sneakoscope 4.6.5 → 4.7.1

package/dist/core/agents/agent-roster.js

@@ -112,8 +112,12 @@ export function buildAgentRoster(opts = {}) {
             index: index + 1,
             write_policy: persona.write_policy,
             status: 'pending',
+            model: effort.model,
             reasoning_effort: effort.reasoning_effort,
             model_reasoning_effort: effort.model_reasoning_effort,
+            model_tier: effort.model_tier,
+            model_profile: effort.model_profile,
+            model_selection_reason: effort.model_selection_reason,
             reasoning_profile: effort.reasoning_profile,
             service_tier: effort.service_tier,
             reasoning_reason: effort.reason,
@@ -192,8 +196,12 @@ export function buildNarutoCloneRoster(opts = {}) {
             index: index + 1,
             write_policy: cloneReadonly ? 'read-only' : 'exclusive Naruto patch-envelope lease required',
             status: 'pending',
+            model: effort.model,
             reasoning_effort: effort.reasoning_effort,
             model_reasoning_effort: effort.model_reasoning_effort,
+            model_tier: effort.model_tier,
+            model_profile: effort.model_profile,
+            model_selection_reason: effort.model_selection_reason,
             reasoning_profile: effort.reasoning_profile,
             service_tier: 'fast',
             fast_mode: true,

package/dist/core/agents/agent-worker-slot.js

@@ -17,7 +17,11 @@ export function createAgentWorkerSlots(roster, targetActiveSlots) {
                 persona_id: String(persona.persona_id || persona.id || `agent_${index + 1}`),
                 role: String(persona.role || 'verifier'),
                 write_policy: String(persona.write_policy || 'read-only'),
+                model: persona.model || null,
                 reasoning_effort: persona.reasoning_effort || persona.model_reasoning_effort || null,
+                model_reasoning_effort: persona.model_reasoning_effort || null,
+                model_tier: persona.model_tier || null,
+                model_profile: persona.model_profile || null,
                 reasoning_profile: persona.reasoning_profile || null,
                 service_tier: persona.service_tier || 'fast',
                 fast_mode: persona.fast_mode !== false

package/dist/core/codex/agent-config-file-repair.js

@@ -175,15 +175,15 @@ function minimalManagedConfigToml() {
         '[mcp_servers.context7]',
         'url = "https://mcp.context7.com/mcp"',
         '',
-        agentConfigBlock('native_agent', 'Read-only SKS analysis agent.', './agents/native-agent-intake.toml', ['Analysis', 'Mapper']),
+        agentConfigBlock('native_agent', 'SKS native agent with bounded write capability.', './agents/native-agent-intake.toml', ['Analysis', 'Mapper']),
         '',
-        agentConfigBlock('team_consensus', 'SKS planning/debate agent.', './agents/team-consensus.toml', ['Consensus', 'Atlas']),
+        agentConfigBlock('team_consensus', 'SKS planning/debate agent with bounded write capability.', './agents/team-consensus.toml', ['Consensus', 'Atlas']),
         '',
         agentConfigBlock('implementation_worker', 'SKS bounded implementation worker.', './agents/implementation-worker.toml', ['Builder', 'Mason']),
         '',
-        agentConfigBlock('db_safety_reviewer', 'Read-only DB safety reviewer.', './agents/db-safety-reviewer.toml', ['Sentinel', 'Ledger']),
+        agentConfigBlock('db_safety_reviewer', 'DB safety reviewer with bounded write capability.', './agents/db-safety-reviewer.toml', ['Sentinel', 'Ledger']),
         '',
-        agentConfigBlock('qa_reviewer', 'Read-only QA reviewer.', './agents/qa-reviewer.toml', ['Verifier', 'Reviewer']),
+        agentConfigBlock('qa_reviewer', 'QA reviewer with bounded write capability.', './agents/qa-reviewer.toml', ['Verifier', 'Reviewer']),
         ''
     ].join('\n');
 }

