sneakoscope 4.0.2 → 4.0.4

package/dist/core/providers/glm/glm-mad-mode.js

@@ -0,0 +1,242 @@
+import readline from 'node:readline/promises';
+import path from 'node:path';
+import { stdin as input, stdout as output } from 'node:process';
+import { printJson } from '../../../cli/output.js';
+import { flag } from '../../../cli/args.js';
+import { nowIso, writeJsonAtomic } from '../../fsx.js';
+import {} from '../openrouter/openrouter-types.js';
+import { sendOpenRouterChatCompletion } from '../openrouter/openrouter-client.js';
+import { resolveOpenRouterApiKey, writeStoredOpenRouterKey } from '../openrouter/openrouter-secret-store.js';
+import { redactOpenRouterKey } from '../../security/redact-secrets.js';
+import { buildGlmCodexAppModelProfile } from './glm-52-profile.js';
+import { buildGlm52KeyValidationRequest, buildGlm52Request } from './glm-52-request.js';
+import { assertGlm52ActualModel } from './glm-52-response-guard.js';
+import { GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE, OPENROUTER_CHAT_COMPLETIONS_URL } from './glm-52-settings.js';
+export async function runMadGlmMode(args = [], adapters = {}) {
+    const runtime = buildDefaultAdapters(adapters);
+    const repair = flag(args, '--repair');
+    const noSaveKey = flag(args, '--no-save-key');
+    const skipValidation = flag(args, '--skip-validation');
+    const json = flag(args, '--json');
+    const profile = buildGlmCodexAppModelProfile();
+    let result;
+    if (repair) {
+        const key = await runtime.promptSecret('OpenRouter API key is required for GLM 5.2 mode.\nEnter OpenRouter API key: ');
+        if (!key) {
+            result = baseResult({
+                status: 'blocked',
+                blockers: ['glm_key_prompt_cancelled'],
+                warnings: []
+            });
+        }
+        else {
+            if (!noSaveKey)
+                await runtime.writeSecret(key);
+            const validation = skipValidation
+                ? { ok: true, value: validationValue(null) }
+                : await runtime.validateOpenRouterKey(key);
+            result = validation.ok
+                ? baseResult({
+                    status: 'ready',
+                    ...(validation.value.actual_model ? { actual_model: validation.value.actual_model } : {}),
+                    openrouter_key_source: noSaveKey ? 'prompt' : 'user-secret-store',
+                    key_preview: redactOpenRouterKey(key),
+                    blockers: [],
+                    warnings: noSaveKey ? ['openrouter_key_not_saved'] : []
+                })
+                : baseResult({
+                    status: 'blocked',
+                    openrouter_key_source: noSaveKey ? 'prompt' : 'user-secret-store',
+                    key_preview: redactOpenRouterKey(key),
+                    blockers: [validation.error.code],
+                    warnings: []
+                });
+        }
+    }
+    else {
+        const resolved = await resolveOpenRouterApiKey({ env: runtime.env });
+        if (!resolved.key && process.stdin.isTTY) {
+            const key = await runtime.promptSecret('OpenRouter API key is required for GLM 5.2 mode.\nEnter OpenRouter API key: ');
+            if (!key) {
+                result = baseResult({ status: 'blocked', blockers: ['glm_key_prompt_cancelled'], warnings: [] });
+            }
+            else {
+                const save = noSaveKey ? false : await runtime.promptConfirm('Save this key for future SKS GLM runs? [Y/n] ', true);
+                if (save)
+                    await runtime.writeSecret(key);
+                result = baseResult({
+                    status: 'ready',
+                    openrouter_key_source: save ? 'user-secret-store' : 'prompt',
+                    key_preview: redactOpenRouterKey(key),
+                    blockers: [],
+                    warnings: save ? [] : ['openrouter_key_not_saved']
+                });
+            }
+        }
+        else if (!resolved.key) {
+            result = baseResult({
+                status: 'blocked',
+                blockers: resolved.blockers,
+                warnings: ['set_OPENROUTER_API_KEY_or_run_sks_--mad_--glm_--repair']
+            });
+        }
+        else {
+            result = baseResult({
+                status: 'ready',
+                ...(resolved.source ? { openrouter_key_source: resolved.source } : {}),
+                key_preview: resolved.key_preview,
+                blockers: [],
+                warnings: resolved.warnings
+            });
+        }
+    }
+    await writeGlmModeArtifacts(runtime.cwd, result, profile, runtime.nowIso()).catch(() => undefined);
+    if (json)
+        printJson(result);
+    else
+        printHumanGlmResult(result, runtime.log);
+    if (!result.ok)
+        process.exitCode = 1;
+    return result;
+}
+function baseResult(input) {
+    const result = {
+        schema: 'sks.glm-mode-result.v1',
+        ok: input.blockers.length === 0 && input.status !== 'failed',
+        status: input.status,
+        mode: GLM_MAD_MODE,
