sneakoscope 4.6.5 → 4.7.1

package/dist/core/feature-registry.js

@@ -154,7 +154,7 @@ export function buildAllFeaturesSelftest(registry, opts = {}) {
         checkRow('native_agent_intake_contract_present', registry.features.some((feature) => feature.id === 'route-native-agent-intake'), ['route-native-agent-intake']),
         checkRow('cli_agent_fixture_pass', registry.features.some((feature) => feature.id === 'cli-agent' && feature.fixture?.status === 'pass' && feature.fixture.expected_artifacts?.some((artifact) => expectedArtifactPath(artifact).includes('agent-proof-evidence'))), ['cli-agent']),
         checkRow('agent_proof_evidence_contract_present', registry.features.some((feature) => feature.id === 'proof-agent-evidence'), ['proof-agent-evidence']),
-        checkRow('agent_lease_policy_present', registry.features.some((feature) => feature.id === 'route-native-agent-intake' && /read-only/i.test(JSON.stringify(feature.contract || {})) && /lease/i.test(JSON.stringify(feature.contract || {}))), ['route-native-agent-intake']),
+        checkRow('agent_lease_policy_present', registry.features.some((feature) => feature.id === 'route-native-agent-intake' && /bounded workspace-write/i.test(JSON.stringify(feature.contract || {})) && /lease/i.test(JSON.stringify(feature.contract || {}))), ['route-native-agent-intake']),
         checkRow('fixture_pass_threshold', (fixturesSummary.counts.pass || 0) >= 90, [`pass=${fixturesSummary.counts.pass || 0}`]),
         checkRow('fixture_not_required_ceiling', (fixturesSummary.counts.not_required || 0) <= 16, [`not_required=${fixturesSummary.counts.not_required || 0}`]),
         checkRow('fixture_mock_blocked_zero', (fixturesSummary.counts.blocked || 0) === 0, [`blocked=${fixturesSummary.counts.blocked || 0}`]),
@@ -628,7 +628,7 @@ function nativeAgentIntakeFeature() {
         aliases: ['sks team "task" [executor:5 reviewer:6 user:1]'],
         category: 'proof-route',
         maturity: 'stable',
-        intent: 'Default read-only native multi-session agent intake before serious route implementation.',
+        intent: 'Default bounded workspace-write native multi-session agent intake before serious route implementation.',
         voxel_triwiki_integration: 'native agent findings are TriWiki-ready and can require image voxel evidence for visual routes',
         completion_proof_integration: 'Completion Proof evidence.agents records agent_count, route, leases, no-overlap proof, cleanup, proof graph, and dynamic effort policy',
         known_gaps: ['real speedup claims require runtime timing/eval evidence; mock/static timing is not enough'],
@@ -636,7 +636,7 @@ function nativeAgentIntakeFeature() {
             input: 'serious route mission, route collaboration fixture, or explicit sks agent run',
             output: 'agents/agent-central-ledger.json, agents/agent-task-board.json, agents/agent-leases.json, agents/agent-no-overlap-proof.json, agents/agent-session-cleanup.json, agents/agent-proof-evidence.json, agents/agent-effort-policy.json',
             state: 'mission-local native agent artifacts',
-            safety: 'read-only analysis agents; central leases prevent overlapping write scopes; parent owns integration',
+            safety: 'bounded workspace-write analysis agents; central leases prevent overlapping write scopes; parent owns integration',
             proof: 'evidence.agents required for serious native route proof',
             voxel: 'visual agent records image voxel requirements without satisfying visual evidence by itself',
             tests: 'unit, integration, e2e route fixtures, native release gate scripts',

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.6.5';
+export const PACKAGE_VERSION = '4.7.0';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/harness-guard.js

@@ -125,8 +125,9 @@ export function classifyHarnessPayload(root, payload = {}, policy = {}) {
     const command = extractCommand(payload);
     const writeIntent = hasWriteIntent(toolName, command, hay);
     const maintenance = classifyMaintenanceCommand(command || hay);
-    const protectedMatches = findProtectedMatches(root, strings, policy);
-    const packageEdit = writeIntent && /\b(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock)\b/i.test(hay) && /\bsneakoscope\b/i.test(hay);
+    const writeTargets = extractWriteTargets(root, payload, strings, command);
+    const protectedMatches = findProtectedMatches(root, writeTargets.length ? writeTargets : strings, policy);
+    const packageEdit = writeIntent && packageManifestEditDetected(writeTargets, hay);
     const block = maintenance.block || packageEdit || (writeIntent && protectedMatches.length > 0);
     const reasons = [];
     if (maintenance.block)
@@ -135,7 +136,7 @@ export function classifyHarnessPayload(root, payload = {}, policy = {}) {
         reasons.push('package_manifest_sneakoscope_edit_blocked');
     if (writeIntent && protectedMatches.length)
         reasons.push('protected_harness_path_write_blocked');
-    return { block, reasons: [...new Set(reasons)], matches: protectedMatches, writeIntent, toolName, command };
+    return { block, reasons: [...new Set(reasons)], matches: protectedMatches, writeIntent, toolName, command, writeTargets };
 }
 export async function collectHarnessFingerprints(root) {
     const out = {};
@@ -196,6 +197,91 @@ function collectPayloadStrings(obj, out = [], depth = 0) {
     }
     return out;
 }
+function extractWriteTargets(root, payload = {}, strings = [], command = '') {
+    const targets = new Set();
+    for (const value of collectPathFieldStrings(payload))
+        addWriteTarget(root, targets, value);
+    for (const text of [command, ...strings]) {
+        const s = String(text || '');
+        for (const match of s.matchAll(/^\*\*\*\s+(?:Update|Add|Delete)\s+File:\s+(.+)$/gmi))
+            addWriteTarget(root, targets, match[1]);
+        for (const match of s.matchAll(/^\*\*\*\s+Move to:\s+(.+)$/gmi))
+            addWriteTarget(root, targets, match[1]);
+        for (const match of s.matchAll(/>{1,2}\s*(['"]?)([^\s;&|'"`]+)\1/g))
+            addWriteTarget(root, targets, match[2]);
+        collectShellCommandTargets(root, targets, s);
+    }
+    return [...targets].sort();
+}
+function collectPathFieldStrings(obj, out = [], depth = 0) {
+    if (depth > 8 || obj == null)
+        return out;
+    if (Array.isArray(obj)) {
+        for (const value of obj)
+            collectPathFieldStrings(value, out, depth + 1);
+        return out;
+    }
+    if (typeof obj !== 'object')
+        return out;
+    for (const [key, value] of Object.entries(obj)) {
+        const normalized = String(key || '').toLowerCase();
+        if (typeof value === 'string' && /^(?:path|file|filename|target|destination|dest|to|from|cwd|workdir|file_path|target_path|output_path|artifact_path)$/.test(normalized))
+            out.push(value);
+        collectPathFieldStrings(value, out, depth + 1);
+    }
+    return out;
+}
+function collectShellCommandTargets(root, targets, text) {
+    const words = shellWords(text);
+    for (let i = 0; i < words.length; i += 1) {
+        const word = words[i] || '';
+        if (!/^(?:rm|rmdir|mv|cp|touch|mkdir|chmod|chown)$/.test(word))
+            continue;
+        for (let j = i + 1; j < words.length; j += 1) {
+            const candidate = words[j] || '';
+            if (!candidate || candidate.startsWith('-'))
+                continue;
+            if (/^(?:&&|\|\||;|\|)$/.test(candidate))
+                break;
+            if (/^(?:rm|rmdir|mv|cp|touch|mkdir|chmod|chown|git|npm|node|python\d?)$/.test(candidate) && j > i + 1)
+                break;
+            addWriteTarget(root, targets, candidate);
+        }
+    }
+}
+function shellWords(text) {
+    return [...String(text || '').matchAll(/"([^"]*)"|'([^']*)'|([^\s]+)/g)].map((match) => match[1] || match[2] || match[3]).filter(Boolean);
+}
+function addWriteTarget(root, targets, value) {
+    const normalized = normalizeTargetPath(root, value);
+    if (normalized)
+        targets.add(normalized);
+}
+function normalizeTargetPath(root, value) {
+    let s = String(value || '').trim();
+    if (!s)
+        return '';
+    s = s.replace(/^['"`<]+|['"`>,]+$/g, '');
+    if (!s || /^\$[\w{]/.test(s) || /^[A-Z_][A-Z0-9_]*=/.test(s))
+        return '';
+    if (/^(?:--?|&&|\|\||;|\|)$/.test(s))
+        return '';
+    s = s.replace(/\\/g, '/');
+    if (s.startsWith('a/') || s.startsWith('b/'))
+        s = s.slice(2);
+    if (s.startsWith('./'))
+        s = s.slice(2);
+    const rootNorm = String(root || '').replace(/\\/g, '/').replace(/\/$/, '');
+    if (rootNorm && s.startsWith(`${rootNorm}/`))
+        s = s.slice(rootNorm.length + 1);
+    return s.replace(/\/$/, '');
+}
+function packageManifestEditDetected(writeTargets, hay) {
+    const hasPackageTarget = writeTargets.length > 0
+        ? writeTargets.some((target) => /(^|\/)(?:package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock)$/.test(target))
+        : /\b(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock)\b/i.test(hay);
+    return hasPackageTarget && /\bsneakoscope\b/i.test(hay);
+}
 function hasWriteIntent(toolName, command, hay) {
     if (/\b(apply_patch|edit|write|create|delete|remove|rename|str_replace|file_write|fs_write)\b/i.test(toolName))
         return true;