package/dist/core/codex-app/codex-app-fast-ui-repair.js

@@ -4,7 +4,8 @@ import { ensureDir, nowIso, readText, sha256, writeJsonAtomic, writeTextAtomic }
 import { codexHome, scanProjectLocalForbiddenKeys, snapshotCodexAppUiState } from './codex-app-ui-state-snapshot.js';
 import { assertCodexAppUiMutationAllowed } from './codex-app-ui-clobber-guard.js';
 export const CODEX_APP_FAST_UI_REPAIR_SCHEMA = 'sks.codex-app-fast-ui-repair.v1';
-const FAST_UI_TOP_LEVEL_RE = /^\s*service_tier\s*=/;
+const FAST_UI_TOP_LEVEL_RE = /^\s*(?:model|model_reasoning_effort|service_tier)\s*=/;
+const CODEX_APP_MODE_LOCK_TOP_LEVEL_RE = /^\s*(?:model|model_reasoning_effort)\s*=/;
 const FAST_UI_FEATURE_LINE_RE = /^\s*fast_mode\s*=/;
 const FAST_UI_USER_TABLE_LINE_RE = /^\s*(enabled|visible|locked|hidden|disabled)\s*=/;
 const SKS_CAUSED_RE = /(?:SKS|Sneakoscope|codex-lb|sks-mad|sks fast)/i;
@@ -125,10 +126,11 @@ function stripProjectLocalForbiddenKeys(text) {
 }
 function stripSksCausedHostOwnedLines(text) {
     return stripMatchingLines(text, (line, table, previous, next) => {
+        const isCodexAppModeLock = !table && CODEX_APP_MODE_LOCK_TOP_LEVEL_RE.test(line);
         const isFastUiLine = FAST_UI_TOP_LEVEL_RE.test(line)
             || (table === 'features' && FAST_UI_FEATURE_LINE_RE.test(line))
             || (table === 'user.fast_mode' && FAST_UI_USER_TABLE_LINE_RE.test(line));
-        return isFastUiLine && (SKS_CAUSED_RE.test(line) || SKS_CAUSED_RE.test(previous) || SKS_CAUSED_RE.test(next));
+        return isCodexAppModeLock || (isFastUiLine && (SKS_CAUSED_RE.test(line) || SKS_CAUSED_RE.test(previous) || SKS_CAUSED_RE.test(next)));
     });
 }
 function stripMatchingLines(text, shouldRemove) {

package/dist/core/codex-app/codex-app-ui-state-snapshot.js

@@ -4,6 +4,8 @@ import path from 'node:path';
 import { exists, nowIso, readText, sha256, writeJsonAtomic } from '../fsx.js';
 export const CODEX_APP_UI_STATE_SNAPSHOT_SCHEMA = 'sks.codex-app-ui-state-snapshot.v1';
 export const PROJECT_LOCAL_FORBIDDEN_CODEX_KEYS = [
+    'model',
+    'model_reasoning_effort',
     'openai_base_url',
     'chatgpt_base_url',
     'apps_mcp_product_sku',
@@ -15,7 +17,7 @@ export const PROJECT_LOCAL_FORBIDDEN_CODEX_KEYS = [
     'experimental_realtime_ws_base_url',
     'otel'
 ];
-const HOST_OWNED_KEY_RE = /^(?:openai_base_url|chatgpt_base_url|apps_mcp_product_sku|model_provider|model_providers(?:\.|$)|notify|profile|profiles(?:\.|$)|experimental_realtime_ws_base_url|otel(?:\.|$)|features\.fast_mode|service_tier|user\.fast_mode(?:\.|$))/;
+const HOST_OWNED_KEY_RE = /^(?:model|model_reasoning_effort|openai_base_url|chatgpt_base_url|apps_mcp_product_sku|model_provider|model_providers(?:\.|$)|notify|profile|profiles(?:\.|$)|experimental_realtime_ws_base_url|otel(?:\.|$)|features\.fast_mode|service_tier|user\.fast_mode(?:\.|$))/;
 const SECRET_KEY_RE = /(?:key|token|secret|password|credential|cookie|authorization|bearer|refresh|access)/i;
 export function codexHome(input) {
     return path.resolve(String(input?.codexHome || process.env.CODEX_HOME || path.join(os.homedir(), '.codex')));
@@ -35,11 +37,16 @@ export async function snapshotCodexAppUiState(root = process.cwd(), input = {})
     const providerSignals = hostOwnedSignals
         .filter((signal) => signal.provider_related)
         .map((signal) => `${signal.key_path}=${signal.value_preview}`);
-    const fastSelectorLocked = hostOwnedSignals.some((signal) => {
+    const baseConfigHostOwnedSignals = files
+        .filter((file) => !isProfileConfigSnapshotPath(file.path))
+        .flatMap((file) => file.signals.filter((signal) => signal.host_owned));
+    const fastSelectorLocked = baseConfigHostOwnedSignals.some((signal) => {
         if (signal.key_path === 'features.fast_mode' && signal.value_preview === 'false')
             return true;
         if (signal.key_path.startsWith('user.fast_mode') && /hidden|fixed|disabled|false/i.test(signal.value_preview))
             return true;
+        if (signal.key_path === 'model' || signal.key_path === 'model_reasoning_effort')
+            return true;
         if (signal.key_path === 'service_tier' && signal.sks_related)
             return true;
         return false;
@@ -120,7 +127,7 @@ export function scanTomlSignals(text) {
             value_hash: sha256(value),
             line: index + 1,
             host_owned: HOST_OWNED_KEY_RE.test(keyPath),
-            fast_ui_related: /(?:fast_mode|service_tier)/i.test(keyPath) || /(?:fast|priority|default)/i.test(value),
+            fast_ui_related: /(?:fast_mode|service_tier|model_reasoning_effort|^model$)/i.test(keyPath) || /(?:fast|priority|default)/i.test(value),
             provider_related: /(?:provider|base_url|auth|profile|openai|chatgpt|codex-lb)/i.test(lowerPath),
             sks_related: /(?:sks|sneakoscope|codex-lb)/i.test(lineText)
         });
@@ -176,6 +183,10 @@ async function profileConfigFiles(home) {
         return [];
     }
 }
+function isProfileConfigSnapshotPath(file) {
+    const base = path.basename(file);
+    return /^profile-.+\.config\.toml$/.test(base) || /^[A-Za-z0-9_-]+\.config\.toml$/.test(base);
+}
 async function readAuthMetadata(file) {
     const text = await readText(file, null);
     if (text == null)

