sneakoscope 4.0.5 → 4.0.7

package/README.md

@@ -35,16 +35,20 @@ Set up this agent project with Sneakoscope Codex. Use [[mandarange/Sneakoscope-C
 
 ## 🚀 Current Release
 
-SKS **4.0.5** tunes only the GLM 5.2 MAD path: `sks --mad --glm` now defaults to an xhigh reasoning profile while recovering speed through compact GLM context, disabled default tools, streaming, request/schema caches, and redacted bench/trace artifacts. Ordinary `sks --mad`, Naruto/Team, and non-GLM Codex paths keep their existing defaults.
+SKS **4.0.6** makes the GLM 5.2 MAD path bounded by default: `sks --mad --glm` now returns readiness/status and exits when no task is supplied, while task forms use a direct GLM-only speed path with loop guards, request timeouts, and deterministic patch gates. Ordinary `sks --mad`, Naruto/Team, and non-GLM Codex paths keep their existing defaults.
 
-What changed in 4.0.5:
+What changed in 4.0.7:
 
-- **GLM-only xhigh speed profile.** `sks --mad --glm` keeps OpenRouter locked to `z-ai/glm-5.2`, uses `reasoning.effort: xhigh`, and bounds the default completion budget to the speed profile instead of changing global SKS reasoning defaults.
-- **Compact GLM request shape.** The GLM speed profile uses streaming, `tool_choice: none`, no fallback `models`, `provider.allow_fallbacks: false`, `provider.require_parameters: true`, and throughput/latency provider preferences.
-- **Opt-in GLM depth controls.** `--deep`, `--xhigh`, `--strict`, `--ttft`, and `--exact-provider` select explicit GLM profiles without affecting non-GLM routes.
-- **GLM speed infrastructure.** GLM-only context budgeting, encoded request cache, tool schema cache, model metadata cache, output envelope parsing, deterministic patch gating, latency traces, and `--bench` dry-run diagnostics are covered by tests.
-- **No GPT fallback panes.** GLM MAD keeps the existing GPT/codex-sdk native swarm disabled by default until a GLM worker backend exists, preserving the no-fallback guarantee.
-- **4.0.4 GLM launch proof remains.** Each GLM MAD launch still writes `mad-glm-launch.json` with provider/model/profile/wrapper evidence and keeps OpenRouter keys out of layout artifacts.
+- **`--open` alias for interactive GLM launch.** `sks --mad --glm --open` now opens the GLM interactive Zellij runtime, equivalent to `sks --mad --glm --interactive`.
+
+What changed in 4.0.6:
+
+- **No default long-lived GLM launch.** Bare `sks --mad --glm` no longer falls through to MAD/Zellij; `--interactive`, `--open`, `--zellij`, or `session` is required for that path.
+- **Fast GLM speed profile.** Speed mode keeps OpenRouter locked to `z-ai/glm-5.2`, disables GPT/model fallback, avoids high/xhigh reasoning by default, and uses `provider.require_parameters: false` with throughput-first routing.
+- **Bounded direct task runs.** `sks --mad --glm run "task"` and `sks --mad --glm "task"` use a one-shot GLM speed run with max-turn, wall-clock, request-timeout, no-progress, repeated-output, and terminal-state guards.
+- **Deterministic mutation gate.** GLM still returns patch envelopes; SKS parses the unified diff, blocks protected paths, runs `git apply --check`, and applies only after the gate passes.
+- **OpenRouter speed plumbing.** Encoded request bodies are cached without Authorization headers, request timeout/abort is wired, streaming TTFT/usage capture is scaffolded, and synthetic `--bench` remains network-free by default.
+- **Loop regression tests.** Routing, speed-profile, cache, loop-guard, patch-gate, and OpenRouter key handling are covered by targeted tests.
 
 SKS **3.1.16** was a launch-reliability patch on the 3.1.15 doctor-reliability release. It made `sks --mad` self-bootstrap a fresh project instead of dead-ending on a missing Codex config.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.0.5"
+version = "4.0.6"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.0.5"
+version = "4.0.6"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.0.5"),
+        Some("--version") => println!("sks-rs 4.0.6"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.0.5';
+const FAST_PACKAGE_VERSION = '4.0.6';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/core/commands/glm-command.js