package/dist/core/init.js

@@ -69,8 +69,7 @@ export function hasTopLevelCodexModeLock(text = '') {
     const lines = String(text || '').split('\n');
     const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
     const top = (firstTable === -1 ? lines : lines.slice(0, firstTable)).join('\n');
-    const model = top.match(/^model\s*=\s*"([^"]+)"/m)?.[1];
-    return (Boolean(model) && model !== 'gpt-5.5') || /^model_reasoning_effort\s*=/m.test(top);
+    return /^model\s*=/.test(top) || /^model_reasoning_effort\s*=/m.test(top);
 }
 export function hasDeprecatedCodexHooksFeatureFlag(text = '') {
     const lines = String(text || '').split('\n');
@@ -590,10 +589,8 @@ export async function initProject(root, opts = {}) {
         let next = removeLegacyTopLevelCodexModeLocks(String(existingContent || '').trimEnd());
         next = removeTomlTableKey(next, 'notice', 'fast_default_opt_out');
         next = removeTomlTableKey(next, 'features', 'codex_hooks');
-        // User-overridable top-level keys: seed defaults only when ABSENT so an
-        // upgrade never clobbers a user's chosen model/service_tier. model_reasoning_effort
-        // is intentionally left untouched at the top level.
-        next = upsertTopLevelTomlStringIfAbsent(next, 'model', 'gpt-5.5');
+        // Model/reasoning defaults live in profiles. Leaving them out of top-level config
+        // keeps Codex Desktop's native model and speed selectors available.
         next = upsertTopLevelTomlBooleanIfAbsent(next, 'suppress_unstable_features_warning', true);
         // Codex App feature flags: SET-IF-ABSENT only (see note above).
         for (const flag of MANAGED_CODEX_FEATURE_FLAGS) {
@@ -704,7 +701,7 @@ export async function initProject(root, opts = {}) {
         return lines.filter((line, index) => {
             if (index >= end)
                 return true;
-            return !/^\s*model_reasoning_effort\s*=/.test(line);
+            return !/^\s*(?:model|model_reasoning_effort)\s*=/.test(line);
         }).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
     }
     function removeTopLevelTomlKeyIfValue(text = '', key = '', value = '') {
@@ -814,11 +811,11 @@ export async function initProject(root, opts = {}) {
             // with `url is not supported for stdio`. Remote is also the transport the doctor
             // migrates everyone to (local stdio can block interactive Codex launch).
             { table: 'mcp_servers.context7', text: context7ConfigToml('remote').trim(), preserveExisting: true },
-            { table: 'agents.native_agent', text: agentConfigBlock('native_agent', 'Read-only SKS analysis agent.', './agents/native-agent-intake.toml', ['Analysis', 'Mapper']) },
-            { table: 'agents.team_consensus', text: agentConfigBlock('team_consensus', 'SKS planning/debate agent.', './agents/team-consensus.toml', ['Consensus', 'Atlas']) },
+            { table: 'agents.native_agent', text: agentConfigBlock('native_agent', 'SKS native agent with bounded write capability.', './agents/native-agent-intake.toml', ['Analysis', 'Mapper']) },
+            { table: 'agents.team_consensus', text: agentConfigBlock('team_consensus', 'SKS planning/debate agent with bounded write capability.', './agents/team-consensus.toml', ['Consensus', 'Atlas']) },
             { table: 'agents.implementation_worker', text: agentConfigBlock('implementation_worker', 'SKS bounded implementation worker.', './agents/implementation-worker.toml', ['Builder', 'Mason']) },
-            { table: 'agents.db_safety_reviewer', text: agentConfigBlock('db_safety_reviewer', 'Read-only DB safety reviewer.', './agents/db-safety-reviewer.toml', ['Sentinel', 'Ledger']) },
-            { table: 'agents.qa_reviewer', text: agentConfigBlock('qa_reviewer', 'Read-only QA reviewer.', './agents/qa-reviewer.toml', ['Verifier', 'Reviewer']) },
+            { table: 'agents.db_safety_reviewer', text: agentConfigBlock('db_safety_reviewer', 'DB safety reviewer with bounded write capability.', './agents/db-safety-reviewer.toml', ['Sentinel', 'Ledger']) },
+            { table: 'agents.qa_reviewer', text: agentConfigBlock('qa_reviewer', 'QA reviewer with bounded write capability.', './agents/qa-reviewer.toml', ['Verifier', 'Reviewer']) },
             // NOTE: SKS config profiles are NO LONGER emitted as `[profiles.sks-*]` tables.
             // Codex 0.134+ deprecated config-profile tables / the `profile=` selector (warns at
             // startup) in favor of per-file `$CODEX_HOME/<name>.config.toml` overlays loaded by
@@ -1304,12 +1301,12 @@ async function removeDirIfEmpty(dir) {
 }
 async function installCodexAgents(root) {
     const agents = {
-        'analysis-scout.toml': `name = "analysis_scout"\ndescription = "Read-only SKS analysis scout retained for stale Codex agent-role config repair."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "medium"\nsandbox_mode = "read-only"\ndeveloper_instructions = """\nYou are an SKS read-only analysis scout.\nDo not edit files.\nInspect only the assigned source paths and return concise source-backed findings.\n"""\n`,
-        'native-agent-intake.toml': `name = "native_agent"\ndescription = "Read-only Team native agent. Maps one independent repo/docs/tests/API/risk/user-friction slice and returns TriWiki-ready source-backed findings before debate starts."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "medium"\nsandbox_mode = "read-only"\ndeveloper_instructions = """\nYou are an SKS Team native agent.\nDo not edit files.\nOwn exactly one investigation slice assigned by the parent orchestrator.\nUse the mission roster or worker inbox reasoning_effort when the host exposes it; simple bounded work can use low, tool-heavy runtime work medium, and knowledge/research/safety/release work high or xhigh. Default to medium only when no assignment is visible.\nMap relevant source files, docs, tests, APIs, DB or safety risks, UX friction, and likely implementation boundaries.\nReturn concise source-backed claims suitable for team-analysis.md and TriWiki ingestion: claim, source path, evidence hash or quoted anchor, risk, confidence, and recommended implementation slice.\nDo not debate the final plan and do not implement code.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`,
-        'team-consensus.toml': `name = "team_consensus"\ndescription = "Planning and debate specialist for SKS Team mode. Maps options, constraints, role-persona risks, and proposes the agreed objective before implementation starts."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "high"\nsandbox_mode = "read-only"\ndeveloper_instructions = """\nYou are the SKS Team consensus specialist.\nDo not edit files.\nUse the mission roster reasoning_effort when the host exposes it; planning has a medium minimum, with high or xhigh for knowledge, safety, release, research, or recovery work.\nMap the affected code paths, viable approaches, constraints, risks, and acceptance criteria.\nRun the debate as role-persona synthesis: final users are low-context, self-interested, stubborn, and inconvenience-averse; executors are capable developers; reviewers are strict.\nArgue for the smallest coherent objective that can be handed to a fresh executor_N development team.\nPlan for at least ${MIN_TEAM_REVIEWER_LANES} independent reviewer/QA validation lanes before integration or final.\nReturn: recommended objective, rejected alternatives, implementation slices, required reviewers, user-friction risks, and unresolved risks.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`,
+        'analysis-scout.toml': `name = "analysis_scout"\ndescription = "SKS analysis scout with bounded write capability retained for stale Codex agent-role config repair."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "low"\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are an SKS analysis scout.\nOnly edit bounded files assigned by the parent orchestrator; otherwise inspect only and return concise source-backed findings.\n"""\n`,
