sneakoscope 4.0.2 → 4.0.4

package/README.md

@@ -35,15 +35,16 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.0.2** is the TriWiki Turbo production completion release. It makes affected/confidence release runs TriWiki-first, restores build-once proof, bridges reusable TriWiki proof cards into release cache v2, runs gate packs through a resource-aware scheduler, and tightens semantic dirty doctor, sksd warmup, legacy purge, orphan detection, and actual five-minute SLA regression evidence.
+SKS **4.0.4** makes the GLM 5.2 MAD launch path real: `sks --mad --glm` now resolves the OpenRouter key, opens the MAD Zellij launch flow with Codex configured for `z-ai/glm-5.2`, blocks GPT fallback panes, and records launch proof; `sks --mad --glm --repair` still rotates the OpenRouter API key outside project files.
 
-What changed in 4.0.2:
+What changed in 4.0.4:
 
-- **TriWiki proof bank.** Proof cards now bind reusable gate proof to input hash, implementation hash, package lock hash, environment allowlist, fixture version, and tool version.
-- **Affected release-equivalent verification.** Changed files map to module cards, gate impact maps, and gate packs so small tasks can run fast without giving up scoped release confidence.
-- **Parallel SLA planning.** Release gate packs, resource budgets, and SLA certificates expose the planned critical path for five-minute foreground verification.
-- **New control surface.** `sks check`, `sks task`, `sks release`, `sks triwiki`, `sks proof bank status`, and `sks daemon` expose the fast proof pipeline.
-- **No silent legacy fallback.** Compatibility aliases are removed; removed runtimes now use explicit migration notices.
+- **GLM MAD actually launches.** `sks --mad --glm` no longer stops after the readiness banner; it continues into the MAD launcher with a GLM/OpenRouter Codex profile.
+- **No leaked OpenRouter key.** The Zellij pane uses a mission-local `sks-glm-codex-wrapper.sh` that reads the key at runtime, so layout artifacts do not contain the raw secret.
+- **No GPT fallback panes.** GLM MAD disables the existing GPT/codex-sdk native swarm by default until a GLM worker backend exists, preserving the no-fallback guarantee.
+- **Launch proof.** Each GLM MAD launch writes `mad-glm-launch.json` with provider/model/profile/wrapper evidence and records disabled fallback status.
+- **OpenRouter key lifecycle.** Keys resolve from `OPENROUTER_API_KEY`, `SKS_OPENROUTER_API_KEY`, or the user SKS secret store; stored keys use private permissions and redacted metadata.
+- **4.0.3 GLM request safeguards remain.** GLM requests still use `provider.allow_fallbacks: false`, omit fallback `models`, and reject non-GLM response model ids before mutation.
 
 SKS **3.1.16** was a launch-reliability patch on the 3.1.15 doctor-reliability release. It made `sks --mad` self-bootstrap a fresh project instead of dead-ending on a missing Codex config.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.0.2"
+version = "4.0.4"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.0.2"
+version = "4.0.4"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.0.2"),
+        Some("--version") => println!("sks-rs 4.0.4"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.0.2';
+const FAST_PACKAGE_VERSION = '4.0.4';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/command-registry.js

@@ -111,6 +111,7 @@ export const COMMANDS = {
     'zellij-slot-column-anchor': entry('beta', 'Render the compact SLOTS anchor pane for first-slot-down Zellij stacks', 'dist/commands/zellij-slot-column-anchor.js', directCommand(() => import('../commands/zellij-slot-column-anchor.js'), 'dist/commands/zellij-slot-column-anchor.js')),
     zellij: entry('beta', 'Inspect Zellij runtime status and explain repair (no auto-install)', 'dist/commands/zellij.js', directCommand(() => import('../commands/zellij.js'), 'dist/commands/zellij.js')),
     'mad-sks': entry('beta', 'MAD-SKS scoped permission modifier', 'dist/commands/mad-sks.js', directCommand(() => import('../commands/mad-sks.js'), 'dist/commands/mad-sks.js')),
+    glm: entry('beta', 'Run GLM 5.2 MAD mode through OpenRouter', 'dist/core/commands/glm-command.js', argsCommand(() => import('../core/commands/glm-command.js'), 'glmCommand', 'dist/core/commands/glm-command.js')),
     'mad-db': entry('beta', 'Create or inspect one-cycle Mad-DB break-glass capability tokens', 'dist/commands/mad-db.js', directCommand(() => import('../commands/mad-db.js'), 'dist/commands/mad-db.js')),
     'auto-review': entry('beta', 'Manage auto-review profile', 'dist/commands/auto-review.js', directCommand(() => import('../commands/auto-review.js'), 'dist/commands/auto-review.js')),
     'dollar-commands': entry('stable', 'List Codex App dollar commands', 'dist/core/commands/basic-cli.js', basicArgs('dollarCommandsCommand')),

