sneakoscope 4.0.1 → 4.0.3

package/dist/core/doctor/doctor-dirty-planner.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { hashJson } from '../triwiki/triwiki-cache-key.js';
+import { triWikiProofBankDir } from '../triwiki/triwiki-proof-bank.js';
 export const DOCTOR_DIRTY_PLAN_SCHEMA = 'sks.doctor-dirty-plan.v1';
 export function planDoctorDirtyRepair(root, phaseIds) {
     const phases = phaseIds.map((id) => {
@@ -13,6 +14,9 @@ export function planDoctorDirtyRepair(root, phaseIds) {
         if (markerState.input_hash !== inputHash) {
             return { id, status: 'dirty', reason: 'input_hash_changed', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired };
         }
+        if (markerState.proof_id && !proofExists(root, markerState.proof_id)) {
+            return { id, status: 'dirty', reason: 'clean_proof_missing', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: postcheckRequired };
+        }
         if (postcheckRequired && !markerState.postcheck_passed) {
             return { id, status: 'dirty', reason: 'postcheck_required', input_hash: inputHash, last_clean_proof_id: markerState.proof_id, postcheck_required: true };
         }
@@ -23,15 +27,17 @@ export function planDoctorDirtyRepair(root, phaseIds) {
         root,
         phases,
         dirty_count: phases.filter((phase) => phase.status === 'dirty').length,
-        clean_count: phases.filter((phase) => phase.status === 'clean').length
+        clean_count: phases.filter((phase) => phase.status === 'clean').length,
+        semantic_dirty_plan_path: dirtyPlanPath(root)
     };
     writeDirtyPlan(root, plan);
     return plan;
 }
-export function markDoctorPhaseClean(root, id) {
+export function markDoctorPhaseClean(root, id, proofId = `doctor-${id}-${Date.now()}`, postcheckPassed = true) {
     const file = markerPath(root, id);
     fs.mkdirSync(path.dirname(file), { recursive: true });
-    fs.writeFileSync(file, `${JSON.stringify({ schema: 'sks.doctor-dirty-clean-proof.v1', proof_id: `doctor-${id}-${Date.now()}`, cleaned_at: new Date().toISOString(), input_hash: phaseInputHash(root, id), postcheck_passed: true }, null, 2)}\n`);
+    fs.writeFileSync(file, `${JSON.stringify({ schema: 'sks.doctor-dirty-clean-proof.v1', proof_id: proofId, cleaned_at: new Date().toISOString(), input_hash: phaseInputHash(root, id), postcheck_passed: postcheckPassed }, null, 2)}\n`);
+    return proofId;
 }
 export function isDoctorPhaseClean(plan, id) {
     return plan?.phases.find((phase) => phase.id === id)?.status === 'clean';
@@ -58,10 +64,9 @@ function phaseInputHash(root, id) {
         const file = path.join(root, rel);
         if (!fs.existsSync(file))
             return { rel, hash: 'missing' };
-        const stat = fs.statSync(file);
-        return { rel, hash: stat.isDirectory() ? `dir:${stat.mtimeMs}` : hashJson({ size: stat.size, mtimeMs: stat.mtimeMs, text: stat.size < 512_000 ? fs.readFileSync(file, 'utf8') : '' }) };
+        return hashSemanticPath(root, rel);
     });
-    return hashJson({ id, files, env: phaseEnvPresence(id) });
+    return hashJson({ id, files, env: phaseEnvPresence(id), semantic_state: phaseSemanticState(root, id) });
 }
 function phaseInputFiles(id) {
     if (id.includes('zellij'))
@@ -84,12 +89,97 @@ function phaseEnvPresence(id) {
     const keys = id.includes('supabase') ? ['SUPABASE_ACCESS_TOKEN'] : id.includes('context7') ? ['CONTEXT7_API_KEY'] : [];
     return Object.fromEntries(keys.map((key) => [key, process.env[key] !== undefined]));
 }
+function phaseSemanticState(root, id) {
+    const config = readTextIfSmall(path.join(root, '.codex', 'config.toml'));
+    return {
+        zellij_capability_present: id.includes('zellij') ? fs.existsSync(path.join(root, 'src', 'core', 'zellij')) : undefined,
+        context7_transport: id.includes('context7') ? parseMcpTransport(config, 'context7') : undefined,
+        startup_config_targets: id.includes('startup') ? parseConfigTargets(config) : undefined,