package/dist/core/codex-app/glm-model-profile.js

@@ -1,2 +1,2 @@
-export { GLM_CODEX_APP_PROFILE_ID, GLM_CODEX_APP_PROFILE_LABEL, buildGlmCodexAppModelProfile } from '../providers/glm/glm-52-profile.js';
+export { GLM_CODEX_APP_PROFILE_ID, GLM_CODEX_APP_PROFILE_LABEL, GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES, GLM_CODEX_SELECTABLE_REASONING_EFFORTS, buildGlmCodexAppModelProfile } from '../providers/glm/glm-52-profile.js';
 //# sourceMappingURL=glm-model-profile.js.map

package/dist/core/codex-app/glm-profile-installer.js

@@ -1,30 +1,49 @@
 import path from 'node:path';
-import { readJson, writeJsonAtomic, nowIso } from '../fsx.js';
-import { buildGlmCodexAppModelProfile } from './glm-model-profile.js';
+import { codexLbConfigPath, ensureGlobalCodexAppGlmProfile } from '../../cli/install-helpers.js';
+import { readJson, readText, writeJsonAtomic, nowIso } from '../fsx.js';
+import { GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES, buildGlmCodexAppModelProfile } from './glm-model-profile.js';
 import { validateGlmCodexAppModelProfile } from './glm-profile-schema.js';
 import { resolveOpenRouterApiKey } from '../providers/openrouter/openrouter-secret-store.js';
+import { GLM_52_OPENROUTER_MODEL } from '../providers/glm/glm-52-settings.js';
 export async function installCodexAppGlmProfile(input) {
     const root = path.resolve(input.root);
     const profile = buildGlmCodexAppModelProfile();
     const profilePath = path.join(root, '.sneakoscope', 'codex-app', 'glm-model-profile.json');
     const reportPath = path.join(root, '.sneakoscope', 'reports', 'codex-app-glm-profile.json');
     const key = await resolveOpenRouterApiKey({ env: input.env || process.env });
+    const home = input.home || input.env?.HOME;
+    const configWrite = input.apply === false
+        ? null
+        : await ensureGlobalCodexAppGlmProfile({ home, configPath: input.configPath });
+    const configStatus = input.apply === false
+        ? await previewCodexAppGlmConfigStatus({ home, configPath: input.configPath })
+        : await inspectCodexAppGlmConfig({ home, configPath: input.configPath });
+    const configWriteBlockers = configWrite?.ok === false
+        ? [`glm_codex_app_config_${configWrite.status || 'failed'}`]
+        : [];
+    const blockers = input.apply === false ? [] : [...configWriteBlockers, ...configStatus.blockers];
     const warnings = [
         ...key.warnings,
-        ...(key.key ? [] : ['openrouter_key_missing_until_sks_--mad_--glm_--repair'])
+        ...(key.key ? [] : ['openrouter_key_missing_until_sks_--mad_--glm_--repair']),
+        ...(input.apply === false ? ['codex_desktop_glm_config_not_written_apply_false'] : [])
     ];
     if (input.apply !== false)
         await writeJsonAtomic(profilePath, profile);
     const result = {
         schema: 'sks.codex-app-glm-profile-result.v1',
         generated_at: nowIso(),
-        ok: true,
-        status: input.apply === false ? 'valid' : 'installed',
+        ok: blockers.length === 0,
+        status: blockers.length === 0 ? input.apply === false ? 'valid' : 'installed' : 'blocked',
         profile,
         profile_path: '.sneakoscope/codex-app/glm-model-profile.json',
         report_path: '.sneakoscope/reports/codex-app-glm-profile.json',
+        config_path: configStatus.config_path,
+        codex_config_profile: GLM_CODEX_CONFIG_PROFILE_ID,
+        codex_reasoning_profiles: GLM_CODEX_CONFIG_REASONING_PROFILES.map((item) => item.id),
+        config_write: configWrite,
+        config_status: configStatus,
         openrouter_key_source: key.source,
-        blockers: [],
+        blockers,
         warnings
     };
     await writeJsonAtomic(reportPath, result).catch(() => undefined);
@@ -38,7 +57,9 @@ export async function doctorCodexAppGlmProfile(input) {
     const validation = validateGlmCodexAppModelProfile(existing);
     const key = await resolveOpenRouterApiKey({ env: input.env || process.env });
     const profile = validation.profile || buildGlmCodexAppModelProfile();
-    const blockers = [...validation.blockers];
+    const home = input.home || input.env?.HOME;
+    const configStatus = await inspectCodexAppGlmConfig({ home, configPath: input.configPath });
+    const blockers = [...validation.blockers, ...configStatus.blockers];
