sneakoscope 4.0.13 → 4.0.15

package/dist/core/codex-control/codex-app-server-v2-client.js

@@ -0,0 +1,211 @@
+import { spawn } from 'node:child_process';
+import { nowIso } from '../fsx.js';
+import { resolveCodexRuntime } from '../codex-runtime/resolve-codex-runtime.js';
+export class CodexAppServerV2Client {
+    command;
+    args;
+    env;
+    cwd;
+    timeoutMs;
+    currentTimeProvider;
+    child = null;
+    nextId = 1;
+    pending = new Map();
+    notifications = [];
+    stdoutBuffer = '';
+    stderr = '';
+    constructor(options) {
+        this.command = options.command;
+        this.args = options.args || ['app-server', '--stdio'];
+        this.env = options.env || process.env;
+        this.cwd = options.cwd || process.cwd();
+        this.timeoutMs = Number(options.timeoutMs || 20_000);
+        this.currentTimeProvider = options.currentTimeProvider || (() => new Date());
+    }
+    async initialize() {
+        this.start();
+        const result = await this.request('initialize', {
+            clientInfo: {
+                name: 'sneakoscope-codex-app-server-v2',
+                title: 'Sneakoscope Codex app-server v2',
+                version: '4.0.15'
+            },
+            capabilities: {
+                experimentalApi: true,
+                requestAttestation: false,
+                optOutNotificationMethods: []
+            }
+        });
+        this.notify('notifications/initialized', {});
+        return result;
+    }
+    async listThreads(params = {}) {
+        return await this.request('thread/list', normalizeThreadListParams(params));
+    }
+    async searchThreads(searchTerm, params = {}) {
+        return await this.listThreads({ ...params, searchTerm });
+    }
+    async readThread(threadId, includeTurns = false) {
+        return await this.request('thread/read', { threadId, includeTurns });
+    }
+    start() {
+        if (this.child)
+            return;
+        this.child = spawn(this.command, [...this.args], {
+            stdio: ['pipe', 'pipe', 'pipe'],
+            shell: false,
+            env: this.env,
+            cwd: this.cwd
+        });
+        this.child.stdout.on('data', (chunk) => this.handleStdout(chunk));
+        this.child.stderr.on('data', (chunk) => {
+            this.stderr += chunk.toString('utf8');
+            if (this.stderr.length > 64 * 1024)
+                this.stderr = this.stderr.slice(-64 * 1024);
+        });
+        this.child.on('error', (err) => this.rejectAll(err));
+        this.child.on('close', (code, signal) => {
+            this.rejectAll(new Error(`Codex app-server exited before response (code ${code ?? signal ?? 'unknown'}). ${this.stderr.trim()}`.trim()));
+        });
+    }
+    request(method, params) {
+        this.start();
+        const id = this.nextId++;
+        const message = { jsonrpc: '2.0', id, method, params };
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error(`Codex app-server request timed out: ${method}. ${this.stderr.trim()}`.trim()));
+            }, this.timeoutMs);
+            timer.unref?.();
+            this.pending.set(id, { method, resolve, reject, timer });
+            this.write(message);
+        });
+    }
+    notify(method, params) {
+        this.start();
+        this.write({ jsonrpc: '2.0', method, params });
+    }
+    handleStdout(chunk) {
+        this.stdoutBuffer += chunk.toString('utf8');
+        const lines = this.stdoutBuffer.split(/\r?\n/);
+        this.stdoutBuffer = lines.pop() || '';
+        for (const line of lines) {
+            if (!line.trim())
+                continue;
+            let message;
+            try {
+                message = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (message.id !== undefined && this.pending.has(message.id)) {