+        supabase_env_present: id.includes('supabase') ? process.env.SUPABASE_ACCESS_TOKEN !== undefined : undefined,
+        skill_registry_hash: id.includes('skill') ? hashSemanticPath(root, '.agents/skills').hash : undefined,
+        native_capability_hash: id.includes('native') ? hashSemanticPath(root, 'src/core/codex-native').hash : undefined,
+        secret_fingerprint_hash: id.includes('secret') ? hashJson({ has_allowlist: fs.existsSync(path.join(root, 'safety-mutation-allowlist.json')) }) : undefined
+    };
+}
+function hashSemanticPath(root, rel) {
+    const absolute = path.join(root, rel);
+    if (!fs.existsSync(absolute))
+        return { rel, hash: 'missing' };
+    const stat = fs.lstatSync(absolute);
+    if (stat.isDirectory()) {
+        const records = walkFiles(absolute).map((file) => {
+            const fileStat = fs.lstatSync(file);
+            const relative = path.relative(root, file).replace(/\\/g, '/');
+            return fileStat.isSymbolicLink()
+                ? { path: relative, mode: 'symlink', target: fs.readlinkSync(file) }
+                : { path: relative, mode: 'file', hash: hashFile(file), size: fileStat.size };
+        });
+        return { rel, hash: hashJson(records) };
+    }
+    if (stat.isSymbolicLink())
+        return { rel, hash: hashJson({ mode: 'symlink', target: fs.readlinkSync(absolute) }) };
+    return { rel, hash: hashFile(absolute) };
+}
+function walkFiles(dir) {
+    const out = [];
+    const stack = [dir];
+    while (stack.length) {
+        const current = stack.pop();
+        if (!current)
+            continue;
+        for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+            const absolute = path.join(current, entry.name);
+            if (entry.isDirectory())
+                stack.push(absolute);
+            else if (entry.isFile() || entry.isSymbolicLink())
+                out.push(absolute);
+        }
+    }
+    return out.sort();
+}
+function hashFile(file) {
+    return hashJson({ text: fs.readFileSync(file, 'utf8') });
+}
+function readTextIfSmall(file) {
+    try {
+        const stat = fs.statSync(file);
+        if (stat.size > 512_000)
+            return '';
+        return fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        return '';
+    }
+}
+function parseMcpTransport(text, name) {
+    const block = text.match(new RegExp(`\\[mcp_servers\\.${name}\\]([\\s\\S]*?)(?:\\n\\[|$)`));
+    if (!block?.[1])
+        return null;
+    const transport = block[1].match(/transport\s*=\s*["']?([^"'\n]+)["']?/);
+    const command = block[1].match(/command\s*=\s*["']?([^"'\n]+)["']?/);
+    return transport?.[1]?.trim() || (command ? 'stdio' : 'unknown');
+}
+function parseConfigTargets(text) {
+    return [...text.matchAll(/config_file\s*=\s*["']([^"']+)["']/g)].map((match) => match[1] || '').filter(Boolean).sort();
+}
+function proofExists(root, proofId) {
+    const transaction = path.join(root, '.sneakoscope', 'reports', 'doctor-fix-transaction.json');
+    if (fs.existsSync(transaction) && fs.readFileSync(transaction, 'utf8').includes(proofId))
+        return true;
+    const bank = triWikiProofBankDir(root);
+    if (!fs.existsSync(bank))
+        return false;
+    return walkFiles(bank).some((file) => path.basename(file) === `${proofId}.json` || fs.readFileSync(file, 'utf8').includes(proofId));
+}
 function phaseRequiresPostcheck(id) {
     return /zellij|context7|startup|supabase|native|secret/i.test(id);
 }
 function writeDirtyPlan(root, plan) {
-    const file = path.join(root, '.sneakoscope', 'reports', 'doctor-dirty-plan.json');
+    const file = dirtyPlanPath(root);
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, `${JSON.stringify(plan, null, 2)}\n`);
 }
+function dirtyPlanPath(root) {
+    return path.join(root, '.sneakoscope', 'reports', 'doctor-dirty-plan.json');
+}
 //# sourceMappingURL=doctor-dirty-planner.js.map