package/dist/cli/global-mode-router.js

@@ -0,0 +1,25 @@
+const RESERVED_COMMANDS = new Set(['help', '--help', '-h', 'version', '--version', '-v']);
+export function detectGlobalMode(args = []) {
+    if (!args.length || RESERVED_COMMANDS.has(String(args[0])))
+        return null;
+    const hasMad = args.includes('--mad');
+    const hasGlm = args.includes('--glm');
+    if (hasMad && hasGlm)
+        return { kind: 'mad-glm', args: stripGlobalModeFlags(args) };
+    if (hasGlm && !hasMad)
+        return { kind: 'glm-without-mad', args: stripGlobalModeFlags(args) };
+    return null;
+}
+export function stripGlobalModeFlags(args) {
+    return args.filter((arg) => arg !== '--mad' && arg !== '--glm');
+}
+export function glmWithoutMadResult() {
+    return {
+        ok: false,
+        status: 'blocked',
+        mode: 'glm',
+        reason: 'glm_requires_mad',
+        hint: 'use sks --mad --glm'
+    };
+}
+//# sourceMappingURL=global-mode-router.js.map

package/dist/cli/router.js

@@ -1,4 +1,5 @@
 import { COMMAND_ALIASES, COMMANDS, } from './command-registry.js';
+import { detectGlobalMode, glmWithoutMadResult } from './global-mode-router.js';
 export function isCommandName(value) {
     return Object.prototype.hasOwnProperty.call(COMMANDS, value);
 }
@@ -18,6 +19,17 @@ export function normalizeCommand(args = []) {
 }
 export async function dispatch(args) {
     const argv = args ?? process.argv.slice(2);
+    const globalMode = detectGlobalMode(argv);
+    if (globalMode?.kind === 'mad-glm') {
+        const mod = await import('../core/commands/glm-command.js');
+        return mod.glmCommand(globalMode.args);
+    }
+    if (globalMode?.kind === 'glm-without-mad') {
+        const result = glmWithoutMadResult();
+        console.error(`GLM mode requires MAD: ${result.hint}`);
+        process.exitCode = 1;
+        return result;
+    }
     const { command, rawCommand, args: rest } = normalizeCommand(argv);
     if (!command) {
         if (!argv.length) {

package/dist/commands/codex-app.js

@@ -10,6 +10,7 @@ import { runCodexInitDeep } from '../core/codex-app/codex-init-deep.js';
 import { buildCodexHookLifecycle } from '../core/codex-app/codex-hook-lifecycle.js';
 import { resolveCodexAppExecutionProfile } from '../core/codex-app/codex-app-execution-profile.js';
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
+import { doctorCodexAppGlmProfile, installCodexAppGlmProfile } from '../core/codex-app/glm-profile-installer.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'check';
     if (action === 'remote-control' || action === 'remote')
@@ -28,6 +29,14 @@ export async function run(_command, args = []) {
         return printCodexAppResult(args, await buildCodexHookLifecycle({ root: await sksRoot(), apply: flag(args, '--apply') || flag(args, '--fix') }));
     if (action === 'execution-profile')
         return printCodexAppResult(args, await resolveCodexAppExecutionProfile({ root: await sksRoot() }));
+    if (action === 'glm-profile') {
+        const subcommand = args[1] || 'doctor';
+        const root = await sksRoot();
+        const result = subcommand === 'install' || subcommand === 'repair'
+            ? await installCodexAppGlmProfile({ root, apply: true })
+            : await doctorCodexAppGlmProfile({ root });
+        return printCodexAppResult(args, result);
+    }
     if (action === 'product-design' || action === 'design-product' || action === 'ensure-product-design') {
         const checkOnly = flag(args, '--check-only') || flag(args, '--no-install');
         const status = await codexProductDesignPluginStatus({
@@ -88,7 +97,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
+    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|glm-profile [install|doctor]|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
     process.exitCode = 1;
 }
 function printCodexAppResult(args = [], result) {

