sneakoscope 4.0.2 → 4.0.3

package/README.md

@@ -35,15 +35,15 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.0.2** is the TriWiki Turbo production completion release. It makes affected/confidence release runs TriWiki-first, restores build-once proof, bridges reusable TriWiki proof cards into release cache v2, runs gate packs through a resource-aware scheduler, and tightens semantic dirty doctor, sksd warmup, legacy purge, orphan detection, and actual five-minute SLA regression evidence.
+SKS **4.0.3** adds a GLM 5.2-only MAD mode through OpenRouter while preserving the proof-first SKS pipeline. `sks --mad --glm` resolves the GLM profile, keeps GPT/OpenAI fallback disabled, and records model-lock proof; `sks --mad --glm --repair` rotates the OpenRouter API key outside project files.
 
-What changed in 4.0.2:
+What changed in 4.0.3:
 
-- **TriWiki proof bank.** Proof cards now bind reusable gate proof to input hash, implementation hash, package lock hash, environment allowlist, fixture version, and tool version.
-- **Affected release-equivalent verification.** Changed files map to module cards, gate impact maps, and gate packs so small tasks can run fast without giving up scoped release confidence.
-- **Parallel SLA planning.** Release gate packs, resource budgets, and SLA certificates expose the planned critical path for five-minute foreground verification.
-- **New control surface.** `sks check`, `sks task`, `sks release`, `sks triwiki`, `sks proof bank status`, and `sks daemon` expose the fast proof pipeline.
-- **No silent legacy fallback.** Compatibility aliases are removed; removed runtimes now use explicit migration notices.
+- **GLM 5.2 MAD mode.** `sks --mad --glm` enters a `mad-glm` profile using OpenRouter model `z-ai/glm-5.2`.
+- **No GPT fallback.** GLM requests use `provider.allow_fallbacks: false`, omit fallback `models`, and reject non-GLM response model ids before mutation.
+- **OpenRouter key lifecycle.** Keys resolve from `OPENROUTER_API_KEY`, `SKS_OPENROUTER_API_KEY`, or the user SKS secret store; stored keys use private permissions and redacted metadata.
+- **Codex App profile.** `sks codex-app glm-profile install` writes the `sks/glm-5.2-mad` profile metadata for Codex App selection.
+- **Codex 0.141 alignment.** SKS delegates remote relay, cwd/shell/path preservation, selected plugin MCP activation, App/MCP dedupe, bounded prompt-image cache, bounded feedback upload, and terminal resize behavior to Codex-native semantics where available.
 
 SKS **3.1.16** was a launch-reliability patch on the 3.1.15 doctor-reliability release. It made `sks --mad` self-bootstrap a fresh project instead of dead-ending on a missing Codex config.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.0.2"
+version = "4.0.3"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.0.2"
+version = "4.0.3"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.0.2"),
+        Some("--version") => println!("sks-rs 4.0.3"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.0.2';
+const FAST_PACKAGE_VERSION = '4.0.3';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/command-registry.js

@@ -111,6 +111,7 @@ export const COMMANDS = {
     'zellij-slot-column-anchor': entry('beta', 'Render the compact SLOTS anchor pane for first-slot-down Zellij stacks', 'dist/commands/zellij-slot-column-anchor.js', directCommand(() => import('../commands/zellij-slot-column-anchor.js'), 'dist/commands/zellij-slot-column-anchor.js')),
     zellij: entry('beta', 'Inspect Zellij runtime status and explain repair (no auto-install)', 'dist/commands/zellij.js', directCommand(() => import('../commands/zellij.js'), 'dist/commands/zellij.js')),
     'mad-sks': entry('beta', 'MAD-SKS scoped permission modifier', 'dist/commands/mad-sks.js', directCommand(() => import('../commands/mad-sks.js'), 'dist/commands/mad-sks.js')),
+    glm: entry('beta', 'Run GLM 5.2 MAD mode through OpenRouter', 'dist/core/commands/glm-command.js', argsCommand(() => import('../core/commands/glm-command.js'), 'glmCommand', 'dist/core/commands/glm-command.js')),
     'mad-db': entry('beta', 'Create or inspect one-cycle Mad-DB break-glass capability tokens', 'dist/commands/mad-db.js', directCommand(() => import('../commands/mad-db.js'), 'dist/commands/mad-db.js')),
     'auto-review': entry('beta', 'Manage auto-review profile', 'dist/commands/auto-review.js', directCommand(() => import('../commands/auto-review.js'), 'dist/commands/auto-review.js')),
     'dollar-commands': entry('stable', 'List Codex App dollar commands', 'dist/core/commands/basic-cli.js', basicArgs('dollarCommandsCommand')),

package/dist/cli/global-mode-router.js

@@ -0,0 +1,25 @@
+const RESERVED_COMMANDS = new Set(['help', '--help', '-h', 'version', '--version', '-v']);
+export function detectGlobalMode(args = []) {
+    if (!args.length || RESERVED_COMMANDS.has(String(args[0])))
+        return null;
+    const hasMad = args.includes('--mad');
+    const hasGlm = args.includes('--glm');
+    if (hasMad && hasGlm)
+        return { kind: 'mad-glm', args: stripGlobalModeFlags(args) };
+    if (hasGlm && !hasMad)
+        return { kind: 'glm-without-mad', args: stripGlobalModeFlags(args) };
+    return null;
+}
+export function stripGlobalModeFlags(args) {
+    return args.filter((arg) => arg !== '--mad' && arg !== '--glm');
+}
+export function glmWithoutMadResult() {
+    return {
+        ok: false,
+        status: 'blocked',
+        mode: 'glm',
+        reason: 'glm_requires_mad',
+        hint: 'use sks --mad --glm'
+    };
+}
+//# sourceMappingURL=global-mode-router.js.map