package/dist/core/doctor/doctor-transaction.js

@@ -4,6 +4,7 @@ import { isDoctorPhaseClean, markDoctorPhaseClean } from './doctor-dirty-planner
 export async function runDoctorFixTransaction(input) {
     const startedAt = nowIso();
     const phases = [];
+    const proofIdsUsed = [];
     let rollbackPerformed = false;
     for (const definition of input.phases) {
         const phaseStarted = nowIso();
@@ -20,10 +21,13 @@ export async function runDoctorFixTransaction(input) {
             started_at: phaseStarted
         };
         if (isDoctorPhaseClean(input.dirtyPlan, definition.id)) {
+            const proofId = input.dirtyPlan?.phases.find((row) => row.id === definition.id)?.last_clean_proof_id;
+            if (proofId)
+                proofIdsUsed.push(proofId);
             phases.push({
                 ...phase,
                 ok: true,
-                warnings: ['dirty_plan_skipped_clean_phase'],
+                warnings: [`dirty_plan_skipped_clean_phase${proofId ? `:${proofId}` : ''}`],
                 completed_at: nowIso(),
                 duration_ms: Math.max(0, Date.now() - startedMs)
             });
@@ -59,8 +63,11 @@ export async function runDoctorFixTransaction(input) {
         }
         phase.completed_at = phase.completed_at || nowIso();
         phase.duration_ms = phase.duration_ms ?? Math.max(0, Date.now() - startedMs);
-        if (phase.ok)
-            markDoctorPhaseClean(input.root, definition.id);
+        if (phase.ok) {
+            const proofId = `doctor-${definition.id}-${Date.now()}`;
+            markDoctorPhaseClean(input.root, definition.id, proofId, true);
+            proofIdsUsed.push(proofId);
+        }
         phases.push(phase);
     }
     const writeInput = {
@@ -71,7 +78,11 @@ export async function runDoctorFixTransaction(input) {
     };
     if (input.reportPath !== undefined)
         writeInput.reportPath = input.reportPath;
-    return writeDoctorFixTransaction(writeInput);
+    return writeDoctorFixTransaction({
+        ...writeInput,
+        dirtyPlan: input.dirtyPlan || null,
+        proofIdsUsed
+    });
 }
 export async function writeDoctorFixTransaction(input) {
     const root = path.resolve(input.root);
@@ -99,7 +110,12 @@ export async function writeDoctorFixTransaction(input) {
         phases,
         postcheck_ok: postcheckOk,
         rollback_performed: input.rollbackPerformed === true,
-        raw_secret_values_recorded: false
+        raw_secret_values_recorded: false,
+        skipped_clean_phases: phases.filter((phase) => phase.warnings.some((warning) => warning.startsWith('dirty_plan_skipped_clean_phase'))).map((phase) => phase.id),
+        dirty_phases: input.dirtyPlan?.phases.filter((phase) => phase.status === 'dirty').map((phase) => phase.id) || phases.filter((phase) => !phase.warnings.some((warning) => warning.startsWith('dirty_plan_skipped_clean_phase'))).map((phase) => phase.id),
+        proof_ids_used: [...new Set(input.proofIdsUsed || [])].sort(),
+        saved_ms_estimate: phases.filter((phase) => phase.warnings.some((warning) => warning.startsWith('dirty_plan_skipped_clean_phase'))).length * 1000,
+        semantic_dirty_plan_path: input.dirtyPlan?.semantic_dirty_plan_path || null
     };
     if (input.reportPath !== null)
         await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'doctor-fix-transaction.json'), report).catch(() => undefined);

