sneakoscope 4.8.1 → 4.8.3

package/README.md

@@ -49,7 +49,7 @@ sks seo-geo-optimizer apply latest --mode seo --apply --json
 sks seo-geo-optimizer audit --mode geo --target package --offline --json
 ```
 
-> 📋 **Current release: `v4.8.1`** — full release history lives in [CHANGELOG.md](CHANGELOG.md). This README documents how Sneakoscope works today, not its version-by-version changes. Release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
+> 📋 **Current release: `v4.8.3`** — full release history lives in [CHANGELOG.md](CHANGELOG.md). This README documents how Sneakoscope works today, not its version-by-version changes. Release readiness is tracked in [docs/release-readiness.md](docs/release-readiness.md).
 
 ## 🍥 Parallelism, UX, And Integrations
 
@@ -763,7 +763,7 @@ npm run release:check
 npm run publish:dry
 ```
 
-`release:check` runs the change-aware affected release gate for ordinary local checks. Publish readiness uses `release:check:full`, which runs the full release DAG and writes a source digest stamp under `.sneakoscope/reports/` so publish commands can verify the same source/dist state. The DAG preserves the 1.18 baseline gates and adds Codex 0.136 compatibility, inherited Codex 0.135/0.134 runner truth, patch swarm runtime truth, transaction journaling, serial conflict rebase, strict strategy-to-patch proof, rollback command proof, Native CLI Session Swarm 5/10/20-process proof, Real Worker Backend Router proof, Codex child overlap proof, model-authored patch-envelope separation, Zellij layout/pane/screen/socket-dir proof, no-subagent-scaling proof, Fast mode default/worker/Codex/MAD propagation proof, Appshots attachment provenance, MCP runtime overlap evidence, task graph expansion, schema-bound follow-up work, actual Agent/Team/Research/QA route blackboxes, scheduler proof hardening, Source Intelligence propagation, Goal mode propagation checks, slot telemetry, update notice, MAD-DB, and Naruto SSOT gates. Broader live gates remain explicit scripts such as `release:real-check`; real Codex patch smoke, real Codex parallel worker proof, and real Zellij proof are optional unless their `SKS_REQUIRE_REAL_*` or `SKS_REQUIRE_ZELLIJ=1` environment variables are set. Generate the human-readable registry with `sks features inventory --write-docs`. Plain `npm publish` uses the `latest` dist-tag. `npm run publish:dry` runs `release:check:full`, verifies the fresh stamp, and then performs provenance/registry and npm dry-run checks. `npm run publish:npm` and `npm run release:publish` run the same prepublish gate and then `npm publish --ignore-scripts`, so the real publish path stays strict even when lifecycle scripts are skipped. npm's `prepublishOnly` uses `prepublish-release-check-or-fast` to accept that current stamp before the real publish; if the stamp is missing or stale, it runs `release:check:full` once before continuing.
+`release:check` runs the change-aware affected release gate for ordinary local checks. Publish readiness uses `release:check:full`, which runs the full release DAG and writes a source digest stamp under `.sneakoscope/reports/` so publish commands can verify the same source/dist state. The DAG preserves the 1.18 baseline gates and adds Codex 0.136 compatibility, inherited Codex 0.135/0.134 runner truth, patch swarm runtime truth, transaction journaling, serial conflict rebase, strict strategy-to-patch proof, rollback command proof, Native CLI Session Swarm 5/10/20-process proof, Real Worker Backend Router proof, Codex child overlap proof, model-authored patch-envelope separation, Zellij layout/pane/screen/socket-dir proof, no-subagent-scaling proof, Fast mode default/worker/Codex/MAD propagation proof, Appshots attachment provenance, MCP runtime overlap evidence, task graph expansion, schema-bound follow-up work, actual Agent/Team/Research/QA route blackboxes, scheduler proof hardening, Source Intelligence propagation, Goal mode propagation checks, slot telemetry, update notice, MAD-DB, and Naruto SSOT gates. Broader live gates remain explicit scripts such as `release:real-check`; real Codex patch smoke, real Codex parallel worker proof, and real Zellij proof are optional unless their `SKS_REQUIRE_REAL_*` or `SKS_REQUIRE_ZELLIJ=1` environment variables are set. Generate the human-readable registry with `sks features inventory --write-docs`. Plain `npm publish` uses the `latest` dist-tag. `npm run publish:dry` runs `release:check:full`, verifies the fresh stamp, and then performs provenance/registry and npm dry-run checks. `npm run publish:npm` and `npm run release:publish` run `npm run publish:prep-ignore-scripts` first, then `npm publish --ignore-scripts`, so the real publish path stays strict even when lifecycle scripts are skipped. Operators who intentionally run `npm publish --ignore-scripts` directly must run `npm run publish:prep-ignore-scripts` immediately before it. npm's `prepublishOnly` uses `prepublish-release-check-or-fast` to accept that current stamp before the real publish; if the stamp is missing or stale, it runs `release:check:full` once before continuing.
 