package/dist/commands/codex.js

@@ -3,6 +3,7 @@ import { printJson } from '../cli/output.js';
 import { codexCompatibilityReport, codexDoctorReport } from '../core/codex-compat/codex-compat-report.js';
 import { codexVersionReport } from '../core/codex-compat/codex-version.js';
 import { codexSchemaSnapshotReport } from '../core/codex-compat/codex-schema-snapshot.js';
+import { detectCodex0141Capability } from '../core/codex-control/codex-0141-capability.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'compatibility';
     if (action === 'compatibility' || action === 'compat') {
@@ -24,6 +25,19 @@ export async function run(_command, args = []) {
         console.log(`Codex detected: ${result.detected.version || 'not installed'} (${result.policy.status})`);
         return;
     }
+    if (action === '0.141' || action === '0141' || action === 'rust-v0.141.0') {
+        const result = await detectCodex0141Capability();
+        if (flag(args, '--json'))
+            return printJson(result);
+        console.log(`Codex 0.141 compatibility: ${result.ok ? 'ok' : 'blocked'}`);
+        for (const blocker of result.blockers || [])
+            console.log(`- blocker: ${blocker}`);
+        for (const warning of result.warnings || [])
+            console.log(`- warning: ${warning}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
     if (action === 'doctor') {
         const result = await codexDoctorReport();
         if (flag(args, '--json'))
@@ -42,7 +56,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex compatibility|version|doctor|schema [--json]');
+    console.error('Usage: sks codex compatibility|version|doctor|schema|0.141 [--json]');
     process.exitCode = 1;
 }
 //# sourceMappingURL=codex.js.map

package/dist/core/codex-app/glm-model-profile.js

@@ -0,0 +1,2 @@
+export { GLM_CODEX_APP_PROFILE_ID, GLM_CODEX_APP_PROFILE_LABEL, buildGlmCodexAppModelProfile } from '../providers/glm/glm-52-profile.js';
+//# sourceMappingURL=glm-model-profile.js.map

package/dist/core/codex-app/glm-profile-installer.js

@@ -0,0 +1,61 @@
+import path from 'node:path';
+import { readJson, writeJsonAtomic, nowIso } from '../fsx.js';
+import { buildGlmCodexAppModelProfile } from './glm-model-profile.js';
+import { validateGlmCodexAppModelProfile } from './glm-profile-schema.js';
+import { resolveOpenRouterApiKey } from '../providers/openrouter/openrouter-secret-store.js';
+export async function installCodexAppGlmProfile(input) {
+    const root = path.resolve(input.root);
+    const profile = buildGlmCodexAppModelProfile();
+    const profilePath = path.join(root, '.sneakoscope', 'codex-app', 'glm-model-profile.json');
+    const reportPath = path.join(root, '.sneakoscope', 'reports', 'codex-app-glm-profile.json');
+    const key = await resolveOpenRouterApiKey({ env: input.env || process.env });
+    const warnings = [
+        ...key.warnings,
+        ...(key.key ? [] : ['openrouter_key_missing_until_sks_--mad_--glm_--repair'])
+    ];
+    if (input.apply !== false)
+        await writeJsonAtomic(profilePath, profile);
+    const result = {
+        schema: 'sks.codex-app-glm-profile-result.v1',
+        generated_at: nowIso(),
+        ok: true,
+        status: input.apply === false ? 'valid' : 'installed',
+        profile,
+        profile_path: '.sneakoscope/codex-app/glm-model-profile.json',
+        report_path: '.sneakoscope/reports/codex-app-glm-profile.json',
+        openrouter_key_source: key.source,
+        blockers: [],
+        warnings
+    };
+    await writeJsonAtomic(reportPath, result).catch(() => undefined);
+    return result;
+}
+export async function doctorCodexAppGlmProfile(input) {
+    const root = path.resolve(input.root);
+    const profilePath = path.join(root, '.sneakoscope', 'codex-app', 'glm-model-profile.json');
+    const reportPath = path.join(root, '.sneakoscope', 'reports', 'codex-app-glm-profile.json');
+    const existing = await readJson(profilePath, null);
+    const validation = validateGlmCodexAppModelProfile(existing);
+    const key = await resolveOpenRouterApiKey({ env: input.env || process.env });
+    const profile = validation.profile || buildGlmCodexAppModelProfile();
+    const blockers = [...validation.blockers];
+    const warnings = [
+        ...key.warnings,
+        ...(key.key ? [] : ['openrouter_key_missing_until_sks_--mad_--glm_--repair'])
+    ];
+    const result = {
+        schema: 'sks.codex-app-glm-profile-result.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        status: blockers.length === 0 ? 'valid' : 'blocked',
+        profile,
+        profile_path: '.sneakoscope/codex-app/glm-model-profile.json',
+        report_path: '.sneakoscope/reports/codex-app-glm-profile.json',
+        openrouter_key_source: key.source,
+        blockers,
+        warnings
+    };
+    await writeJsonAtomic(reportPath, result).catch(() => undefined);
+    return result;
+}
+//# sourceMappingURL=glm-profile-installer.js.map