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.0.1';
+export const PACKAGE_VERSION = '4.0.3';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/providers/glm/glm-52-profile.js

@@ -0,0 +1,30 @@
+import { GLM_52_DEFAULT_REQUEST_SETTINGS, GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE } from './glm-52-settings.js';
+export const GLM_CODEX_APP_PROFILE_ID = 'sks/glm-5.2-mad';
+export const GLM_CODEX_APP_PROFILE_LABEL = 'GLM 5.2 (MAD / OpenRouter)';
+export function buildGlmCodexAppModelProfile() {
+    return {
+        schema: 'sks.codex-app-model-profile.v1',
+        id: GLM_CODEX_APP_PROFILE_ID,
+        label: GLM_CODEX_APP_PROFILE_LABEL,
+        provider: 'openrouter',
+        model: GLM_52_OPENROUTER_MODEL,
+        mode: GLM_MAD_MODE,
+        strictModelLock: true,
+        gptFallbackAllowed: false,
+        requiresSecret: 'openrouter-api-key',
+        defaultSettings: {
+            temperature: GLM_52_DEFAULT_REQUEST_SETTINGS.temperature,
+            top_p: GLM_52_DEFAULT_REQUEST_SETTINGS.top_p,
+            reasoning_effort: 'high',
+            tool_choice: 'auto',
+            parallel_tool_calls: false
+        },
+        codexCompatibility: {
+            target: 'rust-v0.141.0',
+            selectedExecutorPluginMcp: 'defer-to-codex-native',
+            duplicateAppMcpDeclarations: 'dedupe-by-codex',
+            cwdShellPathSemantics: 'preserve-codex-native'
+        }
+    };
+}
+//# sourceMappingURL=glm-52-profile.js.map

package/dist/core/providers/glm/glm-52-request.js

@@ -0,0 +1,34 @@
+import { GLM_52_DEFAULT_REQUEST_SETTINGS, GLM_52_OPENROUTER_MODEL, clampGlm52MaxTokens } from './glm-52-settings.js';
+export function buildGlm52Request(input) {
+    const request = {
+        model: GLM_52_OPENROUTER_MODEL,
+        messages: input.messages,
+        stream: input.stream ?? GLM_52_DEFAULT_REQUEST_SETTINGS.stream,
+        temperature: GLM_52_DEFAULT_REQUEST_SETTINGS.temperature,
+        top_p: GLM_52_DEFAULT_REQUEST_SETTINGS.top_p,
+        reasoning: { effort: input.reasoningEffort ?? 'high' },
+        max_tokens: clampGlm52MaxTokens(input.maxTokens),
+        tool_choice: input.toolChoice ?? 'auto',
+        parallel_tool_calls: input.parallelToolCalls ?? false,
+        provider: {
+            allow_fallbacks: false,
+            require_parameters: true,
+            sort: input.providerSort ?? 'throughput'
+        }
+    };
+    return {
+        ...request,
+        ...(input.tools ? { tools: input.tools } : {}),
+        ...(input.responseFormat ? { response_format: input.responseFormat } : {})
+    };
+}
+export function buildGlm52KeyValidationRequest() {
+    return buildGlm52Request({
+        messages: [{ role: 'user', content: 'Reply with OK.' }],
+        stream: false,
+        maxTokens: 1,
+        toolChoice: 'none',
+        parallelToolCalls: false
+    });
+}
+//# sourceMappingURL=glm-52-request.js.map