+                this.resolvePending(message);
+            }
+            else if (message.id !== undefined && typeof message.method === 'string') {
+                void this.respondToServerRequest(message);
+            }
+            else {
+                this.notifications.push({ ...message, received_at: nowIso() });
+            }
+        }
+    }
+    async respondToServerRequest(message) {
+        const id = message.id;
+        const method = String(message.method || '');
+        try {
+            if (method === 'currentTime/read') {
+                this.write({ jsonrpc: '2.0', id, result: currentTimeResponse(this.currentTimeProvider()) });
+                return;
+            }
+            this.write({
+                jsonrpc: '2.0',
+                id,
+                error: { code: -32601, message: `Unsupported Codex app-server request: ${method}` }
+            });
+        }
+        catch (err) {
+            this.write({
+                jsonrpc: '2.0',
+                id,
+                error: { code: -32603, message: err instanceof Error ? err.message : String(err) }
+            });
+        }
+    }
+    resolvePending(message) {
+        const id = message.id;
+        const pending = this.pending.get(id);
+        if (!pending)
+            return;
+        this.pending.delete(id);
+        clearTimeout(pending.timer);
+        if (message.error)
+            pending.reject(new Error(jsonRpcErrorMessage(pending.method, message.error)));
+        else
+            pending.resolve(message.result);
+    }
+    rejectAll(err) {
+        for (const [id, pending] of this.pending.entries()) {
+            clearTimeout(pending.timer);
+            pending.reject(err);
+            this.pending.delete(id);
+        }
+    }
+    async close() {
+        if (!this.child)
+            return;
+        const child = this.child;
+        this.child = null;
+        child.stdin.end();
+        child.kill('SIGTERM');
+    }
+    write(message) {
+        this.child?.stdin.write(`${JSON.stringify(message)}\n`);
+    }
+}
+export async function createCodexAppServerV2Client(options = {}) {
+    const runtime = await resolveCodexRuntime({
+        explicitPath: options.codexBin || null,
+        requestedBy: options.requestedBy || 'codex-app-server-v2-client'
+    });
+    if (!runtime.identity)
+        throw new Error(`Codex runtime not found: ${runtime.blockers.join(',')}`);
+    const clientOptions = { command: runtime.identity.realpath };
+    if (options.args !== undefined)
+        clientOptions.args = options.args;
+    if (options.cwd !== undefined)
+        clientOptions.cwd = options.cwd;
+    if (options.env !== undefined)
+        clientOptions.env = options.env;
+    if (options.timeoutMs !== undefined)
+        clientOptions.timeoutMs = options.timeoutMs;
+    if (options.currentTimeProvider !== undefined)
+        clientOptions.currentTimeProvider = options.currentTimeProvider;
+    return {
+        client: new CodexAppServerV2Client(clientOptions),
+        runtimeIdentity: runtime.identity
+    };
+}
+export function currentTimeResponse(date) {
+    return {
+        utcIso: date.toISOString(),
+        unixTimeSeconds: Math.floor(date.getTime() / 1000),
+        unixTimeMilliseconds: date.getTime(),
+        timezone: 'UTC'
+    };
+}
+function normalizeThreadListParams(params) {
+    const out = {};
+    for (const [key, value] of Object.entries(params)) {
+        if (value !== undefined)
+            out[key] = value;
+    }
+    return out;
+}
+function jsonRpcErrorMessage(method, error) {
+    if (error && typeof error === 'object' && 'message' in error)
+        return `${method}: ${String(error.message)}`;
+    return `${method}: ${JSON.stringify(error)}`;
+}
+//# sourceMappingURL=codex-app-server-v2-client.js.map

