sneakoscope 4.6.4 → 4.7.0

package/README.md

@@ -49,7 +49,7 @@ sks seo-geo-optimizer apply latest --mode seo --apply --json
 sks seo-geo-optimizer audit --mode geo --target package --offline --json
 ```
 
-> 📋 **Current release: `v4.6.4`** — full release history lives in [CHANGELOG.md](CHANGELOG.md). This README documents how Sneakoscope works today, not its version-by-version changes. Release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
+> 📋 **Current release: `v4.7.0`** — full release history lives in [CHANGELOG.md](CHANGELOG.md). This README documents how Sneakoscope works today, not its version-by-version changes. Release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
 
 ## 🍥 Parallelism, UX, And Integrations
 
@@ -321,6 +321,8 @@ sks fix-path
 sks update now
 ```
 
+`sks doctor --fix` repairs stale SKS-managed Codex TOML, agent role `config_file` paths, and unsupported managed role fields. It now dedupes repeated TOML tables before repair, keeps the first existing external MCP block such as `context7` or `supabase` unchanged, and only removes/repairs SKS-owned stale MCP blocks such as broken `node_repl`.
+
 ### Open Codex CLI With Zellij
 
 ```sh
@@ -330,7 +332,7 @@ sks team open-zellij latest
 sks team attach-zellij latest
 ```
 
-Interactive SKS sessions use Zellij layouts. By default SKS launches Codex in Fast service tier with `--model gpt-5.5`, `-c service_tier="fast"`, the selected `model_reasoning_effort`, and `--no-alt-screen` for Zellij-backed interactive panes so terminal scrollback captures the conversation transcript. Non-GLM SKS sessions force the model to `gpt-5.5`; `sks --mad --glm` is the OpenRouter GLM 5.2 exception. `SKS_CODEX_MODEL` and `SKS_CODEX_FAST_HIGH=0` cannot downgrade or remove the non-GLM model pin. You can still set `SKS_CODEX_REASONING` to change reasoning effort, and `SKS_ZELLIJ_CODEX_ALT_SCREEN=1` restores Codex's alternate-screen UI for the next launch. Use `sks --mad --workspace <name>` for an explicit MAD session and `sks help` for CLI help.
+Interactive SKS sessions use Zellij layouts. By default SKS launches Codex in Fast service tier with `--model gpt-5.5`, `-c service_tier="fast"`, the selected `model_reasoning_effort`, and `--no-alt-screen` for Zellij-backed interactive panes so terminal scrollback captures the conversation transcript. Non-GLM SKS sessions force the model to `gpt-5.5`, while the model guard also recognizes `gpt-5.4-mini` as a supported GPT-5.4 mini model; `sks --mad --glm` is the OpenRouter GLM 5.2 exception. `SKS_CODEX_MODEL` and `SKS_CODEX_FAST_HIGH=0` cannot downgrade or remove the non-GLM model pin. You can still set `SKS_CODEX_REASONING` to change reasoning effort, and `SKS_ZELLIJ_CODEX_ALT_SCREEN=1` restores Codex's alternate-screen UI for the next launch. Use `sks --mad --workspace <name>` for an explicit MAD session and `sks help` for CLI help.
 
 Before opening the interactive runtime, SKS checks the installed Codex CLI against npm `@openai/codex@latest`. If a newer version exists, it asks `Y/n`; answering `y` updates automatically with `npm i -g @openai/codex@latest` and then opens the runtime with the updated Codex CLI.
 
@@ -338,6 +340,7 @@ For [codex-lb](https://github.com/Soju06/codex-lb), start the server, create a d
 
 ```sh
 sks codex-lb setup --host https://your-codex-lb.example.com --api-key "sk-clb-..."
+sks codex-lb setup --host https://your-codex-lb.example.com --api-key-stdin --yes
 sks codex-lb health
 sks codex-lb repair
 sks
@@ -353,6 +356,15 @@ sks codex-lb set-key --api-key-stdin   # or: sks codex-lb set-key --api-key "sk-
 
 (To also change the host, use `sks codex-lb reconfigure --host <domain> --api-key <key>`.)
 
+For OpenRouter-backed GLM 5.2 in Codex Desktop/SKS, store the key and install the GLM provider/profiles with:
+
+```sh
+sks codex-app set-openrouter-key --api-key-stdin
+sks codex-app glm-profile install
+```
+
+This writes the OpenRouter key to the SKS user secret store, writes redacted metadata only, and installs Codex Desktop-compatible `openrouter` provider plus selectable `sks-glm-52-*` reasoning profiles. The npm package does not patch the Codex Desktop macOS menu binary; a top-level `Set OpenRouter Key` menu/modal requires upstream Codex Desktop UI support. The package-owned command surface above is the supported repair path.
+
 ### Switching auth mode: codex-lb ↔ ChatGPT OAuth
 
 Switch between the codex-lb API key and your ChatGPT OAuth login at any time with intent-named commands:
@@ -390,7 +402,7 @@ sks --mad
 sks --mad --allow-package-install --allow-service-control --allow-network --yes
 ```
 