+        'native-agent-intake.toml': `name = "native_agent"\ndescription = "Team native agent with bounded write capability. Maps one independent repo/docs/tests/API/risk/user-friction slice and can produce patch-envelope work when assigned."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "low"\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are an SKS Team native agent.\nOnly edit bounded files assigned by the parent orchestrator.\nOwn exactly one investigation or implementation slice assigned by the parent orchestrator.\nUse the mission roster or worker inbox model and model_reasoning_effort when the host exposes it: simple bounded work may use gpt-5.4-mini, ordinary tool work uses gpt-5.5 low, and knowledge/research/safety/release work uses gpt-5.5 high.\nMap relevant source files, docs, tests, APIs, DB or safety risks, UX friction, and likely implementation boundaries.\nReturn concise source-backed claims suitable for team-analysis.md and TriWiki ingestion: claim, source path, evidence hash or quoted anchor, risk, confidence, and recommended implementation slice.\nDo not debate the final plan. Implement only when the assigned slice includes write paths.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`,
+        'team-consensus.toml': `name = "team_consensus"\ndescription = "Planning and debate specialist for SKS Team mode with bounded write capability. Maps options, constraints, role-persona risks, and proposes the agreed objective before implementation starts."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "high"\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are the SKS Team consensus specialist.\nOnly edit bounded files assigned by the parent orchestrator.\nUse the mission roster model and model_reasoning_effort when the host exposes them; planning normally uses gpt-5.5 low or high depending on risk.\nMap the affected code paths, viable approaches, constraints, risks, and acceptance criteria.\nRun the debate as role-persona synthesis: final users are low-context, self-interested, stubborn, and inconvenience-averse; executors are capable developers; reviewers are strict.\nArgue for the smallest coherent objective that can be handed to a fresh executor_N development team.\nPlan for at least ${MIN_TEAM_REVIEWER_LANES} independent reviewer/QA validation lanes before integration or final.\nReturn: recommended objective, rejected alternatives, implementation slices, required reviewers, user-friction risks, and unresolved risks.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`,
         'implementation-worker.toml': `name = "implementation_worker"\ndescription = "Implementation specialist for SKS Team mode. Owns one bounded write set and coordinates with other executor_N workers."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "medium"\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are an SKS Team executor/developer in the fresh development bundle.\nYou are not alone in the codebase. Other executor_N workers may be editing disjoint files.\nUse the mission roster or worker inbox reasoning_effort when the host exposes it; simple bounded changes can use low, tool-heavy implementation medium, and safety/release/DB work high.\nOnly edit the files or module slice assigned to you.\nDo not revert or overwrite edits made by others.\nRead local patterns first, make the smallest correct change, avoid adding user friction, run focused verification for your slice, and report changed paths plus evidence.\nDo not create fallback implementation code, substitute behavior, mock behavior, or compatibility shims unless the user or sealed decision contract explicitly requested them.\nRespect all SKS hooks, DB safety rules, no-question run rules, and H-Proof completion gates.\nAlso return concise LIVE_EVENT lines for started, blocked, changed files, verification, and final result so the parent can record them.\n"""\n`,
-        'db-safety-reviewer.toml': `name = "db_safety_reviewer"\ndescription = "Read-only database safety reviewer for SQL, migrations, Supabase, RLS, destructive-operation risk, and rollback safety."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "high"\nsandbox_mode = "read-only"\ndeveloper_instructions = """\nYou are a database safety reviewer.\nNever modify files or execute destructive commands.\nReview migrations, SQL, Supabase RLS, transaction boundaries, rollback safety, and MCP database tool usage.\nBlock DROP, TRUNCATE, mass DELETE/UPDATE, db reset, db push, project deletion, branch reset/merge/delete, RLS disabling, and live execute_sql writes.\nReturn concrete risks, exact file references, and required fixes.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`,
-        'qa-reviewer.toml': `name = "qa_reviewer"\ndescription = "Strict read-only verification reviewer for correctness, regressions, missing tests, user friction, and final evidence."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "high"\nsandbox_mode = "read-only"\ndeveloper_instructions = """\nYou are an SKS Team strict reviewer.\nDo not edit files.\nReview correctness, edge cases, regression risk, missing tests, unsupported claims, and whether the final evidence proves the claimed outcome.\nTeam review must cover at least ${MIN_TEAM_REVIEWER_LANES} independent reviewer/QA validation lanes before integration or final; flag missing review lane evidence.\nAlso evaluate practical friction from the viewpoint of a stubborn, low-context final user who dislikes inconvenience.\nPrioritize concrete findings with file references and focused verification suggestions.\nFlag any unrequested fallback implementation code, substitute behavior, mock behavior, or compatibility shim as a blocking finding unless the user or sealed decision contract explicitly requested it.\nReturn no findings if the implementation is sound, and clearly list residual test gaps.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`
+        'db-safety-reviewer.toml': `name = "db_safety_reviewer"\ndescription = "Database safety reviewer with bounded write capability for SQL, migrations, Supabase, RLS, destructive-operation risk, and rollback safety."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "high"\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are a database safety reviewer.\nOnly edit bounded files assigned by the parent orchestrator. Never execute destructive commands.\nReview migrations, SQL, Supabase RLS, transaction boundaries, rollback safety, and MCP database tool usage.\nBlock DROP, TRUNCATE, mass DELETE/UPDATE, db reset, db push, project deletion, branch reset/merge/delete, RLS disabling, and live execute_sql writes.\nReturn concrete risks, exact file references, and required fixes.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`,
+        'qa-reviewer.toml': `name = "qa_reviewer"\ndescription = "Strict verification reviewer with bounded write capability for correctness, regressions, missing tests, user friction, and final evidence."\nmodel = "gpt-5.5"\nmodel_reasoning_effort = "high"\nsandbox_mode = "workspace-write"\ndeveloper_instructions = """\nYou are an SKS Team strict reviewer.\nOnly edit bounded files assigned by the parent orchestrator.\nReview correctness, edge cases, regression risk, missing tests, unsupported claims, and whether the final evidence proves the claimed outcome.\nTeam review must cover at least ${MIN_TEAM_REVIEWER_LANES} independent reviewer/QA validation lanes before integration or final; flag missing review lane evidence.\nAlso evaluate practical friction from the viewpoint of a stubborn, low-context final user who dislikes inconvenience.\nPrioritize concrete findings with file references and focused verification suggestions.\nFlag any unrequested fallback implementation code, substitute behavior, mock behavior, or compatibility shim as a blocking finding unless the user or sealed decision contract explicitly requested it.\nReturn no findings if the implementation is sound, and clearly list residual test gaps.\nAlso return a concise LIVE_EVENT line that the parent can record with sks team event.\n"""\n`
     };
     const dir = path.join(root, '.codex', 'agents');
     await ensureDir(dir);

