sneakoscope 4.0.3 → 4.0.4

package/README.md

@@ -35,15 +35,16 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.0.3** adds a GLM 5.2-only MAD mode through OpenRouter while preserving the proof-first SKS pipeline. `sks --mad --glm` resolves the GLM profile, keeps GPT/OpenAI fallback disabled, and records model-lock proof; `sks --mad --glm --repair` rotates the OpenRouter API key outside project files.
+SKS **4.0.4** makes the GLM 5.2 MAD launch path real: `sks --mad --glm` now resolves the OpenRouter key, opens the MAD Zellij launch flow with Codex configured for `z-ai/glm-5.2`, blocks GPT fallback panes, and records launch proof; `sks --mad --glm --repair` still rotates the OpenRouter API key outside project files.
 
-What changed in 4.0.3:
+What changed in 4.0.4:
 
-- **GLM 5.2 MAD mode.** `sks --mad --glm` enters a `mad-glm` profile using OpenRouter model `z-ai/glm-5.2`.
-- **No GPT fallback.** GLM requests use `provider.allow_fallbacks: false`, omit fallback `models`, and reject non-GLM response model ids before mutation.
+- **GLM MAD actually launches.** `sks --mad --glm` no longer stops after the readiness banner; it continues into the MAD launcher with a GLM/OpenRouter Codex profile.
+- **No leaked OpenRouter key.** The Zellij pane uses a mission-local `sks-glm-codex-wrapper.sh` that reads the key at runtime, so layout artifacts do not contain the raw secret.
+- **No GPT fallback panes.** GLM MAD disables the existing GPT/codex-sdk native swarm by default until a GLM worker backend exists, preserving the no-fallback guarantee.
+- **Launch proof.** Each GLM MAD launch writes `mad-glm-launch.json` with provider/model/profile/wrapper evidence and records disabled fallback status.
 - **OpenRouter key lifecycle.** Keys resolve from `OPENROUTER_API_KEY`, `SKS_OPENROUTER_API_KEY`, or the user SKS secret store; stored keys use private permissions and redacted metadata.
-- **Codex App profile.** `sks codex-app glm-profile install` writes the `sks/glm-5.2-mad` profile metadata for Codex App selection.
-- **Codex 0.141 alignment.** SKS delegates remote relay, cwd/shell/path preservation, selected plugin MCP activation, App/MCP dedupe, bounded prompt-image cache, bounded feedback upload, and terminal resize behavior to Codex-native semantics where available.
+- **4.0.3 GLM request safeguards remain.** GLM requests still use `provider.allow_fallbacks: false`, omit fallback `models`, and reject non-GLM response model ids before mutation.
 
 SKS **3.1.16** was a launch-reliability patch on the 3.1.15 doctor-reliability release. It made `sks --mad` self-bootstrap a fresh project instead of dead-ending on a missing Codex config.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.0.3"
+version = "4.0.4"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.0.3"
+version = "4.0.4"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.0.3"),
+        Some("--version") => println!("sks-rs 4.0.4"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.0.3';
+const FAST_PACKAGE_VERSION = '4.0.4';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/core/commands/glm-command.js

@@ -1,5 +1,10 @@
 import { runMadGlmMode } from '../providers/glm/glm-mad-mode.js';
+import { flag } from '../../cli/args.js';
+import { madHighCommand } from './mad-sks-command.js';
 export async function glmCommand(args = []) {
-    return runMadGlmMode(args);
+    const result = await runMadGlmMode(args);
+    if (!result.ok || flag(args, '--repair') || flag(args, '--json'))
+        return result;
+    return madHighCommand(['--glm', ...args], { glmReadiness: result });
 }
 //# sourceMappingURL=glm-command.js.map

