sneakoscope 5.6.0 → 5.7.0

package/dist/core/codex-app/sks-menubar.js

@@ -15,6 +15,8 @@ const MENU_ITEMS = [
     'Use ChatGPT OAuth',
     'Set codex-lb Domain and Key',
     'Set OpenRouter Key and GLM Profiles',
+    'Fast Mode On',
+    'Fast Mode Off',
     'Fast Check',
     'SKS Version Check',
     'Update SKS Now',
@@ -63,6 +65,7 @@ export async function installSksMenuBar(opts = {}) {
     const nextActions = defaultNextActions();
     let secretEnvCleanup;
     let codexBundleId = null;
+    let lastTargetCheck;
     if (process.platform !== 'darwin') {
         const result = {
             schema: 'sks.codex-app-sks-menubar.v1',
@@ -170,15 +173,11 @@ export async function installSksMenuBar(opts = {}) {
         actionScriptPath: paths.action_script_path,
         warnings
     });
-    const previousActionScript = await readText(paths.action_script_path, '');
-    if (!target.exists && previousActionScript)
-        actions.push('kept previous action script because resolved SKS entry was missing');
-    if (!target.exists && !previousActionScript) {
-        return await blockedResult('sks_entry_unresolved', `Resolved SKS entry does not exist: ${target.resolved || target.packaged}`);
-    }
-    const actionScript = target.used_previous_script
-        ? previousActionScript
-        : actionScriptSource({ nodeBin: process.execPath, sksEntry: target.resolved || target.packaged });
+    lastTargetCheck = target;
+    if (!target.exists) {
+        return await blockedResult('sks_entry_unresolved', `Resolved SKS entry does not exist: ${target.requested || target.resolved || target.packaged}`);
+    }
+    const actionScript = actionScriptSource({ nodeBin: process.execPath, sksEntry: target.resolved || target.packaged });
     const swiftSource = swiftMenuSource({
         actionScriptPath: paths.action_script_path,
         buildStampPath: paths.build_stamp_path,
@@ -201,7 +200,9 @@ export async function installSksMenuBar(opts = {}) {
     };
     const previousStamp = await readJson(paths.build_stamp_path, null);
     const appInstalled = await exists(paths.executable_path);
-    const stampMatches = appInstalled && buildStampEquals(previousStamp, stamp);
+    const currentActionScript = await readText(paths.action_script_path, '');
+    const actionScriptCurrent = currentActionScript === actionScript;
+    const stampMatches = appInstalled && buildStampEquals(previousStamp, stamp) && actionScriptCurrent;
     const binaryStable = appInstalled
         && previousStamp?.schema === stamp.schema
         && previousStamp.package_version === stamp.package_version
@@ -213,7 +214,7 @@ export async function installSksMenuBar(opts = {}) {
         actions.push('menubar_up_to_date');
     }
     else {
-        if (!target.used_previous_script && await readText(paths.action_script_path, '') !== actionScript) {
+        if (currentActionScript !== actionScript) {
             await writeTextAtomic(paths.action_script_path, actionScript);
             actions.push(`wrote ${paths.action_script_path}`);
         }
@@ -342,6 +343,7 @@ export async function installSksMenuBar(opts = {}) {
             menu_items: MENU_ITEMS,
             actions,
             launch: { requested: false, method: 'none', ok: false, error: detail || reason },
+            target_check: lastTargetCheck,
             build_stamp: null,
             tcc_automation_status: 'unknown',
             secret_env_cleanup: secretEnvCleanup,
@@ -394,7 +396,7 @@ async function writeDefaultMenuBarConfig(configPath, codexBundleId) {
     const previous = await readMenuBarConfig(configPath);
     const config = {
         schema: 'sks.sks-menubar-config.v1',
-        codex_bundle_id: codexBundleId,
+        codex_bundle_id: codexBundleId || previous.codex_bundle_id,
         quit_with_codex: previous.quit_with_codex === true
     };
     await writeJsonAtomic(configPath, config);
@@ -691,16 +693,15 @@ async function resolveSksEntryForInstall(input) {
     if (projectLocal) {
         input.warnings.push('sks_entry_project_local');
     }
-    const usedPreviousScript = !existsResolved && await exists(input.actionScriptPath);
-    if (!existsResolved && usedPreviousScript)
-        input.warnings.push('sks_entry_unresolved_kept_previous_script');
+    if (!existsResolved && await exists(input.actionScriptPath))
+        input.warnings.push('sks_entry_unresolved_stale_action_script_not_reused');
     return {
         requested: input.explicit ? path.resolve(input.explicit) : null,
         resolved: existsResolved ? resolved : null,
         packaged,
         exists: existsResolved,
         project_local: projectLocal,
-        used_previous_script: usedPreviousScript
+        used_previous_script: false
     };
 }
 export function actionScriptSource(input) {
@@ -873,6 +874,51 @@ func clipped(_ value: String, limit: Int = 700) -> String {
     return String(value.prefix(limit))
 }
 
