sneakoscope 4.8.0 → 4.8.2

package/README.md

@@ -49,7 +49,7 @@ sks seo-geo-optimizer apply latest --mode seo --apply --json
 sks seo-geo-optimizer audit --mode geo --target package --offline --json
 ```
 
-> 📋 **Current release: `v4.8.0`** — full release history lives in [CHANGELOG.md](CHANGELOG.md). This README documents how Sneakoscope works today, not its version-by-version changes. Release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
+> 📋 **Current release: `v4.8.2`** — full release history lives in [CHANGELOG.md](CHANGELOG.md). This README documents how Sneakoscope works today, not its version-by-version changes. Release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
 
 ## 🍥 Parallelism, UX, And Integrations
 
@@ -363,7 +363,7 @@ sks codex-app set-openrouter-key --api-key-stdin
 sks codex-app glm-profile install
 ```
 
-This writes the OpenRouter key to the SKS user secret store, writes redacted metadata only, and installs Codex Desktop-compatible `openrouter` provider plus selectable `sks-glm-52-*` reasoning profiles. The npm package does not patch the Codex Desktop macOS menu binary; a top-level menu between Window and Help requires upstream Codex Desktop UI support. On macOS, `sks doctor --fix` installs or refreshes a right-side SKS menu bar companion that appears as a compact circled `S` status icon with codex-lb, ChatGPT OAuth, OpenRouter/GLM, Fast Check, SKS Version Check, Update SKS Now, settings, and Codex restart actions.
+This writes the OpenRouter key to the SKS user secret store, writes redacted metadata only, and installs Codex Desktop-compatible `openrouter` provider plus selectable `sks-glm-52-*` reasoning profiles. The npm package does not patch the Codex Desktop macOS menu binary; a top-level menu between Window and Help requires upstream Codex Desktop UI support. On macOS, `sks doctor --fix` installs or refreshes a right-side `SKS` menu bar companion with codex-lb, ChatGPT OAuth, OpenRouter/GLM, Fast Check, SKS Version Check, Update SKS Now, settings, and Codex restart actions.
 
 ### Switching auth mode: codex-lb ↔ ChatGPT OAuth
 
@@ -763,7 +763,7 @@ npm run release:check
 npm run publish:dry
 ```
 
-`release:check` runs the change-aware affected release gate for ordinary local checks. Publish readiness uses `release:check:full`, which runs the full release DAG and writes a source digest stamp under `.sneakoscope/reports/` so publish commands can verify the same source/dist state. The DAG preserves the 1.18 baseline gates and adds Codex 0.136 compatibility, inherited Codex 0.135/0.134 runner truth, patch swarm runtime truth, transaction journaling, serial conflict rebase, strict strategy-to-patch proof, rollback command proof, Native CLI Session Swarm 5/10/20-process proof, Real Worker Backend Router proof, Codex child overlap proof, model-authored patch-envelope separation, Zellij layout/pane/screen/socket-dir proof, no-subagent-scaling proof, Fast mode default/worker/Codex/MAD propagation proof, Appshots attachment provenance, MCP runtime overlap evidence, task graph expansion, schema-bound follow-up work, actual Agent/Team/Research/QA route blackboxes, scheduler proof hardening, Source Intelligence propagation, Goal mode propagation checks, slot telemetry, update notice, MAD-DB, and Naruto SSOT gates. Broader live gates remain explicit scripts such as `release:real-check`; real Codex patch smoke, real Codex parallel worker proof, and real Zellij proof are optional unless their `SKS_REQUIRE_REAL_*` or `SKS_REQUIRE_ZELLIJ=1` environment variables are set. Generate the human-readable registry with `sks features inventory --write-docs`. Plain `npm publish` uses the `latest` dist-tag. `npm run publish:dry` runs `release:check:full`, verifies the fresh stamp, and then performs provenance/registry and npm dry-run checks. `npm run publish:npm` and `npm run release:publish` run the same prepublish gate and then `npm publish --ignore-scripts`, so the real publish path stays strict even when lifecycle scripts are skipped. npm's `prepublishOnly` uses `prepublish-release-check-or-fast` to accept that current stamp before the real publish; if the stamp is missing or stale, it runs `release:check:full` once before continuing.
+`release:check` runs the change-aware affected release gate for ordinary local checks. Publish readiness uses `release:check:full`, which runs the full release DAG and writes a source digest stamp under `.sneakoscope/reports/` so publish commands can verify the same source/dist state. The DAG preserves the 1.18 baseline gates and adds Codex 0.136 compatibility, inherited Codex 0.135/0.134 runner truth, patch swarm runtime truth, transaction journaling, serial conflict rebase, strict strategy-to-patch proof, rollback command proof, Native CLI Session Swarm 5/10/20-process proof, Real Worker Backend Router proof, Codex child overlap proof, model-authored patch-envelope separation, Zellij layout/pane/screen/socket-dir proof, no-subagent-scaling proof, Fast mode default/worker/Codex/MAD propagation proof, Appshots attachment provenance, MCP runtime overlap evidence, task graph expansion, schema-bound follow-up work, actual Agent/Team/Research/QA route blackboxes, scheduler proof hardening, Source Intelligence propagation, Goal mode propagation checks, slot telemetry, update notice, MAD-DB, and Naruto SSOT gates. Broader live gates remain explicit scripts such as `release:real-check`; real Codex patch smoke, real Codex parallel worker proof, and real Zellij proof are optional unless their `SKS_REQUIRE_REAL_*` or `SKS_REQUIRE_ZELLIJ=1` environment variables are set. Generate the human-readable registry with `sks features inventory --write-docs`. Plain `npm publish` uses the `latest` dist-tag. `npm run publish:dry` runs `release:check:full`, verifies the fresh stamp, and then performs provenance/registry and npm dry-run checks. `npm run publish:npm` and `npm run release:publish` run `npm run publish:prep-ignore-scripts` first, then `npm publish --ignore-scripts`, so the real publish path stays strict even when lifecycle scripts are skipped. Operators who intentionally run `npm publish --ignore-scripts` directly must run `npm run publish:prep-ignore-scripts` immediately before it. npm's `prepublishOnly` uses `prepublish-release-check-or-fast` to accept that current stamp before the real publish; if the stamp is missing or stale, it runs `release:check:full` once before continuing.
 
 Version bumps are manual. Run `sks versioning bump` only when preparing release metadata; SKS will not create `.git/hooks/pre-commit` or auto-bump during ordinary commits.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.8.0"
+version = "4.8.2"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.8.0"
+version = "4.8.2"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.8.0"),
+        Some("--version") => println!("sks-rs 4.8.2"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.8.0';
+const FAST_PACKAGE_VERSION = '4.8.2';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/core/codex-app/sks-menubar.js

@@ -3,6 +3,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { ensureDir, exists, runProcess, which, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 const LABEL = 'com.sneakoscope.sks-menubar';
+const CONTROL_CENTER_DOMAIN = 'com.apple.controlcenter';
+const CONTROL_CENTER_PREFERRED_POSITION = 360;
 const MENU_ITEMS = [
     'Use codex-lb',
     'Use ChatGPT OAuth',
@@ -105,7 +107,21 @@ export async function installSksMenuBar(opts = {}) {
     actions.push(`compiled ${executablePath}`);
     await writeTextAtomic(launchAgentPath, launchAgentSource(executablePath, installDir));
     actions.push(`wrote ${launchAgentPath}`);
-    const launchRequested = opts.launch !== false && env.SKS_SKIP_SKS_MENUBAR_LAUNCH !== '1';
+    const launchWanted = opts.launch !== false && env.SKS_SKIP_SKS_MENUBAR_LAUNCH !== '1';
+    const launchAllowedForHome = path.resolve(home) === realUserHome();
+    const installUnderTempDir = isMenuBarInstallPathUnderTempDir(executablePath, env);
+    if (launchWanted && !launchAllowedForHome)
+        warnings.push('launch_skipped_non_user_home');
+    if (launchWanted && installUnderTempDir)
+        warnings.push('launch_skipped_temp_install');
+    const launchRequested = launchWanted && launchAllowedForHome && !installUnderTempDir;
+    if (launchRequested) {
+        const preferredPosition = await seedMenuBarPreferredPosition(env);
+        if (preferredPosition.ok)
+            actions.push('seeded SKS menu bar preferred position');
+        else
+            warnings.push(preferredPosition.warning);
+    }
     const launch = launchRequested && launchctl
         ? await launchWithLaunchctl({ launchctl, open, appPath, executablePath, launchAgentPath })
         : {
@@ -169,6 +185,71 @@ export async function installSksMenuBar(opts = {}) {
 async function fallbackTool(candidate) {
     return await exists(candidate).then((ok) => ok ? candidate : null).catch(() => null);
 }
+async function seedMenuBarPreferredPosition(env) {
+    const defaults = env.SKS_MENUBAR_DEFAULTS || await which('defaults').catch(() => null) || await fallbackTool('/usr/bin/defaults');
+    if (!defaults)
+        return { ok: false, warning: 'defaults_missing_for_menubar_position_seed' };
+    // macOS stores status-item ordering hints in Control Center prefs keyed by
+    // autosaveName. Seeding this keeps SKS right of the notch-overflow zone.
+    const writes = [
+        ['write', CONTROL_CENTER_DOMAIN, `NSStatusItem Preferred Position ${LABEL}`, '-int', String(CONTROL_CENTER_PREFERRED_POSITION)],
+        ['write', CONTROL_CENTER_DOMAIN, `NSStatusItem Visible ${LABEL}`, '-bool', 'true'],
+        ['write', CONTROL_CENTER_DOMAIN, `NSStatusItem VisibleCC ${LABEL}`, '-bool', 'true']
+    ];
+    for (const args of writes) {
+        const result = await runProcess(defaults, args, {
+            timeoutMs: 10_000,
+            maxOutputBytes: 16 * 1024
+        }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+        if (result.code !== 0)
+            return { ok: false, warning: 'menubar_position_seed_failed' };
+    }
+    return { ok: true };
+}
+/**
+ * Refuse to auto-launch a menu bar app whose executable lives under a temp dir.
+ * Release gates run in hermetic envs rooted at os.tmpdir()/SKS_TMP_DIR; without
+ * this guard a gate could spawn a real GUI status item that leaks into the
+ * user's live menu bar (duplicate `com.sneakoscope.sks-menubar` process). This
+ * is defense-in-depth behind SKS_SKIP_SKS_MENUBAR_LAUNCH and the home check.
+ */
+export function isMenuBarInstallPathUnderTempDir(target, env = process.env) {
+    const resolved = path.resolve(target);
+    const roots = new Set();
+    const addRoot = (value) => {
+        if (!value)
+            return;
+        const abs = path.resolve(value);
+        roots.add(abs);
+        // macOS resolves TMPDIR / os.tmpdir() (/var/folders/...) through a /private symlink.
+        if (abs.startsWith('/var/'))
+            roots.add(path.resolve('/private', abs.slice(1)));
+        else if (abs.startsWith('/private/var/'))
+            roots.add(abs.replace('/private', ''));
+    };
+    addRoot(os.tmpdir());
+    addRoot(env.TMPDIR);
+    addRoot(env.SKS_TMP_DIR);
+    for (const root of roots) {
+        if (resolved === root)
+            return true;
+        const prefix = root.endsWith(path.sep) ? root : root + path.sep;
+        if (resolved.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+function realUserHome() {
+    try {
+        const userHome = os.userInfo().homedir;
+        if (userHome)
+            return path.resolve(userHome);
+    }
+    catch {
+        // Fall back below for platforms where userInfo is unavailable.
+    }
+    return path.resolve(os.homedir());
+}
 function resolveSksEntry(explicit) {
     if (explicit)
         return path.resolve(explicit);
@@ -222,7 +303,9 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
 
     func applicationDidFinishLaunching(_ notification: Notification) {
         NSApp.setActivationPolicy(.accessory)
-        statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.squareLength)
+        statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
+        statusItem.autosaveName = "com.sneakoscope.sks-menubar"
+        statusItem.isVisible = true
         if let button = statusItem.button {
             configureStatusButton(button)
         }
@@ -244,14 +327,15 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
     }
 
     func configureStatusButton(_ button: NSStatusBarButton) {
-        if #available(macOS 11.0, *), let image = NSImage(systemSymbolName: "s.circle.fill", accessibilityDescription: "SKS") {
-            image.isTemplate = true
-            button.image = image
-            button.imagePosition = .imageOnly
-            button.title = ""
-        } else {
-            button.title = "S"
-        }
+        button.image = nil
+        button.title = "SKS"
+        let titleFont = NSFont.systemFont(ofSize: NSFont.systemFontSize, weight: .semibold)
+        let titleAttributes: [NSAttributedString.Key: Any] = [
+            .font: titleFont,
+            .foregroundColor: NSColor.labelColor
+        ]
+        button.font = titleFont
+        button.attributedTitle = NSAttributedString(string: "SKS", attributes: titleAttributes)
         button.toolTip = "SKS - Sneakoscope Codex settings"
         button.setAccessibilityLabel("SKS")
         button.setAccessibilityHelp("Open SKS menu")

package/dist/core/codex-native/core-skill-manifest.js

@@ -90,9 +90,12 @@ const CORE_SKILL_DEFINITIONS = [
         canonical_name: 'search-visibility-core',
         display_name: 'search-visibility-core',
         route: '$SEO-GEO-OPTIMIZER',
-        purpose: 'provide the shared search-visibility kernel for SEO and GEO audit, plan, explicit apply, verify, rollback, and Completion Proof without ranking, traffic, or citation guarantees.',
-        when: 'Use when $SEO-GEO-OPTIMIZER or sks seo-geo-optimizer needs typed mode-specific evidence, gates, artifacts, or safe mutation planning.',
-        evidence: 'search-visibility artifacts, seo-gate.json or geo-gate.json, mutation-plan.json, rollback-manifest.json, verification-report.json, and completion-proof.json.',
+        purpose: 'provide the shared search-visibility kernel for SEO and GEO audit, plan, explicit apply, verify, rollback, and Completion Proof without ranking, traffic, indexing, rich-result, answer inclusion, or AI citation guarantees.',
+        when: 'Use when $SEO-GEO-OPTIMIZER or sks seo-geo-optimizer needs typed mode-specific evidence, gates, artifacts, or safe mutation planning for websites, docs, packages, README/npm/GitHub surfaces, or storefront SEO architecture.',
+        workflow: 'Read the touched search-visibility flow before planning: SEO constants/source-of-truth, metadata builders, route topology, sitemap/robots, llms.txt, structured-data builders, target route files, internal-link sources, and SEO tests. Inventory canonical URLs, alternates/hreflang, crawlable localized sitemap rows, JSON-LD, crawler hints, claim evidence, and verification commands before compiling mutation-plan.json.',
+        safety: 'Treat SEO/GEO as an architecture compiler, not scattered page copy. Prefer existing project helpers and constants; never duplicate public route strings across files. JSON-LD must describe visible or source-of-truth facts only. Do not invent prices, reviews, ratings, availability, shipping terms, rankings, traffic, rich-result eligibility, indexing, or AI-answer outcomes.',
+        cli: 'sks seo-geo-optimizer doctor|audit|plan|apply|verify|status|rollback|fixture --mode seo|geo',
+        evidence: 'search-visibility/intake.json, adapter-detection.json, site-inventory.json, route-graph.json, robots-policy.json, structured-data-ledger.json, sitemap coverage, llms.txt plan/evidence, mutation-plan.json, rollback-manifest.json, verification-report.json, seo-gate.json or geo-gate.json, and completion-proof.json.',
         fallback: 'Keep unsupported frameworks plan-only, record unverified production/browser/Search Console/AI citation outcomes, and never invent guarantee evidence.'
     },
     {
@@ -101,8 +104,11 @@ const CORE_SKILL_DEFINITIONS = [
         display_name: 'seo-geo-optimizer',
         route: '$SEO-GEO-OPTIMIZER',
         purpose: 'run the unified SEO/GEO optimizer route for Search Engine Optimization and Generative Engine Optimization, not geolocation or GeoIP, with no ranking, traffic, indexing, rich-result, answer inclusion, or AI citation guarantee.',
-        when: 'Use the CLI entrypoint: sks seo-geo-optimizer doctor|audit|plan|apply|verify|status|rollback|fixture --mode seo|geo for SEO and GEO visibility work.',
-        evidence: 'site inventory, route graph, seo-findings.json or geo-findings.json, claim-evidence-ledger.json, ai-crawler-policy.json, llms-txt-plan.json, verification report, route gate, and Completion Proof.',
+        when: 'Use the single CLI entrypoint: sks seo-geo-optimizer doctor|audit|plan|apply|verify|status|rollback|fixture --mode seo|geo for SEO and GEO visibility work. Legacy seo-geo wording, SEO, GEO, search visibility, AI visibility, sitemap, canonical, JSON-LD, llms.txt, metadata, keyword/intent, or crawler-policy requests should converge here.',