package/dist/core/commands/mad-sks-command.js

@@ -24,16 +24,19 @@ import { writeCodex0138CapabilityArtifacts } from '../codex-control/codex-0138-c
 import { writeCodex0139CapabilityArtifacts } from '../codex-control/codex-0139-capability.js';
 import { resolveCodexNativeInvocationPlan } from '../codex-native/codex-native-invocation-router.js';
 import { repairZellijForSks } from '../zellij/zellij-self-heal.js';
+import { buildMadGlmLaunchArtifact, buildMadGlmLaunchProfileNoWrite, resolveMadGlmLaunchKey, writeMadGlmCodexWrapper } from '../providers/glm/glm-mad-launch.js';
+import { GLM_MAD_MODE } from '../providers/glm/glm-52-settings.js';
 export async function madHighCommand(args = [], deps = {}) {
     const subcommand = firstSubcommand(args);
     if (subcommand)
         return madSksSubcommand(subcommand, args.filter((arg) => String(arg) !== subcommand));
     const cleanArgs = stripMadLaunchOnlyArgs(args);
     const rawArgs = (args || []).map((arg) => String(arg));
+    const glmMadLaunch = isMadGlmLaunch(rawArgs, deps);
     const madDbGrant = resolveMadLaunchMadDbGrant(rawArgs);
     const dryRun = rawArgs.includes('--dry-run');
-    if (args.includes('--json') && !dryRun) {
-        const profile = buildMadHighLaunchProfileNoWrite();
+    if (rawArgs.includes('--json') && !dryRun) {
+        const profile = glmMadLaunch ? buildMadGlmLaunchProfileNoWrite() : buildMadHighLaunchProfileNoWrite();
         return console.log(JSON.stringify(profile, null, 2));
     }
     const update = { status: 'notice_only', non_blocking: true };
@@ -76,7 +79,7 @@ export async function madHighCommand(args = [], deps = {}) {
         }
         return report;
     }
-    const codexUpdate = deps.maybePromptCodexUpdateForLaunch ? await deps.maybePromptCodexUpdateForLaunch(args, { label: 'MAD launch' }) : { status: 'skipped' };
+    const codexUpdate = deps.maybePromptCodexUpdateForLaunch ? await deps.maybePromptCodexUpdateForLaunch(args, { label: glmMadLaunch ? 'GLM MAD launch' : 'MAD launch' }) : { status: 'skipped' };
     if (codexUpdate.status === 'failed' || codexUpdate.status === 'updated_not_reflected') {
         console.error(`Codex CLI update failed: ${codexUpdate.error || 'updated version was not visible on PATH'}`);
         process.exitCode = 1;
@@ -86,7 +89,7 @@ export async function madHighCommand(args = [], deps = {}) {
         ? { status: 'skipped', command: 'sks doctor --fix --yes' }
         : deps.maybePromptZellijUpdateForLaunch
             ? await deps.maybePromptZellijUpdateForLaunch(args, {
-                label: 'MAD launch',
+                label: glmMadLaunch ? 'GLM MAD launch' : 'MAD launch',
                 root: launchRoot,
                 selfHealOnMissing: true,
                 autoApprove: rawArgs.includes('--yes') || rawArgs.includes('-y'),
@@ -121,8 +124,10 @@ export async function madHighCommand(args = [], deps = {}) {
         process.exitCode = 1;
         return;
     }
-    const lb = deps.maybePromptCodexLbSetupForLaunch ? await deps.maybePromptCodexLbSetupForLaunch(args) : { status: 'skipped' };
-    if (lb.status === 'missing_api_key') {
+    const lb = glmMadLaunch
+        ? { status: 'skipped_glm_openrouter', ok: false, reason: 'glm_mad_uses_openrouter_directly' }
+        : deps.maybePromptCodexLbSetupForLaunch ? await deps.maybePromptCodexLbSetupForLaunch(args) : { status: 'skipped' };
+    if (!glmMadLaunch && lb.status === 'missing_api_key') {
         process.exitCode = 1;
         return;
     }
@@ -171,6 +176,11 @@ export async function madHighCommand(args = [], deps = {}) {
         return launchPreflight;
     }
     const madLaunch = await activateMadZellijPermissionState(process.cwd(), args);