     const warnings = [
         ...key.warnings,
         ...(key.key ? [] : ['openrouter_key_missing_until_sks_--mad_--glm_--repair'])
@@ -51,6 +72,11 @@ export async function doctorCodexAppGlmProfile(input) {
         profile,
         profile_path: '.sneakoscope/codex-app/glm-model-profile.json',
         report_path: '.sneakoscope/reports/codex-app-glm-profile.json',
+        config_path: configStatus.config_path,
+        codex_config_profile: GLM_CODEX_CONFIG_PROFILE_ID,
+        codex_reasoning_profiles: GLM_CODEX_CONFIG_REASONING_PROFILES.map((item) => item.id),
+        config_write: null,
+        config_status: configStatus,
         openrouter_key_source: key.source,
         blockers,
         warnings
@@ -58,4 +84,82 @@ export async function doctorCodexAppGlmProfile(input) {
     await writeJsonAtomic(reportPath, result).catch(() => undefined);
     return result;
 }
+async function previewCodexAppGlmConfigStatus(input) {
+    const configPath = input.configPath || codexLbConfigPath(input.home);
+    return {
+        schema: 'sks.codex-app-glm-config-status.v1',
+        ok: true,
+        config_path: configPath,
+        provider_present: false,
+        profiles_present: [],
+        profiles_missing: [],
+        blockers: []
+    };
+}
+async function inspectCodexAppGlmConfig(input) {
+    const configPath = input.configPath || codexLbConfigPath(input.home);
+    const text = await readText(configPath, '').catch(() => '');
+    const providerBody = tomlTableBody(text, `model_providers.${GLM_CODEX_CONFIG_PROVIDER_ID}`);
+    const providerPresent = Boolean(providerBody);
+    const blockers = [];
+    if (!providerPresent) {
+        blockers.push('glm_codex_app_config_missing_openrouter_provider');
+    }
+    else {
+        if (!hasTomlString(providerBody, 'base_url', 'https://openrouter.ai/api/v1'))
+            blockers.push('glm_codex_app_config_invalid_openrouter_base_url');
+        if (!hasTomlString(providerBody, 'wire_api', 'responses'))
+            blockers.push('glm_codex_app_config_invalid_openrouter_wire_api');
+        if (!hasTomlString(providerBody, 'env_key', 'OPENROUTER_API_KEY'))
+            blockers.push('glm_codex_app_config_invalid_openrouter_env_key');
+    }
+    const profilesPresent = [];
+    const profilesMissing = [];
+    for (const profile of GLM_CODEX_CONFIG_REASONING_PROFILES) {
+        const body = tomlTableBody(text, `profiles.${profile.id}`);
+        if (!body) {
+            profilesMissing.push(profile.id);
+            blockers.push(`glm_codex_app_config_missing_profile:${profile.id}`);
+            continue;
+        }
+        profilesPresent.push(profile.id);
+        if (!hasTomlString(body, 'model_provider', GLM_CODEX_CONFIG_PROVIDER_ID))
+            blockers.push(`glm_codex_app_config_invalid_profile_provider:${profile.id}`);
+        if (!hasTomlString(body, 'model', GLM_52_OPENROUTER_MODEL))
+            blockers.push(`glm_codex_app_config_invalid_profile_model:${profile.id}`);
+        if (!hasTomlString(body, 'model_reasoning_effort', profile.reasoning_effort))
+            blockers.push(`glm_codex_app_config_invalid_profile_reasoning:${profile.id}`);
+    }
+    return {
+        schema: 'sks.codex-app-glm-config-status.v1',
+        ok: blockers.length === 0,
+        config_path: configPath,
+        provider_present: providerPresent,
+        profiles_present: profilesPresent,
+        profiles_missing: profilesMissing,
+        blockers
+    };
+}
+function tomlTableBody(text, table) {
+    const header = `[${table}]`;
+    const lines = String(text || '').split('\n');
+    const start = lines.findIndex((line) => line.trim() === header);
+    if (start === -1)
+        return '';
+    const body = [];
+    for (let index = start + 1; index < lines.length; index += 1) {
+        const line = lines[index];
+        if (/^\s*\[[^\]]+\]\s*$/.test(line || ''))
+            break;
+        body.push(line || '');
+    }
+    return body.join('\n');
+}
+function hasTomlString(text, key, value) {
+    const pattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"${escapeRegExp(value)}"\\s*(?:#.*)?$`, 'm');
+    return pattern.test(text);
+}
+function escapeRegExp(value) {
+    return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 //# sourceMappingURL=glm-profile-installer.js.map

