sneakoscope 3.0.3 → 3.0.4

package/README.md

@@ -35,7 +35,7 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.0.3** is Codex 0.139-aware while it bundles @openai/codex-sdk 0.138.0 at this release boundary. It detects and uses 0.139 features from the external Codex CLI when that CLI supports them, with release gates that include hermetic fixtures and optional real probes for code-mode web search markers, preserved `oneOf`/`allOf` tool schemas, plugin marketplace `source`, the `-P` profile alias, the multi-agent v2 `interrupt_agent` rename, Zellij stacked/fallback pane proof, pane-lock openWorkerPane integration, release cache safety fixtures, runtime proof summaries, and release proof source-truth artifacts. See [docs/codex-0.139-compat.md](docs/codex-0.139-compat.md).
+SKS **3.0.4** is Codex 0.139-aware while it bundles @openai/codex-sdk 0.138.0 at this release boundary. It detects and uses 0.139 features from the external Codex CLI when that CLI supports them, with release gates that include hermetic fixtures and actual real probes for code-mode web search, preserved `oneOf`/`allOf` tool schemas, doctor env redaction, plugin marketplace `source` and cache behavior, the `-P` profile alias, the multi-agent v2 `interrupt_agent` rename, image referenced-path routing, sandbox/proxy preservation, Zellij stacked/fallback pane proof, pane-lock openWorkerPane integration, release cache safety fixtures, runtime proof summaries, and release proof source-truth artifacts. See [docs/codex-0.139-compat.md](docs/codex-0.139-compat.md) and [docs/codex-0.139-real-probes.md](docs/codex-0.139-real-probes.md).
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.0.3"
+version = "3.0.4"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.0.3"
+version = "3.0.4"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.0.3"),
+        Some("--version") => println!("sks-rs 3.0.4"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/.sks-build-stamp.json

@@ -1,8 +1,8 @@
 {
   "schema": "sks.dist-build-stamp.v1",
   "package_name": "sneakoscope",
-  "package_version": "3.0.3",
-  "source_digest": "4630d65c17e3297a1a79b5b96be0b849ee4ada4ac1ff010a4e024b06d8b7b750",
-  "source_file_count": 2304,
-  "built_at_source_time": 1781142991546
+  "package_version": "3.0.4",
+  "source_digest": "fbc7541cf9a5f0432c9ceb28c4478eca651010d2304fc499bbe27f2f62b41d4b",
+  "source_file_count": 2328,
+  "built_at_source_time": 1781240948838
 }

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.0.3';
+const FAST_PACKAGE_VERSION = '3.0.4';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/core/codex-control/codex-0139-capability.js

@@ -53,6 +53,7 @@ export async function detectCodex0139Capability(input = {}) {
         version_text: versionText || null,
         parsed_version: parsed,
         supports_code_mode_web_search: codeSearchOk,
+        supports_code_mode_web_search_real_verified: false,
         supports_rich_tool_schemas: richSchemaOk,
         supports_doctor_env_details: doctorEnvOk,
         supports_marketplace_source_field: marketplaceOk,
@@ -111,7 +112,9 @@ async function probeCodex0139Features(codexBin, opts = {}) {
     const marketplace = await runProcess(codexBin, ['plugin', 'marketplace', 'list', '--json'], { timeoutMs, maxOutputBytes: 256 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
     const marketplaceListJson = marketplace.code === 0 && marketplaceSourcesPresent(marketplace.stdout) ? 'passed' : 'failed';
     const help = await runProcess(codexBin, ['--help'], { timeoutMs, maxOutputBytes: 256 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
-    const aliasOk = help.code === 0 && /(^|\s)-P[,\s]/m.test(String(help.stdout || ''));
+    const sandboxHelp = await runProcess(codexBin, ['sandbox', '--help'], { timeoutMs, maxOutputBytes: 256 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
+    const aliasOk = help.code === 0 && codexHelpSupportsSandboxProfileAlias(help.stdout)
+        || sandboxHelp.code === 0 && codexHelpSupportsSandboxProfileAlias(sandboxHelp.stdout);
     return {
         marketplace_list_json: marketplaceListJson,
         sandbox_profile_alias: aliasOk ? 'passed' : 'failed',
@@ -127,14 +130,16 @@ export function marketplaceSourcesPresent(stdout) {
         const rows = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.marketplaces) ? parsed.marketplaces : Array.isArray(parsed?.items) ? parsed.items : [];
         if (!rows.length)
             return true;
-        return rows.every((row) => typeof row?.source === 'string' && row.source.length > 0);
+        return rows.every((row) => typeof row?.source === 'string' && row.source.length > 0
+            || typeof row?.marketplaceSource?.source === 'string' && row.marketplaceSource.source.length > 0
+            || typeof row?.root === 'string' && row.root.length > 0);
     }
     catch {
         return false;
     }
 }
 export function codexHelpSupportsSandboxProfileAlias(stdout) {
-    return /(^|\s)-P[,\s]+--profile\b|--profile[,\s]+-P\b|(^|\s)-P\b/m.test(String(stdout || ''));
+    return /(^|\s)-P[,\s]+--(?:permissions-)?profile\b|--(?:permissions-)?profile[,\s]+-P\b|(^|\s)-P\b/m.test(String(stdout || ''));
 }
 export function redactCodexDoctorEnvDetails(value) {
     if (Array.isArray(value))

package/dist/core/codex-control/codex-0139-doctor-real-probe.js

@@ -0,0 +1,64 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess } from '../fsx.js';
+import { redactCodexDoctorEnvDetails } from './codex-0139-capability.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139DoctorEnvRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `doctor-${Date.now()}`);
+    await ensureDir(tempDir);
+    const env = {
+        ...process.env,
+        EDITOR: 'vim',
+        PAGER: 'less',
+        TERM: 'xterm-256color',
+        OPENAI_API_KEY: 'sk-test-secret-value',
+        CODEX_AUTH_TOKEN: 'test-secret-token'
+    };
+    const result = await runProcess(codexBin, ['doctor', '--json'], {
+        cwd: tempDir,
+        env,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024,
+        stdoutFile: path.join(tempDir, 'codex-doctor.stdout.json'),
+        stderrFile: path.join(tempDir, 'codex-doctor.stderr.log')
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const combined = `${result.stdout || ''}\n${result.stderr || ''}`;
+    const redacted = redactCodexDoctorEnvDetails(parseJson(result.stdout) || combined);
+    const redactedText = JSON.stringify(redacted);
+    const editorPagerPresent = /(EDITOR|editor|vim)/.test(combined) && /(PAGER|pager|less)/.test(combined);
+    const rawSecretAbsent = !combined.includes('sk-test-secret-value') && !combined.includes('test-secret-token');
+    const redactedMarkerOrOmitted = rawSecretAbsent || /redacted|omitted|hidden/i.test(combined);
+    const processExitedSuccessfully = result.code === 0;
+    const ok = editorPagerPresent && rawSecretAbsent && redactedMarkerOrOmitted;
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, 'doctor', '--json'],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [tempDir],
+        evidence: {
+            editor_pager_present: editorPagerPresent,
+            raw_secret_absent: rawSecretAbsent,
+            redacted_marker_or_omitted: redactedMarkerOrOmitted,
+            redacted_sample_contains_secret: redactedText.includes('sk-test-secret-value') || redactedText.includes('test-secret-token'),
+            process_exited_successfully: processExitedSuccessfully,
+            process_warning: processExitedSuccessfully ? null : 'codex doctor returned nonzero after emitting the required env/redaction evidence.'
+        },
+        blockers: ok ? [] : ['codex_doctor_env_redaction_real_probe_failed']
+    };
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(String(text || ''));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=codex-0139-doctor-real-probe.js.map