+        provider: 'openrouter',
+        model: GLM_52_OPENROUTER_MODEL,
+        requested_model: GLM_52_OPENROUTER_MODEL,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false,
+        codex_app_profile_id: 'sks/glm-5.2-mad',
+        blockers: input.blockers,
+        warnings: input.warnings
+    };
+    return {
+        ...result,
+        ...(input.actual_model ? { actual_model: input.actual_model } : {}),
+        ...(input.openrouter_key_source ? { openrouter_key_source: input.openrouter_key_source } : {}),
+        ...(input.key_preview !== undefined ? { key_preview: input.key_preview } : {})
+    };
+}
+function buildDefaultAdapters(overrides) {
+    return {
+        nowIso: overrides.nowIso || nowIso,
+        env: overrides.env || process.env,
+        cwd: overrides.cwd || process.cwd(),
+        promptSecret: overrides.promptSecret || promptLine,
+        promptConfirm: overrides.promptConfirm || promptConfirmLine,
+        writeSecret: overrides.writeSecret || (async (value) => {
+            await writeStoredOpenRouterKey(value);
+        }),
+        validateOpenRouterKey: overrides.validateOpenRouterKey || validateOpenRouterKey,
+        sendOpenRouterRequest: overrides.sendOpenRouterRequest || (async (request, key) => sendOpenRouterChatCompletion({ request, apiKey: key })),
+        log: overrides.log || ((message) => console.log(message))
+    };
+}
+async function validateOpenRouterKey(key) {
+    const response = await sendOpenRouterChatCompletion({
+        apiKey: key,
+        request: buildGlm52KeyValidationRequest()
+    });
+    if (!response.ok)
+        return response;
+    const guard = assertGlm52ActualModel(response.value.model);
+    if (!guard.ok) {
+        return {
+            ok: false,
+            error: {
+                code: guard.code,
+                message: 'GLM model lock violated.',
+                severity: 'blocked'
+            }
+        };
+    }
+    return { ok: true, value: validationValue(response.value.model || null) };
+}
+function validationValue(actualModel) {
+    return {
+        schema: 'sks.openrouter-key-validation.v1',
+        ok: true,
+        requested_model: GLM_52_OPENROUTER_MODEL,
+        actual_model: actualModel,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false
+    };
+}
+async function writeGlmModeArtifacts(cwd, result, profile, generatedAt) {
+    const dir = path.join(cwd, '.sneakoscope', 'glm');
+    await writeJsonAtomic(path.join(dir, 'mad-glm-session.json'), {
+        schema: 'sks.glm-mad-session.v1',
+        generated_at: generatedAt,
+        result,
+        profile_id: profile.id
+    });
+    await writeJsonAtomic(path.join(dir, 'openrouter-request-summary.json'), {
+        schema: 'sks.openrouter-request-summary.v1',
+        generated_at: generatedAt,
+        endpoint: OPENROUTER_CHAT_COMPLETIONS_URL,
+        model: GLM_52_OPENROUTER_MODEL,
+        temperature: 1,
+        top_p: 0.95,
+        reasoning_effort: 'high',
+        stream: true,
+        provider_allow_fallbacks: false,
+        require_parameters: true,
+        key_source: result.openrouter_key_source || null,
+        key_preview: result.key_preview || null
+    });
+    await writeJsonAtomic(path.join(dir, 'model-guard.json'), {
+        schema: 'sks.glm-model-guard.v1',
+        generated_at: generatedAt,
+        requested_model: GLM_52_OPENROUTER_MODEL,
+        actual_model: result.actual_model || null,
+        accepted: result.actual_model ? assertGlm52ActualModel(result.actual_model).ok : result.ok,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false,
+        blockers: result.blockers
+    });
+}
+function printHumanGlmResult(result, log) {
+    log(`GLM 5.2 MAD mode: ${result.ok ? result.status : 'blocked'}`);
+    log(`Model: ${result.model}`);
+    log(`GPT fallback: ${result.gpt_fallback_allowed ? 'allowed' : 'blocked'}`);
+    if (result.openrouter_key_source)
+        log(`OpenRouter key: ${result.openrouter_key_source} ${result.key_preview || ''}`.trim());
+    for (const blocker of result.blockers)
+        log(`- blocker: ${blocker}`);
+    for (const warning of result.warnings)
+        log(`- warning: ${warning}`);
+}
+async function promptLine(prompt) {
+    if (!process.stdin.isTTY)
+        return null;
+    const rl = readline.createInterface({ input, output });
+    try {
+        const answer = await rl.question(prompt);
+        return answer.trim() || null;
+    }
+    finally {
+        rl.close();
+    }
+}
+async function promptConfirmLine(prompt, defaultYes) {
+    if (!process.stdin.isTTY)
+        return defaultYes;
+    const answer = await promptLine(prompt);
+    if (!answer)
+        return defaultYes;
+    return !/^n(o)?$/i.test(answer);
+}
+export function buildGlmModeDryRunRequest() {
+    return buildGlm52Request({
+        messages: [{ role: 'user', content: 'SKS GLM dry run.' }],
+        stream: false,
+        maxTokens: 1,
+        toolChoice: 'none',
+        parallelToolCalls: false
+    });
+}
+//# sourceMappingURL=glm-mad-mode.js.map