package/dist/core/codex-app/glm-profile-schema.js

@@ -1,4 +1,4 @@
-import { GLM_CODEX_APP_PROFILE_ID, buildGlmCodexAppModelProfile } from './glm-model-profile.js';
+import { GLM_CODEX_APP_PROFILE_ID, GLM_CODEX_CONFIG_PROFILE_ID, GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES, GLM_CODEX_SELECTABLE_REASONING_EFFORTS, buildGlmCodexAppModelProfile } from './glm-model-profile.js';
 import { GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE } from '../providers/glm/glm-52-settings.js';
 export function validateGlmCodexAppModelProfile(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
@@ -11,12 +11,16 @@ export function validateGlmCodexAppModelProfile(value) {
         profile.id === GLM_CODEX_APP_PROFILE_ID ? null : 'glm_codex_app_profile_invalid_id',
         profile.provider === 'openrouter' ? null : 'glm_codex_app_profile_invalid_provider',
         profile.model === GLM_52_OPENROUTER_MODEL ? null : 'glm_codex_app_profile_invalid_model',
+        profile.codexConfigProvider === GLM_CODEX_CONFIG_PROVIDER_ID ? null : 'glm_codex_app_profile_invalid_codex_config_provider',
+        profile.codexConfigProfile === GLM_CODEX_CONFIG_PROFILE_ID ? null : 'glm_codex_app_profile_invalid_codex_config_profile',
+        hasExpectedReasoningEfforts(profile.supportedReasoningEfforts) ? null : 'glm_codex_app_profile_invalid_reasoning_efforts',
+        hasExpectedReasoningProfiles(profile.reasoningProfiles) ? null : 'glm_codex_app_profile_invalid_reasoning_profiles',
         profile.mode === GLM_MAD_MODE ? null : 'glm_codex_app_profile_invalid_mode',
         profile.strictModelLock === true ? null : 'glm_codex_app_profile_not_strict',
         profile.gptFallbackAllowed === false ? null : 'glm_codex_app_profile_allows_gpt_fallback',
         profile.defaultProfile === 'speed' ? null : 'glm_codex_app_profile_default_not_speed',
         profile.defaultSettings?.tool_choice === 'none' ? null : 'glm_codex_app_profile_default_tools_not_omitted',
-        profile.defaultSettings?.provider_require_parameters === true ? null : 'glm_codex_app_profile_default_does_not_require_parameters',
+        profile.defaultSettings?.provider_require_parameters === false ? null : 'glm_codex_app_profile_default_requires_parameters',
         profile.defaultSettings?.provider_allow_fallbacks === false ? null : 'glm_codex_app_profile_allows_provider_fallback'
     ].filter((item) => Boolean(item));
     return {
@@ -25,4 +29,19 @@ export function validateGlmCodexAppModelProfile(value) {
         profile: blockers.length === 0 ? profile : null
     };
 }
+function hasExpectedReasoningEfforts(value) {
+    if (!Array.isArray(value)) {
+        return false;
+    }
+    return GLM_CODEX_SELECTABLE_REASONING_EFFORTS.every((effort) => value.includes(effort));
+}
+function hasExpectedReasoningProfiles(value) {
+    if (!Array.isArray(value)) {
+        return false;
+    }
+    return GLM_CODEX_CONFIG_REASONING_PROFILES.every((expected) => value.some((item) => item &&
+        typeof item === 'object' &&
+        item.id === expected.id &&
+        item.reasoning_effort === expected.reasoning_effort));
+}
 //# sourceMappingURL=glm-profile-schema.js.map

package/dist/core/codex-app.js

@@ -798,6 +798,8 @@ async function codexFastModeConfigStatus(opts = {}) {
         if (!config.text)
             continue;
         const topLevel = topLevelToml(config.text);
+        if (/(^|\n)\s*model\s*=/.test(topLevel))
+            blockers.push(`${config.scope}:top_level_model`);
         if (/(^|\n)\s*model_reasoning_effort\s*=/.test(topLevel))
             blockers.push(`${config.scope}:top_level_model_reasoning_effort`);
         if (/(^|\n)\s*fast_default_opt_out\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(tomlTable(config.text, 'notice')))

package/dist/core/codex-control/codex-sdk-config-policy.js

@@ -1,6 +1,7 @@
 export function buildCodexSdkConfig(input) {
+    const model = String(input.model || process.env.SKS_CODEX_MODEL || process.env.CODEX_MODEL || 'gpt-5.5');
     const config = {
-        model: String(process.env.SKS_CODEX_MODEL || process.env.CODEX_MODEL || 'gpt-5.5'),
+        model,
         service_tier: 'fast',
         model_reasoning_effort: String(input.modelReasoningEffort || input.reasoningEffort || process.env.SKS_CODEX_REASONING || process.env.CODEX_MODEL_REASONING_EFFORT || 'medium'),
         mcp_servers: {},