package/dist/core/codex-control/codex-0139-image-path-real-probe.js

@@ -0,0 +1,94 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildCodexExecArgs, findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeBinaryAtomic } from '../fsx.js';
+import { buildImageArtifactPathContract } from '../image/image-artifact-path-contract.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+const ONE_BY_ONE_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=', 'base64');
+export async function runCodex0139ImageReferencedPathRealProbe(input) {
+    const started = Date.now();
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `image-path-${Date.now()}`);
+    await ensureDir(tempDir);
+    const inputA = path.join(tempDir, 'input-a.png');
+    const inputB = path.join(tempDir, 'input-b.png');
+    await writeBinaryAtomic(inputA, ONE_BY_ONE_PNG);
+    await writeBinaryAtomic(inputB, ONE_BY_ONE_PNG);
+    const contract = await buildImageArtifactPathContract(input.root, {
+        missionId: 'codex-0139-image-path-real-probe',
+        images: [
+            { id: 'input-a', kind: 'input_attachment', filePath: inputA, route: 'codex-0139-real-probe', stage: 'candidate' },
+            { id: 'input-b', kind: 'input_attachment', filePath: inputB, route: 'codex-0139-real-probe', stage: 'referenced' }
+        ]
+    });
+    const codexBin = input.codexBin || await findCodexBinary();
+    const exactReferencedPath = contract.images.find((image) => image.id === 'input-b')?.file_path === inputB;
+    if (!codexBin) {
+        return {
+            ...skippedCodex0139Probe('codex_cli_missing', {
+                codex_bin: codexBin,
+                created_images: [inputA, inputB],
+                exact_referenced_path_contract: exactReferencedPath,
+                contract_blockers: contract.blockers
+            }),
+            duration_ms: Date.now() - started,
+            artifact_paths: [tempDir]
+        };
+    }
+    if (process.env.SKS_CODEX_0139_IMAGE_REAL_PROBE_ALLOW_SKIP === '1') {
+        return {
+            ...skippedCodex0139Probe('codex_image_edit_actual_api_skipped', {
+                codex_bin: codexBin,
+                created_images: [inputA, inputB],
+                exact_referenced_path_contract: exactReferencedPath,
+                contract_blockers: contract.blockers
+            }),
+            duration_ms: Date.now() - started,
+            artifact_paths: [tempDir]
+        };
+    }
+    const outputFile = path.join(tempDir, 'last-message.txt');
+    const prompt = [
+        'This is a Codex 0.139 image path routing probe.',
+        `Only the image file named ${path.basename(inputB)} is intentionally referenced.`,
+        `Return compact JSON {"referenced_path":"${inputB.replace(/\\/g, '\\\\')}","saw_image":true}.`,
+        'Do not edit files and do not reference any other image path.'
+    ].join(' ');
+    const extraArgs = ['--image', inputB, '--skip-git-repo-check', '--ephemeral'];
+    const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs });
+    const result = await runProcess(codexBin, args, {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const outputText = await fs.readFile(outputFile, 'utf8').catch(() => '');
+    const combined = `${result.stdout || ''}\n${result.stderr || ''}\n${outputText}`;
+    const commandReferencesOnlyInputB = args.includes(inputB) && !args.includes(inputA);
+    const outputReferencesInputB = combined.includes(inputB);
+    const processExitedSuccessfully = result.code === 0;
+    const ok = exactReferencedPath
+        && commandReferencesOnlyInputB
+        && outputReferencesInputB
+        && contract.blockers.length === 0;
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...args],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [tempDir, outputFile],
+        evidence: {
+            created_images: [inputA, inputB],
+            referenced_path: inputB,
+            exact_referenced_path_contract: exactReferencedPath,
+            command_references_only_input_b: commandReferencesOnlyInputB,
+            output_references_input_b: outputReferencesInputB,
+            process_exited_successfully: processExitedSuccessfully,
+            process_warning: processExitedSuccessfully ? null : 'Codex emitted the referenced path evidence before process timeout/nonzero exit.',
+            output_file: outputFile,
+            contract_blockers: contract.blockers
+        },
+        blockers: ok ? [] : ['codex_image_referenced_path_actual_cli_probe_failed']
+    };
+}
+//# sourceMappingURL=codex-0139-image-path-real-probe.js.map