package/dist/core/codex-control/codex-sdk-adapter.js

@@ -1,23 +1,33 @@
 import path from 'node:path';
 import { appendJsonl } from '../fsx.js';
-import { buildCodexSdkConfig } from './codex-sdk-config-policy.js';
+import { buildCodexExecutionPolicy, buildCodexSdkConfig } from './codex-sdk-config-policy.js';
 import { buildCodexSdkEnv } from './codex-sdk-env-policy.js';
 import { translateCodexSdkEvent } from './codex-event-translator.js';
+import { resolveCodexRuntime } from '../codex-runtime/resolve-codex-runtime.js';
 export async function runRealCodexSdkTask(input, policy) {
     const mod = await import('@openai/codex-sdk');
     const Codex = mod.Codex || mod.default?.Codex || mod.default;
     if (typeof Codex !== 'function')
         throw new Error('Codex SDK export Codex not found');
+    const runtime = await resolveCodexRuntime({
+        explicitPath: typeof input.requestedScopeContract?.codex_bin === 'string' ? input.requestedScopeContract.codex_bin : null,
+        requestedBy: 'codex-sdk-adapter'
+    });
+    if (!runtime.identity)
+        throw new Error(`Codex runtime not found: ${runtime.blockers.join(',')}`);
+    const executionPolicy = buildCodexExecutionPolicy(input);
     const codex = new Codex({
+        codexPathOverride: runtime.identity.realpath,
         env: policy.env,
         config: policy.config
     });
     const threadOptions = {
         workingDirectory: input.cwd,
-        sandboxMode: policy.sandboxMode,
-        approvalPolicy: 'never',
-        skipGitRepoCheck: true,
-        networkAccessEnabled: policy.sandboxMode !== 'read-only'
+        sandboxMode: executionPolicy.sandbox || policy.sandboxMode,
+        approvalPolicy: executionPolicy.approval,
+        skipGitRepoCheck: executionPolicy.gitRepoCheck === 'allow-explicit-non-git',
+        networkAccessEnabled: executionPolicy.network === 'full',
+        webSearchMode: executionPolicy.webSearch === 'indexed' ? undefined : executionPolicy.webSearch
     };
     const resumeId = typeof input.requestedScopeContract?.resume_thread_id === 'string'
         ? input.requestedScopeContract.resume_thread_id
@@ -37,7 +47,23 @@ export async function runRealCodexSdkTask(input, policy) {
         if (event?.type === 'item.completed' && event?.item?.type === 'agent_message')
             finalResponse = String(event.item.text || '');
     }
-    const structuredOutput = parseStructuredOutput(finalResponse);
+    const failed = events.find((event) => event?.type === 'turn.failed' || event?.type === 'error');
+    if (failed) {
+        return {
+            ok: false,
+            sdkThreadId: String(thread.id || events.find((event) => event?.type === 'thread.started')?.thread_id || ''),
+            sdkRunId: extractRunId(events),
+            events,
+            finalResponse,
+            structuredOutput: null,
+            blockers: ['codex_turn_failed'],
+            liveEventsWritten,
+            runtimeIdentity: runtime.identity,
+            executionPolicy,
+            raw: { failed_event: failed }
+        };
+    }
+    const structuredOutput = parseStructuredOutput(finalResponse, Boolean(input.outputSchema));
     return {
         ok: true,
         sdkThreadId: String(thread.id || events.find((event) => event?.type === 'thread.started')?.thread_id || ''),
@@ -46,6 +72,8 @@ export async function runRealCodexSdkTask(input, policy) {
         finalResponse,
         structuredOutput,
         blockers: [],
+        runtimeIdentity: runtime.identity,
+        executionPolicy,
         liveEventsWritten,
         raw: { item_count: events.filter((event) => String(event?.type || '').startsWith('item.')).length }
     };
@@ -68,7 +96,7 @@ function buildSdkInput(input) {
         ...images.map((image) => ({ type: 'local_image', path: image }))
     ];
 }
-function parseStructuredOutput(text) {
+function parseStructuredOutput(text, strict = false) {
     const trimmed = String(text || '').trim();
     if (!trimmed)
         return null;
@@ -76,6 +104,8 @@ function parseStructuredOutput(text) {
         return JSON.parse(trimmed);
     }
     catch {
+        if (strict)
+            return null;
         const start = trimmed.indexOf('{');
         const end = trimmed.lastIndexOf('}');
         if (start >= 0 && end > start) {

package/dist/core/codex-control/codex-sdk-capability.js

@@ -2,6 +2,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
 export async function detectCodexSdkCapability(input = {}) {
     let dynamicImportOk = false;
     let version = null;
@@ -37,7 +38,7 @@ export async function detectCodexSdkCapability(input = {}) {
         node_compatible: nodeCompatible,
         dynamic_import_ok: dynamicImportOk,
         structured_output_fake_smoke: structuredFake,
-        setup_action: blockers.includes('codex_sdk_unavailable') ? 'npm install @openai/codex-sdk@0.137.0' : null,
+        setup_action: blockers.includes('codex_sdk_unavailable') ? `npm install @openai/codex-sdk@${CURRENT_CODEX_RELEASE_MANIFEST.sdkVersion}` : null,
         blockers
     };
 }

package/dist/core/codex-control/codex-sdk-config-policy.js

@@ -29,6 +29,22 @@ export function buildCodexSdkConfig(input) {
     }
     return config;
 }
+export function buildCodexExecutionPolicy(input) {
+    const sandbox = String(input.requestedScopeContract?.sandbox || process.env.SKS_CODEX_SANDBOX || 'workspace-write');
+    const approval = String(process.env.SKS_CODEX_APPROVAL || (String(input.tier || '') === 'verifier' ? 'never' : 'on-request'));
+    const network = String(process.env.SKS_CODEX_NETWORK || 'disabled');
+    const webSearch = String(process.env.SKS_CODEX_WEB_SEARCH || 'cached');
+    const gitRepoCheck = process.env.SKS_CODEX_ALLOW_NON_GIT === '1' ? 'allow-explicit-non-git' : 'required';
+    const mutation = String(input.tier || '') === 'verifier' || sandbox === 'read-only' ? 'deny' : 'ledgered';
+    return {
+        sandbox,
+        approval,
+        network,
+        webSearch,
+        gitRepoCheck,
+        mutation
+    };
+}
 export function redactCodexSdkConfig(config) {
     return JSON.parse(JSON.stringify(config, (_key, value) => {
         if (typeof value === 'string' && /(?:key|token|secret|password|credential|auth|cookie)/i.test(value))