@@ -1,8 +1,9 @@
-import { runMadGlmMode } from '../providers/glm/glm-mad-mode.js';
-import { flag } from '../../cli/args.js';
-import { madHighCommand } from './mad-sks-command.js';
+import { flag, positionalArgs } from '../../cli/args.js';
 import { runGlmBench } from '../providers/glm/glm-bench.js';
 import { printJson } from '../../cli/output.js';
+import { runGlmDirectSpeedRun } from '../providers/glm/glm-direct-run.js';
+import { runGlmReadinessAndExit } from '../providers/glm/glm-readiness.js';
+import { runGlmInteractiveLaunch } from '../providers/glm/glm-interactive-launch.js';
 export async function glmCommand(args = []) {
     if (flag(args, '--bench')) {
         const result = await runGlmBench(process.cwd(), args);
@@ -16,9 +17,39 @@ export async function glmCommand(args = []) {
             console.log(`GLM bench: dry-run p50=${result.summary.speed_p50_total_ms}ms ratio=${result.summary.speed_vs_deep_ratio}`);
         return result;
     }
-    const result = await runMadGlmMode(args);
-    if (!result.ok || flag(args, '--repair') || flag(args, '--json'))
-        return result;
-    return madHighCommand(['--glm', ...args], { glmReadiness: result, glmArgs: args });
+    const task = extractGlmTask(args);
+    const interactive = flag(args, '--interactive') || flag(args, '--open') || flag(args, '--zellij') || positionalArgs(args)[0] === 'session';
+    if (interactive) {
+        const readiness = await runGlmReadinessAndExit(args);
+        if (!readiness.ok)
+            return readiness;
+        return runGlmInteractiveLaunch(args, readiness);
+    }
+    if (!task || flag(args, '--repair') || flag(args, '--status')) {
+        return runGlmReadinessAndExit(args);
+    }
+    const result = await runGlmDirectSpeedRun({
+        cwd: process.cwd(),
+        task,
+        args,
+        dryRun: flag(args, '--dry-run')
+    });
+    if (flag(args, '--json'))
+        printJson(result);
+    else if (result.ok)
+        console.log(`GLM direct run completed: ${result.termination_reason}`);
+    else
+        console.error(`GLM direct run ${result.status}: ${result.blockers.join(', ') || result.termination_reason}`);
+    if (!result.ok)
+        process.exitCode = 1;
+    return result;
+}
+function extractGlmTask(args) {
+    const positional = positionalArgs(args).map(String);
+    if (positional[0] === 'run')
+        return positional.slice(1).join(' ').trim() || null;
+    if (positional[0] === 'session')
+        return null;
+    return positional.join(' ').trim() || null;
 }
 //# sourceMappingURL=glm-command.js.map

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.0.5';
+export const PACKAGE_VERSION = '4.0.6';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/providers/glm/glm-52-profile.js

@@ -1,7 +1,7 @@
 import { GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE } from './glm-52-settings.js';
 import { profileFromConst } from './glm-profile-resolver.js';
 export const GLM_CODEX_APP_PROFILE_ID = 'sks/glm-5.2-mad';
-export const GLM_CODEX_APP_PROFILE_LABEL = 'GLM 5.2 (MAD XHigh Speed / OpenRouter)';
+export const GLM_CODEX_APP_PROFILE_LABEL = 'GLM 5.2 (MAD Speed / OpenRouter)';
 export function buildGlmCodexAppModelProfile() {
     const speed = profileFromConst('speed');
     return {
@@ -18,7 +18,7 @@ export function buildGlmCodexAppModelProfile() {
         defaultSettings: {
             temperature: speed.temperature,
             top_p: speed.top_p,
-            reasoning_effort: 'xhigh',
+            reasoning_effort: speed.reasoning_effort || null,
             tool_choice: speed.tool_choice,
             parallel_tool_calls: speed.parallel_tool_calls,
             max_tokens: speed.max_tokens,

package/dist/core/providers/glm/glm-52-request.js

@@ -1,5 +1,5 @@
 import { GLM_52_DEFAULT_REQUEST_SETTINGS, GLM_52_OPENROUTER_MODEL, clampGlm52MaxTokens } from './glm-52-settings.js';
-import { buildDeepReasoningConfig } from './glm-reasoning-policy.js';
+import { buildDeepReasoningConfig, buildFastReasoningConfig } from './glm-reasoning-policy.js';
 import { profileFromConst, resolveGlmProfileFromArgs } from './glm-profile-resolver.js';
 export function buildGlm52Request(input) {
     const profile = resolveInputProfile(input.profile, input.args, input.reasoningEffort);
@@ -8,8 +8,11 @@ export function buildGlm52Request(input) {
     }
     const strictOrDeepEffort = profile.reasoning_effort || (input.reasoningEffort === 'high' || input.reasoningEffort === 'xhigh' ? input.reasoningEffort : undefined);
     const reasoning = profile.name === 'speed'
-        ? buildDeepReasoningConfig('xhigh')
+        ? buildFastReasoningConfig(input.reasoningMeta)
         : buildDeepReasoningConfig(strictOrDeepEffort || 'high');
+    if (profile.name === 'speed' && (reasoning.effort === 'high' || reasoning.effort === 'xhigh')) {
+        throw new Error(`GLM speed profile invariant violated: forbidden reasoning effort ${reasoning.effort}`);
+    }
     const request = {
         model: GLM_52_OPENROUTER_MODEL,
         messages: input.messages,

package/dist/core/providers/glm/glm-52-settings.js

@@ -21,7 +21,7 @@ export const GLM_SPEED_PROFILE = {
     stream: true,
     provider: {
         allow_fallbacks: false,
-        require_parameters: true,
+        require_parameters: false,
         sort: 'throughput',
         preferred_min_throughput: { p50: 80, p90: 40 },
         preferred_max_latency: { p50: 2, p90: 5 }
@@ -29,8 +29,8 @@ export const GLM_SPEED_PROFILE = {
     tool_choice: 'none',
     parallel_tool_calls: false,
     max_tokens: GLM_52_MAX_TOKENS_SPEED,
-    reasoning_effort: 'xhigh',
-    reasoning_default: 'xhigh-speed-optimized'
+    reasoning_effort: null,
+    reasoning_default: 'off-or-minimal-speed'
 };
 export const GLM_DEEP_PROFILE = {
     model: GLM_52_OPENROUTER_MODEL,