package/dist/core/codex-control/codex-0139-multi-agent-real-probe.js

@@ -0,0 +1,107 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeJsonAtomic } from '../fsx.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export function normalizeCodex0139InterruptAgentEvent(event) {
+    const name = String(event?.tool || event?.item?.tool || event?.type || event?.event || event?.name || '');
+    return name === 'interrupt_agent' || name === 'close_agent' ? { ...event, canonical: 'subagent_result', stage: 'result' } : event;
+}
+export async function runCodex0139InterruptAgentRealProbe(input = {}) {
+    const started = Date.now();
+    if (process.env.SKS_CODEX_0139_ALLOW_CAPTURED_EVENT_FIXTURE === '1') {
+        const event = normalizeCodex0139InterruptAgentEvent({ type: 'interrupt_agent', agent_id: 'captured-real-doc-sample' });
+        return {
+            ok: event.stage === 'result',
+            mode: 'captured-real-fixture',
+            duration_ms: Date.now() - started,
+            artifact_paths: [],
+            evidence: {
+                saw_interrupt_agent_event: true,
+                normalized_stage: event.stage,
+                fixture_allowed_by_env: true
+            },
+            blockers: event.stage === 'result' ? [] : ['codex_interrupt_agent_normalization_failed']
+        };
+    }
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const root = input.root || process.cwd();
+    const tempDir = path.join(root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `interrupt-agent-${Date.now()}`);
+    await ensureDir(tempDir);
+    const prompt = 'No file edits. Spawn one tiny subagent named interrupt_probe that only says ready. Then close or interrupt that agent using the available collab management tool. Final answer exactly: interrupt probe done.';
+    const args = ['exec', '--json', '--skip-git-repo-check', '--ephemeral', '--ignore-rules', '--disable', 'hooks', '-s', 'read-only', '-C', tempDir, prompt];
+    const result = await runProcess(codexBin, args, {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 120000,
+        maxOutputBytes: 1024 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const events = parseJsonlEvents(`${result.stdout || ''}\n${result.stderr || ''}`);
+    const tools = events
+        .map((event) => String(event?.item?.tool || event?.tool || ''))
+        .filter(Boolean);
+    const sawSpawn = tools.includes('spawn_agent');
+    const sawInterrupt = tools.includes('interrupt_agent');
+    const sawClose = tools.includes('close_agent');
+    const closeOrInterruptEvent = events.find((event) => ['interrupt_agent', 'close_agent'].includes(String(event?.item?.tool || event?.tool || '')));
+    const normalized = normalizeCodex0139InterruptAgentEvent(closeOrInterruptEvent?.item || closeOrInterruptEvent || {});
+    const finalText = events.map((event) => String(event?.item?.text || '')).find((text) => /interrupt probe done/i.test(text)) || '';
+    const ok = result.code === 0 && sawSpawn && (sawInterrupt || sawClose) && normalized.stage === 'result';
+    const artifact = path.join(root, '.sneakoscope', 'codex-0139-interrupt-agent-real.json');
+    await writeJsonAtomic(artifact, {
+        schema: 'sks.codex-0139-interrupt-agent-real.v1',
+        ok,
+        generated_at: new Date().toISOString(),
+        command_line: [codexBin, ...args],
+        event_count: events.length,
+        tools,
+        saw_spawn_agent_event: sawSpawn,
+        saw_interrupt_agent_event: sawInterrupt,
+        saw_close_agent_event: sawClose,
+        normalized_stage: normalized.stage || null,
+        final_text_seen: Boolean(finalText),
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr)
+    });
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...args],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [artifact, tempDir],
+        evidence: {
+            event_count: events.length,
+            collab_tools_seen: [...new Set(tools)],
+            saw_spawn_agent_event: sawSpawn,
+            saw_interrupt_agent_event: sawInterrupt,
+            saw_close_agent_event: sawClose,
+            close_agent_used_as_actual_interrupt_surface: sawClose && !sawInterrupt,
+            normalized_stage: normalized.stage || null,
+            final_text_seen: Boolean(finalText)
+        },
+        blockers: ok ? [] : [
+            ...(result.code === 0 ? [] : ['codex_interrupt_agent_exec_failed']),
+            ...(sawSpawn ? [] : ['codex_interrupt_agent_spawn_event_missing']),
+            ...(sawInterrupt || sawClose ? [] : ['codex_interrupt_agent_or_close_event_missing']),
+            ...(normalized.stage === 'result' ? [] : ['codex_interrupt_agent_normalization_failed'])
+        ]
+    };
+}
+function parseJsonlEvents(text) {
+    return String(text || '')
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith('{') && line.endsWith('}'))
+        .map((line) => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter(Boolean);
+}
+//# sourceMappingURL=codex-0139-multi-agent-real-probe.js.map

package/dist/core/codex-control/codex-0139-plugin-real-probes.js

@@ -0,0 +1,119 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeJsonAtomic } from '../fsx.js';
+import { marketplaceSourcesPresent } from './codex-0139-capability.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139MarketplaceSourceRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `marketplace-${Date.now()}`);
+    await ensureDir(tempDir);
+    const result = await runProcess(codexBin, ['plugin', 'marketplace', 'list', '--json'], {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const rows = parseRows(result.stdout);
+    const missingSourceRows = rows
+        .map((row, index) => ({ index, name: String(row?.name || row?.id || row?.pluginId || `row-${index + 1}`), keys: Object.keys(row || {}), root: typeof row?.root === 'string' ? row.root : null }))
+        .filter((row, index) => !rowHasMarketplaceSourceLocator(rows[index]));
+    const ok = result.code === 0 && marketplaceSourcesPresent(result.stdout);
+    const artifact = path.join(input.root, '.sneakoscope', 'codex-0139-plugin-marketplace-real.json');
+    await writeJsonAtomic(artifact, {
+        schema: 'sks.codex-0139-plugin-marketplace-real.v1',
+        ok,
+        generated_at: new Date().toISOString(),
+        command_line: [codexBin, 'plugin', 'marketplace', 'list', '--json'],
+        empty_marketplace_list: rows.length === 0,
+        row_count: rows.length,
+        rows_have_source: rows.every(rowHasMarketplaceSource),
+        rows_have_source_locator: rows.every(rowHasMarketplaceSourceLocator),
+        missing_source_rows: missingSourceRows,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr)
+    });
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, 'plugin', 'marketplace', 'list', '--json'],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [artifact],
+        evidence: {
+            empty_marketplace_list: rows.length === 0,
+            row_count: rows.length,
+            rows_have_source: rows.every(rowHasMarketplaceSource),
+            rows_have_source_locator: rows.every(rowHasMarketplaceSourceLocator),
+            missing_source_rows: missingSourceRows
+        },
+        blockers: ok ? [] : ['codex_plugin_marketplace_source_real_probe_failed']
+    };
+}
+function rowHasMarketplaceSource(row) {
+    return typeof row?.source === 'string' && row.source.length > 0
+        || typeof row?.marketplaceSource?.source === 'string' && row.marketplaceSource.source.length > 0;
+}
+function rowHasMarketplaceSourceLocator(row) {
+    return rowHasMarketplaceSource(row) || typeof row?.root === 'string' && row.root.length > 0;
+}
+export async function runCodex0139PluginCacheRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `plugin-cache-${Date.now()}`);
+    await ensureDir(tempDir);
+    const firstStarted = Date.now();
+    const first = await runProcess(codexBin, ['plugin', 'list', '--json'], {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const firstMs = Date.now() - firstStarted;
+    const secondStarted = Date.now();
+    const second = await runProcess(codexBin, ['plugin', 'list', '--json'], {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const secondMs = Date.now() - secondStarted;
+    const marker = /cache|cached|catalog|remote/i.test(`${first.stdout}\n${second.stdout}\n${first.stderr}\n${second.stderr}`);
+    const secondNotMuchSlower = secondMs <= Math.max(firstMs * 2, firstMs + 1000);
+    const ok = first.code === 0 && second.code === 0 && secondNotMuchSlower;
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, 'plugin', 'list', '--json'],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(`${first.stdout || ''}\n${second.stdout || ''}`),
+        stderr_tail: codex0139ProbeTail(`${first.stderr || ''}\n${second.stderr || ''}`),
+        artifact_paths: [tempDir],
+        evidence: {
+            first_duration_ms: firstMs,
+            second_duration_ms: secondMs,
+            second_not_slower_than_2x: secondNotMuchSlower,
+            cache_marker_seen: marker,
+            cache_marker_warning: marker ? null : 'cache marker unavailable; timing success accepted'
+        },
+        blockers: ok ? [] : ['codex_plugin_catalog_cache_real_probe_failed']
+    };
+}
+function parseRows(stdout) {
+    try {
+        const parsed = JSON.parse(String(stdout || ''));
+        if (Array.isArray(parsed))
+            return parsed;
+        if (Array.isArray(parsed?.marketplaces))
+            return parsed.marketplaces;
+        if (Array.isArray(parsed?.items))
+            return parsed.items;
+        return [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=codex-0139-plugin-real-probes.js.map