package/dist/cli/router.js

@@ -1,4 +1,5 @@
 import { COMMAND_ALIASES, COMMANDS, } from './command-registry.js';
+import { detectGlobalMode, glmWithoutMadResult } from './global-mode-router.js';
 export function isCommandName(value) {
     return Object.prototype.hasOwnProperty.call(COMMANDS, value);
 }
@@ -18,6 +19,17 @@ export function normalizeCommand(args = []) {
 }
 export async function dispatch(args) {
     const argv = args ?? process.argv.slice(2);
+    const globalMode = detectGlobalMode(argv);
+    if (globalMode?.kind === 'mad-glm') {
+        const mod = await import('../core/commands/glm-command.js');
+        return mod.glmCommand(globalMode.args);
+    }
+    if (globalMode?.kind === 'glm-without-mad') {
+        const result = glmWithoutMadResult();
+        console.error(`GLM mode requires MAD: ${result.hint}`);
+        process.exitCode = 1;
+        return result;
+    }
     const { command, rawCommand, args: rest } = normalizeCommand(argv);
     if (!command) {
         if (!argv.length) {

package/dist/commands/codex-app.js

@@ -10,6 +10,7 @@ import { runCodexInitDeep } from '../core/codex-app/codex-init-deep.js';
 import { buildCodexHookLifecycle } from '../core/codex-app/codex-hook-lifecycle.js';
 import { resolveCodexAppExecutionProfile } from '../core/codex-app/codex-app-execution-profile.js';
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
+import { doctorCodexAppGlmProfile, installCodexAppGlmProfile } from '../core/codex-app/glm-profile-installer.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'check';
     if (action === 'remote-control' || action === 'remote')
@@ -28,6 +29,14 @@ export async function run(_command, args = []) {
         return printCodexAppResult(args, await buildCodexHookLifecycle({ root: await sksRoot(), apply: flag(args, '--apply') || flag(args, '--fix') }));
     if (action === 'execution-profile')
         return printCodexAppResult(args, await resolveCodexAppExecutionProfile({ root: await sksRoot() }));
+    if (action === 'glm-profile') {
+        const subcommand = args[1] || 'doctor';
+        const root = await sksRoot();
+        const result = subcommand === 'install' || subcommand === 'repair'
+            ? await installCodexAppGlmProfile({ root, apply: true })
+            : await doctorCodexAppGlmProfile({ root });
+        return printCodexAppResult(args, result);
+    }
     if (action === 'product-design' || action === 'design-product' || action === 'ensure-product-design') {
         const checkOnly = flag(args, '--check-only') || flag(args, '--no-install');
         const status = await codexProductDesignPluginStatus({
@@ -88,7 +97,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
+    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|glm-profile [install|doctor]|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
     process.exitCode = 1;
 }
 function printCodexAppResult(args = [], result) {

package/dist/commands/codex.js

@@ -3,6 +3,7 @@ import { printJson } from '../cli/output.js';
 import { codexCompatibilityReport, codexDoctorReport } from '../core/codex-compat/codex-compat-report.js';
 import { codexVersionReport } from '../core/codex-compat/codex-version.js';
 import { codexSchemaSnapshotReport } from '../core/codex-compat/codex-schema-snapshot.js';
+import { detectCodex0141Capability } from '../core/codex-control/codex-0141-capability.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'compatibility';
     if (action === 'compatibility' || action === 'compat') {
@@ -24,6 +25,19 @@ export async function run(_command, args = []) {
         console.log(`Codex detected: ${result.detected.version || 'not installed'} (${result.policy.status})`);
         return;
     }
+    if (action === '0.141' || action === '0141' || action === 'rust-v0.141.0') {
+        const result = await detectCodex0141Capability();
+        if (flag(args, '--json'))
+            return printJson(result);
+        console.log(`Codex 0.141 compatibility: ${result.ok ? 'ok' : 'blocked'}`);
+        for (const blocker of result.blockers || [])
+            console.log(`- blocker: ${blocker}`);
+        for (const warning of result.warnings || [])
+            console.log(`- warning: ${warning}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
     if (action === 'doctor') {
         const result = await codexDoctorReport();
         if (flag(args, '--json'))
@@ -42,7 +56,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex compatibility|version|doctor|schema [--json]');
+    console.error('Usage: sks codex compatibility|version|doctor|schema|0.141 [--json]');
     process.exitCode = 1;
 }
 //# sourceMappingURL=codex.js.map

package/dist/core/codex-app/glm-model-profile.js

@@ -0,0 +1,2 @@
+export { GLM_CODEX_APP_PROFILE_ID, GLM_CODEX_APP_PROFILE_LABEL, buildGlmCodexAppModelProfile } from '../providers/glm/glm-52-profile.js';
+//# sourceMappingURL=glm-model-profile.js.map