package/dist/core/managed-assets/managed-assets-manifest.js

@@ -1,16 +1,17 @@
 import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 export const MANAGED_ASSET_SCHEMA_VERSION = 1;
-export const MANAGED_ASSET_VERSION = '4.2.0';
+export const MANAGED_ASSET_VERSION = '4.7.0';
 export const MANAGED_ASSET_MARKER = 'SKS-MANAGED-ASSET';
 export const MANAGED_AGENT_ROLES = Object.freeze([
-    role('sks-explorer', 'analysis-scout.toml', 'analysis_scout', 'Read-only SKS analysis scout retained for stale Codex agent-role config repair.', 'read-only', ['analysis-scout', 'analysis_scout', 'native_agent']),
-    role('sks-planner', 'team-consensus.toml', 'team_consensus', 'Planning and debate specialist for SKS Team mode.', 'read-only', ['team-consensus', 'team_consensus']),
+    role('sks-explorer', 'analysis-scout.toml', 'analysis_scout', 'SKS analysis scout for bounded read/write slices retained for stale Codex agent-role config repair.', 'workspace-write', ['analysis-scout', 'analysis_scout']),
+    role('sks-native-agent', 'native-agent-intake.toml', 'native_agent', 'SKS native agent for bounded read/write intake slices.', 'workspace-write', ['native-agent-intake', 'native_agent']),
+    role('sks-planner', 'team-consensus.toml', 'team_consensus', 'Planning and debate specialist for bounded SKS Team mode write sets.', 'workspace-write', ['team-consensus', 'team_consensus']),
     role('sks-implementer', 'implementation-worker.toml', 'implementation_worker', 'Implementation specialist for bounded SKS Team write sets.', 'workspace-write', ['implementation-worker', 'implementation_worker']),
-    role('sks-checker', 'qa-reviewer.toml', 'qa_reviewer', 'Strict read-only verification reviewer for correctness, regressions, and final evidence.', 'read-only', ['qa-reviewer', 'qa_reviewer']),
-    role('sks-release-verifier', 'sks-release-verifier.toml', 'sks_release_verifier', 'Read-only release verifier for repository, docs, tests, API, and risk slices.', 'read-only', ['native-agent-intake', 'native_agent', 'release-verifier']),
-    role('sks-zellij-ui-verifier', 'sks-zellij-ui-verifier.toml', 'sks_zellij_ui_verifier', 'Read-only Zellij UI verifier for session, pane, layout, and terminal evidence.', 'read-only', ['native-agent-intake', 'native_agent', 'zellij-ui-verifier']),
-    role('sks-codex-probe-verifier', 'sks-codex-probe-verifier.toml', 'sks_codex_probe_verifier', 'Read-only Codex probe verifier for CLI, App, SDK, MCP, and native capability evidence.', 'read-only', ['native-agent-intake', 'native_agent', 'codex-probe-verifier']),
-    role('db-safety-reviewer', 'db-safety-reviewer.toml', 'db_safety_reviewer', 'Read-only database safety reviewer for SQL, migrations, Supabase, and rollback safety.', 'read-only', ['db-safety-reviewer', 'db_safety_reviewer'])
+    role('sks-checker', 'qa-reviewer.toml', 'qa_reviewer', 'Strict verification reviewer for correctness, regressions, and final evidence with bounded write capability.', 'workspace-write', ['qa-reviewer', 'qa_reviewer']),
+    role('sks-release-verifier', 'sks-release-verifier.toml', 'sks_release_verifier', 'Release verifier for repository, docs, tests, API, and risk slices with bounded write capability.', 'workspace-write', ['release-verifier']),
+    role('sks-zellij-ui-verifier', 'sks-zellij-ui-verifier.toml', 'sks_zellij_ui_verifier', 'Zellij UI verifier for session, pane, layout, and terminal evidence with bounded write capability.', 'workspace-write', ['zellij-ui-verifier']),
+    role('sks-codex-probe-verifier', 'sks-codex-probe-verifier.toml', 'sks_codex_probe_verifier', 'Codex probe verifier for CLI, App, SDK, MCP, and native capability evidence with bounded write capability.', 'workspace-write', ['codex-probe-verifier']),
+    role('db-safety-reviewer', 'db-safety-reviewer.toml', 'db_safety_reviewer', 'Database safety reviewer for SQL, migrations, Supabase, and rollback safety with bounded write capability.', 'workspace-write', ['db-safety-reviewer', 'db_safety_reviewer'])
 ]);
 export const MANAGED_SKILLS = Object.freeze([
     'loop',

package/dist/core/pipeline-internals/runtime-core.js

@@ -213,7 +213,7 @@ export function validatePipelinePlan(plan = {}) {
         issues.push('ssot_guard_stage');
     if (!plan.next_actions?.length)
         issues.push('next_actions');
-    if (plan.agent_intake?.required && !plan.stages?.some((stage) => stage.id === AGENT_INTAKE_STAGE_ID && stage.agent_count === AGENT_COUNT && stage.read_only === true))
+    if (plan.agent_intake?.required && !plan.stages?.some((stage) => stage.id === AGENT_INTAKE_STAGE_ID && stage.agent_count === AGENT_COUNT && stage.read_only === false && /bounded workspace-write/i.test(String(stage.write_policy || '')) && /lease/i.test(String(stage.write_policy || ''))))
         issues.push('agent_intake_stage');
     return { ok: issues.length === 0, issues };
 }
@@ -970,7 +970,7 @@ async function materializeAutoSealedTeam(root, id, dir, route, task, contractHas
         team_runtime: teamRuntimePlanMetadata(),
         phases: [
             { id: 'team_roster_confirmation', goal: `Materialize the Team roster from default SKS counts or explicit user counts, write team-roster.json, and surface role counts ${formatRoleCounts(roleCounts)}.`, agents: ['parent_orchestrator'], output: 'team-roster.json' },
-            { id: 'native_agent_intake', goal: `Read TriWiki context, then run exactly ${roster.bundle_size} read-only native_agent_N sessions in parallel. ${fromChatImgRequired ? `From-Chat-IMG active: ${CODEX_COMPUTER_USE_ONLY_POLICY}` : 'From-Chat-IMG inactive: do not assume ordinary images are chat captures.'}`, agents: roster.analysis_team.map((agent) => agent.id), max_parallel_native_sessions: agentSessions, write_policy: 'read-only' },
+            { id: 'native_agent_intake', goal: `Read TriWiki context, then run exactly ${roster.bundle_size} bounded workspace-write native_agent_N sessions in parallel. ${fromChatImgRequired ? `From-Chat-IMG active: ${CODEX_COMPUTER_USE_ONLY_POLICY}` : 'From-Chat-IMG inactive: do not assume ordinary images are chat captures.'} Native agents may edit only parent-assigned lease paths and parent integration owns final changes.`, agents: roster.analysis_team.map((agent) => agent.id), max_parallel_native_sessions: agentSessions, write_policy: 'bounded workspace-write leases; parent-owned integration' },
             { id: 'triwiki_refresh', goal: `Refresh or pack TriWiki and run ${triwikiContextTracking().validate_command}.`, agents: ['parent_orchestrator'], output: '.sneakoscope/wiki/context-pack.json' },
             { id: 'ssot_guard', goal: ssotGuardPolicyText(), agents: ['parent_orchestrator'], output: SSOT_GUARD_ARTIFACT },
             { id: 'planning_debate', goal: 'Run read-only planning debate, map constraints and implementation slices, then seal one objective.', agents: roster.debate_team.map((agent) => agent.id) },
@@ -1063,7 +1063,7 @@ async function prepareTeam(root, route, task, required, opts = {}) {
         team_runtime: teamRuntimePlanMetadata(),
         phases: [
             { id: 'team_roster_confirmation', goal: `Before any implementation, materialize the Team roster from default SKS counts or explicit user counts, write team-roster.json, and surface role counts ${formatRoleCounts(roleCounts)}. Implementation cannot be considered complete unless team-gate.json has team_roster_confirmed=true.`, agents: ['parent_orchestrator'], output: 'team-roster.json' },
-            { id: 'native_agent_intake', goal: `Before native agent intake, read TriWiki context. ${fromChatImgRequired ? `From-Chat-IMG active: for web/browser/webapp targets require Codex Chrome Extension readiness first; for native Mac/non-web surfaces use Codex Computer Use visual inspection when available. List every visible customer request, match every screenshot image region to attachments, write ${FROM_CHAT_IMG_COVERAGE_ARTIFACT}, ${FROM_CHAT_IMG_CHECKLIST_ARTIFACT}, and ${FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT}, then require scoped QA-LOOP evidence in ${FROM_CHAT_IMG_QA_LOOP_ARTIFACT} after the customer-request work is done. ${CODEX_WEB_VERIFICATION_POLICY} ${CODEX_COMPUTER_USE_ONLY_POLICY}` : `From-Chat-IMG inactive: do not assume ordinary images are chat captures. ${CODEX_WEB_VERIFICATION_POLICY} ${CODEX_COMPUTER_USE_ONLY_POLICY}`} Run exactly ${roster.bundle_size} read-only native_agent_N sessions in parallel, using the full available session budget without exceeding ${agentSessions}. Split repo/docs/tests/API/user-flow/risk investigation into independent slices, hydrate relevant low-trust claims from source, and record source-backed findings.`, agents: roster.analysis_team.map((agent) => agent.id), max_parallel_native_sessions: agentSessions, write_policy: 'read-only' },
+            { id: 'native_agent_intake', goal: `Before native agent intake, read TriWiki context. ${fromChatImgRequired ? `From-Chat-IMG active: for web/browser/webapp targets require Codex Chrome Extension readiness first; for native Mac/non-web surfaces use Codex Computer Use visual inspection when available. List every visible customer request, match every screenshot image region to attachments, write ${FROM_CHAT_IMG_COVERAGE_ARTIFACT}, ${FROM_CHAT_IMG_CHECKLIST_ARTIFACT}, and ${FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT}, then require scoped QA-LOOP evidence in ${FROM_CHAT_IMG_QA_LOOP_ARTIFACT} after the customer-request work is done. ${CODEX_WEB_VERIFICATION_POLICY} ${CODEX_COMPUTER_USE_ONLY_POLICY}` : `From-Chat-IMG inactive: do not assume ordinary images are chat captures. ${CODEX_WEB_VERIFICATION_POLICY} ${CODEX_COMPUTER_USE_ONLY_POLICY}`} Run exactly ${roster.bundle_size} bounded workspace-write native_agent_N sessions in parallel, using the full available session budget without exceeding ${agentSessions}. Split repo/docs/tests/API/user-flow/risk investigation into independent slices, hydrate relevant low-trust claims from source, record source-backed findings, and edit only parent-assigned lease paths.`, agents: roster.analysis_team.map((agent) => agent.id), max_parallel_native_sessions: agentSessions, write_policy: 'bounded workspace-write leases; parent-owned integration' },
             { id: 'triwiki_refresh', goal: `Parent orchestrator updates Team analysis artifacts, then runs ${triwikiContextTracking().refresh_command} or ${triwikiContextTracking().pack_command}, prunes with ${triwikiContextTracking().prune_command} when stale/oversized wiki state would pollute handoffs, and runs ${triwikiContextTracking().validate_command} so the next stage uses current TriWiki context.`, agents: ['parent_orchestrator'], output: '.sneakoscope/wiki/context-pack.json' },
             { id: 'ssot_guard', goal: ssotGuardPolicyText(), agents: ['parent_orchestrator'], output: SSOT_GUARD_ARTIFACT },
             { id: 'planning_debate', goal: `Before debate, read the refreshed TriWiki pack. Debate team of exactly ${roster.bundle_size} participants maps user inconvenience, options, constraints, affected files, DB/test risk, and tradeoffs while applying compact Hyperplan-derived lenses: challenge framing, subtract surface, demand evidence, test integration risk, and consider one simpler alternative. Hydrate low-trust claims from source.`, agents: roster.debate_team.map((agent) => agent.id) },

package/dist/core/providers/glm/glm-52-profile.js

@@ -2,6 +2,48 @@ import { GLM_52_OPENROUTER_MODEL, GLM_MAD_MODE } from './glm-52-settings.js';
 import { profileFromConst } from './glm-profile-resolver.js';
 export const GLM_CODEX_APP_PROFILE_ID = 'sks/glm-5.2-mad';
 export const GLM_CODEX_APP_PROFILE_LABEL = 'GLM 5.2 (MAD Speed / OpenRouter)';
+export const GLM_CODEX_CONFIG_PROVIDER_ID = 'openrouter';
+export const GLM_CODEX_CONFIG_PROFILE_ID = 'sks-glm-52-mad';
+export const GLM_CODEX_SELECTABLE_REASONING_EFFORTS = [
+    'none',
+    'minimal',
+    'low',
+    'medium',
+    'high',
+    'xhigh',
+];
+export const GLM_CODEX_CONFIG_REASONING_PROFILES = [
+    {
+        id: GLM_CODEX_CONFIG_PROFILE_ID,
+        label: 'GLM 5.2 MAD Speed',
+        reasoning_effort: 'none',
+    },
+    {
+        id: 'sks-glm-52-minimal',
+        label: 'GLM 5.2 Minimal',
+        reasoning_effort: 'minimal',
+    },
+    {
+        id: 'sks-glm-52-low',
+        label: 'GLM 5.2 Low',
+        reasoning_effort: 'low',
+    },
+    {
+        id: 'sks-glm-52-medium',
+        label: 'GLM 5.2 Medium',
+        reasoning_effort: 'medium',
+    },
+    {
+        id: 'sks-glm-52-high',
+        label: 'GLM 5.2 High',
+        reasoning_effort: 'high',
+    },
+    {
+        id: 'sks-glm-52-xhigh',
+        label: 'GLM 5.2 XHigh',
+        reasoning_effort: 'xhigh',
+    },
+];
 export function buildGlmCodexAppModelProfile() {
     const speed = profileFromConst('speed');
     return {
@@ -10,6 +52,10 @@ export function buildGlmCodexAppModelProfile() {
         label: GLM_CODEX_APP_PROFILE_LABEL,
         provider: 'openrouter',
         model: GLM_52_OPENROUTER_MODEL,
+        codexConfigProvider: GLM_CODEX_CONFIG_PROVIDER_ID,
+        codexConfigProfile: GLM_CODEX_CONFIG_PROFILE_ID,
+        supportedReasoningEfforts: GLM_CODEX_SELECTABLE_REASONING_EFFORTS,
+        reasoningProfiles: GLM_CODEX_CONFIG_REASONING_PROFILES,
         mode: GLM_MAD_MODE,
         strictModelLock: true,
         gptFallbackAllowed: false,

package/dist/core/providers/glm/glm-52-request.js

@@ -1,14 +1,15 @@
 import { GLM_52_DEFAULT_REQUEST_SETTINGS, GLM_52_OPENROUTER_MODEL, clampGlm52MaxTokens } from './glm-52-settings.js';
 import { buildDeepReasoningConfig, buildFastReasoningConfig } from './glm-reasoning-policy.js';
-import { profileFromConst, resolveGlmProfileFromArgs } from './glm-profile-resolver.js';
+import { profileFromConst, reasoningEffortFromGlmSlashModelArgs, resolveGlmProfileFromArgs } from './glm-profile-resolver.js';
 export function buildGlm52Request(input) {
     const profile = resolveInputProfile(input.profile, input.args, input.reasoningEffort);
     if (profile.blockers.length) {
         throw new Error(`GLM request profile blocked: ${profile.blockers.join(', ')}`);
     }
     const strictOrDeepEffort = profile.reasoning_effort || (input.reasoningEffort === 'high' || input.reasoningEffort === 'xhigh' ? input.reasoningEffort : undefined);
+    const selectedReasoningEffort = input.reasoningEffort || (input.args ? reasoningEffortFromGlmSlashModelArgs(input.args) || undefined : undefined);
     const reasoning = profile.name === 'speed'
-        ? buildFastReasoningConfig(input.reasoningMeta)
+        ? buildSpeedReasoningConfig(selectedReasoningEffort, input.reasoningMeta)
         : buildDeepReasoningConfig(strictOrDeepEffort || 'high');
     if (profile.name === 'speed' && (reasoning.effort === 'high' || reasoning.effort === 'xhigh')) {
         throw new Error(`GLM speed profile invariant violated: forbidden reasoning effort ${reasoning.effort}`);
@@ -62,4 +63,12 @@ function resolveInputProfile(profile, args, reasoningEffort) {
         return profileFromConst('deep');
     return profileFromConst(GLM_52_DEFAULT_REQUEST_SETTINGS.mode === 'mad-glm-speed' ? 'speed' : 'speed');
 }
+function buildSpeedReasoningConfig(reasoningEffort, reasoningMeta) {
+    if (reasoningEffort === 'none')
+        return { exclude: true };
+    if (reasoningEffort === 'minimal' || reasoningEffort === 'low' || reasoningEffort === 'medium') {
+        return { effort: reasoningEffort, exclude: true };
+    }
+    return buildFastReasoningConfig(reasoningMeta);
+}
 //# sourceMappingURL=glm-52-request.js.map

package/dist/core/providers/glm/glm-direct-run.js

@@ -39,6 +39,7 @@ export async function runGlmDirectSpeedRun(input) {
     controller.transition('request');
     const request = buildGlm52Request({
         profile: 'speed',
+        ...(input.args ? { args: input.args } : {}),
         messages: [
             { role: 'system', content: 'Return only <sks_patch>, <sks_need_context>, or <sks_blocked>. Use unified diff for patches.' },
             { role: 'user', content: JSON.stringify({ task: input.task, context }) }

package/dist/core/providers/glm/glm-mad-launch.js

@@ -45,7 +45,8 @@ export function buildMadGlmLaunchProfileNoWrite(args = []) {
         model_reasoning_effort: effort,
         service_tier: 'fast',
         gpt_fallback_allowed: false,
-        writes_user_codex_config: false
+        writes_user_codex_config: false,
+        blockers: profile.blockers
     };
 }
 export async function resolveMadGlmLaunchKey(env = process.env) {
@@ -111,7 +112,7 @@ export function buildMadGlmLaunchArtifact(input) {
         real_codex_bin: input.wrapper.real_codex_bin,
         raw_key_written_to_wrapper: false,
         codex_args: profile.launch_args,
-        blockers: input.keyResolution.key ? [] : input.keyResolution.blockers,
+        blockers: [...profile.blockers, ...(input.keyResolution.key ? [] : input.keyResolution.blockers)],
         warnings: input.keyResolution.warnings || []
     };
 }

package/dist/core/providers/glm/glm-profile-resolver.js

@@ -1,16 +1,17 @@
 import { readOption } from '../../../cli/args.js';
-import { GLM_DEEP_MODE, GLM_DEEP_PROFILE, GLM_SPEED_MODE, GLM_SPEED_PROFILE, GLM_STRICT_MODE, GLM_STRICT_PROFILE, GLM_XHIGH_MODE, GLM_XHIGH_PROFILE } from './glm-52-settings.js';
+import { GLM_DEEP_MODE, GLM_DEEP_PROFILE, GLM_52_OPENROUTER_MODEL, GLM_SPEED_MODE, GLM_SPEED_PROFILE, GLM_STRICT_MODE, GLM_STRICT_PROFILE, GLM_XHIGH_MODE, GLM_XHIGH_PROFILE } from './glm-52-settings.js';
 export function resolveGlmProfileFromArgs(args = []) {
     const list = args.map(String);
     const exactProvider = readOption(list, '--exact-provider', null);
+    const slashSelection = parseGlmSlashModelSelection(list);
     const providerBlockers = exactProvider && !isValidOpenRouterProviderSlug(exactProvider)
         ? [`invalid_openrouter_provider_slug:${exactProvider}`]
         : [];
-    const base = list.includes('--xhigh')
+    const base = slashSelection.reasoning_effort === 'xhigh' || list.includes('--xhigh')
         ? profileFromConst('xhigh')
         : list.includes('--strict')
             ? profileFromConst('strict')
-            : list.includes('--deep')
+            : slashSelection.reasoning_effort === 'high' || list.includes('--deep')
                 ? profileFromConst('deep')
                 : profileFromConst('speed');
     const provider = exactProvider && !providerBlockers.length
@@ -29,7 +30,64 @@ export function resolveGlmProfileFromArgs(args = []) {
     return {
         ...base,
         provider,
-        blockers: providerBlockers
+        blockers: [...providerBlockers, ...slashSelection.blockers]
+    };
+}
+export function reasoningEffortFromGlmSlashModelArgs(args = []) {
+    return parseGlmSlashModelSelection(args).reasoning_effort;
+}
+export function stripGlmSlashModelArgs(args = []) {
+    const consumed = new Set(parseGlmSlashModelSelection(args).consumed_indexes);
+    return args.map(String).filter((_arg, index) => !consumed.has(index));
+}
+export function parseGlmSlashModelSelection(args = []) {
+    const list = args.map(String);
+    const consumed = new Set();
+    const values = [];
+    for (let i = 0; i < list.length; i += 1) {
+        const arg = list[i] || '';
+        if (arg === '/model') {
+            consumed.add(i);
+            for (let j = i + 1; j < list.length && values.length < 2; j += 1) {
+                const candidate = list[j] || '';
+                if (candidate.startsWith('--') || candidate.startsWith('/'))
+                    break;
+                consumed.add(j);
+                values.push(candidate);
+                if (values.length === 1 && isSelectableGlmReasoningEffort(candidate.trim().toLowerCase()))
+                    break;
+            }
+            break;
+        }
+        const inline = arg.match(/^\/model(?::|=)(.+)$/)?.[1];
+        if (inline) {
+            consumed.add(i);
+            values.push(...inline.split(/[,:]/).map((value) => value.trim()).filter(Boolean).slice(0, 2));
+            break;
+        }
+    }
+    let model = null;
+    let reasoning = null;
+    const blockers = [];
+    for (const value of values) {
+        const normalized = value.trim().toLowerCase();
+        if (isSelectableGlmReasoningEffort(normalized)) {
+            reasoning = normalized;
+            continue;
+        }
+        if (!model) {
+            model = value;
+            if (!isAllowedGlmSlashModel(value))
+                blockers.push(`glm_slash_model_mismatch:${value}`);
+            continue;
+        }
+        blockers.push(`glm_slash_model_unrecognized:${value}`);
+    }
+    return {
+        model,
+        reasoning_effort: reasoning,
+        consumed_indexes: [...consumed].sort((a, b) => a - b),
+        blockers
     };
 }
 export function profileFromConst(name) {
@@ -101,4 +159,11 @@ export function profileFromConst(name) {
 export function isValidOpenRouterProviderSlug(value) {
     return /^(?!.*(?:^|\/)\.\.?(?:\/|$))[a-z0-9][a-z0-9._-]{0,63}(?:\/[a-z0-9][a-z0-9._-]{0,63}){0,3}$/i.test(value);
 }
+function isSelectableGlmReasoningEffort(value) {
+    return value === 'none' || value === 'minimal' || value === 'low' || value === 'medium' || value === 'high' || value === 'xhigh';
+}
+function isAllowedGlmSlashModel(value) {
+    const normalized = value.trim().toLowerCase();
+    return normalized === GLM_52_OPENROUTER_MODEL || normalized === 'glm-5.2' || normalized === 'glm5.2';
+}
 //# sourceMappingURL=glm-profile-resolver.js.map