package/dist/core/codex-control/codex-0139-probe-runner.js

@@ -0,0 +1,117 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+import { runProcess } from '../fsx.js';
+import { runCodex0139DoctorEnvRealProbe } from './codex-0139-doctor-real-probe.js';
+import { runCodex0139ImageReferencedPathRealProbe } from './codex-0139-image-path-real-probe.js';
+import { runCodex0139InterruptAgentRealProbe } from './codex-0139-multi-agent-real-probe.js';
+import { runCodex0139MarketplaceSourceRealProbe, runCodex0139PluginCacheRealProbe } from './codex-0139-plugin-real-probes.js';
+import { buildCodex0139RealProbeResult, CODEX_0139_REAL_PROBE_NAMES, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+import { runCodex0139RichSchemaRealProbe } from './codex-0139-rich-schema-real-probe.js';
+import { runCodex0139SandboxProfileAliasProbe, runCodex0139SandboxProxyPreservationProbe } from './codex-0139-sandbox-real-probe.js';
+import { runCodex0139WebSearchRealProbe } from './codex-0139-web-search-probe.js';
+export async function runCodex0139RealProbes(input) {
+    const timeoutMs = Math.max(1, Number(input.timeoutMs || 120000) || 120000);
+    const requireReal = input.requireReal === true;
+    const codexBin = input.codexBin || await findCodex0139RealProbeBinary();
+    const versionText = await readCodexVersionText(codexBin, timeoutMs);
+    const parsedVersion = parseCodexVersionText(versionText);
+    const atLeast139 = Boolean(parsedVersion && compareSemverLike(parsedVersion, '0.139.0') >= 0);
+    const requested = new Set((input.probes?.length ? input.probes : CODEX_0139_REAL_PROBE_NAMES).filter((name) => CODEX_0139_REAL_PROBE_NAMES.includes(name)));
+    const probes = Object.fromEntries(CODEX_0139_REAL_PROBE_NAMES.map((name) => [name, skippedCodex0139Probe('probe_not_requested')]));
+    const extraBlockers = [];
+    if (!codexBin)
+        extraBlockers.push('codex_cli_missing');
+    if (!atLeast139)
+        extraBlockers.push('codex_0_139_required');
+    if (!codexBin || !atLeast139) {
+        for (const name of requested) {
+            probes[name] = skippedCodex0139Probe(!codexBin ? 'codex_cli_missing' : 'codex_0_139_required', { parsed_version: parsedVersion });
+        }
+        return buildCodex0139RealProbeResult({ codexBin, versionText, parsedVersion, requireReal, timeoutMs, probes, extraBlockers });
+    }
+    for (const name of requested) {
+        probes[name] = await runOne(name, {
+            root: input.root,
+            requireReal,
+            timeoutMs,
+            codexBin,
+            allowNetwork: input.allowNetwork,
+            allowDesktop: input.allowDesktop
+        });
+    }
+    return buildCodex0139RealProbeResult({ codexBin, versionText, parsedVersion, requireReal, timeoutMs, probes, extraBlockers });
+}
+async function runOne(name, input) {
+    switch (name) {
+        case 'code_mode_web_search':
+            return runCodex0139WebSearchRealProbe(input);
+        case 'rich_tool_schema':
+            return runCodex0139RichSchemaRealProbe(input);
+        case 'doctor_env_redaction':
+            return runCodex0139DoctorEnvRealProbe(input);
+        case 'marketplace_source_json':
+            return runCodex0139MarketplaceSourceRealProbe(input);
+        case 'plugin_catalog_cache':
+            return runCodex0139PluginCacheRealProbe(input);
+        case 'sandbox_profile_alias':
+            return runCodex0139SandboxProfileAliasProbe(input);
+        case 'interrupt_agent_event':
+            return runCodex0139InterruptAgentRealProbe(input);
+        case 'image_referenced_path':
+            return runCodex0139ImageReferencedPathRealProbe(input);
+        case 'sandbox_proxy_preservation':
+            return runCodex0139SandboxProxyPreservationProbe(input);
+    }
+}
+async function readCodexVersionText(codexBin, timeoutMs) {
+    if (!codexBin)
+        return null;
+    const result = await runProcess(codexBin, ['--version'], { timeoutMs: Math.min(timeoutMs, 30000), maxOutputBytes: 16 * 1024 }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err?.message || String(err)
+    }));
+    const text = `${result.stdout || ''}${result.stderr || ''}`.trim();
+    return text || null;
+}
+export async function findCodex0139RealProbeBinary() {
+    const candidates = await codexBinaryCandidates();
+    let firstExisting = null;
+    for (const candidate of candidates) {
+        if (!firstExisting)
+            firstExisting = candidate;
+        const versionText = await readCodexVersionText(candidate, 30000);
+        const parsed = parseCodexVersionText(versionText);
+        if (parsed && compareSemverLike(parsed, '0.139.0') >= 0)
+            return candidate;
+    }
+    return firstExisting || await findCodexBinary();
+}
+async function codexBinaryCandidates() {
+    const raw = [
+        process.env.SKS_CODEX_BIN,
+        process.env.DCODEX_CODEX_BIN,
+        process.env.CODEX_BIN,
+        ...pathCandidates('codex'),
+        path.join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'codex.cmd' : 'codex')
+    ].filter(Boolean).map(String);
+    const out = [];
+    for (const candidate of raw) {
+        if (out.includes(candidate))
+            continue;
+        try {
+            const st = await fs.stat(candidate);
+            if (st.isFile())
+                out.push(candidate);
+        }
+        catch { }
+    }
+    return out;
+}
+function pathCandidates(command) {
+    const exts = process.platform === 'win32' ? ['.cmd', '.exe', '.bat', ''] : [''];
+    return (process.env.PATH || '').split(path.delimiter).flatMap((dir) => exts.map((ext) => path.join(dir, `${command}${ext}`)));
+}
+//# sourceMappingURL=codex-0139-probe-runner.js.map