package/dist/core/codex-model-guard.js

@@ -1,4 +1,6 @@
 export const REQUIRED_CODEX_MODEL = 'gpt-5.5';
+export const GPT54_MINI_CODEX_MODEL = 'gpt-5.4-mini';
+export const SUPPORTED_CODEX_MODELS = [REQUIRED_CODEX_MODEL, GPT54_MINI_CODEX_MODEL];
 const MODEL_VALUE_FLAGS = new Set(['--model', '-m']);
 const CONFIG_VALUE_FLAGS = new Set(['-c', '--config']);
 function isModelConfigOverride(value = '') {
@@ -43,6 +45,6 @@ export function forceGpt55CodexConfigArgs(args = []) {
 }
 export function isForbiddenCodexModel(value = '') {
     const model = String(value || '').trim().toLowerCase();
-    return /^gpt-5\./.test(model) && model !== REQUIRED_CODEX_MODEL;
+    return /^gpt-5\./.test(model) && !SUPPORTED_CODEX_MODELS.includes(model);
 }
 //# sourceMappingURL=codex-model-guard.js.map

package/dist/core/commands/fast-mode-command.js

@@ -21,8 +21,11 @@ export async function fastModeCommand(args = []) {
         preference = null;
     }
     const policy = resolveFastModePolicy({ root });
-    const codexFastModeRepair = action === 'on'
-        ? await ensureGlobalCodexFastModeDuringInstall({ forceFastMode: true })
+    const codexFastModeRepair = action === 'on' || action === 'off'
+        ? await ensureGlobalCodexFastModeDuringInstall({
+            forceFastMode: action === 'on',
+            forceFastModeOff: action === 'off'
+        })
         : null;
     const result = {
         schema: FAST_MODE_COMMAND_SCHEMA,

package/dist/core/commands/glm-command.js

@@ -5,6 +5,7 @@ import { runGlmDirectSpeedRun } from '../providers/glm/glm-direct-run.js';
 import { runGlmReadinessAndExit } from '../providers/glm/glm-readiness.js';
 import { runGlmInteractiveLaunch } from '../providers/glm/glm-interactive-launch.js';
 import { glmNarutoCommand } from '../providers/glm/naruto/glm-naruto-command.js';
+import { stripGlmSlashModelArgs } from '../providers/glm/glm-profile-resolver.js';
 export async function glmCommand(args = []) {
     if (flag(args, '--naruto') || positionalArgs(args)[0] === 'naruto') {
         const narutoArgs = args.filter((a) => a !== '--naruto' && a !== 'naruto');
@@ -56,7 +57,7 @@ export async function glmCommand(args = []) {
     return result;
 }
 function extractGlmTask(args) {
-    const positional = positionalArgs(args).map(String);
+    const positional = positionalArgs(stripGlmSlashModelArgs(args)).map(String);
     if (positional[0] === 'run')
         return positional.slice(1).join(' ').trim() || null;
     if (positional[0] === 'session')

package/dist/core/commands/mad-sks-command.js

@@ -332,6 +332,30 @@ function isMadGlmLaunch(args = [], deps = {}) {
 async function prepareMadGlmLaunchRuntime(madLaunch, deps = {}) {
     const keyResolution = await resolveMadGlmLaunchKey(process.env);
     const profile = buildMadGlmLaunchProfileNoWrite(deps?.glmArgs || []);
+    if (profile.blockers.length) {
+        const blocked = {
+            schema: 'sks.glm-mad-launch.v1',
+            ok: false,
+            status: 'blocked',
+            mission_id: madLaunch.mission_id,
+            provider: profile.provider,
+            model: profile.model,
+            glm_profile: profile.glm_profile,
+            glm_mode: profile.glm_mode,
+            model_reasoning_effort: profile.model_reasoning_effort,
+            gpt_fallback_allowed: false,
+            blockers: profile.blockers,
+            warnings: []
+        };
+        await writeJsonAtomic(path.join(madLaunch.dir, 'mad-glm-launch.json'), blocked);
+        await appendJsonlBounded(path.join(madLaunch.dir, 'events.jsonl'), {
+            ts: nowIso(),
+            type: 'mad_sks.glm_launch_blocked',
+            blockers: profile.blockers
+        });
+        console.error(`SKS GLM MAD launch blocked: ${profile.blockers.join(', ')}`);
+        return blocked;
+    }
     if (!keyResolution.key) {
         const blocked = {
             schema: 'sks.glm-mad-launch.v1',

package/dist/core/doctor/doctor-codex-startup-repair.js

@@ -5,12 +5,12 @@ import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 import { ensureDir, exists, nowIso, readText, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 export const DOCTOR_CODEX_STARTUP_REPAIR_SCHEMA = 'sks.doctor-codex-startup-repair.v1';
 const AGENT_ROLE_FILES = new Map([
-    ['analysis_scout', { file: 'analysis-scout.toml', description: 'Read-only SKS scout.', sandbox: 'read-only', nicknames: ['Scout', 'Mapper'] }],
-    ['native_agent', { file: 'native-agent-intake.toml', description: 'Read-only SKS analysis agent.', sandbox: 'read-only', nicknames: ['Analysis', 'Mapper'] }],
-    ['team_consensus', { file: 'team-consensus.toml', description: 'SKS planning/debate agent.', sandbox: 'read-only', nicknames: ['Consensus', 'Atlas'] }],
+    ['analysis_scout', { file: 'analysis-scout.toml', description: 'SKS scout with bounded write capability.', sandbox: 'workspace-write', nicknames: ['Scout', 'Mapper'] }],
+    ['native_agent', { file: 'native-agent-intake.toml', description: 'SKS native agent with bounded write capability.', sandbox: 'workspace-write', nicknames: ['Analysis', 'Mapper'] }],
+    ['team_consensus', { file: 'team-consensus.toml', description: 'SKS planning/debate agent with bounded write capability.', sandbox: 'workspace-write', nicknames: ['Consensus', 'Atlas'] }],
     ['implementation_worker', { file: 'implementation-worker.toml', description: 'SKS bounded implementation worker.', sandbox: 'workspace-write', nicknames: ['Builder', 'Mason'] }],
-    ['db_safety_reviewer', { file: 'db-safety-reviewer.toml', description: 'Read-only DB safety reviewer.', sandbox: 'read-only', nicknames: ['Sentinel', 'Ledger'] }],
-    ['qa_reviewer', { file: 'qa-reviewer.toml', description: 'Read-only QA reviewer.', sandbox: 'read-only', nicknames: ['Verifier', 'Reviewer'] }]
+    ['db_safety_reviewer', { file: 'db-safety-reviewer.toml', description: 'DB safety reviewer with bounded write capability.', sandbox: 'workspace-write', nicknames: ['Sentinel', 'Ledger'] }],
+    ['qa_reviewer', { file: 'qa-reviewer.toml', description: 'QA reviewer with bounded write capability.', sandbox: 'workspace-write', nicknames: ['Verifier', 'Reviewer'] }]
 ]);
 const DIRECTIVE_ROLE_FILES = [
     'sks-explorer.toml',
@@ -42,7 +42,8 @@ export async function runDoctorCodexStartupRepair(input) {
         ...configs.flatMap((entry) => [
             ...entry.agent_config_files_repaired.map((file) => `${entry.scope} agent config_file now points at ${file}`),
             ...(entry.mcp_blocks_repaired || []).map((server) => `${entry.scope} MCP block repaired: ${server}`),
-            ...entry.stale_mcp_blocks_removed.map((server) => `${entry.scope} stale MCP block removed: ${server}`)
+            ...entry.stale_mcp_blocks_removed.map((server) => `${entry.scope} stale MCP block removed: ${server}`),
+            ...entry.duplicate_toml_blocks_removed.map((header) => `${entry.scope} duplicate TOML table removed: ${header}`)
         ])
     ];
     const manualActions = [
@@ -84,7 +85,8 @@ async function inspectOrRepairConfig(candidate, fix, nodeReplCommandCandidates,
             mcp_blocks_repaired: [],
             optional_mcp_blocks_ignored: [],
             blockers: [],
-            warnings: candidate.scope === 'global' ? ['codex_home_config_missing_optional'] : []
+            warnings: candidate.scope === 'global' ? ['codex_home_config_missing_optional'] : [],
+            duplicate_toml_blocks_removed: []
         };
     }
     let next = text;
@@ -92,13 +94,29 @@ async function inspectOrRepairConfig(candidate, fix, nodeReplCommandCandidates,
     const staleMcpBlocksRemoved = [];
     const mcpBlocksRepaired = [];
     const optionalMcpBlocksIgnored = [];
+    const duplicateTomlBlocksRemoved = [];
     const blockers = [];
     const warnings = [];
+    const duplicateRepair = inspectOrRepairDuplicateTomlBlocks(next, candidate, fix);
+    next = duplicateRepair.text;
+    duplicateTomlBlocksRemoved.push(...duplicateRepair.removed);
+    warnings.push(...duplicateRepair.warnings);
     for (const [tableName, role] of AGENT_ROLE_FILES) {
         const target = path.join(candidate.agentDir, role.file);
-        const table = tomlBlock(next, `agents.${tableName}`);
+        let table = tomlBlock(next, `agents.${tableName}`);
         if (!table)
             continue;
+        const currentDescription = stringValue(table.text, 'description');
+        if (currentDescription !== role.description) {
+            if (!fix)
+                warnings.push(`agent_description_stale:${tableName}`);
+            else {
+                next = replaceOrInsertKey(next, table, 'description', `"${escapeToml(role.description)}"`);
+                table = tomlBlock(next, `agents.${tableName}`);
+                if (!table)
+                    continue;
+            }
+        }
         const current = stringValue(table.text, 'config_file');
         const targetExists = await exists(target);
         const currentValid = Boolean(current && path.isAbsolute(current) && await exists(current));
@@ -146,9 +164,87 @@ async function inspectOrRepairConfig(candidate, fix, nodeReplCommandCandidates,
         mcp_blocks_repaired: mcpBlocksRepaired,
         optional_mcp_blocks_ignored: optionalMcpBlocksIgnored,
         blockers,
-        warnings
+        warnings,
+        duplicate_toml_blocks_removed: duplicateTomlBlocksRemoved
+    };
+}
+function inspectOrRepairDuplicateTomlBlocks(text, candidate, fix) {
+    const blocks = tomlBlocks(text);
+    const groups = new Map();
+    for (const block of blocks) {
+        const list = groups.get(block.header) || [];
+        list.push(block);
+        groups.set(block.header, list);
+    }
+    const warnings = [];
+    const removals = [];
+    for (const [header, rows] of groups) {
+        if (rows.length < 2)
+            continue;
+        warnings.push(`duplicate_toml_table:${header}`);
+        const keep = selectDuplicateTomlBlockToKeep(header, rows, candidate);
+        for (let index = 0; index < rows.length; index += 1) {
+            if (index !== keep)
+                removals.push(rows[index]);
+        }
+    }
+    if (!removals.length || !fix)
+        return { text, warnings, removed: [] };
+    return {
+        text: removeBlocks(text, removals),
+        warnings,
+        removed: removals.map((block) => block.header)
     };
 }
+function tomlBlocks(text) {
+    const source = String(text || '');
+    const matches = [...source.matchAll(/(^|\n)\s*\[([^\]]+)\]\s*(?:#.*)?(?:\n|$)/g)];
+    return matches.map((match, index) => {
+        const start = Number(match.index || 0) + (match[1] ? 1 : 0);
+        const next = matches[index + 1];
+        const end = next ? Number(next.index || 0) + (next[1] ? 1 : 0) : source.length;
+        return {
+            header: String(match[2] || '').trim(),
+            start,
+            end,
+            text: source.slice(start, end)
+        };
+    });
+}
+function selectDuplicateTomlBlockToKeep(header, rows, candidate) {
+    const agentName = header.startsWith('agents.') ? header.slice('agents.'.length) : '';
+    const role = agentName ? AGENT_ROLE_FILES.get(agentName) : undefined;
+    if (role) {
+        const target = path.join(candidate.agentDir, role.file);
+        return maxIndexBy(rows, (block, index) => {
+            const configFile = stringValue(block.text, 'config_file');
+            const description = stringValue(block.text, 'description');
+            return ((configFile === target ? 100 : 0) +
+                (configFile && path.isAbsolute(configFile) ? 20 : 0) +
+                (description === role.description ? 30 : 0) +
+                assignmentCount(block.text) -
+                index / 1000);
+        });
+    }
+    if (header.startsWith('mcp_servers.'))
+        return 0;
+    return maxIndexBy(rows, (block, index) => assignmentCount(block.text) - index / 1000);
+}
+function maxIndexBy(rows, score) {
+    let best = 0;
+    let bestScore = Number.NEGATIVE_INFINITY;
+    rows.forEach((row, index) => {
+        const value = score(row, index);
+        if (value > bestScore) {
+            best = index;
+            bestScore = value;
+        }
+    });
+    return best;
+}
+function assignmentCount(text) {
+    return String(text || '').split(/\r?\n/).filter((line) => /^\s*[A-Za-z0-9_.-]+\s*=/.test(line)).length;
+}
 async function inspectOrRepairNodeRepl(text, fix, extraCandidates, includeDefaultCandidates) {
     const server = 'node_repl';
     const table = tomlBlock(text, `mcp_servers.${server}`);
@@ -223,6 +319,12 @@ async function repairAgentRoleFiles(root, codexHome) {
                 await ensureDir(dir);
                 await writeTextAtomic(file, roleConfigToml(name, role.description, role.sandbox));
                 created.push(file);
+                continue;
+            }
+            if (!text.includes(`sandbox_mode = "${role.sandbox}"`) || text.includes('Do not edit files.')) {
+                await backupConfig(file, text, 'role-write-capable');
+                await writeTextAtomic(file, roleConfigToml(name, role.description, role.sandbox));
+                sanitized.push(file);
             }
         }
         for (const file of DIRECTIVE_ROLE_FILES) {