-This syncs existing codex-lb provider auth, creates/uses the `sks-mad-high` xhigh maintenance profile, opens the MAD-SKS permission gate for that Zellij run, starts a same-mission read-only native agent swarm, and launches a Codex CLI layout whose right-side lanes read that MAD ledger. Bare `sks --mad` grants target-project file and shell scope only; add explicit `--allow-*` flags for packages, services, network, Computer Use, browser use, generated assets, file permissions, DB writes, or other high-risk scopes. MAD-SKS is not a DB-only unlock and does not create a MadDB capability. Catastrophic database wipe/all-row/project-management safeguards remain active outside the first-class MadDB route, and the pipeline contract still forbids unrequested fallback implementation code.
+This syncs existing codex-lb provider auth, creates/uses the `sks-mad-high` xhigh maintenance profile, opens the MAD-SKS permission gate for that Zellij run, starts a same-mission bounded native agent swarm, and launches a Codex CLI layout whose right-side lanes read that MAD ledger. Bare `sks --mad` grants target-project file and shell scope only; add explicit `--allow-*` flags for packages, services, network, Computer Use, browser use, generated assets, file permissions, DB writes, or other high-risk scopes. MAD-SKS is not a DB-only unlock and does not create a MadDB capability. Catastrophic database wipe/all-row/project-management safeguards remain active outside the first-class MadDB route, and the pipeline contract still forbids unrequested fallback implementation code.
 
 Before launching, SKS checks npm for a newer `sneakoscope` and prints a non-blocking update notice when one is available; use `sks update now` or `sks doctor --fix` when you want SKS to update itself. Use `--yes` to approve missing dependency installs automatically. Tune MAD swarm startup with `--mad-agents <n>`, `--mad-swarm-work-items <n>`, and `--mad-swarm-backend <backend>`; `--no-mad-swarm` keeps only the cockpit UI if you need a temporary fallback.
 
@@ -429,7 +441,7 @@ Manual fan-out syntax:
 - Team prompt role counts: `$Team <task> executor:8 reviewer:5`
 - Team CLI flag: `sks team "<task>" --agents 8`
 
-Effort is assigned per agent. Simple read-only/docs slices can run low, ordinary tooling and lease mapping use medium, safety/DB/schema/release lanes use high, and frontier/forensic research can escalate to xhigh. If a lease conflict, schema failure, proof blocker, DB risk, or release risk appears, the parent can escalate that lane while keeping unrelated lanes cheaper and faster.
+Effort and model tier are assigned per agent. Managed native agents use bounded workspace-write TOML profiles, but every write still needs an assigned lease, non-overlap proof, and parent-owned integration. When the main model is GPT, simple bounded code/docs slices can downshift to `gpt-5.4-mini`, ordinary tool/lease work uses `gpt-5.5` with low model reasoning, and safety/DB/schema/release lanes use `gpt-5.5` with high model reasoning. When the main model is GLM, native workers stay locked to `z-ai/glm-5.2` and receive GLM effort tiers (`minimal`, `low`, `high`, or `xhigh`) instead of falling back to GPT. If a lease conflict, schema failure, proof blocker, DB risk, or release risk appears, the parent can escalate that lane while keeping unrelated lanes cheaper and faster.
 
 ### Naruto Massive Parallel Work Swarm (`$Naruto`)
 
@@ -528,6 +540,8 @@ sks codex-app remote-control -- --help
 
 `sks codex-app check` reports whether the installed Codex CLI is new enough, whether the required app flags are visible, whether Fast/speed-selector config is unlocked, whether Codex App Git Actions can use Commit, Push, Commit and Push, and PR flows, whether the Codex Chrome Extension path is ready for web/browser/webapp verification, and whether installed OpenAI default plugins such as Browser, Chrome, Computer Use, Documents, Presentations, Spreadsheets, and LaTeX are enabled. `sks-fast-high` intentionally does not pin `sandbox_mode`, so the Codex App/IDE permissions selector owns Full Access vs workspace-write while SKS supplies the model, Fast service tier, approval, and reasoning defaults. `sks codex-app chrome-extension --json` is the rapid preflight for web QA/UX/browser routes. When codex-lb is configured, SKS keeps it selected as the top-level Codex App provider while still preserving required app flags and plugin settings. Codex CLI 0.130.0+ app-server/remote-control threads can pick up config changes live; older CLI/TUI sessions should still be restarted after `.codex/config.toml` or MCP/plugin changes.
 
+For GLM in Codex Desktop, run `sks codex-app glm-profile install`. This writes the OpenRouter provider and selectable GLM 5.2 profiles into `~/.codex/config.toml`: `sks-glm-52-mad`, `sks-glm-52-minimal`, `sks-glm-52-low`, `sks-glm-52-medium`, `sks-glm-52-high`, and `sks-glm-52-xhigh`. Each profile pins `model = "z-ai/glm-5.2"` and the matching `model_reasoning_effort`, so Desktop profile selection can choose both GLM and the reasoning level without editing TOML by hand.
+
 For web-related verification, SKS follows the official Codex Chrome Extension setup path first: https://developers.openai.com/codex/app/chrome-extension. `$QA-LOOP`, `$UX-Review`, `$Image-UX-Review`, browser smoke, authenticated web checks, localhost checks, and web visual review must halt quickly if that extension is missing or disabled. Only after the user says the extension setup is complete should the pipeline resume. Codex Computer Use is for native Mac/non-web targets only; it must not be used as browser/web-app verification evidence.
 