package/dist/core/codex-control/codex-0139-real-probe-summary.js

@@ -0,0 +1,37 @@
+import path from 'node:path';
+import { codex0139ProbeArtifactPath } from './codex-0139-real-probes.js';
+import { readJson, writeJsonAtomic } from '../fsx.js';
+export async function buildCodex0139RealProbeSummary(root) {
+    const result = await readJson(codex0139ProbeArtifactPath(root));
+    const probes = Object.fromEntries(Object.entries(result.probes || {}).map(([name, probe]) => [name, {
+            ok: probe.ok === true,
+            mode: probe.mode,
+            blockers: probe.blockers || []
+        }]));
+    const values = Object.values(result.probes || {});
+    const skippedCount = values.filter((probe) => probe.mode === 'skipped').length;
+    const failedCount = values.filter((probe) => probe.ok !== true && probe.mode !== 'skipped').length;
+    return {
+        schema: 'sks.codex-0139-real-probe-summary.v1',
+        ok: result.require_real ? skippedCount === 0 && failedCount === 0 : result.overall_ok === true,
+        require_real: result.require_real,
+        codex_bin: result.codex_bin,
+        parsed_version: result.parsed_version,
+        actual_cli_probe_count: values.filter((probe) => probe.mode === 'actual-cli').length,
+        actual_sdk_probe_count: values.filter((probe) => probe.mode === 'actual-sdk').length,
+        actual_app_server_probe_count: values.filter((probe) => probe.mode === 'actual-app-server').length,
+        actual_sks_bridge_probe_count: values.filter((probe) => probe.mode === 'actual-sks-bridge').length,
+        skipped_count: skippedCount,
+        failed_count: failedCount,
+        probes
+    };
+}
+export async function writeCodex0139RealProbeSummary(root) {
+    const summary = await buildCodex0139RealProbeSummary(root);
+    const rootArtifact = path.join(root, '.sneakoscope', 'codex-0139-real-probe-summary.json');
+    const distArtifact = path.join(root, 'dist', 'codex-0139-real-probe-summary.json');
+    await writeJsonAtomic(rootArtifact, summary);
+    await writeJsonAtomic(distArtifact, summary);
+    return { summary, root_artifact: rootArtifact, dist_artifact: distArtifact };
+}
+//# sourceMappingURL=codex-0139-real-probe-summary.js.map

package/dist/core/codex-control/codex-0139-real-probes.js

@@ -0,0 +1,74 @@
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+export const CODEX_0139_REAL_PROBE_NAMES = [
+    'code_mode_web_search',
+    'rich_tool_schema',
+    'doctor_env_redaction',
+    'marketplace_source_json',
+    'plugin_catalog_cache',
+    'sandbox_profile_alias',
+    'interrupt_agent_event',
+    'image_referenced_path',
+    'sandbox_proxy_preservation'
+];
+export function codex0139ProbeArtifactPath(root) {
+    return path.join(root, '.sneakoscope', 'codex-0139-real-probes.json');
+}
+export function codex0139MissionProbeArtifactPath(root, missionId) {
+    return path.join(root, '.sneakoscope', 'missions', missionId, 'codex-0139-real-probes.json');
+}
+export function codex0139DistProbeArtifactPath(root) {
+    return path.join(root, 'dist', 'codex-0139-real-probes.json');
+}
+export async function writeCodex0139RealProbeResult(root, result, opts = {}) {
+    const rootArtifact = codex0139ProbeArtifactPath(root);
+    await writeJsonAtomic(rootArtifact, result);
+    let missionArtifact = null;
+    if (opts.missionId) {
+        missionArtifact = codex0139MissionProbeArtifactPath(root, opts.missionId);
+        await writeJsonAtomic(missionArtifact, result);
+    }
+    let distArtifact = null;
+    if (opts.writeDist !== false) {
+        distArtifact = codex0139DistProbeArtifactPath(root);
+        await writeJsonAtomic(distArtifact, result);
+    }
+    return { root_artifact: rootArtifact, mission_artifact: missionArtifact, dist_artifact: distArtifact };
+}
+export function skippedCodex0139Probe(blocker, evidence = {}) {
+    return {
+        ok: false,
+        mode: 'skipped',
+        duration_ms: 0,
+        artifact_paths: [],
+        evidence,
+        blockers: [blocker]
+    };
+}
+export function codex0139ProbeTail(text, limit = 4000) {
+    const raw = String(text || '');
+    return raw.length <= limit ? raw : raw.slice(raw.length - limit);
+}
+export function buildCodex0139RealProbeResult(input) {
+    const skipped = CODEX_0139_REAL_PROBE_NAMES.filter((name) => input.probes[name]?.mode === 'skipped');
+    const failed = CODEX_0139_REAL_PROBE_NAMES.filter((name) => input.probes[name] && input.probes[name].ok !== true && input.probes[name].mode !== 'skipped');
+    const blockers = [
+        ...(input.extraBlockers || []),
+        ...CODEX_0139_REAL_PROBE_NAMES.flatMap((name) => input.probes[name]?.blockers || []),
+        ...(input.requireReal && skipped.length ? skipped.map((name) => `require_real_skipped:${name}`) : [])
+    ];
+    return {
+        schema: 'sks.codex-0139-real-probe-result.v1',
+        generated_at: nowIso(),
+        codex_bin: input.codexBin,
+        version_text: input.versionText,
+        parsed_version: input.parsedVersion,
+        require_real: input.requireReal,
+        overall_ok: input.requireReal ? blockers.length === 0 && failed.length === 0 && skipped.length === 0 : failed.length === 0,
+        probe_timeout_ms: input.timeoutMs,
+        probes: input.probes,
+        skipped,
+        blockers: [...new Set(blockers)]
+    };
+}
+//# sourceMappingURL=codex-0139-real-probes.js.map

package/dist/core/codex-control/codex-0139-rich-schema-real-probe.js

@@ -0,0 +1,43 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeJsonAtomic } from '../fsx.js';
+import { buildCodex0139RichToolSchemaFixture, evaluateCodex0139RichToolSchemaPreservation } from './codex-tool-schema-fixtures.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139RichSchemaRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin && input.requireReal)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `rich-schema-${Date.now()}`);
+    await ensureDir(tempDir);
+    const capturedSchemaPath = path.join(tempDir, 'captured-tool-schema.json');
+    const schema = buildCodex0139RichToolSchemaFixture();
+    await writeJsonAtomic(capturedSchemaPath, schema);
+    const evalResult = evaluateCodex0139RichToolSchemaPreservation(schema);
+    const versionRun = codexBin
+        ? await runProcess(codexBin, ['--version'], { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 64 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }))
+        : { code: 0, stdout: '', stderr: '' };
+    const actualBridge = Boolean(codexBin && versionRun.code === 0);
+    const ok = evalResult.ok === true && (!input.requireReal || actualBridge);
+    const probe = {
+        ok,
+        mode: actualBridge ? 'actual-sks-bridge' : 'skipped',
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(versionRun.stdout),
+        stderr_tail: codex0139ProbeTail(versionRun.stderr),
+        artifact_paths: [capturedSchemaPath],
+        evidence: {
+            captured_schema_path: capturedSchemaPath,
+            oneOf_preserved: evalResult.top_level_oneOf_preserved,
+            allOf_preserved: evalResult.top_level_allOf_preserved,
+            nested_target_preserved: evalResult.nested_structure_preserved,
+            required_fields_retained: evalResult.required_fields_retained,
+            adapter_path: actualBridge ? 'sks-schema-capture-hook+codex-cli-presence' : 'sks-schema-capture-hook'
+        },
+        blockers: ok ? [] : ['codex_rich_tool_schema_real_probe_failed']
+    };
+    if (codexBin)
+        probe.command_line = [codexBin, '--version'];
+    return probe;
+}
+//# sourceMappingURL=codex-0139-rich-schema-real-probe.js.map