package/dist/core/codex-app/glm-profile-schema.js

@@ -0,0 +1,24 @@
+import { GLM_CODEX_APP_PROFILE_ID, buildGlmCodexAppModelProfile } from './glm-model-profile.js';
+import { GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE } from '../providers/glm/glm-52-settings.js';
+export function validateGlmCodexAppModelProfile(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return { ok: false, blockers: ['glm_codex_app_profile_missing'], profile: null };
+    }
+    const profile = value;
+    const expected = buildGlmCodexAppModelProfile();
+    const blockers = [
+        profile.schema === expected.schema ? null : 'glm_codex_app_profile_invalid_schema',
+        profile.id === GLM_CODEX_APP_PROFILE_ID ? null : 'glm_codex_app_profile_invalid_id',
+        profile.provider === 'openrouter' ? null : 'glm_codex_app_profile_invalid_provider',
+        profile.model === GLM_52_OPENROUTER_MODEL ? null : 'glm_codex_app_profile_invalid_model',
+        profile.mode === GLM_MAD_MODE ? null : 'glm_codex_app_profile_invalid_mode',
+        profile.strictModelLock === true ? null : 'glm_codex_app_profile_not_strict',
+        profile.gptFallbackAllowed === false ? null : 'glm_codex_app_profile_allows_gpt_fallback'
+    ].filter((item) => Boolean(item));
+    return {
+        ok: blockers.length === 0,
+        blockers,
+        profile: blockers.length === 0 ? profile : null
+    };
+}
+//# sourceMappingURL=glm-profile-schema.js.map