+    const glmRuntime = glmMadLaunch ? await prepareMadGlmLaunchRuntime(madLaunch, deps) : null;
+    if (glmMadLaunch && !glmRuntime?.ok) {
+        process.exitCode = 1;
+        return glmRuntime;
+    }
     const madDbCapability = madDbGrant.enabled
         ? await createMadDbCapability(madLaunch.root, { missionId: madLaunch.mission_id, ack: madDbGrant.ack, cwd: process.cwd() })
         : null;
@@ -221,7 +231,9 @@ export async function madHighCommand(args = [], deps = {}) {
         error: err?.message || String(err)
     }));
     await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), { ts: nowIso(), type: 'mad_sks.update_notice_checked', non_blocking: true, update_available: updateNotice.update_available === true, source: updateNotice.source });
-    console.log(`SKS MAD ready: ${madHighProfileName()} | gate ${madLaunch.mission_id}`);
+    console.log(`SKS MAD ready: ${glmRuntime?.profile?.profile_name || madHighProfileName()} | gate ${madLaunch.mission_id}`);
+    if (glmRuntime?.profile)
+        console.log(`GLM MAD launch active: ${glmRuntime.profile.model} via OpenRouter; GPT fallback blocked.`);
     if (madDbCapability)
         console.log(`MAD-DB one-cycle capability active (${madDbGrant.source}); expires ${madDbCapability.expires_at}.`);
     if (updateNotice.update_available === true)
@@ -233,8 +245,18 @@ export async function madHighCommand(args = [], deps = {}) {
         SKS_MAD_SKS_TARGET_ROOT: madLaunch.gate.cwd,
         SKS_MAD_SKS_PROTECTED_CORE_DIGEST: madLaunch.gate.protected_core_digest
     };
-    const launchOpts = codexLbImmediateLaunchOpts(cleanArgs, launchLb, { codexArgs: profile.launch_args, conciseBlockers: true, madSksEnv, launchEnv: madSksEnv });
     const explicitWorkspace = readOption(cleanArgs, '--workspace', readOption(cleanArgs, '--session', null));
+    const launchProfile = glmRuntime?.profile || profile;
+    const launchOpts = glmRuntime
+        ? buildGlmMadLaunchOpts(cleanArgs, {
+            codexArgs: launchProfile.launch_args,
+            conciseBlockers: true,
+            madSksEnv,
+            launchEnv: madSksEnv,
+            codexBin: glmRuntime.wrapper.wrapper_path,
+            explicitWorkspace
+        })
+        : codexLbImmediateLaunchOpts(cleanArgs, launchLb, { codexArgs: launchProfile.launch_args, conciseBlockers: true, madSksEnv, launchEnv: madSksEnv });
     // Only the auto-derived stable `sks-mad-<cwd>` name accumulates panes across
     // runs; when the user names a session explicitly (or codex-lb already minted a
     // fresh unique session) respect it and skip the reset.
@@ -268,11 +290,12 @@ export async function madHighCommand(args = [], deps = {}) {
         worker_panes_created: 0,
         right_column_mode: 'spawn-on-first-worker'
     });
-    const madNativeSwarm = await startMadNativeSwarm(madLaunch.root, madLaunch, args, profile, {
+    const madNativeSwarm = await startMadNativeSwarm(madLaunch.root, madLaunch, args, launchProfile, {
         env: {
             ...madSksEnv,
             ...(launch.session_name ? { SKS_ZELLIJ_SESSION_NAME: launch.session_name } : {})
         },
+        glmLaunch: glmRuntime ? { provider: glmRuntime.profile.provider, model: glmRuntime.profile.model } : null,
         zellijSessionName: launch.session_name || null,
         workerPlacement: headlessZellij ? 'process' : shouldAutoAttachZellij(args) ? 'zellij-pane' : 'process',
         zellijVisiblePaneCap: Number(process.env.SKS_ZELLIJ_VISIBLE_PANE_CAP || 8)
@@ -296,6 +319,67 @@ export async function madHighCommand(args = [], deps = {}) {
         console.log('MAD launch running headless: live_panes=false.');
     return launch;
 }