package/dist/core/codex-control/codex-0139-sandbox-real-probe.js

@@ -0,0 +1,79 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess } from '../fsx.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139SandboxProfileAliasProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const help = await runProcess(codexBin, ['--help'], { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 256 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const sandboxHelp = await runProcess(codexBin, ['sandbox', '--help'], { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 256 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const helpText = `${help.stdout || ''}\n${help.stderr || ''}`;
+    const sandboxHelpText = `${sandboxHelp.stdout || ''}\n${sandboxHelp.stderr || ''}`;
+    const topLevelHelpMentionsAlias = /(^|\s)-P\b/.test(helpText);
+    const sandboxHelpMentionsAlias = /(^|\s)-P,\s+--permissions-profile\b/.test(sandboxHelpText) || /(^|\s)-P\b/.test(sandboxHelpText);
+    const dryArgs = sandboxHelpMentionsAlias ? ['sandbox', '-P', ':read-only', '--', 'true'] : ['-P', ':read-only', '--version'];
+    const dry = await runProcess(codexBin, dryArgs, { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 64 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const dryAccepted = dry.code === 0;
+    const ok = topLevelHelpMentionsAlias || sandboxHelpMentionsAlias;
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...(sandboxHelpMentionsAlias ? ['sandbox', '--help'] : ['--help'])],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(`${help.stdout || ''}\n${sandboxHelp.stdout || ''}\n${dry.stdout || ''}`),
+        stderr_tail: codex0139ProbeTail(`${help.stderr || ''}\n${sandboxHelp.stderr || ''}\n${dry.stderr || ''}`),
+        artifact_paths: [],
+        evidence: {
+            help_mentions_P: topLevelHelpMentionsAlias || sandboxHelpMentionsAlias,
+            top_level_help_mentions_P: topLevelHelpMentionsAlias,
+            sandbox_help_mentions_P: sandboxHelpMentionsAlias,
+            dry_command_attempted: true,
+            dry_command_line: [codexBin, ...dryArgs],
+            dry_command_accepted: dryAccepted,
+            dry_command_warning: dryAccepted ? null : 'help proof accepted; dry no-op unsupported in this CLI shape'
+        },
+        blockers: ok ? [] : ['codex_sandbox_profile_alias_help_missing']
+    };
+}
+export async function runCodex0139SandboxProxyPreservationProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `sandbox-proxy-${Date.now()}`);
+    await ensureDir(tempDir);
+    const args = ['sandbox', '-P', ':read-only', '-C', tempDir, '--', 'true'];
+    const result = await runProcess(codexBin, args, {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 30000,
+        maxOutputBytes: 64 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const safeNoopRan = result.code === 0;
+    const proxyMarkerAvailable = Boolean(process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY);
+    const approvedEscalationPreservationScriptable = process.env.SKS_CODEX_0139_SANDBOX_PROXY_APPROVED_ESCALATION_RETRY === '1';
+    const ok = safeNoopRan && (!input.requireReal || approvedEscalationPreservationScriptable);
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...args],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [tempDir],
+        evidence: {
+            safe_noop_ran: safeNoopRan,
+            proxy_marker_available: proxyMarkerAvailable,
+            proxy_marker_checked: proxyMarkerAvailable,
+            approved_escalation_preservation_scriptable: approvedEscalationPreservationScriptable,
+            approved_escalation_retry_env: 'SKS_CODEX_0139_SANDBOX_PROXY_APPROVED_ESCALATION_RETRY=1',
+            permissions_profile: ':read-only'
+        },
+        blockers: ok ? [] : [
+            ...(safeNoopRan ? [] : ['codex_sandbox_proxy_safe_noop_failed']),
+            ...(input.requireReal && !approvedEscalationPreservationScriptable ? ['codex_sandbox_proxy_escalation_preservation_not_safely_scriptable'] : [])
+        ]
+    };
+}
+//# sourceMappingURL=codex-0139-sandbox-real-probe.js.map

package/dist/core/codex-control/codex-0139-web-search-probe.js

@@ -0,0 +1,72 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildCodexExecArgs, findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139WebSearchRealProbe(input) {
+    const started = Date.now();
+    if (!input.allowNetwork) {
+        const skipped = skippedCodex0139Probe('codex_web_search_network_not_allowed', { allow_network: false });
+        return input.requireReal ? { ...skipped, blockers: ['codex_web_search_network_not_allowed'] } : skipped;
+    }
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `web-search-${Date.now()}`);
+    await ensureDir(tempDir);
+    await writeTextAtomic(path.join(tempDir, 'README.md'), 'Temporary Codex 0.139 web-search real probe workspace.\n');
+    const outputFile = path.join(tempDir, 'last-message.txt');
+    const prompt = 'In code mode, use standalone web search to find the title of https://example.com or OpenAI Codex release 0.139. Return JSON {"used_web_search":true,"answer":"...","sources":[...]}.';
+    const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs: [] });
+    const result = await runProcess(codexBin, args, {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 120000,
+        maxOutputBytes: 512 * 1024,
+        stdoutFile: path.join(tempDir, 'codex.stdout.log'),
+        stderrFile: path.join(tempDir, 'codex.stderr.log')
+    }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err?.message || String(err)
+    }));
+    const output = await fs.readFile(outputFile, 'utf8').catch(() => '');
+    const combined = `${result.stdout || ''}\n${result.stderr || ''}\n${output}`;
+    const sawWebSearchEvent = /\b(web[_ -]?search|search_result|sources?|tool_call|standalone web search)\b/i.test(combined);
+    const sawPlaintextResult = /(Example Domain|example\.com|OpenAI|Codex|0\.139)/i.test(combined);
+    const resultContainsExpectedMarker = /"used_web_search"\s*:\s*true|used_web_search/i.test(combined) || sawWebSearchEvent;
+    const processExitedSuccessfully = result.code === 0;
+    const ok = sawPlaintextResult && resultContainsExpectedMarker;
+    if (ok) {
+        await writeJsonAtomic(path.join(input.root, '.sneakoscope', 'codex-0139-code-mode-web-search-policy.json'), {
+            schema: 'sks.codex-0139-code-mode-web-search-policy.v1',
+            ok: true,
+            generated_at: new Date().toISOString(),
+            allow_standalone_web_search_in_code_mode: true,
+            real_probe_verified: true,
+            evidence: {
+                saw_web_search_event: sawWebSearchEvent,
+                saw_plaintext_result: sawPlaintextResult,
+                result_contains_expected_marker: resultContainsExpectedMarker
+            }
+        });
+    }
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...args],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [tempDir, outputFile],
+        evidence: {
+            saw_web_search_event: sawWebSearchEvent,
+            saw_plaintext_result: sawPlaintextResult,
+            result_contains_expected_marker: resultContainsExpectedMarker,
+            process_exited_successfully: processExitedSuccessfully,
+            process_warning: processExitedSuccessfully ? null : 'Codex emitted web-search evidence before process timeout/nonzero exit.',
+            output_file: outputFile
+        },
+        blockers: ok ? [] : ['codex_web_search_real_probe_failed']
+    };
+}
+//# sourceMappingURL=codex-0139-web-search-probe.js.map