package/dist/core/codex-control/codex-sdk-env-policy.js

@@ -1,11 +1,24 @@
 import path from 'node:path';
 const SECRET_RE = /(?:key|token|secret|password|credential|auth|cookie)/i;
+const BASE_ALLOWED_ENV = new Set([
+    'PATH',
+    'TMPDIR',
+    'TEMP',
+    'TMP',
+    'LANG',
+    'LC_ALL',
+    'LC_CTYPE',
+    'TERM',
+    'SHELL',
+    'USER',
+    'LOGNAME',
+    'CI',
+    'NODE_ENV',
+    'SKS_CODEX_BIN',
+    'CODEX_BIN'
+]);
 export function buildCodexSdkEnv(input) {
     const env = {};
-    for (const [key, value] of Object.entries(process.env)) {
-        if (value !== undefined)
-            env[key] = String(value);
-    }
     env.SKS_CODEX_CONTROL_PLANE = '1';
     env.SKS_PARENT_MISSION_ID = input.missionId;
     env.SKS_ROUTE = input.route;
@@ -21,12 +34,23 @@ export function buildCodexSdkEnv(input) {
     const isolatedRoot = path.resolve(input.mutationLedgerRoot, 'codex-sdk-home');
     env.HOME = path.join(isolatedRoot, 'home');
     env.CODEX_HOME = path.join(isolatedRoot, 'codex');
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value === undefined || key in env)
+            continue;
+        if (BASE_ALLOWED_ENV.has(key) || key.startsWith('LC_'))
+            env[key] = String(value);
+    }
     env.SKS_CODEX_CONTROL_PLANE_CONFIG_ISOLATED = '1';
+    const inheritedKeys = Object.keys(env).filter((key) => !key.startsWith('SKS_') && key !== 'HOME' && key !== 'CODEX_HOME').sort();
+    const blockedHostKeys = Object.keys(process.env).filter((key) => !(key in env)).sort();
     return {
         env,
         proof: {
             injected_keys: Object.keys(env).filter((key) => key.startsWith('SKS_')).sort(),
-            inherited_key_count: Object.keys(process.env).length,
+            inherited_allowed_keys: inheritedKeys,
+            inherited_key_count: inheritedKeys.length,
+            blocked_host_env_key_count: blockedHostKeys.length,
+            blocked_sensitive_host_env_key_count: blockedHostKeys.filter((key) => SECRET_RE.test(key)).length,
             redacted_sensitive_keys: Object.keys(env).filter((key) => SECRET_RE.test(key)).sort(),
             codex_home_isolated: true,
             codex_home: env.CODEX_HOME,