package/dist/core/codex-app/glm-profile-installer.js

@@ -0,0 +1,61 @@
+import path from 'node:path';
+import { readJson, writeJsonAtomic, nowIso } from '../fsx.js';
+import { buildGlmCodexAppModelProfile } from './glm-model-profile.js';
+import { validateGlmCodexAppModelProfile } from './glm-profile-schema.js';
+import { resolveOpenRouterApiKey } from '../providers/openrouter/openrouter-secret-store.js';
+export async function installCodexAppGlmProfile(input) {
+    const root = path.resolve(input.root);
+    const profile = buildGlmCodexAppModelProfile();
+    const profilePath = path.join(root, '.sneakoscope', 'codex-app', 'glm-model-profile.json');
+    const reportPath = path.join(root, '.sneakoscope', 'reports', 'codex-app-glm-profile.json');
+    const key = await resolveOpenRouterApiKey({ env: input.env || process.env });
+    const warnings = [
+        ...key.warnings,
+        ...(key.key ? [] : ['openrouter_key_missing_until_sks_--mad_--glm_--repair'])
+    ];
+    if (input.apply !== false)
+        await writeJsonAtomic(profilePath, profile);
+    const result = {
+        schema: 'sks.codex-app-glm-profile-result.v1',
+        generated_at: nowIso(),
+        ok: true,
+        status: input.apply === false ? 'valid' : 'installed',
+        profile,
+        profile_path: '.sneakoscope/codex-app/glm-model-profile.json',
+        report_path: '.sneakoscope/reports/codex-app-glm-profile.json',
+        openrouter_key_source: key.source,
+        blockers: [],
+        warnings
+    };
+    await writeJsonAtomic(reportPath, result).catch(() => undefined);
+    return result;
+}
+export async function doctorCodexAppGlmProfile(input) {
+    const root = path.resolve(input.root);
+    const profilePath = path.join(root, '.sneakoscope', 'codex-app', 'glm-model-profile.json');
+    const reportPath = path.join(root, '.sneakoscope', 'reports', 'codex-app-glm-profile.json');
+    const existing = await readJson(profilePath, null);
+    const validation = validateGlmCodexAppModelProfile(existing);
+    const key = await resolveOpenRouterApiKey({ env: input.env || process.env });
+    const profile = validation.profile || buildGlmCodexAppModelProfile();
+    const blockers = [...validation.blockers];
+    const warnings = [
+        ...key.warnings,
+        ...(key.key ? [] : ['openrouter_key_missing_until_sks_--mad_--glm_--repair'])
+    ];
+    const result = {
+        schema: 'sks.codex-app-glm-profile-result.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        status: blockers.length === 0 ? 'valid' : 'blocked',
+        profile,
+        profile_path: '.sneakoscope/codex-app/glm-model-profile.json',
+        report_path: '.sneakoscope/reports/codex-app-glm-profile.json',
+        openrouter_key_source: key.source,
+        blockers,
+        warnings
+    };
+    await writeJsonAtomic(reportPath, result).catch(() => undefined);
+    return result;
+}
+//# sourceMappingURL=glm-profile-installer.js.map

package/dist/core/codex-app/glm-profile-schema.js

@@ -0,0 +1,24 @@
+import { GLM_CODEX_APP_PROFILE_ID, buildGlmCodexAppModelProfile } from './glm-model-profile.js';
+import { GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE } from '../providers/glm/glm-52-settings.js';
+export function validateGlmCodexAppModelProfile(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return { ok: false, blockers: ['glm_codex_app_profile_missing'], profile: null };
+    }
+    const profile = value;
+    const expected = buildGlmCodexAppModelProfile();
+    const blockers = [
+        profile.schema === expected.schema ? null : 'glm_codex_app_profile_invalid_schema',
+        profile.id === GLM_CODEX_APP_PROFILE_ID ? null : 'glm_codex_app_profile_invalid_id',
+        profile.provider === 'openrouter' ? null : 'glm_codex_app_profile_invalid_provider',
+        profile.model === GLM_52_OPENROUTER_MODEL ? null : 'glm_codex_app_profile_invalid_model',
+        profile.mode === GLM_MAD_MODE ? null : 'glm_codex_app_profile_invalid_mode',
+        profile.strictModelLock === true ? null : 'glm_codex_app_profile_not_strict',
+        profile.gptFallbackAllowed === false ? null : 'glm_codex_app_profile_allows_gpt_fallback'
+    ].filter((item) => Boolean(item));
+    return {
+        ok: blockers.length === 0,
+        blockers,
+        profile: blockers.length === 0 ? profile : null
+    };
+}
+//# sourceMappingURL=glm-profile-schema.js.map

package/dist/core/codex-control/codex-0141-capability.js

@@ -0,0 +1,95 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
+export const CODEX_0141_FEATURE_KEYS = [
+    'noise_relay_delegated',
+    'native_cwd_shell_path_preserved',
+    'permission_paths_preserved',
+    'selected_plugin_mcp_per_thread',
+    'auth_curated_marketplaces',
+    'child_threads_api',
+    'external_agent_import_results',
+    'rate_limit_reset_credits',
+    'realtime_startup_context_control',
+    'tui_prompt_auto_resolve',
+    'hook_trust_resume_persistence',
+    'post_tool_use_blocking_respected',
+    'plugin_app_mcp_dedupe',
+    'windows_sandbox_repairs_delegated',
+    'idle_exec_relay_keepalive',
+    'wait_agent_interrupt_native',
+    'sqlite_wal_reset_fix_delegated',
+    'tls_p521_native',
+    'tool_heavy_copy_reduction',
+    'prompt_image_cache_bound_64_mib',
+    'feedback_upload_bound_8_threads',
+    'terminal_resize_reflow_always'
+];
+export async function detectCodex0141Capability(input = {}) {
+    const fake = process.env.SKS_CODEX_0141_FAKE === '1';
+    const codexBin = fake ? input.codexBin || process.env.CODEX_BIN || 'codex' : input.codexBin || process.env.CODEX_BIN || await findCodexBinary();
+    const versionText = fake ? String(process.env.SKS_CODEX_VERSION_FAKE || 'codex-cli 0.141.0') : await readCodexVersionText(codexBin);
+    const parsed = parseCodexVersionText(versionText);
+    const supports0141 = Boolean(parsed && compareSemverLike(parsed, '0.141.0') >= 0);
+    const featureStates = Object.fromEntries(CODEX_0141_FEATURE_KEYS.map((key) => [key, featureStateFor(key, supports0141)]));
+    const blockers = [
+        ...(!codexBin ? ['codex_cli_missing'] : []),
+        ...(supports0141 ? [] : ['codex_0_141_required_for_0141_features'])
+    ];
+    return {
+        schema: 'sks.codex-0141-capability.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        codex_version: parsed,
+        supports_0141: supports0141,
+        feature_states: featureStates,
+        blockers,
+        warnings: supports0141
+            ? CODEX_0141_FEATURE_KEYS.map((key) => `codex_0141_${key}_assumed_by_version`)
+            : [],
+        codex_bin: codexBin || null,
+        release_source: 'https://github.com/openai/codex/releases/tag/rust-v0.141.0'
+    };
+}
+export async function writeCodex0141CapabilityArtifacts(root, input = {}) {
+    const report = await detectCodex0141Capability({ codexBin: input.codexBin || null });
+    const rootArtifact = path.join(root, '.sneakoscope', 'codex-0141-capability.json');
+    await writeJsonAtomic(rootArtifact, report);
+    let missionArtifact = null;
+    if (input.missionId) {
+        missionArtifact = path.join(root, '.sneakoscope', 'missions', input.missionId, 'codex-0141-capability.json');
+        await writeJsonAtomic(missionArtifact, report);
+    }
+    return { report, root_artifact: rootArtifact, mission_artifact: missionArtifact };
+}
+function featureStateFor(key, supports0141) {
+    return {
+        supported: supports0141,
+        certainty: supports0141 ? 'assumed_by_version' : 'failed',
+        evidence: supports0141 ? ['codex_version>=0.141.0', `release:rust-v0.141.0:${key}`] : [],
+        blockers: supports0141 ? [] : ['codex_0_141_required_for_0141_features'],
+        sks_policy: sksPolicyFor(key)
+    };
+}
+function sksPolicyFor(key) {
+    if (key.includes('dedupe'))
+        return 'dedupe';
+    if (key.includes('bound') || key.includes('cache') || key.includes('feedback'))
+        return 'bound';
+    if (key.includes('blocking') || key.includes('trust'))
+        return 'respect';
+    return 'delegate';
+}
+async function readCodexVersionText(codexBin) {
+    if (!codexBin)
+        return null;
+    const result = await runProcess(codexBin, ['--version'], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err instanceof Error ? err.message : String(err)
+    }));
+    const text = `${result.stdout || ''}${result.stderr || ''}`.trim();
+    return result.code === 0 ? text : text || null;
+}
+//# sourceMappingURL=codex-0141-capability.js.map