package/dist/core/doctor/codex-0139-doctor.js

@@ -0,0 +1,16 @@
+import path from 'node:path';
+import { readJson } from '../fsx.js';
+export async function readCodex0139DoctorRealProbeStatus(root) {
+    const summary = await readJson(path.join(root, '.sneakoscope', 'codex-0139-real-probe-summary.json'), null);
+    const result = await readJson(path.join(root, '.sneakoscope', 'codex-0139-real-probes.json'), null);
+    return {
+        schema: 'sks.doctor-codex-0139-real-probes.v1',
+        codex_cli_version: result?.version_text || null,
+        capability_version_flag: Boolean(result?.parsed_version && String(result.parsed_version).startsWith('0.139')),
+        real_probes_last_run_status: summary ? (summary.ok ? 'ok' : 'blocked') : 'not_run',
+        skipped_probes: result?.skipped || [],
+        strict_probe_command: 'npm run codex:0139-real-probes:require-real',
+        unsafe_auto_fix: false
+    };
+}
+//# sourceMappingURL=codex-0139-doctor.js.map

package/dist/core/doctor/doctor-readiness-matrix.js

@@ -58,6 +58,11 @@ export function buildDoctorReadinessMatrix(input = {}) {
             warnings.add(blocker);
     for (const warning of normalizeList(codex0138Doctor?.warnings))
         warnings.add(warning);
+    const codex0139RealProbes = input.codex_0139_real_probes || null;
+    if (codex0139RealProbes?.real_probes_last_run_status === 'blocked')
+        warnings.add('codex_0139_real_probes_blocked');
+    if (codex0139RealProbes?.real_probes_last_run_status === 'not_run')
+        warnings.add('codex_0139_real_probes_not_run');
     for (const warning of normalizeList(input.codex_plugin_app_template_policy?.doctor_warnings))
         warnings.add(warning);
     if (input.codex_lb?.ok === false)
@@ -116,6 +121,7 @@ export function buildDoctorReadinessMatrix(input = {}) {
         },
         codex_doctor: codexDoctor || null,
         codex_0138_doctor: codex0138Doctor,
+        codex_0139_real_probes: codex0139RealProbes,
         codex_plugin_inventory: input.codex_plugin_inventory || null,
         codex_plugin_app_template_policy: input.codex_plugin_app_template_policy || null,
         fast_mode_ready: input.fast_mode_ready !== false,

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '3.0.3';
+export const PACKAGE_VERSION = '3.0.4';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {
@@ -101,6 +101,30 @@ export async function readJson(p, fallback) {
 export async function writeJsonAtomic(p, data) {
     await writeTextAtomic(p, `${JSON.stringify(data, null, 2)}\n`);
 }
+export async function writeBinaryAtomic(p, data) {
+    await ensureDir(path.dirname(p));
+    try {
+        if ((await fsp.readFile(p)).equals(data))
+            return;
+    }
+    catch { }
+    const tmp = `${p}.${process.pid}.${randomId(6)}.tmp`;
+    try {
+        const handle = await fsp.open(tmp, 'w');
+        try {
+            await handle.writeFile(data);
+            await handle.sync().catch(() => { });
+        }
+        finally {
+            await handle.close().catch(() => { });
+        }
+        await fsp.rename(tmp, p);
+    }
+    catch (err) {
+        await fsp.rm(tmp, { force: true }).catch(() => { });
+        throw err;
+    }
+}
 export async function appendJsonl(p, obj) {
     await ensureDir(path.dirname(p));
     await fsp.appendFile(p, `${JSON.stringify(obj)}\n`, 'utf8');

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '3.0.3';
+export const PACKAGE_VERSION = '3.0.4';
 //# sourceMappingURL=version.js.map

