sneakoscope 3.0.3 → 3.1.0

package/README.md

@@ -35,7 +35,7 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **3.0.3** is Codex 0.139-aware while it bundles @openai/codex-sdk 0.138.0 at this release boundary. It detects and uses 0.139 features from the external Codex CLI when that CLI supports them, with release gates that include hermetic fixtures and optional real probes for code-mode web search markers, preserved `oneOf`/`allOf` tool schemas, plugin marketplace `source`, the `-P` profile alias, the multi-agent v2 `interrupt_agent` rename, Zellij stacked/fallback pane proof, pane-lock openWorkerPane integration, release cache safety fixtures, runtime proof summaries, and release proof source-truth artifacts. See [docs/codex-0.139-compat.md](docs/codex-0.139-compat.md).
+SKS **3.1.0** is Codex 0.139-aware while it bundles @openai/codex-sdk 0.138.0 at this release boundary. It detects and uses 0.139 features from the external Codex CLI when that CLI supports them, with release gates that include hermetic fixtures and actual real probes for code-mode web search, preserved `oneOf`/`allOf` tool schemas, doctor env redaction, plugin marketplace `source` and cache behavior, the `-P` profile alias, the multi-agent v2 `interrupt_agent` rename, image referenced-path routing, sandbox/proxy preservation, Zellij stacked/fallback pane proof, pane-lock openWorkerPane integration, release cache safety fixtures, runtime proof summaries, and release proof source-truth artifacts. See [docs/codex-0.139-compat.md](docs/codex-0.139-compat.md) and [docs/codex-0.139-real-probes.md](docs/codex-0.139-real-probes.md).
 
 SKS 3.0.0 was the parallel-runtime stabilization release. The whole live-swarm experience — what you actually *see* while 5, 20, or 100 workers run — was rebuilt and proven end-to-end.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "3.0.3"
+version = "3.1.0"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "3.0.3"
+version = "3.1.0"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 3.0.3"),
+        Some("--version") => println!("sks-rs 3.1.0"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/.sks-build-stamp.json

@@ -1,8 +1,8 @@
 {
   "schema": "sks.dist-build-stamp.v1",
   "package_name": "sneakoscope",
-  "package_version": "3.0.3",
-  "source_digest": "4630d65c17e3297a1a79b5b96be0b849ee4ada4ac1ff010a4e024b06d8b7b750",
-  "source_file_count": 2304,
-  "built_at_source_time": 1781142991546
+  "package_version": "3.1.0",
+  "source_digest": "0eed1c5f95e3d3e67d263680e28b27bfd1dabe232ff7265720a57d7d377252e8",
+  "source_file_count": 2392,
+  "built_at_source_time": 1781256416238
 }

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '3.0.3';
+const FAST_PACKAGE_VERSION = '3.1.0';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/command-registry.js

@@ -123,6 +123,7 @@ export const COMMANDS = {
     agent: entry('beta', 'Run native multi-session agent missions', 'dist/core/commands/agent-command.js', argsCommand(() => import('../core/commands/agent-command.js'), 'agentCommand', 'dist/core/commands/agent-command.js')),
     'with-local-llm': entry('beta', 'Enable or inspect local Ollama worker backend', 'dist/core/commands/local-model-command.js', argsCommand(() => import('../core/commands/local-model-command.js'), 'localModelCommand', 'dist/core/commands/local-model-command.js')),
     naruto: entry('labs', 'Run $Naruto shadow-clone swarm (up to 100 parallel sessions)', 'dist/core/commands/naruto-command.js', argsCommand(() => import('../core/commands/naruto-command.js'), 'narutoCommand', 'dist/core/commands/naruto-command.js')),
+    loop: entry('labs', 'Dynamic Loop Runtime: plan/run/status/proof loop graphs.', 'dist/core/commands/loop-command.js', subcommand(() => import('../core/commands/loop-command.js'), 'loopCommand', 'dist/core/commands/loop-command.js', 'help')),
     'qa-loop': entry('beta', 'Run QA loop missions', 'dist/core/commands/qa-loop-command.js', subcommand(() => import('../core/commands/qa-loop-command.js'), 'qaLoopCommand', 'dist/core/commands/qa-loop-command.js')),
     research: entry('labs', 'Run research missions', 'dist/core/commands/research-command.js', subcommand(() => import('../core/commands/research-command.js'), 'researchCommand', 'dist/core/commands/research-command.js')),
     autoresearch: entry('labs', 'Alias for research/autoresearch route', 'dist/core/commands/autoresearch-command.js', subcommand(() => import('../core/commands/autoresearch-command.js'), 'autoresearchCommand', 'dist/core/commands/autoresearch-command.js', 'status')),