package/dist/core/providers/openrouter/openrouter-client.js

@@ -0,0 +1,44 @@
+import { OPENROUTER_CHAT_COMPLETIONS_URL } from './openrouter-types.js';
+import { invalidOpenRouterResponseIssue, normalizeOpenRouterError } from './openrouter-error.js';
+import { redactOpenRouterString } from '../../security/redact-secrets.js';
+export async function sendOpenRouterChatCompletion(input) {
+    try {
+        const doFetch = input.fetchImpl || fetch;
+        const response = await doFetch(input.endpoint || OPENROUTER_CHAT_COMPLETIONS_URL, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${input.apiKey}`,
+                'Content-Type': 'application/json',
+                'X-OpenRouter-Title': 'Sneakoscope-Codex'
+            },
+            body: JSON.stringify(input.request)
+        });
+        const text = await response.text();
+        if (!response.ok)
+            return { ok: false, error: normalizeOpenRouterError(response.status, text) };
+        return parseOpenRouterResponse(text);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: {
+                code: 'glm_openrouter_request_failed',
+                message: redactOpenRouterString(err instanceof Error ? err.message : String(err)),
+                severity: 'failed'
+            }
+        };
+    }
+}
+export function parseOpenRouterResponse(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return { ok: false, error: invalidOpenRouterResponseIssue('OpenRouter response was not an object.', text) };
+        }
+        return { ok: true, value: parsed };
+    }
+    catch {
+        return { ok: false, error: invalidOpenRouterResponseIssue('OpenRouter response was not valid JSON.', text) };
+    }
+}
+//# sourceMappingURL=openrouter-client.js.map