package/dist/core/providers/glm/glm-52-response-guard.js

@@ -0,0 +1,34 @@
+import { GLM_52_OPENROUTER_MODEL } from './glm-52-settings.js';
+export function assertGlm52ActualModel(responseModel) {
+    if (!responseModel) {
+        return {
+            ok: false,
+            code: 'glm_model_missing',
+            requestedModel: GLM_52_OPENROUTER_MODEL,
+            strictModelLock: true,
+            gptFallbackAllowed: false
+        };
+    }
+    const normalized = responseModel.toLowerCase();
+    if (normalized === GLM_52_OPENROUTER_MODEL ||
+        normalized.startsWith(`${GLM_52_OPENROUTER_MODEL}-`) ||
+        normalized.includes('glm-5.2')) {
+        return {
+            ok: true,
+            code: 'ok',
+            actualModel: responseModel,
+            requestedModel: GLM_52_OPENROUTER_MODEL,
+            strictModelLock: true,
+            gptFallbackAllowed: false
+        };
+    }
+    return {
+        ok: false,
+        code: 'glm_model_mismatch',
+        actualModel: responseModel,
+        requestedModel: GLM_52_OPENROUTER_MODEL,
+        strictModelLock: true,
+        gptFallbackAllowed: false
+    };
+}
+//# sourceMappingURL=glm-52-response-guard.js.map

package/dist/core/providers/glm/glm-52-settings.js

@@ -0,0 +1,26 @@
+export { OPENROUTER_CHAT_COMPLETIONS_URL } from '../openrouter/openrouter-types.js';
+export const GLM_52_OPENROUTER_MODEL = 'z-ai/glm-5.2';
+export const GLM_MAD_MODE = 'mad-glm';
+export const GLM_52_MAX_TOKENS_DEFAULT = 32768;
+export const GLM_52_MAX_TOKENS_LONG = 65536;
+export const GLM_52_MAX_TOKENS_XLONG = 131072;
+export const GLM_52_TOP_PROVIDER_MAX_COMPLETION_TOKENS = 262144;
+export const GLM_52_DEFAULT_REQUEST_SETTINGS = {
+    model: GLM_52_OPENROUTER_MODEL,
+    temperature: 1,
+    top_p: 0.95,
+    reasoning_effort: 'high',
+    stream: true,
+    provider: {
+        allow_fallbacks: false,
+        require_parameters: true
+    },
+    tool_choice: 'auto',
+    parallel_tool_calls: false,
+    max_tokens: GLM_52_MAX_TOKENS_DEFAULT
+};
+export function clampGlm52MaxTokens(value) {
+    const numeric = Number.isFinite(value) ? Math.floor(Number(value)) : GLM_52_MAX_TOKENS_DEFAULT;
+    return Math.max(1, Math.min(numeric, GLM_52_TOP_PROVIDER_MAX_COMPLETION_TOKENS));
+}
+//# sourceMappingURL=glm-52-settings.js.map