+function isMadGlmLaunch(args = [], deps = {}) {
+    const list = (args || []).map((arg) => String(arg));
+    return list.includes('--glm') || deps?.glmReadiness?.mode === GLM_MAD_MODE;
+}
+async function prepareMadGlmLaunchRuntime(madLaunch, deps = {}) {
+    const keyResolution = await resolveMadGlmLaunchKey(process.env);
+    const profile = buildMadGlmLaunchProfileNoWrite();
+    if (!keyResolution.key) {
+        const blocked = {
+            schema: 'sks.glm-mad-launch.v1',
+            ok: false,
+            status: 'blocked',
+            mission_id: madLaunch.mission_id,
+            provider: profile.provider,
+            model: profile.model,
+            gpt_fallback_allowed: false,
+            blockers: keyResolution.blockers,
+            warnings: keyResolution.warnings
+        };
+        await writeJsonAtomic(path.join(madLaunch.dir, 'mad-glm-launch.json'), blocked);
+        await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), {
+            ts: nowIso(),
+            type: 'mad_sks.glm_launch_blocked',
+            blockers: keyResolution.blockers
+        });
+        console.error('SKS GLM MAD launch blocked: OpenRouter API key is missing.');
+        console.error('Run: sks --mad --glm --repair');
+        return blocked;
+    }
+    const wrapper = await writeMadGlmCodexWrapper({
+        missionDir: madLaunch.dir,
+        realCodexBin: process.env.SKS_CODEX_BIN || null
+    });
+    const report = {
+        ...buildMadGlmLaunchArtifact({
+            missionId: madLaunch.mission_id,
+            keyResolution,
+            wrapper,
+            profile
+        }),
+        readiness_status: deps?.glmReadiness?.status || null
+    };
+    await writeJsonAtomic(path.join(madLaunch.dir, 'mad-glm-launch.json'), report);
+    await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), {
+        ts: nowIso(),
+        type: 'mad_sks.glm_launch_profile_ready',
+        provider: profile.provider,
+        model: profile.model,
+        key_source: keyResolution.source || null,
+        gpt_fallback_allowed: false
+    });
+    return { ok: true, profile, wrapper, report };
+}
+function buildGlmMadLaunchOpts(cleanArgs = [], opts = {}) {
+    if (opts.explicitWorkspace)
+        return opts;
+    const root = readOption(cleanArgs, '--root', process.cwd());
+    const session = sanitizeZellijSessionName(`sks-glm-${Date.now().toString(36)}-${path.basename(root) || 'project'}`);
+    console.log(`Using fresh GLM Zellij session: ${session}`);
+    return { ...opts, session, glmMadLaunch: true };
+}
 export function resolveMadLaunchMadDbGrant(args = []) {
     const list = (args || []).map((arg) => String(arg));
     return {
@@ -319,6 +403,9 @@ export async function startMadNativeSwarm(root, madLaunch, args = [], profile =
             status: 'disabled',
             reason: swarm.disabled_reason,
             mission_id: madLaunch.mission_id,
+            model_provider: opts.glmLaunch?.provider || null,
+            model: opts.glmLaunch?.model || null,
+            gpt_fallback_allowed: opts.glmLaunch ? false : null,
             lane_count: 1,
             ledger_root: path.relative(root, ledgerRoot)
         };
@@ -381,6 +468,9 @@ export async function startMadNativeSwarm(root, madLaunch, args = [], profile =
         zellij_session_name: opts.zellijSessionName || null,
         worker_placement: opts.workerPlacement || (swarm.backend === 'zellij' ? 'zellij-pane' : 'process'),
         zellij_visible_pane_cap: opts.zellijVisiblePaneCap || null,
+        model_provider: opts.glmLaunch?.provider || null,
+        model: opts.glmLaunch?.model || null,
+        gpt_fallback_allowed: opts.glmLaunch ? false : null,
         readonly: true,