package/dist/core/codex-control/codex-thread-registry.js

@@ -1,33 +1,124 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { ensureDir, nowIso, readJson, writeJsonAtomic } from '../fsx.js';
+import { appendJsonl, ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
 export const CODEX_THREAD_REGISTRY_SCHEMA = 'sks.codex-thread-registry.v1';
 export async function recordCodexThread(root, entry) {
     const registryPath = path.join(root, 'codex-thread-registry.json');
-    await ensureDir(path.dirname(registryPath));
-    const current = await readJson(registryPath, null);
-    const threads = Array.isArray(current?.threads) ? current.threads : [];
-    const key = `${entry.sdk_thread_id || ''}:${entry.session_id || ''}:${entry.work_item_id || ''}`;
-    const nextThreads = threads.filter((row) => `${row.sdk_thread_id || ''}:${row.session_id || ''}:${row.work_item_id || ''}` !== key);
-    nextThreads.push({
-        recorded_at: nowIso(),
-        ...entry
+    return await withRegistryLock(root, async () => {
+        await ensureDir(path.dirname(registryPath));
+        const current = await readRegistryForUpdate(registryPath);
+        const threads = Array.isArray(current?.threads) ? current.threads : [];
+        const key = registryKey(entry);
+        const nextThreads = threads.filter((row) => registryKey(row) !== key);
+        const recorded = {
+            recorded_at: nowIso(),
+            registry_key: key,
+            ...entry
+        };
+        nextThreads.push(recorded);
+        const registry = {
+            schema: CODEX_THREAD_REGISTRY_SCHEMA,
+            generated_at: nowIso(),
+            storage_mode: 'json-with-atomic-lock-and-journal',
+            lock_strategy: 'atomic-mkdir',
+            thread_count: nextThreads.length,
+            corruption: current?.corruption || null,
+            threads: nextThreads
+        };
+        await appendJsonl(path.join(root, 'codex-thread-registry.events.jsonl'), {
+            ts: nowIso(),
+            type: 'thread.recorded',
+            registry_key: key,
+            thread_id: entry.thread_id || entry.sdk_thread_id || null,
+            session_id: entry.session_id || null,
+            work_item_id: entry.work_item_id || null
+        });
+        await writeJsonAtomic(registryPath, registry);
+        return { registry, registryPath };
     });
-    const registry = {
-        schema: CODEX_THREAD_REGISTRY_SCHEMA,
-        generated_at: nowIso(),
-        thread_count: nextThreads.length,
-        threads: nextThreads
-    };
-    await writeJsonAtomic(registryPath, registry);
-    return { registry, registryPath };
 }
 export async function readCodexThreadRegistry(root) {
     try {
         return JSON.parse(await fs.readFile(path.join(root, 'codex-thread-registry.json'), 'utf8'));
     }
-    catch {
-        return null;
+    catch (err) {
+        if (errorCode(err) === 'ENOENT')
+            return null;
+        return {
+            schema: CODEX_THREAD_REGISTRY_SCHEMA,
+            generated_at: nowIso(),
+            ok: false,
+            corruption: {
+                detected_at: nowIso(),
+                error: err instanceof Error ? err.message : String(err)
+            },
+            thread_count: 0,
+            threads: []
+        };
     }
 }
+async function readRegistryForUpdate(registryPath) {
+    try {
+        return JSON.parse(await fs.readFile(registryPath, 'utf8'));
+    }
+    catch (err) {
+        if (errorCode(err) === 'ENOENT')
+            return null;
+        const corruptPath = `${registryPath}.corrupt-${Date.now()}-${process.pid}`;
+        await fs.copyFile(registryPath, corruptPath).catch(() => { });
+        return {
+            schema: CODEX_THREAD_REGISTRY_SCHEMA,
+            generated_at: nowIso(),
+            thread_count: 0,
+            threads: [],
+            corruption: {
+                detected_at: nowIso(),
+                source_path: registryPath,
+                preserved_path: corruptPath,
+                error: err instanceof Error ? err.message : String(err)
+            }
+        };
+    }
+}
+async function withRegistryLock(root, fn) {
+    const lockDir = path.join(root, 'codex-thread-registry.lock');
+    const deadline = Date.now() + 30_000;
+    while (true) {
+        try {
+            await fs.mkdir(lockDir, { recursive: false });
+            await fs.writeFile(path.join(lockDir, 'owner.json'), JSON.stringify({ pid: process.pid, acquired_at: nowIso() }), 'utf8').catch(() => { });
+            break;
+        }
+        catch (err) {
+            if (errorCode(err) !== 'EEXIST')
+                throw err;
+            if (Date.now() > deadline)
+                throw new Error(`Timed out waiting for Codex thread registry lock: ${lockDir}`);
+            await sleep(25);
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        await fs.rm(lockDir, { recursive: true, force: true }).catch(() => { });
+    }
+}
+function registryKey(entry) {
+    return [
+        entry.thread_id || entry.sdk_thread_id || '',
+        entry.session_id || '',
+        entry.work_item_id || '',
+        entry.slot_id || '',
+        entry.generation_index ?? ''
+    ].map((value) => String(value)).join(':');
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function errorCode(err) {
+    if (err && typeof err === 'object' && 'code' in err)
+        return String(err.code);
+    return null;
+}
 //# sourceMappingURL=codex-thread-registry.js.map