+        workflow: 'Follow the architecture-first playbook: identify target intent and market, locate the central SEO source of truth, update/reuse canonical helpers before page code, build metadata through project helpers, emit independently crawlable localized sitemap rows plus alternates when applicable, add factual JSON-LD only from visible/source data, add internal crawl links, update AI/GEO documentation surfaces such as llms.txt when strategic, add focused tests/guards, then verify. For CELIMAX-style storefronts, prefer STOREFRONT_PATH, buildSeoMetadata, buildSeoPath, buildSeoUrl, app/sitemap.ts, proxy.ts, public/llms.txt, and market-specific tests when those files exist.',
+        safety: 'Separate implemented, verified, and unverified claims. Competitor/retailer intent pages must be factual, helpful, and non-deceptive; block keyword stuffing, doorway pages, hidden AI-only text, fake ratings/reviews/prices/availability/shipping, competitor defamation, and unsupported "official retailer", "cheapest", "best", "exclusive", first-page, traffic, Search Console, or AI-citation claims.',
+        cli: 'sks seo-geo-optimizer doctor|audit|plan|apply|verify|status|rollback|fixture --mode seo|geo',
+        evidence: 'SEO intent map, canonical URL map, metadata summary, JSON-LD summary, sitemap coverage summary, internal link plan, unsupported claims ledger, Search Console/analytics follow-up plan, site inventory, route graph, seo-findings.json or geo-findings.json, claim-evidence-ledger.json, ai-crawler-policy.json, llms-txt-plan.json, verification report, route gate, and Completion Proof.',
         fallback: 'Do not auto-allow training crawlers or fabricate AI answer visibility; mark missing live outcomes unverified and keep recovery on the unified optimizer route.'
     }
 ];
@@ -139,9 +145,14 @@ export function renderCoreSkillTemplate(name) {
         `Command: ${skill.route}`,
         `Purpose: ${skill.purpose}`,
         `Use when: ${skill.when}`,
+        `Workflow: ${skill.workflow || 'Run the selected route lifecycle, read source evidence before mutation planning, keep changes scoped, verify with the cheapest sufficient check, and record blockers honestly.'}`,
+        `CLI entrypoint: ${skill.cli || skill.route}`,
         `Lean policy: ${lean.policy_id}/${lean.policy_hash}`,
+        `Safety: ${skill.safety || 'Preserve user-authored content, keep route state bounded, avoid unsupported guarantees, and stop on hard blockers instead of fabricating fallback behavior.'}`,
+        `Evidence/artifacts: ${skill.evidence}`,
         `Proof paths: ${skill.evidence}`,
         'Safety rules: preserve user-authored skills, keep route state bounded, and stop on hard blockers instead of fabricating fallback behavior.',
+        `Failure/recovery: ${skill.fallback}`,
         `Failure recovery: ${skill.fallback}`,
         ''
     ].join('\n');

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.8.0';
+export const PACKAGE_VERSION = '4.8.2';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/managed-assets/managed-assets-manifest.js

@@ -1,6 +1,6 @@
 import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 export const MANAGED_ASSET_SCHEMA_VERSION = 1;
-export const MANAGED_ASSET_VERSION = '4.8.0';
+export const MANAGED_ASSET_VERSION = '4.8.1';
 export const MANAGED_ASSET_MARKER = 'SKS-MANAGED-ASSET';
 export const MANAGED_AGENT_ROLES = Object.freeze([
     role('sks-explorer', 'analysis-scout.toml', 'analysis_scout', 'SKS analysis scout for bounded read/write slices retained for stale Codex agent-role config repair.', 'workspace-write', ['analysis-scout', 'analysis_scout']),

package/dist/core/release/release-gate-hermetic-env.js

@@ -25,7 +25,10 @@ export function createReleaseGateHermeticEnv(input) {
             CODEX_HOME: input.gate.isolation.codex_home === 'temp' ? codexHome : process.env.CODEX_HOME,
             XDG_CACHE_HOME: cacheHome,
             SKS_DISABLE_REAL_MODEL_CALLS: input.gate.preset.includes('real-check') ? process.env.SKS_DISABLE_REAL_MODEL_CALLS || '0' : '1',
-            SKS_DISABLE_GLOBAL_CONFIG_MUTATION: '1'
+            SKS_DISABLE_GLOBAL_CONFIG_MUTATION: '1',
+            // Gates must never spawn a real GUI menu bar status item into the user's
+            // live session. Belt to the temp-path launch guard in installSksMenuBar.
+            SKS_SKIP_SKS_MENUBAR_LAUNCH: '1'
         }
     };
 }

package/dist/core/update/update-migration-state.js

@@ -237,7 +237,7 @@ export async function ensureCurrentMigrationBeforeCommand(input) {
                 SKS_UPDATE_MIGRATION_GATE_DISABLED: '1',
                 SKS_DISABLE_UPDATE_CHECK: '1'
             },
-            timeoutMs: 15_000,
+            timeoutMs: 30_000,
             maxOutputBytes: 32 * 1024
         });
         if (!doctor.ok) {

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '4.8.0';
+export const PACKAGE_VERSION = '4.8.2';
 //# sourceMappingURL=version.js.map

package/dist/scripts/release-metadata-1-19-check.js

@@ -329,6 +329,9 @@ for (const script of requiredRealScripts) {
 assertGate(pkg.bin?.sks === 'dist/bin/sks.js', 'package runtime must use dist/bin/sks.js');
 assertGate(pkg.bin?.sneakoscope === 'dist/bin/sks.js', 'sneakoscope runtime must use dist/bin/sks.js');
 assertGate(!pkg.files?.includes('src'), 'package files must not include src runtime shadows');
+assertGate(pkg.scripts?.['publish:prep-ignore-scripts'] === 'npm run prepublishOnly', 'publish:prep-ignore-scripts must run the prepublishOnly release gate before lifecycle-disabled publish', { script: pkg.scripts?.['publish:prep-ignore-scripts'] || null });
+assertGate(String(pkg.scripts?.['publish:ignore-scripts'] || '').includes('npm run publish:prep-ignore-scripts'), 'publish:ignore-scripts must run publish:prep-ignore-scripts before npm publish --ignore-scripts', { script: pkg.scripts?.['publish:ignore-scripts'] || null });
+assertGate(String(pkg.scripts?.['publish:ignore-scripts'] || '').includes('--ignore-scripts'), 'publish:ignore-scripts must keep npm lifecycle scripts disabled for the final publish', { script: pkg.scripts?.['publish:ignore-scripts'] || null });
 for (const file of requiredDocs) {
     const absolute = path.join(root, file);
     assertGate(fs.existsSync(absolute), `missing release doc: ${file}`);

package/dist/scripts/runtime-ts-rust-boundary-check.js

@@ -13,7 +13,7 @@ import { root, assertGate, emitGate, importDist, readText, readJson } from './sk
 assertGate(!/cargo|rustc/.test(readText('src/scripts/build-dist.ts')), 'build-dist must not invoke cargo/rustc');
 assertGate(!/cargo|rustc/.test(readText('src/scripts/clean-dist.ts')), 'clean-dist must not invoke cargo/rustc');
 const pkg = readJson('package.json');
-for (const s of ['prepack', 'prepublishOnly', 'publish:dry', 'publish:ignore-scripts', 'publish:npm']) {
+for (const s of ['prepack', 'prepublishOnly', 'publish:dry', 'publish:prep-ignore-scripts', 'publish:ignore-scripts', 'publish:npm']) {
     assertGate(!String(pkg.scripts?.[s] || '').includes('cargo'), `publish_script_compiles_rust:${s}`);
 }
 // 2) The published binary is JS; no prebuilt native artifact is shipped or required.

package/dist/scripts/seo-geo-skill-rich-content-check.js

@@ -7,6 +7,7 @@ import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-seo-geo-skills-'));
 const init = await importDist('core/init.js');
 await init.installSkills(root);
+assertGate(!fs.existsSync(path.join(root, '.agents', 'skills', 'seo-geo', 'SKILL.md')), 'generated skills must not recreate legacy seo-geo alias');
 for (const name of ['search-visibility-core', 'seo-geo-optimizer']) {
     const file = path.join(root, '.agents', 'skills', name, 'SKILL.md');
     assertGate(fs.existsSync(file), `generated skill missing: ${name}`);
@@ -18,5 +19,20 @@ for (const name of ['search-visibility-core', 'seo-geo-optimizer']) {
     assertGate(/CLI entrypoint:/i.test(text), `skill missing CLI entrypoint: ${name}`, text);
     assertGate(/ranking|citation|traffic|guarantee|보장/i.test(text), `skill must name forbidden guarantee boundary: ${name}`, text);
 }
+const optimizer = fs.readFileSync(path.join(root, '.agents', 'skills', 'seo-geo-optimizer', 'SKILL.md'), 'utf8');
+for (const token of [
+    'SEO intent map',
+    'canonical URL map',
+    'JSON-LD summary',
+    'sitemap coverage summary',
+    'internal link plan',
+    'unsupported claims ledger',
+    'llms.txt',
+    'Search Console',
+    'STOREFRONT_PATH',
+    'buildSeoMetadata'
+]) {
+    assertGate(optimizer.includes(token), `seo-geo-optimizer skill missing CELIMAX architecture token: ${token}`, optimizer);
+}
 emitGate('seo-geo:skill-rich-content', { skills_checked: 2 });
 //# sourceMappingURL=seo-geo-skill-rich-content-check.js.map

package/dist/scripts/sks-menubar-install-check.js

@@ -3,21 +3,37 @@ import os from 'node:os';
 import path from 'node:path';
 import { installSksMenuBar } from '../core/codex-app/sks-menubar.js';
 const temp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-menubar-check-'));
+const envHomeTemp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-menubar-env-home-check-'));
+const launchGuardEnv = { ...process.env, SKS_SKIP_SKS_MENUBAR_LAUNCH: '0' };
 const result = await installSksMenuBar({
     apply: true,
-    launch: false,
+    launch: true,
     home: temp,
     root: temp,
-    sksEntry: path.join(process.cwd(), 'dist', 'bin', 'sks.js')
+    sksEntry: path.join(process.cwd(), 'dist', 'bin', 'sks.js'),
+    env: launchGuardEnv
+});
+const envHomeResult = await installSksMenuBar({
+    apply: true,
+    launch: true,
+    root: envHomeTemp,
+    sksEntry: path.join(process.cwd(), 'dist', 'bin', 'sks.js'),
+    env: { ...launchGuardEnv, HOME: envHomeTemp }
 });
 const executableExists = result.executable_path ? await exists(result.executable_path) : false;
 const launchAgentExists = result.launch_agent_path ? await exists(result.launch_agent_path) : false;
 const actionScriptExists = result.action_script_path ? await exists(result.action_script_path) : false;
 const generatedSourcePath = result.app_path ? path.join(path.dirname(result.app_path), 'SKSMenuBar.swift') : null;
 const generatedSource = generatedSourcePath ? await fs.readFile(generatedSourcePath, 'utf8').catch(() => '') : '';
-const hasVisibleIconSource = generatedSource.includes('NSStatusItem.squareLength')
-    && generatedSource.includes('s.circle.fill')
-    && generatedSource.includes('configureStatusButton');
+const hasVisibleLabelSource = generatedSource.includes('NSStatusItem.variableLength')
+    && generatedSource.includes('button.title = "SKS"')
+    && generatedSource.includes('button.attributedTitle = NSAttributedString(string: "SKS"')
+    && generatedSource.includes('NSColor.labelColor')
+    && generatedSource.includes('button.image = nil');
+// The status item must persist its user-arranged position across restarts so a
+// once-dragged item does not jump back behind the notch on the next doctor --fix.
+const hasAutosaveNameSource = generatedSource.includes('statusItem.autosaveName = "com.sneakoscope.sks-menubar"');
+const hasExplicitVisibleSource = generatedSource.includes('statusItem.isVisible = true');
 const expectedMenuItems = [
     'Use codex-lb',
     'Use ChatGPT OAuth',
@@ -28,25 +44,56 @@ const expectedMenuItems = [
 ];
 const missingExpectedItems = expectedMenuItems.filter((item) => !result.menu_items.includes(item));
 const hasExpectedItems = missingExpectedItems.length === 0;
+const launchSkippedForTempHome = result.launch?.requested === false
+    && result.launch?.method === 'skipped'
+    && result.warnings.includes('launch_skipped_non_user_home');
+const launchSkippedForEnvHome = envHomeResult.launch?.requested === false
+    && envHomeResult.launch?.method === 'skipped'
+    && envHomeResult.warnings.includes('launch_skipped_non_user_home');
+// Temp-path guard: a temp-rooted install must never request a launch, even if
+// some caller forgets SKS_SKIP_SKS_MENUBAR_LAUNCH. Both fixtures live under
+// os.tmpdir(), so both results must carry the temp-install skip warning.
+const launchSkippedForTempInstall = result.launch?.requested === false
+    && result.warnings.includes('launch_skipped_temp_install')
+    && envHomeResult.launch?.requested === false
+    && envHomeResult.warnings.includes('launch_skipped_temp_install');
+const preferredPositionSkippedForTempInstall = !result.actions.includes('seeded SKS menu bar preferred position')
+    && !envHomeResult.actions.includes('seeded SKS menu bar preferred position');
 const ok = process.platform === 'darwin'
     ? result.ok === true
         && result.status === 'installed_launch_skipped'
+        && envHomeResult.ok === true
+        && envHomeResult.status === 'installed_launch_skipped'
         && executableExists
         && launchAgentExists
         && actionScriptExists
         && hasExpectedItems
-        && hasVisibleIconSource
+        && hasVisibleLabelSource
+        && hasAutosaveNameSource
+        && hasExplicitVisibleSource
+        && launchSkippedForTempHome
+        && launchSkippedForEnvHome
+        && launchSkippedForTempInstall
+        && preferredPositionSkippedForTempInstall
     : result.ok === true && result.status === 'unsupported_platform';
 const report = {
     schema: 'sks.sks-menubar-install-check.v1',
     ok,
     temp,
+    env_home_temp: envHomeTemp,
     result,
+    env_home_result: envHomeResult,
     executable_exists: executableExists,
     launch_agent_exists: launchAgentExists,
     action_script_exists: actionScriptExists,
     generated_source_path: generatedSourcePath,
-    has_visible_icon_source: hasVisibleIconSource,
+    has_visible_label_source: hasVisibleLabelSource,
+    has_autosave_name_source: hasAutosaveNameSource,
+    has_explicit_visible_source: hasExplicitVisibleSource,
+    launch_skipped_for_temp_home: launchSkippedForTempHome,
+    launch_skipped_for_env_home: launchSkippedForEnvHome,
+    launch_skipped_for_temp_install: launchSkippedForTempInstall,
+    preferred_position_skipped_for_temp_install: preferredPositionSkippedForTempInstall,
     expected_menu_items: expectedMenuItems,
     missing_expected_items: missingExpectedItems,
     has_expected_items: hasExpectedItems,

package/dist/scripts/update-first-command-migration-check.js

@@ -7,6 +7,7 @@ assertGate(router.includes('ensureCurrentMigrationBeforeCommand'), 'router must
 assertGate(helper.includes('INSTALLATION_EPOCH_SCHEMA') && helper.includes('installationEpochPath'), 'migration helper must keep a persistent installation epoch');
 assertGate(helper.includes('projectUpdateMigrationReceiptPath'), 'migration helper must keep a project receipt');
 assertGate(helper.includes("'--profile', 'migration'") && helper.includes("'--machine-only'") && helper.includes("'--report-file'"), 'first normal command must repair through package-local migration Doctor machine report before continuing');
+assertGate(helper.includes('timeoutMs: 30_000'), 'first normal command migration Doctor timeout must allow slow but successful macOS repair profiles');
 assertGate(helper.includes('isProjectReceiptCurrentForEpoch'), 'project receipts must be compared against the current installation epoch');
 assertGate(helper.includes('runUpdateRetentionCleanup') && helper.includes('retention_cleanup'), 'project update migration receipt must run mission retention cleanup and record its receipt');
 assertGate(helper.includes('clearPendingUpdateMigration') && helper.includes('one project must not consume global migration state'), 'legacy clear helper must preserve the persistent epoch contract');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "4.8.0",
+  "version": "4.8.2",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -381,7 +381,8 @@
     "release:real-check": "node ./dist/scripts/release-real-check.js",
     "release:publish": "npm run publish:ignore-scripts",
     "publish:dry": "npm run release:metadata && npm run release:version-truth && npm run publish:packlist-performance && npm run release:check:full && node ./dist/scripts/check-publish-tag.js && node ./dist/scripts/release-check-stamp.js verify && npm run release:provenance -- --publish && npm run release:dist-freshness && node ./dist/scripts/release-registry-check.js --require-unpublished && npm --cache /tmp/sks-npm-cache publish --dry-run --ignore-scripts --registry https://registry.npmjs.org/ --access public",
-    "publish:ignore-scripts": "npm run prepublishOnly && npm --cache /tmp/sks-npm-cache publish --ignore-scripts --registry https://registry.npmjs.org/ --access public",
+    "publish:prep-ignore-scripts": "npm run prepublishOnly",
+    "publish:ignore-scripts": "npm run publish:prep-ignore-scripts && npm --cache /tmp/sks-npm-cache publish --ignore-scripts --registry https://registry.npmjs.org/ --access public",
     "publish:npm": "npm run publish:ignore-scripts",
     "publish:fast": "node -e \"console.error('publish:fast is quarantined; use publish:dry and publish:npm with the release gates.'); process.exit(1)\"",
     "prepack": "npm run build",