         command,
         stdout_log: path.relative(root, stdoutLog),
@@ -430,13 +520,18 @@ export async function startMadNativeSwarm(root, madLaunch, args = [], profile =
 }
 export function resolveMadNativeSwarmOptions(args = [], profile = {}, opts = {}) {
     const list = (args || []).map((arg) => String(arg));
-    const disabled = list.includes('--no-swarm') || list.includes('--no-mad-swarm') || process.env.SKS_MAD_NATIVE_SWARM === '0';
+    const operatorDisabled = list.includes('--no-swarm') || list.includes('--no-mad-swarm') || process.env.SKS_MAD_NATIVE_SWARM === '0';
+    const glmRequested = list.includes('--glm') || opts.glmLaunch?.provider === 'openrouter';
+    const glmNativeSwarmDisabled = glmRequested && process.env.SKS_GLM_MAD_ALLOW_GPT_SWARM !== '1';
+    const disabled = operatorDisabled || glmNativeSwarmDisabled;
     const agents = clampInt(readOption(list, '--mad-agents', readOption(list, '--mad-swarm-agents', process.env.SKS_MAD_SWARM_AGENTS || opts.agents || 5)), 1, 20);
     const workItems = clampInt(readOption(list, '--mad-swarm-work-items', process.env.SKS_MAD_SWARM_WORK_ITEMS || opts.workItems || agents), agents, 100);
     const backend = defaultMadSwarmBackend(list, opts);
     return {
         enabled: !disabled,
-        disabled_reason: disabled ? 'operator_disabled_mad_native_swarm' : null,
+        disabled_reason: operatorDisabled
+            ? 'operator_disabled_mad_native_swarm'
+            : glmNativeSwarmDisabled ? 'glm_mad_native_swarm_disabled_to_block_gpt_fallback' : null,
         agents,
         workItems,
         backend,
@@ -516,12 +611,14 @@ async function activateMadZellijPermissionState(cwd = process.cwd(), args = [])
     const root = await sksRoot();
     if (!(await exists(path.join(root, '.sneakoscope'))))
         await initProject(root, {});
+    const rawArgs = (args || []).map((arg) => String(arg));
+    const activatedBy = rawArgs.includes('--glm') ? 'sks --mad --glm' : 'sks --mad';
     const flags = parseMadSksFlags(['--mad-sks', ...args].filter(Boolean));
-    const permission = buildMadSksPermissionModel({ targetRoot: cwd, userIntent: 'sks --mad Zellij scoped high-power maintenance session', flags });
+    const permission = buildMadSksPermissionModel({ targetRoot: cwd, userIntent: `${activatedBy} Zellij scoped high-power maintenance session`, flags });
     const allowedScopes = new Set(permission.allowed_scopes || []);
     const has = (scope) => allowedScopes.has(scope);
     const dbWriteAllowed = has('db_write');
-    const { id, dir } = await createMission(root, { mode: 'mad-sks', prompt: 'sks --mad Zellij scoped high-power maintenance session' });
+    const { id, dir } = await createMission(root, { mode: 'mad-sks', prompt: `${activatedBy} Zellij scoped high-power maintenance session` });
     await writeCodex0138CapabilityArtifacts(root, { missionId: id }).catch(() => null);
     await writeCodex0139CapabilityArtifacts(root, { missionId: id }).catch(() => null);
     const codexNativeInvocation = await resolveCodexNativeInvocationPlan({
@@ -582,7 +679,7 @@ async function activateMadZellijPermissionState(cwd = process.cwd(), args = [])
             warnings: codexNativeInvocation.warnings,
             artifact_path: 'mad-codex-native-invocation.json'
         } : null,
-        activated_by: 'sks --mad',
+        activated_by: activatedBy,
         cwd: path.resolve(cwd || process.cwd())
     };
     await writeJsonAtomic(path.join(dir, 'mad-sks-gate.json'), gate);
@@ -621,6 +718,7 @@ function madLaunchOnlyFlags() {
         '--mad',
         '--MAD',
         '--mad-sks',
+        '--glm',
         '--high',
         '--attach',
         '--no-attach',