package/dist/core/providers/glm/glm-bench.js

@@ -9,11 +9,12 @@ const SYNTHETIC_CASES = Object.freeze([
     benchCase('simple config edit', 'config_edit', 390, 930)
 ]);
 export async function runGlmBench(root, args = []) {
+    const live = args.includes('--live');
     const execute = args.includes('--execute');
-    if (execute) {
+    if (execute && !live) {
         const blocked = {
             schema: 'sks.glm-bench-result.v1',
-            version: '4.0.5',
+            version: '4.0.6',
             generated_at: nowIso(),
             status: 'blocked',
             dry_run: true,
@@ -28,11 +29,47 @@ export async function runGlmBench(root, args = []) {
         await writeJsonAtomic(path.join(root, '.sneakoscope', 'glm', 'bench-blocked.json'), blocked);
         return blocked;
     }
+    if (live) {
+        const blocked = {
+            schema: 'sks.glm-bench-result.v1',
+            version: '4.0.6',
+            generated_at: nowIso(),
+            status: 'blocked',
+            dry_run: false,
+            cases: [],
+            summary: {
+                speed_p50_total_ms: 0,
+                speed_p90_total_ms: 0,
+                speed_p50_ttft_ms: null
+            },
+            warnings: ['live_openrouter_bench_requires_explicit_network_runner_not_enabled_in_this_build']
+        };
+        await writeJsonAtomic(path.join(root, '.sneakoscope', 'glm', 'bench-live-blocked.json'), blocked);
+        return blocked;
+    }
+    if (execute) {
+        const blocked = {
+            schema: 'sks.glm-bench-result.v1',
+            version: '4.0.6',
+            generated_at: nowIso(),
+            status: 'blocked',
+            dry_run: true,
+            cases: [],
+            summary: {
+                speed_p50_total_ms: 0,
+                speed_p90_total_ms: 0,
+                speed_p50_ttft_ms: null
+            },
+            warnings: ['execute_requested_without_live_flag_uses_no_network_dry_run_policy']
+        };
+        await writeJsonAtomic(path.join(root, '.sneakoscope', 'glm', 'bench-blocked.json'), blocked);
+        return blocked;
+    }
     const speedTotals = SYNTHETIC_CASES.map((row) => row.speed.total_ms);
     const deepTotals = SYNTHETIC_CASES.map((row) => row.deep.total_ms);
     const result = {
         schema: 'sks.glm-bench-result.v1',
-        version: '4.0.5',
+        version: '4.0.6',
         generated_at: nowIso(),
         status: 'dry_run',
         dry_run: true,