package/dist/scripts/github-release-body-helper.js

@@ -7,6 +7,7 @@ const args = process.argv.slice(2);
 const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
 const truth = readJson('.sneakoscope/release-proof-truth.json') || readJson('dist/release-proof-truth.json');
 const codex0139 = readJson('.sneakoscope/codex-0139-capability.json');
+const codex0139Real = readJson('.sneakoscope/codex-0139-real-probe-summary.json');
 const zellij = readJson('.sneakoscope/reports/zellij-worker-pane-summary.json');
 const changelog = fs.readFileSync(path.join(root, 'CHANGELOG.md'), 'utf8');
 const latest = latestChangelogSection(changelog);
@@ -24,6 +25,7 @@ const body = [
     `Release proof truth: ${truth ? '.sneakoscope/release-proof-truth.json' : 'missing'}`,
     `Codex SDK package: ${sdkVersion || 'unknown'}`,
     `External Codex CLI 0.139 capability: ${codex0139 ? `${codex0139.ok ? 'ok' : 'blocked'}${codex0139.parsed_version ? ` (${codex0139.parsed_version})` : ''}` : 'not recorded'}`,
+    `Codex 0.139 real probes: ${codex0139Real ? `${codex0139Real.ok ? 'ok' : 'blocked'} (${codex0139Real.actual_cli_probe_count || 0} actual CLI, ${codex0139Real.skipped_count || 0} skipped, ${codex0139Real.failed_count || 0} failed)` : 'not run in this release environment. Hermetic fixture gates: passed.'}`,
     `Zellij stacked panes: ${zellij ? `${zellij.stacked_applied_count || 0}/${zellij.stacked_requested_count || 0} applied, fallback ${zellij.stacked_fallback_count || 0}, SLOTS anchors ${zellij.duplicate_slot_anchor_count || 0}` : 'not recorded'}`,
     `Packlist: ${truth?.npm_packlist_count ?? 'unknown'} files / ${truth?.npm_packlist_bytes ?? 'unknown'} bytes`,
     ...(warnings.length ? [`Warnings: ${warnings.join('; ')}`] : ['Warnings: none']),
@@ -34,7 +36,7 @@ const body = [
 if (args.includes('--check')) {
     assertGate(Boolean(truth && truth.schema === 'sks.release-proof-truth.v1'), 'release proof truth missing; run npm run release:proof-truth first');
     assertGate(latest.version === pkg.version, 'latest changelog section must match package version', { latest: latest.version, package: pkg.version });
-    assertGate(body.includes(`Version: ${pkg.version}`) && body.includes('Commit:') && body.includes('Dirty:') && body.includes('Release proof truth:') && body.includes('Codex SDK package:') && body.includes('External Codex CLI 0.139 capability:') && body.includes('Zellij stacked panes:') && body.includes('Packlist:'), 'github release body helper missing source truth fields', { body });
+    assertGate(body.includes(`Version: ${pkg.version}`) && body.includes('Commit:') && body.includes('Dirty:') && body.includes('Release proof truth:') && body.includes('Codex SDK package:') && body.includes('External Codex CLI 0.139 capability:') && body.includes('Codex 0.139 real probes:') && body.includes('Zellij stacked panes:') && body.includes('Packlist:'), 'github release body helper missing source truth fields', { body });
     assertGate(!warnings.some((warning) => warning.includes('package version') || warning.includes('changelog latest') || warning.includes('release proof truth missing')), 'github release body helper source truth warnings must not include version/proof mismatch', { warnings, body });
 }
 console.log(body);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -726,7 +726,19 @@
     "codex:0139-code-mode-web-search": "node ./dist/scripts/codex-0139-code-mode-web-search-check.js",
     "codex:0139-marketplace-source": "node ./dist/scripts/codex-0139-marketplace-source-check.js",
     "codex:0139-sandbox-profile-alias": "node ./dist/scripts/codex-0139-sandbox-profile-alias-check.js",
-    "codex:0139-real-probes": "node ./dist/scripts/codex-0139-real-probes-check.js --require-real",
+    "codex:0139-real-probes": "node ./dist/scripts/codex-0139-real-probes-check.js",
+    "codex:0139-real-probes:require-real": "node ./dist/scripts/codex-0139-real-probes-check.js --require-real --allow-network",
+    "codex:0139-code-mode-web-search-real": "node ./dist/scripts/codex-0139-code-mode-web-search-real-check.js",
+    "codex:0139-rich-tool-schema-real": "node ./dist/scripts/codex-0139-rich-tool-schema-real-check.js",
+    "codex:0139-doctor-env-real": "node ./dist/scripts/codex-0139-doctor-env-real-check.js",
+    "codex:0139-plugin-marketplace-real": "node ./dist/scripts/codex-0139-plugin-marketplace-real-check.js",
+    "codex:0139-plugin-cache-real": "node ./dist/scripts/codex-0139-plugin-cache-real-check.js",
+    "codex:0139-sandbox-profile-alias-real": "node ./dist/scripts/codex-0139-sandbox-profile-alias-real-check.js",
+    "codex:0139-interrupt-agent-real": "node ./dist/scripts/codex-0139-interrupt-agent-real-check.js",
+    "codex:0139-image-path-real": "node ./dist/scripts/codex-0139-image-path-real-check.js",
+    "codex:0139-sandbox-proxy-real": "node ./dist/scripts/codex-0139-sandbox-proxy-real-check.js",
+    "codex:0139-real-probe-summary": "node ./dist/scripts/codex-0139-real-probe-summary-check.js",
+    "doctor:codex-0139-real-probes": "node ./dist/scripts/doctor-codex-0139-real-probes-check.js",
     "zellij:fake-adapter": "node ./dist/scripts/zellij-fake-adapter-check.js",
     "zellij:pane-lock-open-worker-integration": "node ./dist/scripts/zellij-pane-lock-open-worker-integration-blackbox.js",
     "zellij:stacked-fallback-integration": "node ./dist/scripts/zellij-stacked-fallback-integration-blackbox.js",

package/schemas/codex/codex-0139-real-probe-result.schema.json

@@ -0,0 +1,85 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sneakoscope.local/schemas/codex/codex-0139-real-probe-result.schema.json",
+  "title": "SKS Codex 0.139 real probe result",
+  "type": "object",
+  "required": [
+    "schema",
+    "generated_at",
+    "codex_bin",
+    "version_text",
+    "parsed_version",
+    "require_real",
+    "overall_ok",
+    "probe_timeout_ms",
+    "probes",
+    "skipped",
+    "blockers"
+  ],
+  "properties": {
+    "schema": { "const": "sks.codex-0139-real-probe-result.v1" },
+    "generated_at": { "type": "string" },
+    "codex_bin": { "type": ["string", "null"] },
+    "version_text": { "type": ["string", "null"] },
+    "parsed_version": { "type": ["string", "null"] },
+    "require_real": { "type": "boolean" },
+    "overall_ok": { "type": "boolean" },
+    "probe_timeout_ms": { "type": "integer", "minimum": 1 },
+    "probes": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "code_mode_web_search",
+        "rich_tool_schema",
+        "doctor_env_redaction",
+        "marketplace_source_json",
+        "plugin_catalog_cache",
+        "sandbox_profile_alias",
+        "interrupt_agent_event",
+        "image_referenced_path",
+        "sandbox_proxy_preservation"
+      ],
+      "properties": {
+        "code_mode_web_search": { "$ref": "#/$defs/singleProbe" },
+        "rich_tool_schema": { "$ref": "#/$defs/singleProbe" },
+        "doctor_env_redaction": { "$ref": "#/$defs/singleProbe" },
+        "marketplace_source_json": { "$ref": "#/$defs/singleProbe" },
+        "plugin_catalog_cache": { "$ref": "#/$defs/singleProbe" },
+        "sandbox_profile_alias": { "$ref": "#/$defs/singleProbe" },
+        "interrupt_agent_event": { "$ref": "#/$defs/singleProbe" },
+        "image_referenced_path": { "$ref": "#/$defs/singleProbe" },
+        "sandbox_proxy_preservation": { "$ref": "#/$defs/singleProbe" }
+      }
+    },
+    "skipped": { "type": "array", "items": { "type": "string" } },
+    "blockers": { "type": "array", "items": { "type": "string" } }
+  },
+  "$defs": {
+    "singleProbe": {
+      "type": "object",
+      "required": ["ok", "mode", "duration_ms", "artifact_paths", "evidence", "blockers"],
+      "properties": {
+        "ok": { "type": "boolean" },
+        "mode": {
+          "enum": [
+            "actual-cli",
+            "actual-sdk",
+            "actual-app-server",
+            "actual-sks-bridge",
+            "captured-real-fixture",
+            "skipped"
+          ]
+        },
+        "command_line": { "type": "array", "items": { "type": "string" } },
+        "duration_ms": { "type": "integer", "minimum": 0 },
+        "stdout_tail": { "type": "string" },
+        "stderr_tail": { "type": "string" },
+        "artifact_paths": { "type": "array", "items": { "type": "string" } },
+        "evidence": { "type": "object" },
+        "blockers": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}