package/dist/core/providers/glm/glm-mad-mode.js

@@ -0,0 +1,242 @@
+import readline from 'node:readline/promises';
+import path from 'node:path';
+import { stdin as input, stdout as output } from 'node:process';
+import { printJson } from '../../../cli/output.js';
+import { flag } from '../../../cli/args.js';
+import { nowIso, writeJsonAtomic } from '../../fsx.js';
+import {} from '../openrouter/openrouter-types.js';
+import { sendOpenRouterChatCompletion } from '../openrouter/openrouter-client.js';
+import { resolveOpenRouterApiKey, writeStoredOpenRouterKey } from '../openrouter/openrouter-secret-store.js';
+import { redactOpenRouterKey } from '../../security/redact-secrets.js';
+import { buildGlmCodexAppModelProfile } from './glm-52-profile.js';
+import { buildGlm52KeyValidationRequest, buildGlm52Request } from './glm-52-request.js';
+import { assertGlm52ActualModel } from './glm-52-response-guard.js';
+import { GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE, OPENROUTER_CHAT_COMPLETIONS_URL } from './glm-52-settings.js';
+export async function runMadGlmMode(args = [], adapters = {}) {
+    const runtime = buildDefaultAdapters(adapters);
+    const repair = flag(args, '--repair');
+    const noSaveKey = flag(args, '--no-save-key');
+    const skipValidation = flag(args, '--skip-validation');
+    const json = flag(args, '--json');
+    const profile = buildGlmCodexAppModelProfile();
+    let result;
+    if (repair) {
+        const key = await runtime.promptSecret('OpenRouter API key is required for GLM 5.2 mode.\nEnter OpenRouter API key: ');
+        if (!key) {
+            result = baseResult({
+                status: 'blocked',
+                blockers: ['glm_key_prompt_cancelled'],
+                warnings: []
+            });
+        }
+        else {
+            if (!noSaveKey)
+                await runtime.writeSecret(key);
+            const validation = skipValidation
+                ? { ok: true, value: validationValue(null) }
+                : await runtime.validateOpenRouterKey(key);
+            result = validation.ok
+                ? baseResult({
+                    status: 'ready',
+                    ...(validation.value.actual_model ? { actual_model: validation.value.actual_model } : {}),
+                    openrouter_key_source: noSaveKey ? 'prompt' : 'user-secret-store',
+                    key_preview: redactOpenRouterKey(key),
+                    blockers: [],
+                    warnings: noSaveKey ? ['openrouter_key_not_saved'] : []
+                })
+                : baseResult({
+                    status: 'blocked',
+                    openrouter_key_source: noSaveKey ? 'prompt' : 'user-secret-store',
+                    key_preview: redactOpenRouterKey(key),
+                    blockers: [validation.error.code],
+                    warnings: []
+                });
+        }
+    }
+    else {
+        const resolved = await resolveOpenRouterApiKey({ env: runtime.env });
+        if (!resolved.key && process.stdin.isTTY) {
+            const key = await runtime.promptSecret('OpenRouter API key is required for GLM 5.2 mode.\nEnter OpenRouter API key: ');
+            if (!key) {
+                result = baseResult({ status: 'blocked', blockers: ['glm_key_prompt_cancelled'], warnings: [] });
+            }
+            else {
+                const save = noSaveKey ? false : await runtime.promptConfirm('Save this key for future SKS GLM runs? [Y/n] ', true);
+                if (save)
+                    await runtime.writeSecret(key);
+                result = baseResult({
+                    status: 'ready',
+                    openrouter_key_source: save ? 'user-secret-store' : 'prompt',
+                    key_preview: redactOpenRouterKey(key),
+                    blockers: [],
+                    warnings: save ? [] : ['openrouter_key_not_saved']
+                });
+            }
+        }
+        else if (!resolved.key) {
+            result = baseResult({
+                status: 'blocked',
+                blockers: resolved.blockers,
+                warnings: ['set_OPENROUTER_API_KEY_or_run_sks_--mad_--glm_--repair']
+            });
+        }
+        else {
+            result = baseResult({
+                status: 'ready',
+                ...(resolved.source ? { openrouter_key_source: resolved.source } : {}),
+                key_preview: resolved.key_preview,
+                blockers: [],
+                warnings: resolved.warnings
+            });
+        }
+    }
+    await writeGlmModeArtifacts(runtime.cwd, result, profile, runtime.nowIso()).catch(() => undefined);
+    if (json)
+        printJson(result);
+    else
+        printHumanGlmResult(result, runtime.log);
+    if (!result.ok)
+        process.exitCode = 1;
+    return result;
+}
+function baseResult(input) {
+    const result = {
+        schema: 'sks.glm-mode-result.v1',
+        ok: input.blockers.length === 0 && input.status !== 'failed',
+        status: input.status,
+        mode: GLM_MAD_MODE,