package/dist/core/providers/glm/glm-direct-run.js

@@ -0,0 +1,140 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { nowIso, writeJsonAtomic } from '../../fsx.js';
+import { resolveOpenRouterApiKey } from '../openrouter/openrouter-secret-store.js';
+import { sendOpenRouterChatCompletionStream } from '../openrouter/openrouter-stream.js';
+import { assertGlm52ActualModel } from './glm-52-response-guard.js';
+import { GLM_52_OPENROUTER_MODEL } from './glm-52-settings.js';
+import { buildGlm52Request } from './glm-52-request.js';
+import { buildGlmSpeedContext } from './glm-speed-context.js';
+import { parseGlmSpeedOutput } from './glm-speed-output-parser.js';
+import { evaluateGlmSpeedGate } from './glm-speed-gate.js';
+import { checkAndApplyGlmPatch } from './glm-patch-apply.js';
+import { createGlmRunController, writeGlmRunArtifacts } from './glm-run-controller.js';
+import { GLM_SPEED_LIMITS } from './glm-run-timeout.js';
+import { recordGlmLoopIteration } from './glm-loop-guard.js';
+export async function runGlmDirectSpeedRun(input) {
+    if (process.env.SKS_GLM_WRAPPER_ACTIVE === '1') {
+        return blocked('glm-recursive-blocked', input.task, 'glm_recursive_launch_blocked', ['glm_recursive_launch_blocked']);
+    }
+    const controller = createGlmRunController({ limits: GLM_SPEED_LIMITS });
+    controller.transition('preflight');
+    const key = await resolveOpenRouterApiKey({ env: process.env });
+    if (!key.key) {
+        const termination = controller.terminate('blocked', 'glm_patch_gate_failed', key.blockers, [
+            'set_OPENROUTER_API_KEY_or_run_sks_--mad_--glm_--repair'
+        ]);
+        const artifactDir = await writeGlmRunArtifacts({ cwd: input.cwd, state: controller.state(), termination });
+        return result('blocked', controller.state().run_id, input.task, termination.reason, artifactDir, [], key.blockers, termination.warnings);
+    }
+    controller.transition('context');
+    const gitStatus = await readGitStatus(input.cwd);
+    const context = await buildGlmSpeedContext({
+        cwd: input.cwd,
+        task: input.task,
+        mentionedPaths: extractMentionedPaths(input.task),
+        readFile: async (file) => fs.readFile(file, 'utf8').catch(() => null),
+        ...(gitStatus ? { gitStatus } : {})
+    });
+    controller.transition('request');
+    const request = buildGlm52Request({
+        profile: 'speed',
+        messages: [
+            { role: 'system', content: 'Return only <sks_patch>, <sks_need_context>, or <sks_blocked>. Use unified diff for patches.' },
+            { role: 'user', content: JSON.stringify({ task: input.task, context }) }
+        ],
+        maxTokens: 4096
+    });
+    const response = await sendOpenRouterChatCompletionStream({
+        apiKey: key.key,
+        request: {
+            ...request,
+            session_id: `sks-${controller.state().run_id}`
+        },
+        timeoutMs: GLM_SPEED_LIMITS.request_timeout_ms
+    });
+    if (!response.ok) {
+        const reason = response.error.code === 'glm_request_timeout' ? 'glm_request_timeout' : 'glm_patch_gate_failed';
+        const termination = controller.terminate(reason === 'glm_request_timeout' ? 'timeout' : 'failed', reason, [response.error.code]);
+        const artifactDir = await writeGlmRunArtifacts({ cwd: input.cwd, state: controller.state(), termination, contextOmissions: context.omitted });
+        return result(reason === 'glm_request_timeout' ? 'timeout' : 'failed', controller.state().run_id, input.task, termination.reason, artifactDir, [], [response.error.code], []);
+    }
+    controller.transition('model_guard');
+    const modelGuard = assertGlm52ActualModel(response.value.model || GLM_52_OPENROUTER_MODEL);
+    if (!modelGuard.ok) {
+        const termination = controller.terminate('blocked', 'glm_model_mismatch', [modelGuard.code]);
+        const artifactDir = await writeGlmRunArtifacts({ cwd: input.cwd, state: controller.state(), termination, contextOmissions: context.omitted });
+        return result('blocked', controller.state().run_id, input.task, termination.reason, artifactDir, [], [modelGuard.code], []);
+    }
+    controller.transition('parse_output');
+    const parsed = parseGlmSpeedOutput(response.value.content);
+    const guard = recordGlmLoopIteration({
+        state: controller.state(),
+        limits: GLM_SPEED_LIMITS,
+        output: response.value.content,
+        madeProgress: parsed.kind === 'patch',
+        nowIso: nowIso()
+    });
+    if (!guard.ok) {
+        const termination = controller.terminate('blocked', guard.reason === 'glm_loop_repeated_output' ? 'glm_loop_repeated_output' : 'glm_loop_no_progress', [guard.reason || 'glm_loop_blocked']);
+        const artifactDir = await writeGlmRunArtifacts({ cwd: input.cwd, state: controller.state(), termination, loopGuard: guard, contextOmissions: context.omitted });
+        return result('blocked', controller.state().run_id, input.task, termination.reason, artifactDir, [], termination.blockers, []);
+    }
+    if (parsed.kind === 'blocked' || parsed.kind === 'need_context' || parsed.kind === 'malformed') {
+        const termination = controller.terminate('blocked', parsed.kind === 'malformed' ? 'glm_loop_no_progress' : 'completed_noop', [parsed.reason || parsed.kind]);
+        const artifactDir = await writeGlmRunArtifacts({ cwd: input.cwd, state: controller.state(), termination, loopGuard: guard, contextOmissions: context.omitted });
+        return result('blocked', controller.state().run_id, input.task, termination.reason, artifactDir, [], termination.blockers, []);
+    }
+    controller.transition('patch_gate');
+    const gate = evaluateGlmSpeedGate(response.value.content);
+    if (!gate.ok) {
+        const termination = controller.terminate('blocked', 'glm_patch_gate_failed', gate.checks.filter((row) => !row.ok).map((row) => row.reason || row.id));
+        const artifactDir = await writeGlmRunArtifacts({ cwd: input.cwd, state: controller.state(), termination, loopGuard: guard, contextOmissions: context.omitted });
+        return result('blocked', controller.state().run_id, input.task, termination.reason, artifactDir, [], termination.blockers, []);
+    }
+    controller.transition('apply_patch');
+    const applied = await checkAndApplyGlmPatch({ cwd: input.cwd, patch: parsed.content, apply: !input.dryRun });
+    if (!applied.ok) {
+        const termination = controller.terminate('blocked', 'glm_patch_gate_failed', [applied.error.code]);
+        const artifactDir = await writeGlmRunArtifacts({ cwd: input.cwd, state: controller.state(), termination, loopGuard: guard, contextOmissions: context.omitted });
+        return result('blocked', controller.state().run_id, input.task, termination.reason, artifactDir, [], termination.blockers, []);
+    }
+    controller.transition('verify');
+    const termination = controller.terminate('completed', input.dryRun ? 'completed_noop' : 'completed_patch_applied');
+    const artifactDir = await writeGlmRunArtifacts({ cwd: input.cwd, state: controller.state(), termination, loopGuard: guard, contextOmissions: context.omitted });
+    await writeJsonAtomic(path.join(artifactDir, 'direct-run.json'), { request_model: request.model, stream: true, gate, applied: applied.value });
+    return result('completed', controller.state().run_id, input.task, termination.reason, artifactDir, applied.value.touchedPaths, [], []);
+}
+function result(status, runId, task, terminationReason, artifactDir, touchedPaths, blockers, warnings) {
+    return {
+        schema: 'sks.glm-direct-run-result.v1',
+        ok: status === 'completed',
+        status,
+        run_id: runId,
+        task,
+        model: GLM_52_OPENROUTER_MODEL,
+        gpt_fallback_allowed: false,
+        termination_reason: terminationReason,
+        ...(artifactDir ? { artifact_dir: artifactDir } : {}),
+        touched_paths: touchedPaths,
+        blockers,
+        warnings
+    };
+}
+function blocked(runId, task, reason, blockers) {
+    return result('blocked', runId, task, reason, undefined, [], blockers, []);
+}
+async function readGitStatus(cwd) {
+    const { spawn } = await import('node:child_process');
+    return new Promise((resolve) => {
+        const child = spawn('git', ['status', '--short'], { cwd, stdio: ['ignore', 'pipe', 'ignore'] });
+        let stdout = '';
+        child.stdout.on('data', (chunk) => { stdout += String(chunk); });
+        child.on('close', () => resolve(stdout.trim() || undefined));
+    });
+}
+function extractMentionedPaths(task) {
+    const matches = task.match(/(?:^|\s|[`"'])([A-Za-z0-9_.-]+\/[A-Za-z0-9_./-]+\.[A-Za-z0-9]+)(?:\s|[`"']|$)/g) || [];
+    return [...new Set(matches.map((value) => value.trim().replace(/^[`"']|[`"']$/g, '')))];
+}
+//# sourceMappingURL=glm-direct-run.js.map