package/dist/core/codex-control/codex-0141-capability.js

@@ -0,0 +1,95 @@
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
+export const CODEX_0141_FEATURE_KEYS = [
+    'noise_relay_delegated',
+    'native_cwd_shell_path_preserved',
+    'permission_paths_preserved',
+    'selected_plugin_mcp_per_thread',
+    'auth_curated_marketplaces',
+    'child_threads_api',
+    'external_agent_import_results',
+    'rate_limit_reset_credits',
+    'realtime_startup_context_control',
+    'tui_prompt_auto_resolve',
+    'hook_trust_resume_persistence',
+    'post_tool_use_blocking_respected',
+    'plugin_app_mcp_dedupe',
+    'windows_sandbox_repairs_delegated',
+    'idle_exec_relay_keepalive',
+    'wait_agent_interrupt_native',
+    'sqlite_wal_reset_fix_delegated',
+    'tls_p521_native',
+    'tool_heavy_copy_reduction',
+    'prompt_image_cache_bound_64_mib',
+    'feedback_upload_bound_8_threads',
+    'terminal_resize_reflow_always'
+];
+export async function detectCodex0141Capability(input = {}) {
+    const fake = process.env.SKS_CODEX_0141_FAKE === '1';
+    const codexBin = fake ? input.codexBin || process.env.CODEX_BIN || 'codex' : input.codexBin || process.env.CODEX_BIN || await findCodexBinary();
+    const versionText = fake ? String(process.env.SKS_CODEX_VERSION_FAKE || 'codex-cli 0.141.0') : await readCodexVersionText(codexBin);
+    const parsed = parseCodexVersionText(versionText);
+    const supports0141 = Boolean(parsed && compareSemverLike(parsed, '0.141.0') >= 0);
+    const featureStates = Object.fromEntries(CODEX_0141_FEATURE_KEYS.map((key) => [key, featureStateFor(key, supports0141)]));
+    const blockers = [
+        ...(!codexBin ? ['codex_cli_missing'] : []),
+        ...(supports0141 ? [] : ['codex_0_141_required_for_0141_features'])
+    ];
+    return {
+        schema: 'sks.codex-0141-capability.v1',
+        generated_at: nowIso(),
+        ok: blockers.length === 0,
+        codex_version: parsed,
+        supports_0141: supports0141,
+        feature_states: featureStates,
+        blockers,
+        warnings: supports0141
+            ? CODEX_0141_FEATURE_KEYS.map((key) => `codex_0141_${key}_assumed_by_version`)
+            : [],
+        codex_bin: codexBin || null,
+        release_source: 'https://github.com/openai/codex/releases/tag/rust-v0.141.0'
+    };
+}
+export async function writeCodex0141CapabilityArtifacts(root, input = {}) {
+    const report = await detectCodex0141Capability({ codexBin: input.codexBin || null });
+    const rootArtifact = path.join(root, '.sneakoscope', 'codex-0141-capability.json');
+    await writeJsonAtomic(rootArtifact, report);
+    let missionArtifact = null;
+    if (input.missionId) {
+        missionArtifact = path.join(root, '.sneakoscope', 'missions', input.missionId, 'codex-0141-capability.json');
+        await writeJsonAtomic(missionArtifact, report);
+    }
+    return { report, root_artifact: rootArtifact, mission_artifact: missionArtifact };
+}
+function featureStateFor(key, supports0141) {
+    return {
+        supported: supports0141,
+        certainty: supports0141 ? 'assumed_by_version' : 'failed',
+        evidence: supports0141 ? ['codex_version>=0.141.0', `release:rust-v0.141.0:${key}`] : [],
+        blockers: supports0141 ? [] : ['codex_0_141_required_for_0141_features'],
+        sks_policy: sksPolicyFor(key)
+    };
+}
+function sksPolicyFor(key) {
+    if (key.includes('dedupe'))
+        return 'dedupe';
+    if (key.includes('bound') || key.includes('cache') || key.includes('feedback'))
+        return 'bound';
+    if (key.includes('blocking') || key.includes('trust'))
+        return 'respect';
+    return 'delegate';
+}
+async function readCodexVersionText(codexBin) {
+    if (!codexBin)
+        return null;
+    const result = await runProcess(codexBin, ['--version'], { timeoutMs: 10_000, maxOutputBytes: 16 * 1024 }).catch((err) => ({
+        code: 1,
+        stdout: '',
+        stderr: err instanceof Error ? err.message : String(err)
+    }));
+    const text = `${result.stdout || ''}${result.stderr || ''}`.trim();
+    return result.code === 0 ? text : text || null;
+}
+//# sourceMappingURL=codex-0141-capability.js.map

package/dist/core/commands/glm-command.js

@@ -0,0 +1,10 @@
+import { runMadGlmMode } from '../providers/glm/glm-mad-mode.js';
+import { flag } from '../../cli/args.js';
+import { madHighCommand } from './mad-sks-command.js';
+export async function glmCommand(args = []) {
+    const result = await runMadGlmMode(args);
+    if (!result.ok || flag(args, '--repair') || flag(args, '--json'))
+        return result;
+    return madHighCommand(['--glm', ...args], { glmReadiness: result });
+}
+//# sourceMappingURL=glm-command.js.map