package/dist/core/commands/glm-command.js

@@ -0,0 +1,5 @@
+import { runMadGlmMode } from '../providers/glm/glm-mad-mode.js';
+export async function glmCommand(args = []) {
+    return runMadGlmMode(args);
+}
+//# sourceMappingURL=glm-command.js.map

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.0.2';
+export const PACKAGE_VERSION = '4.0.3';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/providers/glm/glm-52-profile.js

@@ -0,0 +1,30 @@
+import { GLM_52_DEFAULT_REQUEST_SETTINGS, GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE } from './glm-52-settings.js';
+export const GLM_CODEX_APP_PROFILE_ID = 'sks/glm-5.2-mad';
+export const GLM_CODEX_APP_PROFILE_LABEL = 'GLM 5.2 (MAD / OpenRouter)';
+export function buildGlmCodexAppModelProfile() {
+    return {
+        schema: 'sks.codex-app-model-profile.v1',
+        id: GLM_CODEX_APP_PROFILE_ID,
+        label: GLM_CODEX_APP_PROFILE_LABEL,
+        provider: 'openrouter',
+        model: GLM_52_OPENROUTER_MODEL,
+        mode: GLM_MAD_MODE,
+        strictModelLock: true,
+        gptFallbackAllowed: false,
+        requiresSecret: 'openrouter-api-key',
+        defaultSettings: {
+            temperature: GLM_52_DEFAULT_REQUEST_SETTINGS.temperature,
+            top_p: GLM_52_DEFAULT_REQUEST_SETTINGS.top_p,
+            reasoning_effort: 'high',
+            tool_choice: 'auto',
+            parallel_tool_calls: false
+        },
+        codexCompatibility: {
+            target: 'rust-v0.141.0',
+            selectedExecutorPluginMcp: 'defer-to-codex-native',
+            duplicateAppMcpDeclarations: 'dedupe-by-codex',
+            cwdShellPathSemantics: 'preserve-codex-native'
+        }
+    };
+}
+//# sourceMappingURL=glm-52-profile.js.map

package/dist/core/providers/glm/glm-52-request.js

@@ -0,0 +1,34 @@
+import { GLM_52_DEFAULT_REQUEST_SETTINGS, GLM_52_OPENROUTER_MODEL, clampGlm52MaxTokens } from './glm-52-settings.js';
+export function buildGlm52Request(input) {
+    const request = {
+        model: GLM_52_OPENROUTER_MODEL,
+        messages: input.messages,
+        stream: input.stream ?? GLM_52_DEFAULT_REQUEST_SETTINGS.stream,
+        temperature: GLM_52_DEFAULT_REQUEST_SETTINGS.temperature,
+        top_p: GLM_52_DEFAULT_REQUEST_SETTINGS.top_p,
+        reasoning: { effort: input.reasoningEffort ?? 'high' },
+        max_tokens: clampGlm52MaxTokens(input.maxTokens),
+        tool_choice: input.toolChoice ?? 'auto',
+        parallel_tool_calls: input.parallelToolCalls ?? false,
+        provider: {
+            allow_fallbacks: false,
+            require_parameters: true,
+            sort: input.providerSort ?? 'throughput'
+        }
+    };
+    return {
+        ...request,
+        ...(input.tools ? { tools: input.tools } : {}),
+        ...(input.responseFormat ? { response_format: input.responseFormat } : {})
+    };
+}
+export function buildGlm52KeyValidationRequest() {
+    return buildGlm52Request({
+        messages: [{ role: 'user', content: 'Reply with OK.' }],
+        stream: false,
+        maxTokens: 1,
+        toolChoice: 'none',
+        parallelToolCalls: false
+    });
+}
+//# sourceMappingURL=glm-52-request.js.map