package/dist/core/providers/glm/glm-interactive-launch.js

@@ -0,0 +1,5 @@
+import { madHighCommand } from '../../commands/mad-sks-command.js';
+export async function runGlmInteractiveLaunch(args, readiness) {
+    return madHighCommand(['--glm', '--no-swarm', ...args], { glmReadiness: readiness, glmArgs: args });
+}
+//# sourceMappingURL=glm-interactive-launch.js.map

package/dist/core/providers/glm/glm-latency-trace.js

@@ -3,7 +3,7 @@ import { nowIso, writeJsonAtomic } from '../../fsx.js';
 export function createEmptyGlmLatencyTrace(mode) {
     return {
         schema: 'sks.glm-latency-trace.v1',
-        version: '4.0.5',
+        version: '4.0.6',
         mode,
         total_ms: 0,
         preflight_ms: 0,

package/dist/core/providers/glm/glm-loop-guard.js

@@ -0,0 +1,31 @@
+import crypto from 'node:crypto';
+import { isGlmTerminalPhase } from './glm-run-state.js';
+export function recordGlmLoopIteration(input) {
+    if (isGlmTerminalPhase(input.state.phase) || input.state.terminal) {
+        return { ok: false, reason: 'terminal_state', state: input.state };
+    }
+    const outputDigest = input.output ? digestNormalizedOutput(input.output) : input.state.last_output_digest;
+    const repeated = Boolean(outputDigest && outputDigest === input.state.last_output_digest);
+    const nextState = {
+        ...input.state,
+        updated_at: input.nowIso,
+        turn_count: input.state.turn_count + 1,
+        no_progress_count: input.madeProgress ? 0 : input.state.no_progress_count + 1,
+        repeated_output_count: repeated ? input.state.repeated_output_count + 1 : 0,
+        ...(outputDigest ? { last_output_digest: outputDigest } : {})
+    };
+    if (nextState.turn_count > input.limits.max_turns) {
+        return { ok: false, reason: 'glm_loop_max_turns', state: nextState };
+    }
+    if (nextState.repeated_output_count >= input.limits.max_repeated_output) {
+        return { ok: false, reason: 'glm_loop_repeated_output', state: nextState };
+    }
+    if (nextState.no_progress_count > input.limits.max_no_progress_iterations) {
+        return { ok: false, reason: 'glm_loop_no_progress', state: nextState };
+    }
+    return { ok: true, state: nextState };
+}
+export function digestNormalizedOutput(output) {
+    return crypto.createHash('sha256').update(output.replace(/\s+/g, ' ').trim()).digest('hex');
+}
+//# sourceMappingURL=glm-loop-guard.js.map

package/dist/core/providers/glm/glm-mad-launch.js

@@ -123,6 +123,6 @@ function codexReasoningEffortForProfile(profile) {
         return 'xhigh';
     if (profile.name === 'deep' || profile.name === 'strict')
         return 'high';
-    return 'xhigh';
+    return 'low';
 }
 //# sourceMappingURL=glm-mad-launch.js.map

package/dist/core/providers/glm/glm-mad-mode.js

@@ -204,7 +204,7 @@ async function writeGlmModeArtifacts(cwd, result, profile, selectedProfile, gene
         profile: selectedProfile.name,
         temperature: selectedProfile.temperature,
         top_p: selectedProfile.top_p,
-        reasoning_effort: selectedProfile.reasoning_effort || 'xhigh',
+        reasoning_effort: selectedProfile.reasoning_effort || null,
         max_tokens: selectedProfile.max_tokens,
         tool_choice: selectedProfile.tool_choice,
         parallel_tool_calls: selectedProfile.parallel_tool_calls,

package/dist/core/providers/glm/glm-patch-apply.js

@@ -0,0 +1,58 @@
+import { spawn } from 'node:child_process';
+import { parseUnifiedDiffPatch } from './glm-patch-parser.js';
+const PROTECTED_PATH = /(^|\/)(\.github|dist|node_modules)(\/|$)/;
+export async function checkAndApplyGlmPatch(input) {
+    const parsed = parseUnifiedDiffPatch(input.patch);
+    if (parsed.empty) {
+        return issue('glm_patch_empty', 'GLM output did not contain a non-empty unified diff.');
+    }
+    const blockedPath = parsed.touchedPaths.find((file) => PROTECTED_PATH.test(file));
+    if (blockedPath) {
+        return issue('glm_patch_protected_path', `GLM patch touched protected path: ${blockedPath}`);
+    }
+    const check = await runGitApply(input.cwd, input.patch, ['apply', '--check', '--whitespace=nowarn', '-']);
+    if (check.code !== 0) {
+        return issue('glm_patch_gate_failed', check.stderr || check.stdout || 'git apply --check failed.');
+    }
+    if (!input.apply) {
+        return {
+            ok: true,
+            value: {
+                checked: true,
+                applied: false,
+                touchedPaths: parsed.touchedPaths,
+                stdout: check.stdout,
+                stderr: check.stderr
+            }
+        };
+    }
+    const applied = await runGitApply(input.cwd, input.patch, ['apply', '--whitespace=nowarn', '-']);
+    if (applied.code !== 0) {
+        return issue('glm_patch_apply_failed', applied.stderr || applied.stdout || 'git apply failed.');
+    }
+    return {
+        ok: true,
+        value: {
+            checked: true,
+            applied: true,
+            touchedPaths: parsed.touchedPaths,
+            stdout: applied.stdout,
+            stderr: applied.stderr
+        }
+    };
+}
+function issue(code, message) {
+    return { ok: false, error: { code, message, severity: 'blocked' } };
+}
+function runGitApply(cwd, patch, args) {
+    return new Promise((resolve) => {
+        const child = spawn('git', [...args], { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (chunk) => { stdout += String(chunk); });
+        child.stderr.on('data', (chunk) => { stderr += String(chunk); });
+        child.on('close', (code) => resolve({ code, stdout, stderr }));
+        child.stdin.end(patch);
+    });
+}
+//# sourceMappingURL=glm-patch-apply.js.map

package/dist/core/providers/glm/glm-patch-parser.js

@@ -0,0 +1,19 @@
+export function parseUnifiedDiffPatch(patch) {
+    const touched = new Set();
+    for (const line of patch.split(/\r?\n/)) {
+        const diff = line.match(/^diff --git a\/(.+?) b\/(.+)$/);
+        if (diff?.[1])
+            touched.add(diff[1]);
+        if (diff?.[2])
+            touched.add(diff[2]);
+        const file = line.match(/^(?:---|\+\+\+) [ab]\/(.+)$/);
+        if (file?.[1] && file[1] !== '/dev/null')
+            touched.add(file[1]);
+    }
+    return {
+        patch,
+        touchedPaths: [...touched],
+        empty: !patch.trim() || !/^diff --git /m.test(patch)
+    };
+}
+//# sourceMappingURL=glm-patch-parser.js.map

package/dist/core/providers/glm/glm-readiness.js

@@ -0,0 +1,5 @@
+import { runMadGlmMode } from './glm-mad-mode.js';
+export async function runGlmReadinessAndExit(args = []) {
+    return runMadGlmMode(args);
+}
+//# sourceMappingURL=glm-readiness.js.map

package/dist/core/providers/glm/glm-request-cache.js

@@ -6,18 +6,31 @@ export function createGlmEncodedRequestCache(maxEntries = 128) {
 export function encodeGlmRequestWithCache(request, cache = defaultEncodedRequestCache) {
     const key = digestRequestForCache(request);
     const hit = cache.get(key);
-    if (hit)
-        return { entry: hit, cacheHit: true };
     const body = JSON.stringify(request);
+    if (hit)
+        return { body: hit.bodyStored ? hit.body : body, entry: hit, cacheHit: true };
+    if (containsSecretLikeContent(body)) {
+        const entry = {
+            key,
+            body: '',
+            bodySha256: crypto.createHash('sha256').update(body).digest('hex'),
+            byteLength: Buffer.byteLength(body),
+            createdAt: Date.now(),
+            bodyStored: false,
+            skippedReason: 'secret_like_request_body_not_cached'
+        };
+        return { body, entry, cacheHit: false };
+    }
     const entry = {
         key,
+        body,
         bodySha256: crypto.createHash('sha256').update(body).digest('hex'),
         byteLength: Buffer.byteLength(body),
         createdAt: Date.now(),
-        bodyStored: false
+        bodyStored: true
     };
     cache.set(key, entry);
-    return { entry, cacheHit: false };
+    return { body, entry, cacheHit: false };
 }
 export function digestRequestForCache(request) {
     const safe = {
@@ -31,10 +44,14 @@ export function digestRequestForCache(request) {
         top_p: request.top_p || null,
         tool_choice: request.tool_choice || null,
         parallel_tool_calls: request.parallel_tool_calls || null,
-        reasoning: request.reasoning || null
+        reasoning: request.reasoning || null,
+        session_id: request.session_id || null
     };
     return crypto.createHash('sha256').update(stableStringify(safe)).digest('hex');
 }
+function containsSecretLikeContent(body) {
+    return /\b(?:Bearer\s+[A-Za-z0-9._~+/-]+|sk-(?:or-)?[A-Za-z0-9_-]{12,}|OPENROUTER_API_KEY|SKS_OPENROUTER_API_KEY)\b/.test(body);
+}
 function stableStringify(value) {
     if (!value || typeof value !== 'object')
         return JSON.stringify(value);

package/dist/core/providers/glm/glm-run-controller.js

@@ -0,0 +1,66 @@
+import path from 'node:path';
+import { nowIso, randomId, writeJsonAtomic } from '../../fsx.js';
+import { GLM_SPEED_LIMITS } from './glm-run-timeout.js';
+import { isGlmTerminalPhase } from './glm-run-state.js';
+export function createGlmRunController(input = {}) {
+    const clock = input.now || nowIso;
+    const startedAt = clock();
+    const startedMs = Date.now();
+    let state = {
+        run_id: input.runId || `glm-${startedAt.replace(/[:.]/g, '-')}-${randomId(6)}`,
+        ...(input.missionId ? { mission_id: input.missionId } : {}),
+        phase: 'idle',
+        started_at: startedAt,
+        updated_at: startedAt,
+        turn_count: 0,
+        tool_round_count: 0,
+        no_progress_count: 0,
+        repeated_output_count: 0,
+        terminal: false
+    };
+    const limits = input.limits || GLM_SPEED_LIMITS;
+    return {
+        state: () => state,
+        transition: (phase, reason) => {
+            if (state.terminal || isGlmTerminalPhase(state.phase))
+                return state;
+            state = {
+                ...state,
+                phase,
+                updated_at: clock(),
+                terminal: isGlmTerminalPhase(phase),
+                ...(reason ? { terminal_reason: reason } : {})
+            };
+            return state;
+        },
+        terminate: (phase, reason, blockers = [], warnings = []) => {
+            state = {
+                ...state,
+                phase,
+                updated_at: clock(),
+                terminal: true,
+                terminal_reason: reason
+            };
+            return {
+                schema: 'sks.glm-run-termination.v1',
+                run_id: state.run_id,
+                terminal: true,
+                phase,
+                reason,
+                turn_count: state.turn_count,
+                wall_clock_ms: Math.min(Date.now() - startedMs, limits.max_wall_clock_ms),
+                blockers,
+                warnings
+            };
+        }
+    };
+}
+export async function writeGlmRunArtifacts(input) {
+    const dir = path.join(input.cwd, '.sneakoscope', 'glm', 'runs', input.state.run_id);
+    await writeJsonAtomic(path.join(dir, 'run-state.json'), input.state);
+    await writeJsonAtomic(path.join(dir, 'termination.json'), input.termination);
+    await writeJsonAtomic(path.join(dir, 'loop-guard.json'), input.loopGuard || { schema: 'sks.glm-loop-guard.v1', ok: true });
+    await writeJsonAtomic(path.join(dir, 'context-omissions.json'), input.contextOmissions || { omitted: [] });
+    return dir;
+}
+//# sourceMappingURL=glm-run-controller.js.map

package/dist/core/providers/glm/glm-run-state.js

@@ -0,0 +1,11 @@
+export const GLM_TERMINAL_PHASES = new Set([
+    'completed',
+    'blocked',
+    'failed',
+    'cancelled',
+    'timeout'
+]);
+export function isGlmTerminalPhase(phase) {
+    return GLM_TERMINAL_PHASES.has(phase);
+}
+//# sourceMappingURL=glm-run-state.js.map

package/dist/core/providers/glm/glm-run-timeout.js

@@ -0,0 +1,31 @@
+export const GLM_SPEED_LIMITS = {
+    max_turns: 2,
+    max_tool_rounds: 0,
+    max_wall_clock_ms: 90_000,
+    request_timeout_ms: 45_000,
+    idle_timeout_ms: 15_000,
+    max_no_progress_iterations: 1,
+    max_repeated_output: 1,
+    max_patch_retries: 1,
+    max_context_requests: 1
+};
+export const GLM_DEEP_LIMITS = {
+    max_turns: 4,
+    max_tool_rounds: 4,
+    max_wall_clock_ms: 240_000,
+    request_timeout_ms: 120_000,
+    idle_timeout_ms: 30_000,
+    max_no_progress_iterations: 2,
+    max_repeated_output: 2,
+    max_patch_retries: 2,
+    max_context_requests: 2
+};
+export function createRequestAbortController(timeoutMs) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), Math.max(1, timeoutMs));
+    return {
+        controller,
+        clear: () => clearTimeout(timeout)
+    };
+}
+//# sourceMappingURL=glm-run-timeout.js.map