package/dist/core/codex-runtime/resolve-codex-runtime.js

@@ -0,0 +1,102 @@
+import crypto from 'node:crypto';
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { exists, packageRoot, runProcess, which } from '../fsx.js';
+import { parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+export async function resolveCodexRuntime(input = {}) {
+    const requestedBy = input.requestedBy || 'codex-runtime-resolver';
+    const candidates = await codexRuntimeCandidates(input.explicitPath || null, Boolean(input.includeGlobalDiagnostics));
+    const found = candidates.find((candidate) => candidate.exists);
+    if (!found) {
+        return {
+            ok: false,
+            identity: null,
+            blockers: ['codex_runtime_not_found'],
+            candidates
+        };
+    }
+    const identity = await codexRuntimeIdentity(found.path, found.source, requestedBy);
+    const blockers = identity.version ? [] : ['codex_runtime_version_unavailable'];
+    return {
+        ok: blockers.length === 0,
+        identity,
+        blockers,
+        candidates
+    };
+}
+export async function codexRuntimeCandidates(explicitPath, includeGlobalDiagnostics = false) {
+    const rows = [];
+    const add = async (source, value) => {
+        const candidate = String(value || '').trim();
+        if (!candidate)
+            return;
+        if (rows.some((row) => row.path === candidate))
+            return;
+        rows.push({ source, path: candidate, exists: await exists(candidate) });
+    };
+    await add('explicit', explicitPath);
+    await add('env', process.env.SKS_CODEX_BIN);
+    await add('env', process.env.CODEX_BIN);
+    await add('project', path.join(packageRoot(), 'node_modules', '.bin', process.platform === 'win32' ? 'codex.cmd' : 'codex'));
+    const pathCandidate = await which(process.platform === 'win32' ? 'codex.cmd' : 'codex');
+    await add(includeGlobalDiagnostics ? 'global-diagnostic' : 'path', pathCandidate);
+    return rows;
+}
+async function codexRuntimeIdentity(bin, source, requestedBy) {
+    const realpath = await fsp.realpath(bin);
+    const versionText = await readCodexVersionText(realpath);
+    const packageRootForBin = await findPackageRoot(realpath);
+    const packageVersion = packageRootForBin ? await readPackageVersion(packageRootForBin) : null;
+    return {
+        requestedBy,
+        path: bin,
+        realpath,
+        version: parseCodexVersionText(versionText) || '',
+        source,
+        sha256: await sha256File(realpath),
+        packageRoot: packageRootForBin,
+        packageVersion,
+        platform: os.platform(),
+        arch: os.arch()
+    };
+}
+async function readCodexVersionText(bin) {
+    const result = await runProcess(bin, ['--version'], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err instanceof Error ? err.message : String(err),
+        stdoutBytes: 0,
+        stderrBytes: 0,
+        truncated: false,
+        timedOut: false
+    }));
+    return `${result.stdout || ''}${result.stderr || ''}`.trim();
+}
+async function sha256File(file) {
+    const data = await fsp.readFile(file);
+    return crypto.createHash('sha256').update(data).digest('hex');
+}
+async function findPackageRoot(startFile) {
+    let dir = path.dirname(startFile);
+    for (let i = 0; i < 8; i += 1) {
+        const candidate = path.join(dir, 'package.json');
+        if (await exists(candidate))
+            return dir;
+        const next = path.dirname(dir);
+        if (next === dir)
+            break;
+        dir = next;
+    }
+    return null;
+}
+async function readPackageVersion(root) {
+    try {
+        const pkg = JSON.parse(await fsp.readFile(path.join(root, 'package.json'), 'utf8'));
+        return typeof pkg.version === 'string' ? pkg.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=resolve-codex-runtime.js.map

package/dist/core/commands/mad-sks-command.js

@@ -26,12 +26,15 @@ import { resolveCodexNativeInvocationPlan } from '../codex-native/codex-native-i
 import { repairZellijForSks } from '../zellij/zellij-self-heal.js';
 import { buildMadGlmLaunchArtifact, buildMadGlmLaunchProfileNoWrite, resolveMadGlmLaunchKey, writeMadGlmCodexWrapper } from '../providers/glm/glm-mad-launch.js';
 import { GLM_MAD_MODE } from '../providers/glm/glm-52-settings.js';
+import { assertNonGlmMadRoute } from '../routes/model-mode-router.js';
 export async function madHighCommand(args = [], deps = {}) {
     const subcommand = firstSubcommand(args);
     if (subcommand)
         return madSksSubcommand(subcommand, args.filter((arg) => String(arg) !== subcommand));
     const rawArgs = (args || []).map((arg) => String(arg));
     const glmMadLaunch = isMadGlmLaunch(rawArgs, deps);
+    if (!glmMadLaunch)
+        assertNonGlmMadRoute(rawArgs.includes('--mad') ? rawArgs : ['--mad', ...rawArgs]);
     const glmOnlyFlagBlockers = findGlmOnlyMadFlagBlockers(rawArgs, glmMadLaunch);
     if (glmOnlyFlagBlockers.length) {
         const result = {

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.0.13';
+export const PACKAGE_VERSION = '4.0.15';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {