodex0139RichToolSchemaFixture()) {
+    return compactMcpToolSchema(schema, 128).schema;
+}
+export function evaluateCodex0139RichToolSchemaPreservation(schema = buildCodex0139RichToolSchemaFixture()) {
+    const bridged = passCodex0139RichToolSchemaThroughBridge(schema);
+    const required = Array.isArray(bridged?.required) ? bridged.required : [];
+    const result = {
+        schema: 'sks.codex-0139-rich-tool-schema-preservation.v1',
+        ok: Array.isArray(bridged?.oneOf)
+            && Array.isArray(bridged?.allOf)
+            && Boolean(bridged?.properties?.payload?.properties?.target)
+            && required.includes('kind')
+            && required.includes('payload'),
+        top_level_oneOf_preserved: Array.isArray(bridged?.oneOf),
+        top_level_allOf_preserved: Array.isArray(bridged?.allOf),
+        nested_structure_preserved: Boolean(bridged?.properties?.payload?.properties?.target),
+        required_fields_retained: required.includes('kind') && required.includes('payload'),
+        bridged_schema: bridged
+    };
+    return {
+        ...result,
+        blockers: result.ok ? [] : ['codex_rich_tool_schema_preservation_failed']
+    };
+}
+//# sourceMappingURL=codex-tool-schema-fixtures.js.map

package/dist/core/doctor/codex-0139-doctor.js

@@ -0,0 +1,16 @@
+import path from 'node:path';
+import { readJson } from '../fsx.js';
+export async function readCodex0139DoctorRealProbeStatus(root) {
+    const summary = await readJson(path.join(root, '.sneakoscope', 'codex-0139-real-probe-summary.json'), null);
+    const result = await readJson(path.join(root, '.sneakoscope', 'codex-0139-real-probes.json'), null);
+    return {
+        schema: 'sks.doctor-codex-0139-real-probes.v1',
+        codex_cli_version: result?.version_text || null,
+        capability_version_flag: Boolean(result?.parsed_version && String(result.parsed_version).startsWith('0.139')),
+        real_probes_last_run_status: summary ? (summary.ok ? 'ok' : 'blocked') : 'not_run',
+        skipped_probes: result?.skipped || [],
+        strict_probe_command: 'npm run codex:0139-real-probes:require-real',
+        unsafe_auto_fix: false
+    };
+}
+//# sourceMappingURL=codex-0139-doctor.js.map

package/dist/core/doctor/doctor-readiness-matrix.js

@@ -58,6 +58,11 @@ export function buildDoctorReadinessMatrix(input = {}) {
             warnings.add(blocker);
     for (const warning of normalizeList(codex0138Doctor?.warnings))
         warnings.add(warning);
+    const codex0139RealProbes = input.codex_0139_real_probes || null;
+    if (codex0139RealProbes?.real_probes_last_run_status === 'blocked')
+        warnings.add('codex_0139_real_probes_blocked');
+    if (codex0139RealProbes?.real_probes_last_run_status === 'not_run')
+        warnings.add('codex_0139_real_probes_not_run');
     for (const warning of normalizeList(input.codex_plugin_app_template_policy?.doctor_warnings))
         warnings.add(warning);
     if (input.codex_lb?.ok === false)
@@ -116,6 +121,7 @@ export function buildDoctorReadinessMatrix(input = {}) {
         },
         codex_doctor: codexDoctor || null,
         codex_0138_doctor: codex0138Doctor,
+        codex_0139_real_probes: codex0139RealProbes,
         codex_plugin_inventory: input.codex_plugin_inventory || null,
         codex_plugin_app_template_policy: input.codex_plugin_app_template_policy || null,
         fast_mode_ready: input.fast_mode_ready !== false,