package/dist/core/providers/openrouter/openrouter-client.js

@@ -1,24 +1,44 @@
 import { OPENROUTER_CHAT_COMPLETIONS_URL } from './openrouter-types.js';
 import { invalidOpenRouterResponseIssue, normalizeOpenRouterError } from './openrouter-error.js';
 import { redactOpenRouterString } from '../../security/redact-secrets.js';
+import { encodeGlmRequestWithCache } from '../glm/glm-request-cache.js';
 export async function sendOpenRouterChatCompletion(input) {
     try {
         const doFetch = input.fetchImpl || fetch;
+        const encoded = encodeGlmRequestWithCache(input.request);
+        const controller = input.timeoutMs ? new AbortController() : null;
+        const timeout = controller
+            ? setTimeout(() => controller.abort(), Math.max(1, input.timeoutMs || 0))
+            : null;
+        const signal = input.signal || controller?.signal;
         const response = await doFetch(input.endpoint || OPENROUTER_CHAT_COMPLETIONS_URL, {
             method: 'POST',
+            ...(signal ? { signal } : {}),
             headers: {
                 Authorization: `Bearer ${input.apiKey}`,
                 'Content-Type': 'application/json',
                 'X-OpenRouter-Title': 'Sneakoscope-Codex'
             },
-            body: JSON.stringify(input.request)
+            body: encoded.body
         });
+        if (timeout)
+            clearTimeout(timeout);
         const text = await response.text();
         if (!response.ok)
             return { ok: false, error: normalizeOpenRouterError(response.status, text) };
         return parseOpenRouterResponse(text);
     }
     catch (err) {
+        if (err instanceof Error && err.name === 'AbortError') {
+            return {
+                ok: false,
+                error: {
+                    code: 'glm_request_timeout',
+                    message: `OpenRouter request aborted after ${input.timeoutMs || 'external'}ms.`,
+                    severity: 'failed'
+                }
+            };
+        }
         return {
             ok: false,
             error: {

package/dist/core/providers/openrouter/openrouter-stream.js

@@ -0,0 +1,94 @@
+import { redactOpenRouterString } from '../../security/redact-secrets.js';
+import { OPENROUTER_CHAT_COMPLETIONS_URL } from './openrouter-types.js';
+import { normalizeOpenRouterError } from './openrouter-error.js';
+import { encodeGlmRequestWithCache } from '../glm/glm-request-cache.js';
+export async function sendOpenRouterChatCompletionStream(input) {
+    const started = Date.now();
+    const controller = input.timeoutMs ? new AbortController() : null;
+    const timeout = controller ? setTimeout(() => controller.abort(), Math.max(1, input.timeoutMs || 0)) : null;
+    try {
+        const request = { ...input.request, stream: true };
+        const encoded = encodeGlmRequestWithCache(request);
+        const signal = input.signal || controller?.signal;
+        const response = await (input.fetchImpl || fetch)(OPENROUTER_CHAT_COMPLETIONS_URL, {
+            method: 'POST',
+            ...(signal ? { signal } : {}),
+            headers: {
+                Authorization: `Bearer ${input.apiKey}`,
+                'Content-Type': 'application/json',
+                'X-OpenRouter-Title': 'Sneakoscope-Codex'
+            },
+            body: encoded.body
+        });
+        if (timeout)
+            clearTimeout(timeout);
+        const text = await response.text();
+        if (!response.ok)
+            return { ok: false, error: normalizeOpenRouterError(response.status, text) };
+        return { ok: true, value: parseOpenRouterStreamText(text, started) };
+    }
+    catch (err) {
+        if (timeout)
+            clearTimeout(timeout);
+        if (err instanceof Error && err.name === 'AbortError') {
+            return {
+                ok: false,
+                error: {
+                    code: 'glm_request_timeout',
+                    message: `OpenRouter stream aborted after ${input.timeoutMs || 'external'}ms.`,
+                    severity: 'failed'
+                }
+            };
+        }
+        return {
+            ok: false,
+            error: {
+                code: 'glm_openrouter_stream_failed',
+                message: redactOpenRouterString(err instanceof Error ? err.message : String(err)),
+                severity: 'failed'
+            }
+        };
+    }
+}
+export function parseOpenRouterStreamText(text, startedAtMs = Date.now()) {
+    const events = [];
+    let content = '';
+    let model;
+    let usage;
+    let ttft = null;
+    for (const line of text.split(/\r?\n/)) {
+        if (!line.startsWith('data:'))
+            continue;
+        const data = line.slice('data:'.length).trim();
+        if (!data || data === '[DONE]')
+            continue;
+        try {
+            const raw = JSON.parse(data);
+            const delta = raw?.choices?.[0]?.delta?.content;
+            if (typeof raw?.model === 'string')
+                model = raw.model;
+            if (raw?.usage)
+                usage = raw.usage;
+            if (typeof delta === 'string' && delta) {
+                if (ttft === null)
+                    ttft = Math.max(0, Date.now() - startedAtMs);
+                content += delta;
+                events.push({ type: 'chunk', content_delta: delta, ...(model ? { model } : {}), raw });
+            }
+        }
+        catch {
+            events.push({ type: 'error', raw: data });
+        }
+    }
+    events.push({ type: 'done', ...(model ? { model } : {}), ...(usage ? { usage } : {}) });
+    return {
+        content,
+        ...(model ? { model } : {}),
+        ...(usage ? { usage } : {}),
+        ttft_ms: ttft,
+        total_ms: Math.max(0, Date.now() - startedAtMs),
+        chunk_count: events.filter((event) => event.type === 'chunk').length,
+        events
+    };
+}
+//# sourceMappingURL=openrouter-stream.js.map

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '4.0.5';
+export const PACKAGE_VERSION = '4.0.6';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "4.0.5",
+  "version": "4.0.7",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",