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.0.3';
+export const PACKAGE_VERSION = '4.0.4';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/providers/glm/glm-mad-launch.js

@@ -0,0 +1,113 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { nowIso, writeTextAtomic } from '../../fsx.js';
+import { resolveOpenRouterApiKey, openRouterSecretPaths } from '../openrouter/openrouter-secret-store.js';
+import { GLM_52_OPENROUTER_MODEL } from './glm-52-settings.js';
+export const GLM_MAD_PROFILE_ID = 'sks/glm-5.2-mad';
+export const OPENROUTER_CODEX_PROVIDER = 'openrouter';
+export function buildMadGlmLaunchProfileNoWrite() {
+    return {
+        schema: 'sks.glm-mad-launch-profile.v1',
+        profile_name: GLM_MAD_PROFILE_ID,
+        provider: OPENROUTER_CODEX_PROVIDER,
+        model: GLM_52_OPENROUTER_MODEL,
+        launch_args: [
+            '--sandbox',
+            'danger-full-access',
+            '--ask-for-approval',
+            'never',
+            '-c',
+            'service_tier=fast',
+            '-c',
+            'model_reasoning_effort=high',
+            '-c',
+            'model_provider="openrouter"',
+            '-c',
+            `model="${GLM_52_OPENROUTER_MODEL}"`,
+            '-c',
+            'model_providers.openrouter.name="OpenRouter"',
+            '-c',
+            'model_providers.openrouter.base_url="https://openrouter.ai/api/v1"',
+            '-c',
+            'model_providers.openrouter.env_key="OPENROUTER_API_KEY"',
+            '-c',
+            'model_providers.openrouter.wire_api="responses"',
+            '-c',
+            'model_providers.openrouter.requires_openai_auth=false'
+        ],
+        sandbox_mode: 'danger-full-access',
+        approval_policy: 'never',
+        model_reasoning_effort: 'high',
+        service_tier: 'fast',
+        gpt_fallback_allowed: false,
+        writes_user_codex_config: false
+    };
+}
+export async function resolveMadGlmLaunchKey(env = process.env) {
+    return resolveOpenRouterApiKey({ env });
+}
+export async function writeMadGlmCodexWrapper(input) {
+    const env = input.env || process.env;
+    const paths = openRouterSecretPaths(env);
+    const realCodexBin = String(input.realCodexBin || env.SKS_CODEX_BIN || 'codex');
+    const wrapperPath = path.join(input.missionDir, 'sks-glm-codex-wrapper.sh');
+    await writeTextAtomic(wrapperPath, buildMadGlmCodexWrapperScript({
+        realCodexBin,
+        secretKeyPath: paths.keyPath
+    }));
+    await fs.chmod(wrapperPath, 0o700).catch(() => undefined);
+    return {
+        wrapper_path: wrapperPath,
+        real_codex_bin: realCodexBin,
+        secret_key_path: paths.keyPath,
+        raw_key_written_to_wrapper: false
+    };
+}
+export function buildMadGlmCodexWrapperScript(input) {
+    return [
+        '#!/bin/sh',
+        'set -eu',
+        '# Generated by SKS GLM MAD launch. This wrapper reads the key at runtime',
+        '# so Zellij layout artifacts never contain the raw OpenRouter secret.',
+        'if [ -z "${OPENROUTER_API_KEY:-}" ] && [ -n "${SKS_OPENROUTER_API_KEY:-}" ]; then',
+        '  OPENROUTER_API_KEY="$SKS_OPENROUTER_API_KEY"',
+        '  export OPENROUTER_API_KEY',
+        'fi',
+        `if [ -z "\${OPENROUTER_API_KEY:-}" ] && [ -r ${shellQuote(input.secretKeyPath)} ]; then`,
+        `  OPENROUTER_API_KEY="$(cat ${shellQuote(input.secretKeyPath)})"`,
+        '  export OPENROUTER_API_KEY',
+        'fi',
+        'if [ -z "${OPENROUTER_API_KEY:-}" ]; then',
+        '  echo "SKS GLM MAD blocked: OPENROUTER_API_KEY is missing. Run sks --mad --glm --repair or export OPENROUTER_API_KEY." >&2',
+        '  exit 66',
+        'fi',
+        `exec ${shellQuote(input.realCodexBin)} "$@"`,
+        ''
+    ].join('\n');
+}
+export function buildMadGlmLaunchArtifact(input) {
+    const profile = input.profile || buildMadGlmLaunchProfileNoWrite();
+    return {
+        schema: 'sks.glm-mad-launch.v1',
+        generated_at: nowIso(),
+        ok: Boolean(input.keyResolution.key),
+        mission_id: input.missionId,
+        provider: profile.provider,
+        model: profile.model,
+        profile_name: profile.profile_name,
+        strict_model_lock: true,
+        gpt_fallback_allowed: false,
+        openrouter_key_source: input.keyResolution.source || null,
+        key_preview: input.keyResolution.key_preview || null,
+        wrapper_path: input.wrapper.wrapper_path,
+        real_codex_bin: input.wrapper.real_codex_bin,
+        raw_key_written_to_wrapper: false,
+        codex_args: profile.launch_args,
+        blockers: input.keyResolution.key ? [] : input.keyResolution.blockers,
+        warnings: input.keyResolution.warnings || []
+    };
+}
+function shellQuote(value) {
+    return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+//# sourceMappingURL=glm-mad-launch.js.map

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '4.0.3';
+export const PACKAGE_VERSION = '4.0.4';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "4.0.3",
+  "version": "4.0.4",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",