+        provider: 'openrouter',
+        model: GLM_52_OPENROUTER_MODEL,
+        requested_model: GLM_52_OPENROUTER_MODEL,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false,
+        codex_app_profile_id: 'sks/glm-5.2-mad',
+        blockers: input.blockers,
+        warnings: input.warnings
+    };
+    return {
+        ...result,
+        ...(input.actual_model ? { actual_model: input.actual_model } : {}),
+        ...(input.openrouter_key_source ? { openrouter_key_source: input.openrouter_key_source } : {}),
+        ...(input.key_preview !== undefined ? { key_preview: input.key_preview } : {})
+    };
+}
+function buildDefaultAdapters(overrides) {
+    return {
+        nowIso: overrides.nowIso || nowIso,
+        env: overrides.env || process.env,
+        cwd: overrides.cwd || process.cwd(),
+        promptSecret: overrides.promptSecret || promptLine,
+        promptConfirm: overrides.promptConfirm || promptConfirmLine,
+        writeSecret: overrides.writeSecret || (async (value) => {
+            await writeStoredOpenRouterKey(value);
+        }),
+        validateOpenRouterKey: overrides.validateOpenRouterKey || validateOpenRouterKey,
+        sendOpenRouterRequest: overrides.sendOpenRouterRequest || (async (request, key) => sendOpenRouterChatCompletion({ request, apiKey: key })),
+        log: overrides.log || ((message) => console.log(message))
+    };
+}
+async function validateOpenRouterKey(key) {
+    const response = await sendOpenRouterChatCompletion({
+        apiKey: key,
+        request: buildGlm52KeyValidationRequest()
+    });
+    if (!response.ok)
+        return response;
+    const guard = assertGlm52ActualModel(response.value.model);
+    if (!guard.ok) {
+        return {
+            ok: false,
+            error: {
+                code: guard.code,
+                message: 'GLM model lock violated.',
+                severity: 'blocked'
+            }
+        };
+    }
+    return { ok: true, value: validationValue(response.value.model || null) };
+}
+function validationValue(actualModel) {
+    return {
+        schema: 'sks.openrouter-key-validation.v1',
+        ok: true,
+        requested_model: GLM_52_OPENROUTER_MODEL,
+        actual_model: actualModel,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false
+    };
+}
+async function writeGlmModeArtifacts(cwd, result, profile, generatedAt) {
+    const dir = path.join(cwd, '.sneakoscope', 'glm');
+    await writeJsonAtomic(path.join(dir, 'mad-glm-session.json'), {
+        schema: 'sks.glm-mad-session.v1',
+        generated_at: generatedAt,
+        result,
+        profile_id: profile.id
+    });
+    await writeJsonAtomic(path.join(dir, 'openrouter-request-summary.json'), {
+        schema: 'sks.openrouter-request-summary.v1',
+        generated_at: generatedAt,
+        endpoint: OPENROUTER_CHAT_COMPLETIONS_URL,
+        model: GLM_52_OPENROUTER_MODEL,
+        temperature: 1,
+        top_p: 0.95,
+        reasoning_effort: 'high',
+        stream: true,
+        provider_allow_fallbacks: false,
+        require_parameters: true,
+        key_source: result.openrouter_key_source || null,
+        key_preview: result.key_preview || null
+    });
+    await writeJsonAtomic(path.join(dir, 'model-guard.json'), {
+        schema: 'sks.glm-model-guard.v1',
+        generated_at: generatedAt,
+        requested_model: GLM_52_OPENROUTER_MODEL,
+        actual_model: result.actual_model || null,
+        accepted: result.actual_model ? assertGlm52ActualModel(result.actual_model).ok : result.ok,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false,
+        blockers: result.blockers
+    });
+}
+function printHumanGlmResult(result, log) {
+    log(`GLM 5.2 MAD mode: ${result.ok ? result.status : 'blocked'}`);
+    log(`Model: ${result.model}`);
+    log(`GPT fallback: ${result.gpt_fallback_allowed ? 'allowed' : 'blocked'}`);
+    if (result.openrouter_key_source)
+        log(`OpenRouter key: ${result.openrouter_key_source} ${result.key_preview || ''}`.trim());
+    for (const blocker of result.blockers)
+        log(`- blocker: ${blocker}`);
+    for (const warning of result.warnings)
+        log(`- warning: ${warning}`);
+}
+async function promptLine(prompt) {
+    if (!process.stdin.isTTY)
+        return null;
+    const rl = readline.createInterface({ input, output });
+    try {
+        const answer = await rl.question(prompt);
+        return answer.trim() || null;
+    }
+    finally {
+        rl.close();
+    }
+}
+async function promptConfirmLine(prompt, defaultYes) {
+    if (!process.stdin.isTTY)
+        return defaultYes;
+    const answer = await promptLine(prompt);
+    if (!answer)
+        return defaultYes;
+    return !/^n(o)?$/i.test(answer);
+}
+export function buildGlmModeDryRunRequest() {
+    return buildGlm52Request({
+        messages: [{ role: 'user', content: 'SKS GLM dry run.' }],
+        stream: false,
+        maxTokens: 1,
+        toolChoice: 'none',
+        parallelToolCalls: false
+    });
+}
+//# sourceMappingURL=glm-mad-mode.js.map