 Imagegen is a core SKS capability, not a decorative add-on. `$Image-UX-Review`, `$UX-Review`, `$Visual-Review`, `$UI-UX-Review`, and PPT generated-review paths require real Codex App `$imagegen`/`gpt-image-2` output before full visual verification can pass. For newest-model image requests, prompts should say "Use ChatGPT Images 2.0 / GPT Image 2.0 with gpt-image-2" while still invoking Codex App `$imagegen` when live generation is needed. Use `imagegen-source-scout` when current official docs plus X/social prompt-workflow signals are needed; social sources are prompt heuristics only, not capability or evidence specs. `npm run imagegen:capability` checks that the official Codex App imagegen surface is visible and records that capability detection is not output proof; OpenAI API, Responses image-generation, codex-lb, or `CODEX_LB_API_KEY` fallbacks are non-Codex paths and do not satisfy Codex App generated-image evidence unless a separate API fallback task is explicitly requested. The README architecture asset uses the same rule: run `npm run imagegen:readme-architecture:prompt` to print/write the official prompt, generate the image in Codex App `$imagegen`, then rerun `npm run imagegen:readme-architecture -- --output <path>` after Codex App creates a real gpt-image-2 output. When exactly one current generated_images candidate exists after the prompt, `npm run imagegen:readme-architecture -- --auto-pick-latest` can select it automatically. To let the verifier wait while Codex App writes the file, use `npm run imagegen:readme-architecture -- --wait-ms <milliseconds>`; it still accepts only one current candidate under `$CODEX_HOME/generated_images`. Env forms such as `SKS_CODEX_APP_IMAGEGEN_OUTPUT=<path>` remain supported for automation. Use the selected file directly under `$CODEX_HOME/generated_images`; moved or copied files are not accepted as provenance evidence. Disabled or missing `image_generation` remains a blocker that `sks codex-app check`, `npm run imagegen:capability`, and selftest cover.

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.6.4"
+version = "4.7.0"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.6.4"
+version = "4.7.0"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.6.4"),
+        Some("--version") => println!("sks-rs 4.7.0"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.6.4';
+const FAST_PACKAGE_VERSION = '4.7.0';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/cli/install-helpers.js

@@ -14,6 +14,8 @@ import { checkZellijCapability } from '../core/zellij/zellij-capability.js';
 import { reconcileCodexAppUpgradeProcesses } from '../core/codex-app.js';
 import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
 import { loadCodexLbEnv, writeCodexLbKeychain, codexLbMetadataPath } from '../core/codex-lb/codex-lb-env.js';
+import { GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from '../core/providers/glm/glm-52-profile.js';
+import { GLM_52_OPENROUTER_MODEL } from '../core/providers/glm/glm-52-settings.js';
 import { buildCodexLbSetupPlan, codexLbPersistenceSummary, installCodexLbShellProfileSnippet, selectedCodexLbPersistenceModes } from '../core/codex-lb/codex-lb-setup.js';
 import { runPostinstallGlobalDoctorAndMarkPending } from '../core/update/update-migration-state.js';
 const DEFAULT_CODEX_APP_PLUGINS = [
@@ -1499,6 +1501,63 @@ export function upsertCodexLbConfig(text = '', baseUrl, selectDefault = true) {
     next = upsertTomlTable(next, 'model_providers.codex-lb', block);
     return `${next.trim()}\n`;
 }
+export function upsertCodexAppGlmConfig(text = '') {
+    let next = String(text || '');
+    const providerBlock = [
+        `[model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}]`,
+        'name = "OpenRouter"',
+        'base_url = "https://openrouter.ai/api/v1"',
+        'wire_api = "responses"',
+        'env_key = "OPENROUTER_API_KEY"',
+        'requires_openai_auth = false'
+    ].join('\n');
+    next = upsertTomlTable(next, `model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}`, providerBlock);
+    for (const profile of GLM_CODEX_CONFIG_REASONING_PROFILES) {
+        const profileBlock = [
+            `[profiles.${profile.id}]`,
+            `model_provider = "${GLM_CODEX_CONFIG_PROVIDER_ID}"`,
+            `model = "${GLM_52_OPENROUTER_MODEL}"`,
+            `model_reasoning_effort = "${profile.reasoning_effort}"`,
+            'service_tier = "default"',
+            'approval_policy = "on-request"'
+        ].join('\n');
+        next = upsertTomlTable(next, `profiles.${profile.id}`, profileBlock);
+    }
+    return `${next.trim()}\n`;
+}
+export async function ensureGlobalCodexAppGlmProfile(opts = {}) {
+    if (process.env.SKS_SKIP_CODEX_GLM_PROFILE_REPAIR === '1' && opts.force !== true) {
+        return { ok: true, status: 'skipped', reason: 'SKS_SKIP_CODEX_GLM_PROFILE_REPAIR=1' };
+    }
+    const home = opts.home || process.env.HOME || os.homedir();
+    const configPath = opts.configPath || codexLbConfigPath(home);
+    try {
+        await ensureDir(path.dirname(configPath));
+        const current = await readText(configPath, '');
+        const next = upsertCodexAppGlmConfig(current);
+        const safeWrite = await safeWriteCodexConfigToml(configPath, current, next, 'glm-profile');
+        return {
+            ...safeWrite,
+            status: safeWrite.status === 'written' ? 'updated' : safeWrite.status,
+            provider: GLM_CODEX_CONFIG_PROVIDER_ID,
+            model: GLM_52_OPENROUTER_MODEL,
+            codex_config_profile: GLM_CODEX_CONFIG_PROFILE_ID,
+            reasoning_profiles: GLM_CODEX_CONFIG_REASONING_PROFILES.map((profile) => profile.id)
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 'failed',
+            config_path: configPath,
+            error: err.message,
+            provider: GLM_CODEX_CONFIG_PROVIDER_ID,
+            model: GLM_52_OPENROUTER_MODEL,
+            codex_config_profile: GLM_CODEX_CONFIG_PROFILE_ID,
+            reasoning_profiles: GLM_CODEX_CONFIG_REASONING_PROFILES.map((profile) => profile.id)
+        };
+    }
+}
 function detectCodexLbSetupDrift(state = {}) {
     const drift = [];
     if (state.useDefaultProvider && state.selected !== true)
@@ -1582,7 +1641,10 @@ export async function ensureGlobalCodexFastModeDuringInstall(opts = {}) {
                 return { status: 'unparseable_config_preserved', config_path: configPath, backup_path: backupPath, parse_smoke: currentSmoke };
             }
         }
-        const next = normalizeCodexFastModeUiConfig(current, { forceFastMode: opts.forceFastMode === true });
+        const next = normalizeCodexFastModeUiConfig(current, {
+            forceFastMode: opts.forceFastMode === true,
+            forceFastModeOff: opts.forceFastModeOff === true
+        });
         if (next === ensureTrailingNewline(current))
             return { status: 'present', config_path: configPath };
         // Safety gate 2: never WRITE a config that would not parse.
@@ -1612,9 +1674,12 @@ function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
     next = removeTomlTableKey(next, 'notice', 'fast_default_opt_out');
     next = removeTomlTableKey(next, 'features', 'codex_hooks');
     next = upsertTopLevelTomlStringIfAbsent(next, 'model', 'gpt-5.5');
-    next = opts.forceFastMode === true
-        ? upsertTopLevelTomlString(next, 'service_tier', 'fast')
-        : next;
+    if (opts.forceFastMode === true) {
+        next = upsertTopLevelTomlString(next, 'service_tier', 'fast');
+    }
+    else if (opts.forceFastModeOff === true) {
+        next = upsertTopLevelTomlString(next, 'service_tier', 'default');
+    }
     // Codex App feature flags / fast-mode UI / suppress-warning are SET-IF-ABSENT: a fresh
     // config still gets SKS's defaults, but SKS NEVER overrides (re-enables) a feature the
     // user disabled in the App, and never rejects-then-hides UI by forcing an unrecognized
@@ -1627,10 +1692,12 @@ function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
         'guardian_approval = true', 'tool_suggest = true', 'apps = true', 'plugins = true'
     ])
         next = upsertTomlTableKeyIfAbsent(next, 'features', featureLine);
-    if (opts.forceFastMode === true) {
+    if (opts.forceFastMode === true || opts.forceFastModeOff === true) {
         next = upsertTomlTableKey(next, 'user.fast_mode', 'visible = true');
         next = upsertTomlTableKey(next, 'user.fast_mode', 'enabled = true');
-        next = upsertTomlTableKey(next, 'user.fast_mode', 'default_profile = "sks-fast-high"');
+        next = opts.forceFastMode === true
+            ? upsertTomlTableKey(next, 'user.fast_mode', 'default_profile = "sks-fast-high"')
+            : removeTomlTableKey(next, 'user.fast_mode', 'default_profile');
     }
     else {
         next = upsertTomlTableKeyIfAbsent(next, 'user.fast_mode', 'visible = true');