 Version bumps are manual. Run `sks versioning bump` only when preparing release metadata; SKS will not create `.git/hooks/pre-commit` or auto-bump during ordinary commits.
 

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "4.8.1"
+version = "4.8.3"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "4.8.1"
+version = "4.8.3"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 4.8.1"),
+        Some("--version") => println!("sks-rs 4.8.3"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '4.8.1';
+const FAST_PACKAGE_VERSION = '4.8.3';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--agent' && args[1] === 'worker') {

package/dist/core/codex-app/sks-menubar.js

@@ -3,6 +3,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { ensureDir, exists, runProcess, which, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 const LABEL = 'com.sneakoscope.sks-menubar';
+const CONTROL_CENTER_DOMAIN = 'com.apple.controlcenter';
+const CONTROL_CENTER_PREFERRED_POSITION = 360;
 const MENU_ITEMS = [
     'Use codex-lb',
     'Use ChatGPT OAuth',
@@ -107,9 +109,19 @@ export async function installSksMenuBar(opts = {}) {
     actions.push(`wrote ${launchAgentPath}`);
     const launchWanted = opts.launch !== false && env.SKS_SKIP_SKS_MENUBAR_LAUNCH !== '1';
     const launchAllowedForHome = path.resolve(home) === realUserHome();
+    const installUnderTempDir = isMenuBarInstallPathUnderTempDir(executablePath, env);
     if (launchWanted && !launchAllowedForHome)
         warnings.push('launch_skipped_non_user_home');
-    const launchRequested = launchWanted && launchAllowedForHome;
+    if (launchWanted && installUnderTempDir)
+        warnings.push('launch_skipped_temp_install');
+    const launchRequested = launchWanted && launchAllowedForHome && !installUnderTempDir;
+    if (launchRequested) {
+        const preferredPosition = await seedMenuBarPreferredPosition(env);
+        if (preferredPosition.ok)
+            actions.push('seeded SKS menu bar preferred position');
+        else
+            warnings.push(preferredPosition.warning);
+    }
     const launch = launchRequested && launchctl
         ? await launchWithLaunchctl({ launchctl, open, appPath, executablePath, launchAgentPath })
         : {
@@ -173,6 +185,60 @@ export async function installSksMenuBar(opts = {}) {
 async function fallbackTool(candidate) {
     return await exists(candidate).then((ok) => ok ? candidate : null).catch(() => null);
 }
+async function seedMenuBarPreferredPosition(env) {
+    const defaults = env.SKS_MENUBAR_DEFAULTS || await which('defaults').catch(() => null) || await fallbackTool('/usr/bin/defaults');
+    if (!defaults)
+        return { ok: false, warning: 'defaults_missing_for_menubar_position_seed' };
+    // macOS stores status-item ordering hints in Control Center prefs keyed by
+    // autosaveName. Seeding this keeps SKS right of the notch-overflow zone.
+    const writes = [
+        ['write', CONTROL_CENTER_DOMAIN, `NSStatusItem Preferred Position ${LABEL}`, '-int', String(CONTROL_CENTER_PREFERRED_POSITION)],
+        ['write', CONTROL_CENTER_DOMAIN, `NSStatusItem Visible ${LABEL}`, '-bool', 'true'],
+        ['write', CONTROL_CENTER_DOMAIN, `NSStatusItem VisibleCC ${LABEL}`, '-bool', 'true']
+    ];
+    for (const args of writes) {
+        const result = await runProcess(defaults, args, {
+            timeoutMs: 10_000,
+            maxOutputBytes: 16 * 1024
+        }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
+        if (result.code !== 0)
+            return { ok: false, warning: 'menubar_position_seed_failed' };
+    }
+    return { ok: true };
+}
+/**
+ * Refuse to auto-launch a menu bar app whose executable lives under a temp dir.
+ * Release gates run in hermetic envs rooted at os.tmpdir()/SKS_TMP_DIR; without
+ * this guard a gate could spawn a real GUI status item that leaks into the
+ * user's live menu bar (duplicate `com.sneakoscope.sks-menubar` process). This
+ * is defense-in-depth behind SKS_SKIP_SKS_MENUBAR_LAUNCH and the home check.
+ */
+export function isMenuBarInstallPathUnderTempDir(target, env = process.env) {
+    const resolved = path.resolve(target);
+    const roots = new Set();
+    const addRoot = (value) => {
+        if (!value)
+            return;
+        const abs = path.resolve(value);
+        roots.add(abs);
+        // macOS resolves TMPDIR / os.tmpdir() (/var/folders/...) through a /private symlink.
+        if (abs.startsWith('/var/'))
+            roots.add(path.resolve('/private', abs.slice(1)));
+        else if (abs.startsWith('/private/var/'))
+            roots.add(abs.replace('/private', ''));
+    };
+    addRoot(os.tmpdir());
+    addRoot(env.TMPDIR);
+    addRoot(env.SKS_TMP_DIR);
+    for (const root of roots) {
+        if (resolved === root)
+            return true;
+        const prefix = root.endsWith(path.sep) ? root : root + path.sep;
+        if (resolved.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
 function realUserHome() {
     try {
         const userHome = os.userInfo().homedir;
@@ -238,6 +304,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
     func applicationDidFinishLaunching(_ notification: Notification) {
         NSApp.setActivationPolicy(.accessory)
         statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
+        statusItem.autosaveName = "com.sneakoscope.sks-menubar"
+        statusItem.isVisible = true
         if let button = statusItem.button {
             configureStatusButton(button)
         }
@@ -261,7 +329,13 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
     func configureStatusButton(_ button: NSStatusBarButton) {
         button.image = nil
         button.title = "SKS"
-        button.font = NSFont.systemFont(ofSize: NSFont.systemFontSize, weight: .semibold)
+        let titleFont = NSFont.systemFont(ofSize: NSFont.systemFontSize, weight: .semibold)
+        let titleAttributes: [NSAttributedString.Key: Any] = [
+            .font: titleFont,
+            .foregroundColor: NSColor.labelColor
+        ]
+        button.font = titleFont
+        button.attributedTitle = NSAttributedString(string: "SKS", attributes: titleAttributes)
         button.toolTip = "SKS - Sneakoscope Codex settings"
         button.setAccessibilityLabel("SKS")
         button.setAccessibilityHelp("Open SKS menu")
@@ -357,8 +431,8 @@ function launchAgentSource(executablePath, installDir) {
   </array>
   <key>RunAtLoad</key>
   <true/>
-  <key>KeepAlive</key>
-  <true/>
+  <key>ProcessType</key>
+  <string>Interactive</string>
   <key>StandardOutPath</key>
   <string>${escapeXml(path.join(installDir, 'menubar.out.log'))}</string>
   <key>StandardErrorPath</key>

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '4.8.1';
+export const PACKAGE_VERSION = '4.8.3';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/release/release-gate-hermetic-env.js

@@ -25,7 +25,10 @@ export function createReleaseGateHermeticEnv(input) {
             CODEX_HOME: input.gate.isolation.codex_home === 'temp' ? codexHome : process.env.CODEX_HOME,
             XDG_CACHE_HOME: cacheHome,
             SKS_DISABLE_REAL_MODEL_CALLS: input.gate.preset.includes('real-check') ? process.env.SKS_DISABLE_REAL_MODEL_CALLS || '0' : '1',
-            SKS_DISABLE_GLOBAL_CONFIG_MUTATION: '1'
+            SKS_DISABLE_GLOBAL_CONFIG_MUTATION: '1',
+            // Gates must never spawn a real GUI menu bar status item into the user's
+            // live session. Belt to the temp-path launch guard in installSksMenuBar.
+            SKS_SKIP_SKS_MENUBAR_LAUNCH: '1'
         }
     };
 }

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '4.8.1';
+export const PACKAGE_VERSION = '4.8.3';
 //# sourceMappingURL=version.js.map

package/dist/scripts/release-metadata-1-19-check.js

@@ -329,6 +329,9 @@ for (const script of requiredRealScripts) {
 assertGate(pkg.bin?.sks === 'dist/bin/sks.js', 'package runtime must use dist/bin/sks.js');
 assertGate(pkg.bin?.sneakoscope === 'dist/bin/sks.js', 'sneakoscope runtime must use dist/bin/sks.js');
 assertGate(!pkg.files?.includes('src'), 'package files must not include src runtime shadows');
+assertGate(pkg.scripts?.['publish:prep-ignore-scripts'] === 'npm run prepublishOnly', 'publish:prep-ignore-scripts must run the prepublishOnly release gate before lifecycle-disabled publish', { script: pkg.scripts?.['publish:prep-ignore-scripts'] || null });
+assertGate(String(pkg.scripts?.['publish:ignore-scripts'] || '').includes('npm run publish:prep-ignore-scripts'), 'publish:ignore-scripts must run publish:prep-ignore-scripts before npm publish --ignore-scripts', { script: pkg.scripts?.['publish:ignore-scripts'] || null });
+assertGate(String(pkg.scripts?.['publish:ignore-scripts'] || '').includes('--ignore-scripts'), 'publish:ignore-scripts must keep npm lifecycle scripts disabled for the final publish', { script: pkg.scripts?.['publish:ignore-scripts'] || null });
 for (const file of requiredDocs) {
     const absolute = path.join(root, file);
     assertGate(fs.existsSync(absolute), `missing release doc: ${file}`);

package/dist/scripts/runtime-ts-rust-boundary-check.js

@@ -13,7 +13,7 @@ import { root, assertGate, emitGate, importDist, readText, readJson } from './sk
 assertGate(!/cargo|rustc/.test(readText('src/scripts/build-dist.ts')), 'build-dist must not invoke cargo/rustc');
 assertGate(!/cargo|rustc/.test(readText('src/scripts/clean-dist.ts')), 'clean-dist must not invoke cargo/rustc');
 const pkg = readJson('package.json');
-for (const s of ['prepack', 'prepublishOnly', 'publish:dry', 'publish:ignore-scripts', 'publish:npm']) {
+for (const s of ['prepack', 'prepublishOnly', 'publish:dry', 'publish:prep-ignore-scripts', 'publish:ignore-scripts', 'publish:npm']) {
     assertGate(!String(pkg.scripts?.[s] || '').includes('cargo'), `publish_script_compiles_rust:${s}`);
 }
 // 2) The published binary is JS; no prebuilt native artifact is shipped or required.

package/dist/scripts/sks-menubar-install-check.js

@@ -4,28 +4,40 @@ import path from 'node:path';
 import { installSksMenuBar } from '../core/codex-app/sks-menubar.js';
 const temp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-menubar-check-'));
 const envHomeTemp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-menubar-env-home-check-'));
+const launchGuardEnv = { ...process.env, SKS_SKIP_SKS_MENUBAR_LAUNCH: '0' };
 const result = await installSksMenuBar({
     apply: true,
     launch: true,
     home: temp,
     root: temp,
-    sksEntry: path.join(process.cwd(), 'dist', 'bin', 'sks.js')
+    sksEntry: path.join(process.cwd(), 'dist', 'bin', 'sks.js'),
+    env: launchGuardEnv
 });
 const envHomeResult = await installSksMenuBar({
     apply: true,
     launch: true,
     root: envHomeTemp,
     sksEntry: path.join(process.cwd(), 'dist', 'bin', 'sks.js'),
-    env: { ...process.env, HOME: envHomeTemp }
+    env: { ...launchGuardEnv, HOME: envHomeTemp }
 });
 const executableExists = result.executable_path ? await exists(result.executable_path) : false;
 const launchAgentExists = result.launch_agent_path ? await exists(result.launch_agent_path) : false;
 const actionScriptExists = result.action_script_path ? await exists(result.action_script_path) : false;
 const generatedSourcePath = result.app_path ? path.join(path.dirname(result.app_path), 'SKSMenuBar.swift') : null;
 const generatedSource = generatedSourcePath ? await fs.readFile(generatedSourcePath, 'utf8').catch(() => '') : '';
+const launchAgentSource = result.launch_agent_path ? await fs.readFile(result.launch_agent_path, 'utf8').catch(() => '') : '';
 const hasVisibleLabelSource = generatedSource.includes('NSStatusItem.variableLength')
     && generatedSource.includes('button.title = "SKS"')
+    && generatedSource.includes('button.attributedTitle = NSAttributedString(string: "SKS"')
+    && generatedSource.includes('NSColor.labelColor')
     && generatedSource.includes('button.image = nil');
+// The status item must persist its user-arranged position across restarts so a
+// once-dragged item does not jump back behind the notch on the next doctor --fix.
+const hasAutosaveNameSource = generatedSource.includes('statusItem.autosaveName = "com.sneakoscope.sks-menubar"');
+const hasExplicitVisibleSource = generatedSource.includes('statusItem.isVisible = true');
+const hasNoUnconditionalKeepAlive = !launchAgentSource.includes('<key>KeepAlive</key>');
+const hasInteractiveProcessType = launchAgentSource.includes('<key>ProcessType</key>')
+    && launchAgentSource.includes('<string>Interactive</string>');
 const expectedMenuItems = [
     'Use codex-lb',
     'Use ChatGPT OAuth',
@@ -42,6 +54,15 @@ const launchSkippedForTempHome = result.launch?.requested === false
 const launchSkippedForEnvHome = envHomeResult.launch?.requested === false
     && envHomeResult.launch?.method === 'skipped'
     && envHomeResult.warnings.includes('launch_skipped_non_user_home');
+// Temp-path guard: a temp-rooted install must never request a launch, even if
+// some caller forgets SKS_SKIP_SKS_MENUBAR_LAUNCH. Both fixtures live under
+// os.tmpdir(), so both results must carry the temp-install skip warning.
+const launchSkippedForTempInstall = result.launch?.requested === false
+    && result.warnings.includes('launch_skipped_temp_install')
+    && envHomeResult.launch?.requested === false
+    && envHomeResult.warnings.includes('launch_skipped_temp_install');
+const preferredPositionSkippedForTempInstall = !result.actions.includes('seeded SKS menu bar preferred position')
+    && !envHomeResult.actions.includes('seeded SKS menu bar preferred position');
 const ok = process.platform === 'darwin'
     ? result.ok === true
         && result.status === 'installed_launch_skipped'
@@ -52,8 +73,14 @@ const ok = process.platform === 'darwin'
         && actionScriptExists
         && hasExpectedItems
         && hasVisibleLabelSource
+        && hasAutosaveNameSource
+        && hasExplicitVisibleSource
+        && hasNoUnconditionalKeepAlive
+        && hasInteractiveProcessType
         && launchSkippedForTempHome
         && launchSkippedForEnvHome
+        && launchSkippedForTempInstall
+        && preferredPositionSkippedForTempInstall
     : result.ok === true && result.status === 'unsupported_platform';
 const report = {
     schema: 'sks.sks-menubar-install-check.v1',
@@ -67,8 +94,14 @@ const report = {
     action_script_exists: actionScriptExists,
     generated_source_path: generatedSourcePath,
     has_visible_label_source: hasVisibleLabelSource,
+    has_autosave_name_source: hasAutosaveNameSource,
+    has_explicit_visible_source: hasExplicitVisibleSource,
+    has_no_unconditional_keepalive: hasNoUnconditionalKeepAlive,
+    has_interactive_process_type: hasInteractiveProcessType,
     launch_skipped_for_temp_home: launchSkippedForTempHome,
     launch_skipped_for_env_home: launchSkippedForEnvHome,
+    launch_skipped_for_temp_install: launchSkippedForTempInstall,
+    preferred_position_skipped_for_temp_install: preferredPositionSkippedForTempInstall,
     expected_menu_items: expectedMenuItems,
     missing_expected_items: missingExpectedItems,
     has_expected_items: hasExpectedItems,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Sneakoscope Codex: fast proof-first Codex trust layer with image-based Voxel TriWiki.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -381,7 +381,8 @@
     "release:real-check": "node ./dist/scripts/release-real-check.js",
     "release:publish": "npm run publish:ignore-scripts",
     "publish:dry": "npm run release:metadata && npm run release:version-truth && npm run publish:packlist-performance && npm run release:check:full && node ./dist/scripts/check-publish-tag.js && node ./dist/scripts/release-check-stamp.js verify && npm run release:provenance -- --publish && npm run release:dist-freshness && node ./dist/scripts/release-registry-check.js --require-unpublished && npm --cache /tmp/sks-npm-cache publish --dry-run --ignore-scripts --registry https://registry.npmjs.org/ --access public",
-    "publish:ignore-scripts": "npm run prepublishOnly && npm --cache /tmp/sks-npm-cache publish --ignore-scripts --registry https://registry.npmjs.org/ --access public",
+    "publish:prep-ignore-scripts": "npm run prepublishOnly",
+    "publish:ignore-scripts": "npm run publish:prep-ignore-scripts && npm --cache /tmp/sks-npm-cache publish --ignore-scripts --registry https://registry.npmjs.org/ --access public",
     "publish:npm": "npm run publish:ignore-scripts",
     "publish:fast": "node -e \"console.error('publish:fast is quarantined; use publish:dry and publish:npm with the release gates.'); process.exit(1)\"",
     "prepack": "npm run build",