package/dist/core/providers/openrouter/openrouter-client.js

@@ -0,0 +1,44 @@
+import { OPENROUTER_CHAT_COMPLETIONS_URL } from './openrouter-types.js';
+import { invalidOpenRouterResponseIssue, normalizeOpenRouterError } from './openrouter-error.js';
+import { redactOpenRouterString } from '../../security/redact-secrets.js';
+export async function sendOpenRouterChatCompletion(input) {
+    try {
+        const doFetch = input.fetchImpl || fetch;
+        const response = await doFetch(input.endpoint || OPENROUTER_CHAT_COMPLETIONS_URL, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${input.apiKey}`,
+                'Content-Type': 'application/json',
+                'X-OpenRouter-Title': 'Sneakoscope-Codex'
+            },
+            body: JSON.stringify(input.request)
+        });
+        const text = await response.text();
+        if (!response.ok)
+            return { ok: false, error: normalizeOpenRouterError(response.status, text) };
+        return parseOpenRouterResponse(text);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: {
+                code: 'glm_openrouter_request_failed',
+                message: redactOpenRouterString(err instanceof Error ? err.message : String(err)),
+                severity: 'failed'
+            }
+        };
+    }
+}
+export function parseOpenRouterResponse(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return { ok: false, error: invalidOpenRouterResponseIssue('OpenRouter response was not an object.', text) };
+        }
+        return { ok: true, value: parsed };
+    }
+    catch {
+        return { ok: false, error: invalidOpenRouterResponseIssue('OpenRouter response was not valid JSON.', text) };
+    }
+}
+//# sourceMappingURL=openrouter-client.js.map

package/dist/core/providers/openrouter/openrouter-error.js

@@ -0,0 +1,37 @@
+import { redactOpenRouterString } from '../../security/redact-secrets.js';
+export function normalizeOpenRouterError(status, body) {
+    const code = status === 401 || status === 403
+        ? 'glm_openrouter_unauthorized'
+        : status === 429
+            ? 'glm_openrouter_rate_limited'
+            : status >= 500
+                ? 'glm_openrouter_provider_unavailable'
+                : 'glm_openrouter_request_failed';
+    return {
+        code,
+        message: statusMessage(code),
+        severity: status >= 500 ? 'failed' : 'blocked',
+        status,
+        redacted_body_tail: redactOpenRouterString(body).slice(-2000)
+    };
+}
+export function invalidOpenRouterResponseIssue(message, body) {
+    const issue = {
+        code: 'glm_openrouter_invalid_response',
+        message,
+        severity: 'failed'
+    };
+    return body ? { ...issue, redacted_body_tail: redactOpenRouterString(body).slice(-2000) } : issue;
+}
+function statusMessage(code) {
+    if (code === 'glm_openrouter_unauthorized')
+        return 'OpenRouter rejected the GLM API key.';
+    if (code === 'glm_openrouter_rate_limited')
+        return 'OpenRouter rate limited the GLM request.';
+    if (code === 'glm_openrouter_provider_unavailable')
+        return 'OpenRouter provider is unavailable for GLM 5.2.';
+    if (code === 'glm_openrouter_invalid_response')
+        return 'OpenRouter returned an invalid response.';
+    return 'OpenRouter request failed.';
+}
+//# sourceMappingURL=openrouter-error.js.map