package/dist/commands/codex-app.js

@@ -1,8 +1,8 @@
-import { flag } from '../cli/args.js';
+import { flag, readOption } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
 import { codexAccessTokenStatus, codexAppIntegrationStatus, codexChromeExtensionStatus, codexProductDesignPluginStatus, formatCodexAppStatus, formatCodexProductDesignPluginStatus } from '../core/codex-app.js';
 import { codexAppRemoteControlCommand } from '../cli/codex-app-command.js';
-import { sksRoot } from '../core/fsx.js';
+import { readStdin, sksRoot } from '../core/fsx.js';
 import { buildCodexAppHarnessMatrix } from '../core/codex-app/codex-app-harness-matrix.js';
 import { syncCodexSksSkills } from '../core/codex-app/codex-skill-sync.js';
 import { syncCodexAgentRoles } from '../core/codex-app/codex-agent-role-sync.js';
@@ -11,6 +11,7 @@ import { buildCodexHookLifecycle } from '../core/codex-app/codex-hook-lifecycle.
 import { resolveCodexAppExecutionProfile } from '../core/codex-app/codex-app-execution-profile.js';
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 import { doctorCodexAppGlmProfile, installCodexAppGlmProfile } from '../core/codex-app/glm-profile-installer.js';
+import { promptForOpenRouterKeyHidden, writeStoredOpenRouterKey } from '../core/providers/openrouter/openrouter-secret-store.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'check';
     if (action === 'remote-control' || action === 'remote')
@@ -37,6 +38,28 @@ export async function run(_command, args = []) {
             : await doctorCodexAppGlmProfile({ root });
         return printCodexAppResult(args, result);
     }
+    if (action === 'set-openrouter-key' || action === 'openrouter-key') {
+        const root = await sksRoot();
+        const key = await readOpenRouterKeyFromArgs(args.slice(1));
+        if (!key) {
+            const result = { schema: 'sks.codex-app-openrouter-key.v1', ok: false, status: 'missing_key', blockers: ['openrouter_key_missing'], warnings: [] };
+            return printCodexAppResult(args, result);
+        }
+        const record = await writeStoredOpenRouterKey(key);
+        const profile = await installCodexAppGlmProfile({ root, apply: true });
+        const result = {
+            schema: 'sks.codex-app-openrouter-key.v1',
+            ok: profile.ok,
+            status: profile.ok ? 'stored' : 'stored_profile_blocked',
+            key_preview: record.key_preview,
+            raw_key_recorded: false,
+            secret_store: 'sks-openrouter-secret-store',
+            glm_profile: profile,
+            blockers: profile.blockers || [],
+            warnings: profile.warnings || []
+        };
+        return printCodexAppResult(args, result);
+    }
     if (action === 'product-design' || action === 'design-product' || action === 'ensure-product-design') {
         const checkOnly = flag(args, '--check-only') || flag(args, '--no-install');
         const status = await codexProductDesignPluginStatus({
@@ -97,9 +120,17 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|glm-profile [install|doctor]|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
+    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|glm-profile [install|doctor]|set-openrouter-key [--api-key-stdin]|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
     process.exitCode = 1;
 }
+async function readOpenRouterKeyFromArgs(args = []) {
+    const key = readOption(args, '--api-key', readOption(args, '--key', ''));
+    if (key)
+        return String(key).trim();
+    if (flag(args, '--api-key-stdin') || flag(args, '--key-stdin'))
+        return String(await readStdin()).trim();
+    return await promptForOpenRouterKeyHidden() || '';
+}
 function printCodexAppResult(args = [], result) {
     if (flag(args, '--json')) {
         printJson(result);