package/dist/core/providers/glm/glm-52-response-guard.js

@@ -0,0 +1,34 @@
+import { GLM_52_OPENROUTER_MODEL } from './glm-52-settings.js';
+export function assertGlm52ActualModel(responseModel) {
+    if (!responseModel) {
+        return {
+            ok: false,
+            code: 'glm_model_missing',
+            requestedModel: GLM_52_OPENROUTER_MODEL,
+            strictModelLock: true,
+            gptFallbackAllowed: false
+        };
+    }
+    const normalized = responseModel.toLowerCase();
+    if (normalized === GLM_52_OPENROUTER_MODEL ||
+        normalized.startsWith(`${GLM_52_OPENROUTER_MODEL}-`) ||
+        normalized.includes('glm-5.2')) {
+        return {
+            ok: true,
+            code: 'ok',
+            actualModel: responseModel,
+            requestedModel: GLM_52_OPENROUTER_MODEL,
+            strictModelLock: true,
+            gptFallbackAllowed: false
+        };
+    }
+    return {
+        ok: false,
+        code: 'glm_model_mismatch',
+        actualModel: responseModel,
+        requestedModel: GLM_52_OPENROUTER_MODEL,
+        strictModelLock: true,
+        gptFallbackAllowed: false
+    };
+}
+//# sourceMappingURL=glm-52-response-guard.js.map

package/dist/core/providers/glm/glm-52-settings.js

@@ -0,0 +1,26 @@
+export { OPENROUTER_CHAT_COMPLETIONS_URL } from '../openrouter/openrouter-types.js';
+export const GLM_52_OPENROUTER_MODEL = 'z-ai/glm-5.2';
+export const GLM_MAD_MODE = 'mad-glm';
+export const GLM_52_MAX_TOKENS_DEFAULT = 32768;
+export const GLM_52_MAX_TOKENS_LONG = 65536;
+export const GLM_52_MAX_TOKENS_XLONG = 131072;
+export const GLM_52_TOP_PROVIDER_MAX_COMPLETION_TOKENS = 262144;
+export const GLM_52_DEFAULT_REQUEST_SETTINGS = {
+    model: GLM_52_OPENROUTER_MODEL,
+    temperature: 1,
+    top_p: 0.95,
+    reasoning_effort: 'high',
+    stream: true,
+    provider: {
+        allow_fallbacks: false,
+        require_parameters: true
+    },
+    tool_choice: 'auto',
+    parallel_tool_calls: false,
+    max_tokens: GLM_52_MAX_TOKENS_DEFAULT
+};
+export function clampGlm52MaxTokens(value) {
+    const numeric = Number.isFinite(value) ? Math.floor(Number(value)) : GLM_52_MAX_TOKENS_DEFAULT;
+    return Math.max(1, Math.min(numeric, GLM_52_TOP_PROVIDER_MAX_COMPLETION_TOKENS));
+}
+//# sourceMappingURL=glm-52-settings.js.map