package/dist/core/providers/openrouter/openrouter-error.js

@@ -0,0 +1,37 @@
+import { redactOpenRouterString } from '../../security/redact-secrets.js';
+export function normalizeOpenRouterError(status, body) {
+    const code = status === 401 || status === 403
+        ? 'glm_openrouter_unauthorized'
+        : status === 429
+            ? 'glm_openrouter_rate_limited'
+            : status >= 500
+                ? 'glm_openrouter_provider_unavailable'
+                : 'glm_openrouter_request_failed';
+    return {
+        code,
+        message: statusMessage(code),
+        severity: status >= 500 ? 'failed' : 'blocked',
+        status,
+        redacted_body_tail: redactOpenRouterString(body).slice(-2000)
+    };
+}
+export function invalidOpenRouterResponseIssue(message, body) {
+    const issue = {
+        code: 'glm_openrouter_invalid_response',
+        message,
+        severity: 'failed'
+    };
+    return body ? { ...issue, redacted_body_tail: redactOpenRouterString(body).slice(-2000) } : issue;
+}
+function statusMessage(code) {
+    if (code === 'glm_openrouter_unauthorized')
+        return 'OpenRouter rejected the GLM API key.';
+    if (code === 'glm_openrouter_rate_limited')
+        return 'OpenRouter rate limited the GLM request.';
+    if (code === 'glm_openrouter_provider_unavailable')
+        return 'OpenRouter provider is unavailable for GLM 5.2.';
+    if (code === 'glm_openrouter_invalid_response')
+        return 'OpenRouter returned an invalid response.';
+    return 'OpenRouter request failed.';
+}
+//# sourceMappingURL=openrouter-error.js.map

package/dist/core/providers/openrouter/openrouter-secret-store.js

@@ -0,0 +1,113 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { redactOpenRouterKey } from '../../security/redact-secrets.js';
+export const OPENROUTER_KEY_ENV_NAMES = ['OPENROUTER_API_KEY', 'SKS_OPENROUTER_API_KEY'];
+export function openRouterSecretPaths(env = process.env) {
+    const sksHome = path.resolve(env.SKS_HOME || path.join(env.HOME || os.homedir(), '.sneakoscope'));
+    const secretDir = path.join(sksHome, 'secrets');
+    return {
+        sksHome,
+        secretDir,
+        keyPath: path.join(secretDir, 'openrouter-api-key'),
+        metadataPath: path.join(secretDir, 'openrouter-api-key.json')
+    };
+}
+export async function resolveOpenRouterApiKey(input = {}) {
+    const env = input.env || process.env;
+    for (const name of OPENROUTER_KEY_ENV_NAMES) {
+        const value = String(env[name] || '').trim();
+        if (value) {
+            return {
+                key: value,
+                source: 'env',
+                env_var: name,
+                key_preview: redactOpenRouterKey(value),
+                blockers: [],
+                warnings: name === 'OPENROUTER_API_KEY' ? [] : ['using_sks_openrouter_api_key_env']
+            };
+        }
+    }
+    const stored = await readStoredOpenRouterKey(input.paths || openRouterSecretPaths(env));
+    if (stored) {
+        return {
+            key: stored,
+            source: 'user-secret-store',
+            key_preview: redactOpenRouterKey(stored),
+            blockers: [],
+            warnings: []
+        };
+    }
+    return {
+        key: null,
+        source: null,
+        key_preview: null,
+        blockers: ['glm_missing_openrouter_key'],
+        warnings: []
+    };
+}
+export async function readStoredOpenRouterKey(paths) {
+    try {
+        const text = await fs.readFile(paths.keyPath, 'utf8');
+        const key = text.trim();
+        return key || null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeStoredOpenRouterKey(value, input = {}) {
+    const key = value.trim();
+    if (!key)
+        throw new Error('OpenRouter key is empty.');
+    const paths = input.paths || openRouterSecretPaths();
+    const nowIso = input.nowIso || (() => new Date().toISOString());
+    const timestamp = nowIso();
+    const previous = input.previousRecord ?? await readOpenRouterKeyRecord(paths);
+    await ensureSecretDir(paths.secretDir);
+    const tmp = `${paths.keyPath}.${process.pid}.${crypto.randomBytes(3).toString('hex')}.tmp`;
+    try {
+        const handle = await fs.open(tmp, 'w', 0o600);
+        try {
+            await handle.writeFile(`${key}\n`, 'utf8');
+            await handle.sync().catch(() => undefined);
+        }
+        finally {
+            await handle.close().catch(() => undefined);
+        }
+        await fs.chmod(tmp, 0o600).catch(() => undefined);
+        await fs.rename(tmp, paths.keyPath);
+        await fs.chmod(paths.keyPath, 0o600).catch(() => undefined);
+    }
+    catch (err) {
+        await fs.rm(tmp, { force: true }).catch(() => undefined);
+        throw err;
+    }
+    const record = {
+        schema: 'sks.openrouter-key.v1',
+        created_at: previous?.created_at || timestamp,
+        updated_at: timestamp,
+        key_hash: crypto.createHash('sha256').update(key).digest('hex'),
+        key_preview: redactOpenRouterKey(key)
+    };
+    await fs.writeFile(paths.metadataPath, `${JSON.stringify(record, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await fs.chmod(paths.metadataPath, 0o600).catch(() => undefined);
+    return record;
+}
+export async function readOpenRouterKeyRecord(paths) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(paths.metadataPath, 'utf8'));
+        if (parsed.schema !== 'sks.openrouter-key.v1' || !parsed.key_hash || !parsed.key_preview)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+async function ensureSecretDir(secretDir) {
+    await fs.mkdir(secretDir, { recursive: true, mode: 0o700 });
+    await fs.chmod(secretDir, 0o700).catch(() => undefined);
+}
+//# sourceMappingURL=openrouter-secret-store.js.map