package/dist/commands/doctor.js

@@ -746,7 +746,7 @@ async function runDoctor(args = [], root, doctorFix) {
         console.log(`  manual: ${action}`);
     for (const warning of codexStartupRepair.warnings || [])
         console.log(`  warning: ${warning}`);
-    console.log(`  codex doctor:    ${authoritativeCodexDoctor.available ? (authoritativeCodexDoctor.disposition || (authoritativeCodexDoctor.exit_code === 0 ? 'pass' : 'warn')) : 'unavailable'}`);
+    console.log(`  codex doctor:    ${formatCodexDoctorConsoleStatus(authoritativeCodexDoctor)}`);
     console.log(`Rust acc.: ${rust.mode || (rust.available ? 'rust_accelerated' : 'js_fallback')} ${rust.version || rust.status || ''}`);
     console.log(`Codex App: ${ready.codex_app_ready ? 'ok' : 'optional_missing'}`);
     console.log('SKS Runtime Readiness:');
@@ -1166,6 +1166,11 @@ function readOption(args = [], name, fallback = null) {
     const index = args.indexOf(name);
     return index >= 0 && args[index + 1] ? args[index + 1] : fallback;
 }
+export function formatCodexDoctorConsoleStatus(report) {
+    if (!report || report.available !== true)
+        return 'unavailable';
+    return report.disposition || (report.exit_code === 0 ? 'pass' : 'warn');
+}
 function mergeObservedCodexStartupWarnings(startupRepair, codexDoctor) {
     const text = `${codexDoctor?.stdout_tail || ''}\n${codexDoctor?.stderr_tail || ''}`;
     const manual = new Set(Array.isArray(startupRepair?.manual_actions) ? startupRepair.manual_actions : []);