package/dist/core/providers/glm/naruto/glm-naruto-command.js

@@ -2,6 +2,7 @@ import { flag, readOption, positionalArgs } from '../../../../cli/args.js';
 import { printJson } from '../../../../cli/output.js';
 import { runGlmNarutoMission } from './glm-naruto-orchestrator.js';
 import { runGlmNarutoBench } from './glm-naruto-bench.js';
+import { stripGlmSlashModelArgs } from '../glm-profile-resolver.js';
 export async function glmNarutoCommand(args = []) {
     if (flag(args, '--bench')) {
         // --compare is an alias; the benchmark always compares direct vs Naruto.
@@ -24,7 +25,7 @@ export async function glmNarutoCommand(args = []) {
         }
         return result;
     }
-    const positional = positionalArgs(args).map(String);
+    const positional = positionalArgs(stripGlmSlashModelArgs(args)).map(String);
     const task = positional.join(' ').trim();
     if (!task && !flag(args, '--repair') && !flag(args, '--status')) {
         const result = {

package/dist/core/team-live.js

@@ -417,14 +417,14 @@ export function buildTeamRoster(roleCounts = DEFAULT_TEAM_ROLE_COUNTS, opts = {}
     const debateReviewers = numberedAgents('debate_reviewer', counts.reviewer, 'Strict debate reviewer: applies validator/researcher lenses to correctness, safety, DB risk, tests, regressions, and unsupported assumptions.', 'reviewer', { prompt });
     const debateExecutorPool = numberedAgents('debate_executor', bundleSize, 'Capable developer voice in debate: applies skeptic/architect lenses to implementation shape, ownership boundaries, dependencies, coupling, and risks before coding starts.', 'executor', { prompt });
     const debateTeam = composeDebateTeam({ users: debateUsers, planners: debatePlanners, reviewers: debateReviewers, executors: debateExecutorPool, bundleSize });
-    const nativeAgents = numberedAgents('native_agent', bundleSize, 'Read-only native agent: quickly maps one independent slice of repo/docs/tests/API risk, records source paths and evidence, and returns TriWiki-ready findings.', 'analysis', { prompt });
+    const nativeAgents = numberedAgents('native_agent', bundleSize, 'Bounded native agent: quickly maps one independent slice of repo/docs/tests/API risk, records source paths and evidence, returns TriWiki-ready findings, and edits only parent-assigned lease paths.', 'analysis', { prompt });
     const developmentExecutors = numberedAgents('executor', bundleSize, 'Capable developer executor: owns one disjoint implementation slice and coordinates without reverting others.', 'executor', { prompt });
     const validationReviewers = numberedAgents('reviewer', counts.reviewer, 'Strict reviewer: adversarial about correctness, safety, DB risk, tests, regressions, and unsupported claims.', 'reviewer', { prompt });
     const validationUsers = numberedAgents('user', counts.user, 'Impatient final user acceptance persona: low-context, self-interested, stubborn, dislikes inconvenience, rejects clever work that feels annoying.', 'user', { prompt });
     return {
         role_counts: counts,
         bundle_size: bundleSize,
-        analysis_team: nativeAgents.map((agent) => ({ ...agent, write_policy: 'read-only native analysis', output: 'team-analysis.md' })),
+        analysis_team: nativeAgents.map((agent) => ({ ...agent, write_policy: 'bounded workspace-write native analysis lease', output: 'team-analysis.md' })),
         debate_team: debateTeam,
         development_team: developmentExecutors.map((agent) => ({ ...agent, write_policy: 'workspace-write with explicit ownership' })),
         validation_team: [

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '4.6.5';
+export const PACKAGE_VERSION = '4.7.0';
 //# sourceMappingURL=version.js.map

package/dist/scripts/agent-role-config-repair-check.js

@@ -16,18 +16,20 @@ fs.writeFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml')
 const stalePlan = await mod.repairAgentRoleConfigs({ root: staleRoot, apply: false, codexHome: path.join(staleRoot, 'codex-home') });
 const staleRepair = await mod.repairAgentRoleConfigs({ root: staleRoot, apply: true, codexHome: path.join(staleRoot, 'codex-home') });
 const repairedText = fs.readFileSync(path.join(staleRoot, '.codex', 'agents', 'analysis-scout.toml'), 'utf8');
+const createdText = fs.readFileSync(analysisScout, 'utf8');
 const report = {
     schema: 'sks.agent-role-config-repair-check.v1',
     plan_ok: plan.ok === true && plan.missing.includes('analysis-scout.toml'),
     repair_ok: repair.ok === true,
     analysis_scout_created: fs.existsSync(analysisScout),
-    created_matches_model: fs.readFileSync(analysisScout, 'utf8').includes('model = "gpt-5.5"'),
+    created_matches_model: createdText.includes('model = "gpt-5.5"'),
+    created_write_capable: createdText.includes('sandbox_mode = "workspace-write"') && !createdText.includes('Do not edit files.'),
     stale_detected: stalePlan.stale.includes('analysis-scout.toml'),
-    stale_repaired: staleRepair.repaired.includes('.codex/agents/analysis-scout.toml') && repairedText.includes('name = "analysis_scout"') && repairedText.includes('model = "gpt-5.5"'),
+    stale_repaired: staleRepair.repaired.includes('.codex/agents/analysis-scout.toml') && repairedText.includes('name = "analysis_scout"') && repairedText.includes('model = "gpt-5.5"') && repairedText.includes('sandbox_mode = "workspace-write"'),
     warnings_suppressed: repair.warnings_suppressed === true,
     artifact_written: fs.existsSync(path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json'))
 };
-const ok = report.plan_ok && report.repair_ok && report.analysis_scout_created && report.created_matches_model && report.stale_detected && report.stale_repaired && report.warnings_suppressed && report.artifact_written;
+const ok = report.plan_ok && report.repair_ok && report.analysis_scout_created && report.created_matches_model && report.created_write_capable && report.stale_detected && report.stale_repaired && report.warnings_suppressed && report.artifact_written;
 assertGate(ok, 'doctor --fix must repair missing SKS-owned agent role configs', report);
 emitGate('agent:role-config-repair', report);
 //# sourceMappingURL=agent-role-config-repair-check.js.map