package/dist/core/providers/glm/glm-mad-mode.js

@@ -0,0 +1,242 @@
+import readline from 'node:readline/promises';
+import path from 'node:path';
+import { stdin as input, stdout as output } from 'node:process';
+import { printJson } from '../../../cli/output.js';
+import { flag } from '../../../cli/args.js';
+import { nowIso, writeJsonAtomic } from '../../fsx.js';
+import {} from '../openrouter/openrouter-types.js';
+import { sendOpenRouterChatCompletion } from '../openrouter/openrouter-client.js';
+import { resolveOpenRouterApiKey, writeStoredOpenRouterKey } from '../openrouter/openrouter-secret-store.js';
+import { redactOpenRouterKey } from '../../security/redact-secrets.js';
+import { buildGlmCodexAppModelProfile } from './glm-52-profile.js';
+import { buildGlm52KeyValidationRequest, buildGlm52Request } from './glm-52-request.js';
+import { assertGlm52ActualModel } from './glm-52-response-guard.js';
+import { GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE, OPENROUTER_CHAT_COMPLETIONS_URL } from './glm-52-settings.js';
+export async function runMadGlmMode(args = [], adapters = {}) {
+    const runtime = buildDefaultAdapters(adapters);
+    const repair = flag(args, '--repair');
+    const noSaveKey = flag(args, '--no-save-key');
+    const skipValidation = flag(args, '--skip-validation');
+    const json = flag(args, '--json');
+    const profile = buildGlmCodexAppModelProfile();
+    let result;
+    if (repair) {
+        const key = await runtime.promptSecret('OpenRouter API key is required for GLM 5.2 mode.\nEnter OpenRouter API key: ');
+        if (!key) {
+            result = baseResult({
+                status: 'blocked',
+                blockers: ['glm_key_prompt_cancelled'],
+                warnings: []
+            });
+        }
+        else {
+            if (!noSaveKey)
+                await runtime.writeSecret(key);
+            const validation = skipValidation
+                ? { ok: true, value: validationValue(null) }
+                : await runtime.validateOpenRouterKey(key);
+            result = validation.ok
+                ? baseResult({
+                    status: 'ready',
+                    ...(validation.value.actual_model ? { actual_model: validation.value.actual_model } : {}),
+                    openrouter_key_source: noSaveKey ? 'prompt' : 'user-secret-store',
+                    key_preview: redactOpenRouterKey(key),
+                    blockers: [],
+                    warnings: noSaveKey ? ['openrouter_key_not_saved'] : []
+                })
+                : baseResult({
+                    status: 'blocked',
+                    openrouter_key_source: noSaveKey ? 'prompt' : 'user-secret-store',
+                    key_preview: redactOpenRouterKey(key),
+                    blockers: [validation.error.code],
+                    warnings: []
+                });
+        }
+    }
+    else {
+        const resolved = await resolveOpenRouterApiKey({ env: runtime.env });
+        if (!resolved.key && process.stdin.isTTY) {
+            const key = await runtime.promptSecret('OpenRouter API key is required for GLM 5.2 mode.\nEnter OpenRouter API key: ');
+            if (!key) {
+                result = baseResult({ status: 'blocked', blockers: ['glm_key_prompt_cancelled'], warnings: [] });
+            }
+            else {
+                const save = noSaveKey ? false : await runtime.promptConfirm('Save this key for future SKS GLM runs? [Y/n] ', true);
+                if (save)
+                    await runtime.writeSecret(key);
+                result = baseResult({
+                    status: 'ready',
+                    openrouter_key_source: save ? 'user-secret-store' : 'prompt',
+                    key_preview: redactOpenRouterKey(key),
+                    blockers: [],
+                    warnings: save ? [] : ['openrouter_key_not_saved']
+                });
+            }
+        }
+        else if (!resolved.key) {
+            result = baseResult({
+                status: 'blocked',
+                blockers: resolved.blockers,
+                warnings: ['set_OPENROUTER_API_KEY_or_run_sks_--mad_--glm_--repair']
+            });
+        }
+        else {
+            result = baseResult({
+                status: 'ready',
+                ...(resolved.source ? { openrouter_key_source: resolved.source } : {}),
+                key_preview: resolved.key_preview,
+                blockers: [],
+                warnings: resolved.warnings
+            });
+        }
+    }
+    await writeGlmModeArtifacts(runtime.cwd, result, profile, runtime.nowIso()).catch(() => undefined);
+    if (json)
+        printJson(result);
+    else
+        printHumanGlmResult(result, runtime.log);
+    if (!result.ok)
+        process.exitCode = 1;
+    return result;
+}
+function baseResult(input) {
+    const result = {
+        schema: 'sks.glm-mode-result.v1',
+        ok: input.blockers.length === 0 && input.status !== 'failed',
+        status: input.status,
+        mode: GLM_MAD_MODE,
+        provider: 'openrouter',
+        model: GLM_52_OPENROUTER_MODEL,
+        requested_model: GLM_52_OPENROUTER_MODEL,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false,
+        codex_app_profile_id: 'sks/glm-5.2-mad',
+        blockers: input.blockers,
+        warnings: input.warnings
+    };
+    return {
+        ...result,
+        ...(input.actual_model ? { actual_model: input.actual_model } : {}),
+        ...(input.openrouter_key_source ? { openrouter_key_source: input.openrouter_key_source } : {}),
+        ...(input.key_preview !== undefined ? { key_preview: input.key_preview } : {})
+    };
+}
+function buildDefaultAdapters(overrides) {
+    return {
+        nowIso: overrides.nowIso || nowIso,
+        env: overrides.env || process.env,
+        cwd: overrides.cwd || process.cwd(),
+        promptSecret: overrides.promptSecret || promptLine,
+        promptConfirm: overrides.promptConfirm || promptConfirmLine,
+        writeSecret: overrides.writeSecret || (async (value) => {
+            await writeStoredOpenRouterKey(value);
+        }),
+        validateOpenRouterKey: overrides.validateOpenRouterKey || validateOpenRouterKey,
+        sendOpenRouterRequest: overrides.sendOpenRouterRequest || (async (request, key) => sendOpenRouterChatCompletion({ request, apiKey: key })),
+        log: overrides.log || ((message) => console.log(message))
+    };
+}
+async function validateOpenRouterKey(key) {
+    const response = await sendOpenRouterChatCompletion({
+        apiKey: key,
+        request: buildGlm52KeyValidationRequest()
+    });
+    if (!response.ok)
+        return response;
+    const guard = assertGlm52ActualModel(response.value.model);
+    if (!guard.ok) {
+        return {
+            ok: false,
+            error: {
+                code: guard.code,
+                message: 'GLM model lock violated.',
+                severity: 'blocked'
+            }
+        };
+    }
+    return { ok: true, value: validationValue(response.value.model || null) };
+}
+function validationValue(actualModel) {
+    return {
+        schema: 'sks.openrouter-key-validation.v1',
+        ok: true,
+        requested_model: GLM_52_OPENROUTER_MODEL,
+        actual_model: actualModel,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false
+    };
+}
+async function writeGlmModeArtifacts(cwd, result, profile, generatedAt) {
+    const dir = path.join(cwd, '.sneakoscope', 'glm');
+    await writeJsonAtomic(path.join(dir, 'mad-glm-session.json'), {
+        schema: 'sks.glm-mad-session.v1',
+        generated_at: generatedAt,
+        result,
+        profile_id: profile.id
+    });
+    await writeJsonAtomic(path.join(dir, 'openrouter-request-summary.json'), {
+        schema: 'sks.openrouter-request-summary.v1',
+        generated_at: generatedAt,
+        endpoint: OPENROUTER_CHAT_COMPLETIONS_URL,
+        model: GLM_52_OPENROUTER_MODEL,
+        temperature: 1,
+        top_p: 0.95,
+        reasoning_effort: 'high',
+        stream: true,
+        provider_allow_fallbacks: false,
+        require_parameters: true,
+        key_source: result.openrouter_key_source || null,
+        key_preview: result.key_preview || null
+    });
+    await writeJsonAtomic(path.join(dir, 'model-guard.json'), {
+        schema: 'sks.glm-model-guard.v1',
+        generated_at: generatedAt,
+        requested_model: GLM_52_OPENROUTER_MODEL,
+        actual_model: result.actual_model || null,
+        accepted: result.actual_model ? assertGlm52ActualModel(result.actual_model).ok : result.ok,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false,
+        blockers: result.blockers
+    });
+}
+function printHumanGlmResult(result, log) {
+    log(`GLM 5.2 MAD mode: ${result.ok ? result.status : 'blocked'}`);
+    log(`Model: ${result.model}`);
+    log(`GPT fallback: ${result.gpt_fallback_allowed ? 'allowed' : 'blocked'}`);
+    if (result.openrouter_key_source)
+        log(`OpenRouter key: ${result.openrouter_key_source} ${result.key_preview || ''}`.trim());
+    for (const blocker of result.blockers)
+        log(`- blocker: ${blocker}`);
+    for (const warning of result.warnings)
+        log(`- warning: ${warning}`);
+}
+async function promptLine(prompt) {
+    if (!process.stdin.isTTY)
+        return null;
+    const rl = readline.createInterface({ input, output });
+    try {
+        const answer = await rl.question(prompt);
+        return answer.trim() || null;
+    }
+    finally {
+        rl.close();
+    }
+}
+async function promptConfirmLine(prompt, defaultYes) {
+    if (!process.stdin.isTTY)
+        return defaultYes;
+    const answer = await promptLine(prompt);
+    if (!answer)
+        return defaultYes;
+    return !/^n(o)?$/i.test(answer);
+}
+export function buildGlmModeDryRunRequest() {
+    return buildGlm52Request({
+        messages: [{ role: 'user', content: 'SKS GLM dry run.' }],
+        stream: false,
+        maxTokens: 1,
+        toolChoice: 'none',
+        parallelToolCalls: false
+    });
+}
+//# sourceMappingURL=glm-mad-mode.js.map