package/dist/core/agents/agent-effort-policy.js

@@ -1,8 +1,11 @@
 import { codexModelEffortCapability } from '../codex-control/codex-model-capabilities.js';
+import { GPT54_MINI_CODEX_MODEL, REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
+import { GLM_52_OPENROUTER_MODEL } from '../providers/glm/glm-52-settings.js';
 const XHIGH_SIGNAL_RE = /(frontier|autoresearch|novelty|hypothesis|falsif|forensic|from-chat-img|image\s*work\s*order|새로운\s*연구|가설|포렌식)/i;
 const HIGH_SIGNAL_RE = /(database|supabase|sql|migration|security|permission|mad|release|publish|deploy|architecture|policy|schema|hook|rollback|db|보안|배포|마이그레이션|데이터베이스|권한|릴리즈)/i;
 const MEDIUM_SIGNAL_RE = /(tmux|terminal|cli|tool(?:\s|-)?call|router|routing|orchestrat|pipeline|multi[-\s]?session|multi[-\s]?agent|lease|ledger|proof|검증|파이프라인|오케스트레이션|병렬|에이전트)/i;
 const SIMPLE_SIGNAL_RE = /(tiny|simple|small|one[-\s]?line|typo|copy|label|spacing|rename|readme|docs?|간단|단순|오타|문구|라벨)/i;
+const SIMPLE_CODE_MOD_RE = /(tiny|simple|small|one[-\s]?line|typo|copy|label|spacing|rename|readme|docs?|minor|bounded|간단|단순|작은|오타|문구|라벨|이름\s*변경)/i;
 export function decideAgentEffort(input = {}) {
     const persona = input.persona || {};
     const prompt = String(input.prompt || '');
@@ -27,14 +30,19 @@ export function decideAgentEffort(input = {}) {
         effort = 'high';
         reason = 'implementation_lane_capped_at_high';
     }
-    const modelCapability = codexModelEffortCapability({ defaultEffort: effort });
+    const modelDecision = decideAgentWorkerModel({ effort, prompt, role, agentId, readonly: input.readonly === true || persona.read_only === true, writePolicy: String(persona.write_policy || '') });
+    const modelCapability = codexModelEffortCapability({ model: modelDecision.model, defaultEffort: modelDecision.model_reasoning_effort });
     return {
         schema: 'sks.agent-effort-decision.v1',
         policy_version: 1,
         agent_id: agentId,
         role,
+        model: modelDecision.model,
         reasoning_effort: effort,
-        model_reasoning_effort: effort,
+        model_reasoning_effort: modelDecision.model_reasoning_effort,
+        model_tier: modelDecision.model_tier,
+        model_profile: modelDecision.model_profile,
+        model_selection_reason: modelDecision.reason,
         model_effort_capability: modelCapability,
         reasoning_profile: reasoningProfileName(effort),
         service_tier: 'fast',
@@ -76,14 +84,19 @@ export function decideNarutoCloneEffort(input = {}) {
     const writes = !readonly || /write|edit|route-local|workspace|patch|integrat/i.test(writePolicy) || hasActionTool;
     const toolUse = writes || NARUTO_ACTION_TOOL_RE.test(prompt);
     const effort = toolUse ? 'medium' : 'low';
-    const modelCapability = codexModelEffortCapability({ defaultEffort: effort });
+    const modelDecision = decideAgentWorkerModel({ effort, prompt, role, agentId, readonly, writePolicy: String(writePolicy || '') });
+    const modelCapability = codexModelEffortCapability({ model: modelDecision.model, defaultEffort: modelDecision.model_reasoning_effort });
     return {
         schema: 'sks.agent-effort-decision.v1',
         policy_version: 1,
         agent_id: agentId,
         role,
+        model: modelDecision.model,
         reasoning_effort: effort,
-        model_reasoning_effort: effort,
+        model_reasoning_effort: modelDecision.model_reasoning_effort,
+        model_tier: modelDecision.model_tier,
+        model_profile: modelDecision.model_profile,
+        model_selection_reason: modelDecision.reason,
         model_effort_capability: modelCapability,
         reasoning_profile: reasoningProfileName(effort),
         service_tier: 'fast',
@@ -102,7 +115,12 @@ export function buildAgentEffortPolicy(roster = {}) {
         agent_id: agent.id,
         session_id: agent.session_id,
         role: agent.role,
+        model: agent.model,
         reasoning_effort: agent.reasoning_effort,
+        model_reasoning_effort: agent.model_reasoning_effort,
+        model_tier: agent.model_tier,
+        model_profile: agent.model_profile,
+        model_selection_reason: agent.model_selection_reason,
         reasoning_profile: agent.reasoning_profile,
         reason: agent.reasoning_reason,
         dynamic: true
@@ -112,13 +130,15 @@ export function buildAgentEffortPolicy(roster = {}) {
         policy_version: 1,
         dynamic: true,
         service_tier: 'fast',
+        allowed_models: [GPT54_MINI_CODEX_MODEL, REQUIRED_CODEX_MODEL, GLM_52_OPENROUTER_MODEL],
+        model_tiers: ['gpt-5.4-mini', 'gpt-5.5-low', 'gpt-5.5-high', 'glm-5.2-minimal', 'glm-5.2-low', 'glm-5.2-high', 'glm-5.2-xhigh'],