package/dist/cli/context7-command.js

@@ -3,7 +3,7 @@ import { getCodexInfo } from '../core/codex-adapter.js';
 import { context7Docs, context7Resolve, context7Text, context7Tools } from '../core/context7-client.js';
 import { context7Evidence, recordContext7Evidence } from '../core/pipeline.js';
 import { stateFile } from '../core/mission.js';
-import { checkContext7, ensureProjectContext7Config } from './install-helpers.js';
+import { checkContext7, context7GlobalMcpStatus, ensureProjectContext7Config } from './install-helpers.js';
 const flag = (args, name) => args.includes(name);
 export async function context7Command(sub = 'check', args = []) {
     const action = sub || 'check';
@@ -92,9 +92,24 @@ export async function context7Command(sub = 'check', args = []) {
             timeoutMs: readNumberOption(args, '--timeout-ms', 30000)
         });
         const state = { ...(await readJson(stateFile(root), {})), mission_id: missionId };
-        await recordContext7Evidence(root, state, { tool_name: 'resolve-library-id', library: libraryNameOrId, library_id: result.library_id, source: result.resolve ? 'sks context7 evidence' : 'sks context7 evidence explicit-library-id' });
+        const evidenceQuery = readOption(args, '--query', readOption(args, '--topic', libraryNameOrId));
+        const evidenceTopic = readOption(args, '--topic', libraryNameOrId);
+        await recordContext7Evidence(root, state, {
+            tool_name: 'resolve-library-id',
+            library: libraryNameOrId,
+            library_id: result.library_id,
+            query: evidenceQuery,
+            source: result.resolve ? 'sks context7 evidence' : 'sks context7 evidence explicit-library-id'
+        });
         if (result.docs_tool) {
-            await recordContext7Evidence(root, state, { tool_name: result.docs_tool, library_id: result.library_id, source: 'sks context7 evidence' });
+            await recordContext7Evidence(root, state, {
+                tool_name: result.docs_tool,
+                library_id: result.library_id,
+                query: evidenceQuery,
+                topic: evidenceTopic,
+                tokens: readNumberOption(args, '--tokens', 2000),
+                source: 'sks context7 evidence'
+            });
         }
         const evidence = await context7Evidence(root, state);
         const out = { ...result, mission_id: missionId, evidence };
@@ -126,12 +141,21 @@ export async function context7Command(sub = 'check', args = []) {
         const codex = await getCodexInfo();
         if (!codex.bin)
             throw new Error('Codex CLI missing. Install separately: npm i -g @openai/codex, or set SKS_CODEX_BIN.');
+        const env = { ...process.env };
+        env.CODEX_LB_API_KEY = '';
+        const existing = await context7GlobalMcpStatus(codex.bin, env);
+        if (existing.present) {
+            if (flag(args, '--json'))
+                return console.log(JSON.stringify({ changed: false, status: 'present', codex_mcp_list: existing }, null, 2));
+            console.log('Context7 global MCP already configured; existing entry preserved.');
+            return;
+        }
         const cmdArgs = transport === 'remote'
             ? ['mcp', 'add', 'context7', '--url', 'https://mcp.context7.com/mcp']
             : ['mcp', 'add', 'context7', '--', 'npx', '-y', '@upstash/context7-mcp@latest'];
-        const result = await runProcess(codex.bin, cmdArgs, { timeoutMs: 30000, maxOutputBytes: 64 * 1024 });
+        const result = await runProcess(codex.bin, cmdArgs, { env, timeoutMs: 30000, maxOutputBytes: 64 * 1024 });
         if (flag(args, '--json'))
-            return console.log(JSON.stringify({ command: `${codex.bin} ${cmdArgs.join(' ')}`, result }, null, 2));
+            return console.log(JSON.stringify({ changed: result.code === 0, status: result.code === 0 ? 'installed' : 'failed', command: `${codex.bin} ${cmdArgs.join(' ')}`, result }, null, 2));
         if (result.code !== 0)
             throw new Error(result.stderr || result.stdout || 'codex mcp add failed');
         console.log('Context7 global MCP configured.');

package/dist/cli/install-helpers.js

@@ -2019,14 +2019,26 @@ async function ensureGlobalContext7DuringInstall() {
     if (!codex.bin)
         return { status: 'codex_missing' };
     const env = withoutSecretEnv(['CODEX_LB_API_KEY']);
-    const list = await runProcess(codex.bin, ['mcp', 'list'], { env, timeoutMs: 8000, maxOutputBytes: 32 * 1024 }).catch((err) => ({ code: 1, stderr: err.message, stdout: '' }));
-    if (list.code === 0 && /context7/i.test(`${list.stdout}\n${list.stderr}`))
+    const existing = await context7GlobalMcpStatus(codex.bin, env);
+    if (existing.present)
         return { status: 'present' };
     const add = await runProcess(codex.bin, ['mcp', 'add', 'context7', '--', 'npx', '-y', '@upstash/context7-mcp@latest'], { env, timeoutMs: 30000, maxOutputBytes: 64 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
     if (add.code === 0)
         return { status: 'installed' };
     return { status: 'failed', error: `${add.stderr || add.stdout || 'codex mcp add failed'}`.trim() };
 }
+export async function context7GlobalMcpStatus(codexBin, env = process.env) {
+    const list = await runProcess(codexBin, ['mcp', 'list'], { env, timeoutMs: 8000, maxOutputBytes: 32 * 1024 })
+        .catch((err) => ({ code: 1, stderr: err.message, stdout: '' }));
+    const output = `${list.stdout || ''}\n${list.stderr || ''}`;
+    return {
+        checked: true,
+        ok: list.code === 0,
+        present: list.code === 0 && /context7/i.test(output),
+        stdout: list.stdout || '',
+        stderr: list.stderr || ''
+    };
+}
 function withoutSecretEnv(keys = []) {
     const env = { ...process.env };
     for (const key of keys)
@@ -2348,11 +2360,7 @@ export async function ensureProjectContext7Config(root, transport = 'local') {
     const block = context7ConfigToml(transport).trim();
     const existingBlock = /(^|\n)\[mcp_servers\.context7\]\n[\s\S]*?(?=\n\[[^\]]+\]|\s*$)/;
     if (existingBlock.test(current)) {
-        const next = current.replace(existingBlock, `$1${block}\n`);
-        if (next === current)
-            return false;
-        await writeTextAtomic(configPath, next.endsWith('\n') ? next : `${next}\n`);
-        return true;
+        return false;
     }
     if (hasContext7ConfigText(current))
         return false;