package/dist/core/providers/openrouter/openrouter-client.js

@@ -0,0 +1,44 @@
+import { OPENROUTER_CHAT_COMPLETIONS_URL } from './openrouter-types.js';
+import { invalidOpenRouterResponseIssue, normalizeOpenRouterError } from './openrouter-error.js';
+import { redactOpenRouterString } from '../../security/redact-secrets.js';
+export async function sendOpenRouterChatCompletion(input) {
+    try {
+        const doFetch = input.fetchImpl || fetch;
+        const response = await doFetch(input.endpoint || OPENROUTER_CHAT_COMPLETIONS_URL, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${input.apiKey}`,
+                'Content-Type': 'application/json',
+                'X-OpenRouter-Title': 'Sneakoscope-Codex'
+            },
+            body: JSON.stringify(input.request)
+        });
+        const text = await response.text();
+        if (!response.ok)
+            return { ok: false, error: normalizeOpenRouterError(response.status, text) };
+        return parseOpenRouterResponse(text);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: {
+                code: 'glm_openrouter_request_failed',
+                message: redactOpenRouterString(err instanceof Error ? err.message : String(err)),
+                severity: 'failed'
+            }
+        };
+    }
+}
+export function parseOpenRouterResponse(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return { ok: false, error: invalidOpenRouterResponseIssue('OpenRouter response was not an object.', text) };
+        }
+        return { ok: true, value: parsed };
+    }
+    catch {
+        return { ok: false, error: invalidOpenRouterResponseIssue('OpenRouter response was not valid JSON.', text) };
+    }
+}
+//# sourceMappingURL=openrouter-client.js.map

package/dist/core/providers/openrouter/openrouter-error.js

@@ -0,0 +1,37 @@
+import { redactOpenRouterString } from '../../security/redact-secrets.js';
+export function normalizeOpenRouterError(status, body) {
+    const code = status === 401 || status === 403
+        ? 'glm_openrouter_unauthorized'
+        : status === 429
+            ? 'glm_openrouter_rate_limited'
+            : status >= 500
+                ? 'glm_openrouter_provider_unavailable'
+                : 'glm_openrouter_request_failed';
+    return {
+        code,
+        message: statusMessage(code),
+        severity: status >= 500 ? 'failed' : 'blocked',
+        status,
+        redacted_body_tail: redactOpenRouterString(body).slice(-2000)
+    };
+}
+export function invalidOpenRouterResponseIssue(message, body) {
+    const issue = {
+        code: 'glm_openrouter_invalid_response',
+        message,
+        severity: 'failed'
+    };
+    return body ? { ...issue, redacted_body_tail: redactOpenRouterString(body).slice(-2000) } : issue;
+}
+function statusMessage(code) {
+    if (code === 'glm_openrouter_unauthorized')
+        return 'OpenRouter rejected the GLM API key.';
+    if (code === 'glm_openrouter_rate_limited')
+        return 'OpenRouter rate limited the GLM request.';
+    if (code === 'glm_openrouter_provider_unavailable')
+        return 'OpenRouter provider is unavailable for GLM 5.2.';
+    if (code === 'glm_openrouter_invalid_response')
+        return 'OpenRouter returned an invalid response.';
+    return 'OpenRouter request failed.';
+}
+//# sourceMappingURL=openrouter-error.js.map