package/dist/core/providers/openrouter/openrouter-types.js

@@ -0,0 +1,2 @@
+export const OPENROUTER_CHAT_COMPLETIONS_URL = 'https://openrouter.ai/api/v1/chat/completions';
+//# sourceMappingURL=openrouter-types.js.map

package/dist/core/results.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=results.js.map

package/dist/core/secret-redaction.js

@@ -1,6 +1,8 @@
 const SECRET_ENV_NAMES = [
     'CODEX_ACCESS_TOKEN',
     'OPENAI_API_KEY',
+    'OPENROUTER_API_KEY',
+    'SKS_OPENROUTER_API_KEY',
     'CODEX_LB_API_KEY',
     'ANTHROPIC_API_KEY',
     'GITHUB_TOKEN',
@@ -8,6 +10,8 @@ const SECRET_ENV_NAMES = [
 ];
 const SECRET_PATTERNS = [
     /\bsk-proj-[A-Za-z0-9_-]{12,}\b/g,
+    /\bsk-or-v1-[A-Za-z0-9_-]{12,}\b/g,
+    /\bsk-or-[A-Za-z0-9_-]{12,}\b/g,
     /\bsk-[A-Za-z0-9_-]{20,}\b/g,
     /\bsk-clb-[A-Za-z0-9_-]{8,}\b/g,
     /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,

package/dist/core/security/redact-secrets.js

@@ -0,0 +1,15 @@
+import { redactSecrets, redactString } from '../secret-redaction.js';
+export function redactOpenRouterKey(value) {
+    if (!value)
+        return '';
+    if (value.length <= 10)
+        return '<redacted>';
+    return `${value.slice(0, 6)}...${value.slice(-4)}`;
+}
+export function redactOpenRouterSecrets(value, env = process.env) {
+    return redactSecrets(value, env);
+}
+export function redactOpenRouterString(value, env = process.env) {
+    return redactString(String(value ?? ''), env);
+}
+//# sourceMappingURL=redact-secrets.js.map

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '4.0.2';
+export const PACKAGE_VERSION = '4.0.4';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "4.0.2",
+  "version": "4.0.4",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -30,6 +30,8 @@
     "!dist/**/*.d.ts.map",
     "!dist/**/*.js.map",
     "!dist/**/*.tsbuildinfo",
+    "!dist/**/__tests__",
+    "!dist/**/*.test.js",
     "!dist/vendor/openai-codex/rust-v0.131.0",
     "!dist/scripts/*-blackbox.js",
     "!dist/scripts/*-check.js",
@@ -122,6 +124,7 @@
     "prepublish:fast-check": "node ./dist/scripts/prepublish-fast-check.js",
     "prepublish:release-check-or-fast": "node ./dist/scripts/prepublish-release-check-or-fast.js",
     "mad:preflight-blocks-unreadable-config": "node ./dist/scripts/mad-preflight-blocks-unreadable-config-check.js",
+    "codex:0.141-compat": "node ./dist/scripts/codex-0141-capability-check.js",
     "codex:0.136-compat": "node ./dist/scripts/codex-0-136-compat-check.js",
     "codex:0.136-compat:require-real": "node ./dist/scripts/codex-0-136-compat-check.js --require-real",
     "codex:0.135-compat": "node ./dist/scripts/codex-0-135-compat-check.js",