package/dist/core/agents/runtime-proof-summary.js

@@ -3,6 +3,7 @@ import { findLatestMission, missionDir } from '../mission.js';
 import { readJson, writeJsonAtomic } from '../fsx.js';
 import { readAgentMessageBus } from './agent-message-bus.js';
 import { buildZellijWorkerPaneSummary } from '../zellij/zellij-worker-pane-summary.js';
+import { readLoopGraphProof, summarizeLoopGraphProof } from '../loops/loop-observability.js';
 export const RUNTIME_PROOF_SUMMARY_SCHEMA = 'sks.runtime-proof-summary.v1';
 export async function buildRuntimeProofSummary(root, missionIdInput = 'latest', opts = {}) {
     const missionId = missionIdInput === 'latest' ? await findLatestMission(root) : missionIdInput;
@@ -18,6 +19,7 @@ export async function buildRuntimeProofSummary(root, missionIdInput = 'latest',
     const messagesAll = await readAgentMessageBus(root, missionId, { max: 500 });
     const recentMessages = await readAgentMessageBus(root, missionId, { max: opts.maxMessages || 8 });
     const zellijSummary = await buildZellijWorkerPaneSummary(root, missionId).catch(() => null);
+    const loopSummary = summarizeLoopGraphProof(await readLoopGraphProof(root, missionId).catch(() => null));
     const failedMessages = messagesAll.filter((row) => row.event_type === 'worker_failed');
     const errorMessages = messagesAll.filter((row) => row.level === 'error');
     const telemetryAgeMs = telemetry?.updated_at ? Math.max(0, Date.now() - Date.parse(telemetry.updated_at)) : Number.MAX_SAFE_INTEGER;
@@ -73,6 +75,7 @@ export async function buildRuntimeProofSummary(root, missionIdInput = 'latest',
             pane_lock_held_p95_ms: Number(zellijSummary?.pane_lock_held_p95_ms || 0),
             duplicate_slot_anchor_count: Number(zellijSummary?.duplicate_slot_anchor_count || 0)
         },
+        loops: loopSummary,
         blockers
     };
     await writeJsonAtomic(path.join(agentsDir, 'runtime-proof-summary.json'), summary);
@@ -91,6 +94,7 @@ export function renderRuntimeProofSummary(summary) {
         `Stack fallback: ${summary.zellij.stacked_fallback_count}`,
         `Pane lock wait p95: ${summary.zellij.pane_lock_wait_p95_ms}ms`,
         `SLOTS anchors: ${summary.zellij.duplicate_slot_anchor_count}`,
+        `Loops: ${summary.loops.total} total / ${summary.loops.completed} done / ${summary.loops.blocked} blocked / ${summary.loops.speedup_ratio}x`,
         ...(summary.messages.recent.length ? [
             'Recent worker messages:',
             ...summary.messages.recent.map((row) => `  ${messageStatusLabel(row)} ${row.slot_id || row.worker_id}: ${row.message}`)

package/dist/core/codex-control/codex-0139-capability.js

@@ -53,6 +53,7 @@ export async function detectCodex0139Capability(input = {}) {
         version_text: versionText || null,
         parsed_version: parsed,
         supports_code_mode_web_search: codeSearchOk,
+        supports_code_mode_web_search_real_verified: false,
         supports_rich_tool_schemas: richSchemaOk,
         supports_doctor_env_details: doctorEnvOk,
         supports_marketplace_source_field: marketplaceOk,
@@ -111,7 +112,9 @@ async function probeCodex0139Features(codexBin, opts = {}) {
     const marketplace = await runProcess(codexBin, ['plugin', 'marketplace', 'list', '--json'], { timeoutMs, maxOutputBytes: 256 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
     const marketplaceListJson = marketplace.code === 0 && marketplaceSourcesPresent(marketplace.stdout) ? 'passed' : 'failed';
     const help = await runProcess(codexBin, ['--help'], { timeoutMs, maxOutputBytes: 256 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
-    const aliasOk = help.code === 0 && /(^|\s)-P[,\s]/m.test(String(help.stdout || ''));
+    const sandboxHelp = await runProcess(codexBin, ['sandbox', '--help'], { timeoutMs, maxOutputBytes: 256 * 1024 }).catch(() => ({ code: 1, stdout: '' }));
+    const aliasOk = help.code === 0 && codexHelpSupportsSandboxProfileAlias(help.stdout)
+        || sandboxHelp.code === 0 && codexHelpSupportsSandboxProfileAlias(sandboxHelp.stdout);
     return {
         marketplace_list_json: marketplaceListJson,
         sandbox_profile_alias: aliasOk ? 'passed' : 'failed',
@@ -127,14 +130,16 @@ export function marketplaceSourcesPresent(stdout) {
         const rows = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.marketplaces) ? parsed.marketplaces : Array.isArray(parsed?.items) ? parsed.items : [];
         if (!rows.length)
             return true;
-        return rows.every((row) => typeof row?.source === 'string' && row.source.length > 0);
+        return rows.every((row) => typeof row?.source === 'string' && row.source.length > 0
+            || typeof row?.marketplaceSource?.source === 'string' && row.marketplaceSource.source.length > 0
+            || typeof row?.root === 'string' && row.root.length > 0);
     }
     catch {
         return false;
     }
 }
 export function codexHelpSupportsSandboxProfileAlias(stdout) {
-    return /(^|\s)-P[,\s]+--profile\b|--profile[,\s]+-P\b|(^|\s)-P\b/m.test(String(stdout || ''));
+    return /(^|\s)-P[,\s]+--(?:permissions-)?profile\b|--(?:permissions-)?profile[,\s]+-P\b|(^|\s)-P\b/m.test(String(stdout || ''));
 }
 export function redactCodexDoctorEnvDetails(value) {
     if (Array.isArray(value))

package/dist/core/codex-control/codex-0139-doctor-real-probe.js

@@ -0,0 +1,64 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess } from '../fsx.js';
+import { redactCodexDoctorEnvDetails } from './codex-0139-capability.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139DoctorEnvRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `doctor-${Date.now()}`);
+    await ensureDir(tempDir);
+    const env = {
+        ...process.env,
+        EDITOR: 'vim',
+        PAGER: 'less',
+        TERM: 'xterm-256color',
+        OPENAI_API_KEY: 'sk-test-secret-value',
+        CODEX_AUTH_TOKEN: 'test-secret-token'
+    };
+    const result = await runProcess(codexBin, ['doctor', '--json'], {
+        cwd: tempDir,
+        env,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024,
+        stdoutFile: path.join(tempDir, 'codex-doctor.stdout.json'),
+        stderrFile: path.join(tempDir, 'codex-doctor.stderr.log')
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const combined = `${result.stdout || ''}\n${result.stderr || ''}`;
+    const redacted = redactCodexDoctorEnvDetails(parseJson(result.stdout) || combined);
+    const redactedText = JSON.stringify(redacted);
+    const editorPagerPresent = /(EDITOR|editor|vim)/.test(combined) && /(PAGER|pager|less)/.test(combined);
+    const rawSecretAbsent = !combined.includes('sk-test-secret-value') && !combined.includes('test-secret-token');
+    const redactedMarkerOrOmitted = rawSecretAbsent || /redacted|omitted|hidden/i.test(combined);
+    const processExitedSuccessfully = result.code === 0;
+    const ok = editorPagerPresent && rawSecretAbsent && redactedMarkerOrOmitted;
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, 'doctor', '--json'],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [tempDir],
+        evidence: {
+            editor_pager_present: editorPagerPresent,
+            raw_secret_absent: rawSecretAbsent,
+            redacted_marker_or_omitted: redactedMarkerOrOmitted,
+            redacted_sample_contains_secret: redactedText.includes('sk-test-secret-value') || redactedText.includes('test-secret-token'),
+            process_exited_successfully: processExitedSuccessfully,
+            process_warning: processExitedSuccessfully ? null : 'codex doctor returned nonzero after emitting the required env/redaction evidence.'
+        },
+        blockers: ok ? [] : ['codex_doctor_env_redaction_real_probe_failed']
+    };
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(String(text || ''));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=codex-0139-doctor-real-probe.js.map