package/dist/core/providers/openrouter/openrouter-secret-store.js

@@ -0,0 +1,113 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { redactOpenRouterKey } from '../../security/redact-secrets.js';
+export const OPENROUTER_KEY_ENV_NAMES = ['OPENROUTER_API_KEY', 'SKS_OPENROUTER_API_KEY'];
+export function openRouterSecretPaths(env = process.env) {
+    const sksHome = path.resolve(env.SKS_HOME || path.join(env.HOME || os.homedir(), '.sneakoscope'));
+    const secretDir = path.join(sksHome, 'secrets');
+    return {
+        sksHome,
+        secretDir,
+        keyPath: path.join(secretDir, 'openrouter-api-key'),
+        metadataPath: path.join(secretDir, 'openrouter-api-key.json')
+    };
+}
+export async function resolveOpenRouterApiKey(input = {}) {
+    const env = input.env || process.env;
+    for (const name of OPENROUTER_KEY_ENV_NAMES) {
+        const value = String(env[name] || '').trim();
+        if (value) {
+            return {
+                key: value,
+                source: 'env',
+                env_var: name,
+                key_preview: redactOpenRouterKey(value),
+                blockers: [],
+                warnings: name === 'OPENROUTER_API_KEY' ? [] : ['using_sks_openrouter_api_key_env']
+            };
+        }
+    }
+    const stored = await readStoredOpenRouterKey(input.paths || openRouterSecretPaths(env));
+    if (stored) {
+        return {
+            key: stored,
+            source: 'user-secret-store',
+            key_preview: redactOpenRouterKey(stored),
+            blockers: [],
+            warnings: []
+        };
+    }
+    return {
+        key: null,
+        source: null,
+        key_preview: null,
+        blockers: ['glm_missing_openrouter_key'],
+        warnings: []
+    };
+}
+export async function readStoredOpenRouterKey(paths) {
+    try {
+        const text = await fs.readFile(paths.keyPath, 'utf8');
+        const key = text.trim();
+        return key || null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeStoredOpenRouterKey(value, input = {}) {
+    const key = value.trim();
+    if (!key)
+        throw new Error('OpenRouter key is empty.');
+    const paths = input.paths || openRouterSecretPaths();
+    const nowIso = input.nowIso || (() => new Date().toISOString());
+    const timestamp = nowIso();
+    const previous = input.previousRecord ?? await readOpenRouterKeyRecord(paths);
+    await ensureSecretDir(paths.secretDir);
+    const tmp = `${paths.keyPath}.${process.pid}.${crypto.randomBytes(3).toString('hex')}.tmp`;
+    try {
+        const handle = await fs.open(tmp, 'w', 0o600);
+        try {
+            await handle.writeFile(`${key}\n`, 'utf8');
+            await handle.sync().catch(() => undefined);
+        }
+        finally {
+            await handle.close().catch(() => undefined);
+        }
+        await fs.chmod(tmp, 0o600).catch(() => undefined);
+        await fs.rename(tmp, paths.keyPath);
+        await fs.chmod(paths.keyPath, 0o600).catch(() => undefined);
+    }
+    catch (err) {
+        await fs.rm(tmp, { force: true }).catch(() => undefined);
+        throw err;
+    }
+    const record = {
+        schema: 'sks.openrouter-key.v1',
+        created_at: previous?.created_at || timestamp,
+        updated_at: timestamp,
+        key_hash: crypto.createHash('sha256').update(key).digest('hex'),
+        key_preview: redactOpenRouterKey(key)
+    };
+    await fs.writeFile(paths.metadataPath, `${JSON.stringify(record, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await fs.chmod(paths.metadataPath, 0o600).catch(() => undefined);
+    return record;
+}
+export async function readOpenRouterKeyRecord(paths) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(paths.metadataPath, 'utf8'));
+        if (parsed.schema !== 'sks.openrouter-key.v1' || !parsed.key_hash || !parsed.key_preview)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+async function ensureSecretDir(secretDir) {
+    await fs.mkdir(secretDir, { recursive: true, mode: 0o700 });
+    await fs.chmod(secretDir, 0o700).catch(() => undefined);
+}
+//# sourceMappingURL=openrouter-secret-store.js.map

package/dist/core/providers/openrouter/openrouter-types.js

@@ -0,0 +1,2 @@
+export const OPENROUTER_CHAT_COMPLETIONS_URL = 'https://openrouter.ai/api/v1/chat/completions';
+//# sourceMappingURL=openrouter-types.js.map

package/dist/core/results.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=results.js.map

package/dist/core/secret-redaction.js

@@ -1,6 +1,8 @@
 const SECRET_ENV_NAMES = [
     'CODEX_ACCESS_TOKEN',
     'OPENAI_API_KEY',
+    'OPENROUTER_API_KEY',
+    'SKS_OPENROUTER_API_KEY',
     'CODEX_LB_API_KEY',
     'ANTHROPIC_API_KEY',
     'GITHUB_TOKEN',
@@ -8,6 +10,8 @@ const SECRET_ENV_NAMES = [
 ];
 const SECRET_PATTERNS = [
     /\bsk-proj-[A-Za-z0-9_-]{12,}\b/g,
+    /\bsk-or-v1-[A-Za-z0-9_-]{12,}\b/g,
+    /\bsk-or-[A-Za-z0-9_-]{12,}\b/g,
     /\bsk-[A-Za-z0-9_-]{20,}\b/g,
     /\bsk-clb-[A-Za-z0-9_-]{8,}\b/g,
     /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,

package/dist/core/security/redact-secrets.js

@@ -0,0 +1,15 @@
+import { redactSecrets, redactString } from '../secret-redaction.js';
+export function redactOpenRouterKey(value) {
+    if (!value)
+        return '';
+    if (value.length <= 10)
+        return '<redacted>';
+    return `${value.slice(0, 6)}...${value.slice(-4)}`;
+}
+export function redactOpenRouterSecrets(value, env = process.env) {
+    return redactSecrets(value, env);
+}
+export function redactOpenRouterString(value, env = process.env) {
+    return redactString(String(value ?? ''), env);
+}
+//# sourceMappingURL=redact-secrets.js.map

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '4.0.2';
+export const PACKAGE_VERSION = '4.0.3';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -30,6 +30,8 @@
     "!dist/**/*.d.ts.map",
     "!dist/**/*.js.map",
     "!dist/**/*.tsbuildinfo",
+    "!dist/**/__tests__",
+    "!dist/**/*.test.js",
     "!dist/vendor/openai-codex/rust-v0.131.0",
     "!dist/scripts/*-blackbox.js",
     "!dist/scripts/*-check.js",
@@ -122,6 +124,7 @@
     "prepublish:fast-check": "node ./dist/scripts/prepublish-fast-check.js",
     "prepublish:release-check-or-fast": "node ./dist/scripts/prepublish-release-check-or-fast.js",
     "mad:preflight-blocks-unreadable-config": "node ./dist/scripts/mad-preflight-blocks-unreadable-config-check.js",
+    "codex:0.141-compat": "node ./dist/scripts/codex-0141-capability-check.js",
     "codex:0.136-compat": "node ./dist/scripts/codex-0-136-compat-check.js",
     "codex:0.136-compat:require-real": "node ./dist/scripts/codex-0-136-compat-check.js --require-real",
     "codex:0.135-compat": "node ./dist/scripts/codex-0-135-compat-check.js",