         allowed_efforts: codexModelEffortCapability().advertised_efforts,
         model_effort_capability: codexModelEffortCapability(),
         max_agents: roster.max_agents || 20,
         agent_count: roster.agent_count || decisions.length,
         concurrency: roster.concurrency || decisions.length,
         decisions,
-        rule: 'Parent orchestration assigns per-agent effort from prompt risk, persona role, lease ownership, and proof state; lanes can escalate on blockers and downshift for narrow read-only work.'
+        rule: 'Parent orchestration assigns per-agent model tiers from prompt risk, persona role, lease ownership, and proof state: simple bounded GPT workers can downshift to gpt-5.4-mini; ordinary GPT workers use gpt-5.5 low; risky GPT lanes use gpt-5.5 high. In GLM mode, native workers stay on z-ai/glm-5.2 and receive GLM effort tiers.'
     };
 }
 export function reasoningProfileName(effort) {
@@ -144,4 +164,89 @@ function effortReason(effort) {
         return 'simple_bounded_slice';
     return 'default_orchestration_slice';
 }
+export function decideAgentWorkerModel(input = {}) {
+    const mainModel = String(input.mainModel || process.env.SKS_CODEX_MODEL || process.env.CODEX_MODEL || REQUIRED_CODEX_MODEL).trim();
+    const glmMain = isGlmWorkerMode(mainModel);
+    const gptMain = !glmMain && (!mainModel || /^gpt-/i.test(mainModel));
+    const effort = String(input.effort || 'medium');
+    const text = [input.prompt, input.role, input.agentId, input.writePolicy].map((item) => String(item || '')).join(' ');
+    const simpleText = [input.prompt, input.role, input.agentId].map((item) => String(item || '')).join(' ');
+    const risky = HIGH_SIGNAL_RE.test(text) || XHIGH_SIGNAL_RE.test(text);
+    const simple = SIMPLE_CODE_MOD_RE.test(simpleText) && !HIGH_SIGNAL_RE.test(simpleText) && !XHIGH_SIGNAL_RE.test(simpleText);
+    if (glmMain) {
+        const glmEffort = glmWorkerEffort({ effort, risky, simple });
+        return {
+            model: GLM_52_OPENROUTER_MODEL,
+            model_reasoning_effort: glmEffort,
+            model_tier: `glm-5.2-${glmEffort === 'none' ? 'minimal' : glmEffort}`,
+            model_profile: glmProfileForReasoning(glmEffort),
+            reason: `glm_52_${glmEffort}_worker`
+        };
+    }
+    if (gptMain && risky) {
+        return {
+            model: REQUIRED_CODEX_MODEL,
+            model_reasoning_effort: 'high',
+            model_tier: 'gpt-5.5-high',
+            model_profile: 'sks-agent-gpt-5.5-high-fast',
+            reason: 'risk_signal_worker'
+        };
+    }
+    if (gptMain && (simple || effort === 'low')) {
+        return {
+            model: GPT54_MINI_CODEX_MODEL,
+            model_reasoning_effort: 'low',
+            model_tier: 'gpt-5.4-mini',
+            model_profile: 'sks-agent-gpt-5.4-mini-fast',
+            reason: simple ? 'simple_code_or_docs_slice_downshift' : 'low_effort_worker_downshift'
+        };
+    }
+    if (gptMain && (effort === 'high' || effort === 'xhigh')) {
+        return {
+            model: REQUIRED_CODEX_MODEL,
+            model_reasoning_effort: 'high',
+            model_tier: 'gpt-5.5-high',
+            model_profile: 'sks-agent-gpt-5.5-high-fast',
+            reason: 'risk_or_high_effort_worker'
+        };
+    }
+    return {
+        model: gptMain ? REQUIRED_CODEX_MODEL : mainModel || REQUIRED_CODEX_MODEL,
+        model_reasoning_effort: 'low',
+        model_tier: 'gpt-5.5-low',
+        model_profile: 'sks-agent-gpt-5.5-low-fast',
+        reason: gptMain ? 'ordinary_worker_gpt55_low' : 'non_gpt_main_model_preserved'
+    };
+}
+function isGlmWorkerMode(mainModel) {
+    const model = String(mainModel || '').trim().toLowerCase();
+    return model === GLM_52_OPENROUTER_MODEL
+        || model === 'glm-5.2'
+        || model === 'glm5.2'
+        || process.env.SKS_GLM_MODE === '1'
+        || process.env.SKS_GLM_WRAPPER_ACTIVE === '1'
+        || process.env.SKS_GLM_MAD_ACTIVE === '1';
+}
+function glmWorkerEffort(input) {
+    if (input.effort === 'xhigh')
+        return 'xhigh';
+    if (input.risky || input.effort === 'high')
+        return 'high';
+    if (input.simple || input.effort === 'low')
+        return 'minimal';
+    return 'low';
+}
+function glmProfileForReasoning(effort) {
+    if (effort === 'xhigh')
+        return 'sks-glm-52-xhigh';
+    if (effort === 'high')
+        return 'sks-glm-52-high';
+    if (effort === 'medium')
+        return 'sks-glm-52-medium';
+    if (effort === 'low')
+        return 'sks-glm-52-low';
+    if (effort === 'none')
+        return 'sks-glm-52-mad';
+    return 'sks-glm-52-minimal';
+}
 //# sourceMappingURL=agent-effort-policy.js.map