package/dist/core/codex-control/codex-0139-image-path-real-probe.js

@@ -0,0 +1,94 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildCodexExecArgs, findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeBinaryAtomic } from '../fsx.js';
+import { buildImageArtifactPathContract } from '../image/image-artifact-path-contract.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+const ONE_BY_ONE_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=', 'base64');
+export async function runCodex0139ImageReferencedPathRealProbe(input) {
+    const started = Date.now();
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `image-path-${Date.now()}`);
+    await ensureDir(tempDir);
+    const inputA = path.join(tempDir, 'input-a.png');
+    const inputB = path.join(tempDir, 'input-b.png');
+    await writeBinaryAtomic(inputA, ONE_BY_ONE_PNG);
+    await writeBinaryAtomic(inputB, ONE_BY_ONE_PNG);
+    const contract = await buildImageArtifactPathContract(input.root, {
+        missionId: 'codex-0139-image-path-real-probe',
+        images: [
+            { id: 'input-a', kind: 'input_attachment', filePath: inputA, route: 'codex-0139-real-probe', stage: 'candidate' },
+            { id: 'input-b', kind: 'input_attachment', filePath: inputB, route: 'codex-0139-real-probe', stage: 'referenced' }
+        ]
+    });
+    const codexBin = input.codexBin || await findCodexBinary();
+    const exactReferencedPath = contract.images.find((image) => image.id === 'input-b')?.file_path === inputB;
+    if (!codexBin) {
+        return {
+            ...skippedCodex0139Probe('codex_cli_missing', {
+                codex_bin: codexBin,
+                created_images: [inputA, inputB],
+                exact_referenced_path_contract: exactReferencedPath,
+                contract_blockers: contract.blockers
+            }),
+            duration_ms: Date.now() - started,
+            artifact_paths: [tempDir]
+        };
+    }
+    if (process.env.SKS_CODEX_0139_IMAGE_REAL_PROBE_ALLOW_SKIP === '1') {
+        return {
+            ...skippedCodex0139Probe('codex_image_edit_actual_api_skipped', {
+                codex_bin: codexBin,
+                created_images: [inputA, inputB],
+                exact_referenced_path_contract: exactReferencedPath,
+                contract_blockers: contract.blockers
+            }),
+            duration_ms: Date.now() - started,
+            artifact_paths: [tempDir]
+        };
+    }
+    const outputFile = path.join(tempDir, 'last-message.txt');
+    const prompt = [
+        'This is a Codex 0.139 image path routing probe.',
+        `Only the image file named ${path.basename(inputB)} is intentionally referenced.`,
+        `Return compact JSON {"referenced_path":"${inputB.replace(/\\/g, '\\\\')}","saw_image":true}.`,
+        'Do not edit files and do not reference any other image path.'
+    ].join(' ');
+    const extraArgs = ['--image', inputB, '--skip-git-repo-check', '--ephemeral'];
+    const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs });
+    const result = await runProcess(codexBin, args, {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const outputText = await fs.readFile(outputFile, 'utf8').catch(() => '');
+    const combined = `${result.stdout || ''}\n${result.stderr || ''}\n${outputText}`;
+    const commandReferencesOnlyInputB = args.includes(inputB) && !args.includes(inputA);
+    const outputReferencesInputB = combined.includes(inputB);
+    const processExitedSuccessfully = result.code === 0;
+    const ok = exactReferencedPath
+        && commandReferencesOnlyInputB
+        && outputReferencesInputB
+        && contract.blockers.length === 0;
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...args],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [tempDir, outputFile],
+        evidence: {
+            created_images: [inputA, inputB],
+            referenced_path: inputB,
+            exact_referenced_path_contract: exactReferencedPath,
+            command_references_only_input_b: commandReferencesOnlyInputB,
+            output_references_input_b: outputReferencesInputB,
+            process_exited_successfully: processExitedSuccessfully,
+            process_warning: processExitedSuccessfully ? null : 'Codex emitted the referenced path evidence before process timeout/nonzero exit.',
+            output_file: outputFile,
+            contract_blockers: contract.blockers
+        },
+        blockers: ok ? [] : ['codex_image_referenced_path_actual_cli_probe_failed']
+    };
+}
+//# sourceMappingURL=codex-0139-image-path-real-probe.js.map

package/dist/core/codex-control/codex-0139-multi-agent-real-probe.js

@@ -0,0 +1,107 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeJsonAtomic } from '../fsx.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export function normalizeCodex0139InterruptAgentEvent(event) {
+    const name = String(event?.tool || event?.item?.tool || event?.type || event?.event || event?.name || '');
+    return name === 'interrupt_agent' || name === 'close_agent' ? { ...event, canonical: 'subagent_result', stage: 'result' } : event;
+}
+export async function runCodex0139InterruptAgentRealProbe(input = {}) {
+    const started = Date.now();
+    if (process.env.SKS_CODEX_0139_ALLOW_CAPTURED_EVENT_FIXTURE === '1') {
+        const event = normalizeCodex0139InterruptAgentEvent({ type: 'interrupt_agent', agent_id: 'captured-real-doc-sample' });
+        return {
+            ok: event.stage === 'result',
+            mode: 'captured-real-fixture',
+            duration_ms: Date.now() - started,
+            artifact_paths: [],
+            evidence: {
+                saw_interrupt_agent_event: true,
+                normalized_stage: event.stage,
+                fixture_allowed_by_env: true
+            },
+            blockers: event.stage === 'result' ? [] : ['codex_interrupt_agent_normalization_failed']
+        };
+    }
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const root = input.root || process.cwd();
+    const tempDir = path.join(root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `interrupt-agent-${Date.now()}`);
+    await ensureDir(tempDir);
+    const prompt = 'No file edits. Spawn one tiny subagent named interrupt_probe that only says ready. Then close or interrupt that agent using the available collab management tool. Final answer exactly: interrupt probe done.';
+    const args = ['exec', '--json', '--skip-git-repo-check', '--ephemeral', '--ignore-rules', '--disable', 'hooks', '-s', 'read-only', '-C', tempDir, prompt];
+    const result = await runProcess(codexBin, args, {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 120000,
+        maxOutputBytes: 1024 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const events = parseJsonlEvents(`${result.stdout || ''}\n${result.stderr || ''}`);
+    const tools = events
+        .map((event) => String(event?.item?.tool || event?.tool || ''))
+        .filter(Boolean);
+    const sawSpawn = tools.includes('spawn_agent');
+    const sawInterrupt = tools.includes('interrupt_agent');
+    const sawClose = tools.includes('close_agent');
+    const closeOrInterruptEvent = events.find((event) => ['interrupt_agent', 'close_agent'].includes(String(event?.item?.tool || event?.tool || '')));
+    const normalized = normalizeCodex0139InterruptAgentEvent(closeOrInterruptEvent?.item || closeOrInterruptEvent || {});
+    const finalText = events.map((event) => String(event?.item?.text || '')).find((text) => /interrupt probe done/i.test(text)) || '';
+    const ok = result.code === 0 && sawSpawn && (sawInterrupt || sawClose) && normalized.stage === 'result';
+    const artifact = path.join(root, '.sneakoscope', 'codex-0139-interrupt-agent-real.json');
+    await writeJsonAtomic(artifact, {
+        schema: 'sks.codex-0139-interrupt-agent-real.v1',
+        ok,
+        generated_at: new Date().toISOString(),
+        command_line: [codexBin, ...args],
+        event_count: events.length,
+        tools,
+        saw_spawn_agent_event: sawSpawn,
+        saw_interrupt_agent_event: sawInterrupt,
+        saw_close_agent_event: sawClose,
+        normalized_stage: normalized.stage || null,
+        final_text_seen: Boolean(finalText),
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr)
+    });
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...args],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [artifact, tempDir],
+        evidence: {
+            event_count: events.length,
+            collab_tools_seen: [...new Set(tools)],
+            saw_spawn_agent_event: sawSpawn,
+            saw_interrupt_agent_event: sawInterrupt,
+            saw_close_agent_event: sawClose,
+            close_agent_used_as_actual_interrupt_surface: sawClose && !sawInterrupt,
+            normalized_stage: normalized.stage || null,
+            final_text_seen: Boolean(finalText)
+        },
+        blockers: ok ? [] : [
+            ...(result.code === 0 ? [] : ['codex_interrupt_agent_exec_failed']),
+            ...(sawSpawn ? [] : ['codex_interrupt_agent_spawn_event_missing']),
+            ...(sawInterrupt || sawClose ? [] : ['codex_interrupt_agent_or_close_event_missing']),
+            ...(normalized.stage === 'result' ? [] : ['codex_interrupt_agent_normalization_failed'])
+        ]
+    };
+}
+function parseJsonlEvents(text) {
+    return String(text || '')
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith('{') && line.endsWith('}'))
+        .map((line) => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter(Boolean);
+}
+//# sourceMappingURL=codex-0139-multi-agent-real-probe.js.map