package/dist/core/agents/agent-orchestrator.js

@@ -24,6 +24,7 @@ import { runFakeAgent } from './agent-runner-fake.js';
 import { runProcessAgent } from './agent-runner-process.js';
 import { classifyOllamaWorkerSlice, runOllamaAgent } from './agent-runner-ollama.js';
 import { resolveOllamaWorkerConfig } from './ollama-worker-config.js';
+import { decideAgentWorkerModel } from './agent-effort-policy.js';
 import { validateAgentWorkerResult } from './agent-worker-pipeline.js';
 import { writeAgentCleanupReport } from './agent-cleanup.js';
 import { writeAgentTrustReport } from './agent-trust-report.js';
@@ -93,7 +94,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
     const selectedCoreSkill = routeSkillSelection ? skillProofRecord(routeSkillSelection) : null;
     const namespace = await buildProjectNamespace({ root, missionId });
     await writeProjectNamespaceArtifact(dir, namespace);
-    let roster = buildProvidedAgentRoster(opts.roster, { concurrency: opts.concurrency, readonly: opts.readonly, maxAgentCount }) || buildAgentRoster({ agents: opts.agents, concurrency: opts.concurrency, prompt, maxAgentCount, ...(opts.readonly === undefined ? {} : { readonly: opts.readonly }) });
+    let roster = buildProvidedAgentRoster(opts.roster, { concurrency: opts.concurrency, readonly: opts.readonly, maxAgentCount, prompt }) || buildAgentRoster({ agents: opts.agents, concurrency: opts.concurrency, prompt, maxAgentCount, ...(opts.readonly === undefined ? {} : { readonly: opts.readonly }) });
     roster = applyFastModeToRoster(roster, fastModePolicy);
     roster.roster = roster.roster.map((agent) => ({
         ...agent,
@@ -1638,6 +1639,19 @@ function buildProvidedAgentRoster(input, opts = {}) {
     const roster = sourceRows.map((entry, index) => {
         const readOnly = opts.readonly === true || entry.read_only === true;
         const id = String(entry.id || entry.agent_id || `agent_${index + 1}`);
+        const reasoningEffort = entry.reasoning_effort || entry.model_reasoning_effort || (readOnly ? 'high' : 'medium');
+        const modelDecision = decideAgentWorkerModel({
+            effort: reasoningEffort,
+            prompt: opts.prompt || input?.prompt || '',
+            role: String(entry.role || 'verifier'),
+            agentId: id,
+            readonly: readOnly,
+            writePolicy: String(entry.write_policy || '')
+        });
+        const suppliedModelEffort = String(entry.model_reasoning_effort || '');
+        const modelReasoningEffort = suppliedModelEffort === 'low' || suppliedModelEffort === 'high'
+            ? suppliedModelEffort
+            : modelDecision.model_reasoning_effort;
         return {
             id,
             session_id: String(entry.session_id || `${id}-session-${String(index + 1).padStart(2, '0')}`),
@@ -1646,8 +1660,12 @@ function buildProvidedAgentRoster(input, opts = {}) {
             index: index + 1,
             write_policy: String(entry.write_policy || (readOnly ? 'read-only' : 'route-local-artifact')),
             status: 'pending',
-            reasoning_effort: entry.reasoning_effort || entry.model_reasoning_effort || (readOnly ? 'high' : 'medium'),
-            model_reasoning_effort: entry.model_reasoning_effort || entry.reasoning_effort || (readOnly ? 'high' : 'medium'),
+            model: entry.model || modelDecision.model,
+            reasoning_effort: reasoningEffort,
+            model_reasoning_effort: modelReasoningEffort,
+            model_tier: entry.model_tier || modelDecision.model_tier,
+            model_profile: entry.model_profile || modelDecision.model_profile,
+            model_selection_reason: entry.model_selection_reason || modelDecision.reason,
             reasoning_profile: entry.reasoning_profile || (readOnly ? 'sks-logic-high' : 'sks-logic-medium'),
             service_tier: entry.service_tier,
             reasoning_reason: entry.reasoning_reason || 'route_native_agent_plan',
@@ -1690,6 +1708,9 @@ async function runAgentByBackend(backend, agent, slice, opts) {
             sessionId: String(agent.session_id || ''),
             cwd: String(opts.cwd || process.cwd()),
             prompt: buildDirectSdkWorkerPrompt(slice),
+            model: agent.model || null,
+            reasoningEffort: agent.reasoning_effort || null,
+            modelReasoningEffort: agent.model_reasoning_effort || agent.reasoning_effort || null,
             inputFiles: Array.isArray(opts.inputFiles) ? opts.inputFiles.map(String) : [],
             inputImages: Array.isArray(opts.inputImages) ? opts.inputImages.map(String) : [],
             outputSchemaId: CODEX_AGENT_WORKER_RESULT_SCHEMA_ID,
@@ -1723,6 +1744,9 @@ async function runAgentByBackend(backend, agent, slice, opts) {
             structured_output_valid: sdkTask.structuredOutputValid,
             worker_result_path: path.relative(ledgerRoot, sdkTask.workerResultPath),
             patch_envelope_path: sdkTask.patchEnvelopePath ? path.relative(ledgerRoot, sdkTask.patchEnvelopePath) : null,
+            model: agent.model || null,
+            model_reasoning_effort: agent.model_reasoning_effort || null,
+            model_tier: agent.model_tier || null,
             service_tier: opts.serviceTier || 'fast',
             fast_mode: opts.fastMode !== false,
             blockers: sdkTask.blockers

package/dist/core/agents/agent-plan.js

@@ -36,8 +36,8 @@ export function agentPipelineStage(policy = {}) {
         agent_count: required ? Number(policy.agent_count || DEFAULT_AGENT_COUNT) : 0,
         max_parallel_native_sessions: Number(policy.agent_count || DEFAULT_AGENT_COUNT),
         backend: 'native-agent-kernel',
-        read_only: true,
-        write_policy: 'read-only analysis; parent-owned integration',
+        read_only: false,
+        write_policy: 'bounded workspace-write analysis leases; parent-owned integration',
         outputs: policy.outputs || ['agents/agent-proof-evidence.json']
     };
 }

package/dist/core/agents/agent-roster.js

@@ -112,8 +112,12 @@ export function buildAgentRoster(opts = {}) {
             index: index + 1,
             write_policy: persona.write_policy,
             status: 'pending',
+            model: effort.model,
             reasoning_effort: effort.reasoning_effort,
             model_reasoning_effort: effort.model_reasoning_effort,
+            model_tier: effort.model_tier,
+            model_profile: effort.model_profile,
+            model_selection_reason: effort.model_selection_reason,
             reasoning_profile: effort.reasoning_profile,
             service_tier: effort.service_tier,
             reasoning_reason: effort.reason,
@@ -192,8 +196,12 @@ export function buildNarutoCloneRoster(opts = {}) {
             index: index + 1,
             write_policy: cloneReadonly ? 'read-only' : 'exclusive Naruto patch-envelope lease required',
             status: 'pending',
+            model: effort.model,
             reasoning_effort: effort.reasoning_effort,
             model_reasoning_effort: effort.model_reasoning_effort,
+            model_tier: effort.model_tier,
+            model_profile: effort.model_profile,
+            model_selection_reason: effort.model_selection_reason,
             reasoning_profile: effort.reasoning_profile,
             service_tier: 'fast',
             fast_mode: true,

package/dist/core/agents/agent-worker-slot.js

@@ -17,7 +17,11 @@ export function createAgentWorkerSlots(roster, targetActiveSlots) {
                 persona_id: String(persona.persona_id || persona.id || `agent_${index + 1}`),
                 role: String(persona.role || 'verifier'),
                 write_policy: String(persona.write_policy || 'read-only'),
+                model: persona.model || null,
                 reasoning_effort: persona.reasoning_effort || persona.model_reasoning_effort || null,
+                model_reasoning_effort: persona.model_reasoning_effort || null,
+                model_tier: persona.model_tier || null,
+                model_profile: persona.model_profile || null,
                 reasoning_profile: persona.reasoning_profile || null,
                 service_tier: persona.service_tier || 'fast',
                 fast_mode: persona.fast_mode !== false