package/dist/core/codex-control/codex-0139-plugin-real-probes.js

@@ -0,0 +1,119 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess, writeJsonAtomic } from '../fsx.js';
+import { marketplaceSourcesPresent } from './codex-0139-capability.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+export async function runCodex0139MarketplaceSourceRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `marketplace-${Date.now()}`);
+    await ensureDir(tempDir);
+    const result = await runProcess(codexBin, ['plugin', 'marketplace', 'list', '--json'], {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const rows = parseRows(result.stdout);
+    const missingSourceRows = rows
+        .map((row, index) => ({ index, name: String(row?.name || row?.id || row?.pluginId || `row-${index + 1}`), keys: Object.keys(row || {}), root: typeof row?.root === 'string' ? row.root : null }))
+        .filter((row, index) => !rowHasMarketplaceSourceLocator(rows[index]));
+    const ok = result.code === 0 && marketplaceSourcesPresent(result.stdout);
+    const artifact = path.join(input.root, '.sneakoscope', 'codex-0139-plugin-marketplace-real.json');
+    await writeJsonAtomic(artifact, {
+        schema: 'sks.codex-0139-plugin-marketplace-real.v1',
+        ok,
+        generated_at: new Date().toISOString(),
+        command_line: [codexBin, 'plugin', 'marketplace', 'list', '--json'],
+        empty_marketplace_list: rows.length === 0,
+        row_count: rows.length,
+        rows_have_source: rows.every(rowHasMarketplaceSource),
+        rows_have_source_locator: rows.every(rowHasMarketplaceSourceLocator),
+        missing_source_rows: missingSourceRows,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr)
+    });
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, 'plugin', 'marketplace', 'list', '--json'],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [artifact],
+        evidence: {
+            empty_marketplace_list: rows.length === 0,
+            row_count: rows.length,
+            rows_have_source: rows.every(rowHasMarketplaceSource),
+            rows_have_source_locator: rows.every(rowHasMarketplaceSourceLocator),
+            missing_source_rows: missingSourceRows
+        },
+        blockers: ok ? [] : ['codex_plugin_marketplace_source_real_probe_failed']
+    };
+}
+function rowHasMarketplaceSource(row) {
+    return typeof row?.source === 'string' && row.source.length > 0
+        || typeof row?.marketplaceSource?.source === 'string' && row.marketplaceSource.source.length > 0;
+}
+function rowHasMarketplaceSourceLocator(row) {
+    return rowHasMarketplaceSource(row) || typeof row?.root === 'string' && row.root.length > 0;
+}
+export async function runCodex0139PluginCacheRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `plugin-cache-${Date.now()}`);
+    await ensureDir(tempDir);
+    const firstStarted = Date.now();
+    const first = await runProcess(codexBin, ['plugin', 'list', '--json'], {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const firstMs = Date.now() - firstStarted;
+    const secondStarted = Date.now();
+    const second = await runProcess(codexBin, ['plugin', 'list', '--json'], {
+        cwd: tempDir,
+        timeoutMs: input.timeoutMs || 60000,
+        maxOutputBytes: 512 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+    const secondMs = Date.now() - secondStarted;
+    const marker = /cache|cached|catalog|remote/i.test(`${first.stdout}\n${second.stdout}\n${first.stderr}\n${second.stderr}`);
+    const secondNotMuchSlower = secondMs <= Math.max(firstMs * 2, firstMs + 1000);
+    const ok = first.code === 0 && second.code === 0 && secondNotMuchSlower;
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, 'plugin', 'list', '--json'],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(`${first.stdout || ''}\n${second.stdout || ''}`),
+        stderr_tail: codex0139ProbeTail(`${first.stderr || ''}\n${second.stderr || ''}`),
+        artifact_paths: [tempDir],
+        evidence: {
+            first_duration_ms: firstMs,
+            second_duration_ms: secondMs,
+            second_not_slower_than_2x: secondNotMuchSlower,
+            cache_marker_seen: marker,
+            cache_marker_warning: marker ? null : 'cache marker unavailable; timing success accepted'
+        },
+        blockers: ok ? [] : ['codex_plugin_catalog_cache_real_probe_failed']
+    };
+}
+function parseRows(stdout) {
+    try {
+        const parsed = JSON.parse(String(stdout || ''));
+        if (Array.isArray(parsed))
+            return parsed;
+        if (Array.isArray(parsed?.marketplaces))
+            return parsed.marketplaces;
+        if (Array.isArray(parsed?.items))
+            return parsed.items;
+        return [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=codex-0139-plugin-real-probes.js.map