+// sks commands report failures as JSON ({reason|status|error|blockers[]|guidance[]}
+// as short snake_case codes), which read as opaque "error codes" if dumped raw into
+// an alert. Extract the readable parts and translate known codes into plain English;
+// unknown codes fall back to "snake_case -> Words" rather than staying cryptic, and
+// genuinely non-JSON output (already plain text) passes through unchanged.
+func humanizeSksFailure(_ text: String) -> String {
+    let trimmed = text.trimmingCharacters(in: .whitespacesAndNewlines)
+    guard let data = trimmed.data(using: .utf8),
+          let obj = try? JSONSerialization.jsonObject(with: data, options: []) as? [String: Any] else {
+        return text
+    }
+    var lines: [String] = []
+    if let reason = obj["reason"] as? String {
+        lines.append(humanizeSksCode(reason))
+    } else if let status = obj["status"] as? String, !["ok", "pass", "verified", "verified_partial"].contains(status) {
+        lines.append(humanizeSksCode(status))
+    }
+    if let errorMessage = obj["error"] as? String, !errorMessage.isEmpty {
+        lines.append(errorMessage)
+    }
+    if let blockers = obj["blockers"] as? [String], !blockers.isEmpty {
+        lines.append(contentsOf: blockers.map { "- " + humanizeSksCode($0) })
+    }
+    if let guidance = obj["guidance"] as? [String], !guidance.isEmpty {
+        lines.append("")
+        lines.append(contentsOf: guidance)
+    }
+    return lines.isEmpty ? text : lines.joined(separator: "\\n")
+}
+
+func humanizeSksCode(_ code: String) -> String {
+    let known: [String: String] = [
+        "missing_host_or_base_url": "No domain or base URL was entered.",
+        "missing_api_key": "No API key was entered.",
+        "setup_needed": "codex-lb is not configured yet.",
+        "cancelled": "Setup was cancelled.",
+        "process_only_cancelled": "Setup was cancelled (process-only mode was not confirmed).",
+        "process_only_requires_yes": "This setup would only be kept for the current session — nothing durable was saved."
+    ]
+    if let mapped = known[code] { return mapped }
+    let words = code.split(separator: "_").joined(separator: " ")
+    guard let first = words.first else { return code }
+    return String(first).uppercased() + words.dropFirst()
+}
+
 func showAlert(_ message: String, informative: String = "") {
     DispatchQueue.main.async {
         NSApp.activate(ignoringOtherApps: true)
@@ -915,6 +961,11 @@ func promptChoice(title: String, message: String, options: [String]) -> String?
     return popup.titleOfSelectedItem
 }
 
+func parseJsonObject(_ text: String) -> [String: Any]? {
+    guard let data = text.data(using: .utf8) else { return nil }
+    return (try? JSONSerialization.jsonObject(with: data, options: [])) as? [String: Any]
+}
+
 func runProcess(_ executable: String, _ args: [String] = [], stdinText: String? = nil, completion: ((Int32, String) -> Void)? = nil) {
     let process = Process()
     let output = Pipe()
@@ -1007,6 +1058,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     var statusLineItem: NSMenuItem!
     var codexLbItem: NSMenuItem!
     var oauthItem: NSMenuItem!
+    var fastModeOnItem: NSMenuItem!
+    var fastModeOffItem: NSMenuItem!
     var timer: Timer?
     var busy = false
     var lastFailure = false
@@ -1032,6 +1085,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         add(menu, "Set codex-lb Domain and Key", #selector(setCodexLbDomainAndKey))
         menu.addItem(NSMenuItem.separator())
         add(menu, "Set OpenRouter Key and GLM Profiles", #selector(setOpenRouterKey))
+        fastModeOnItem = add(menu, "Fast Mode On", #selector(fastModeOn))
+        fastModeOffItem = add(menu, "Fast Mode Off", #selector(fastModeOff))
         add(menu, "Fast Check", #selector(fastCheck))
         add(menu, "SKS Version Check", #selector(sksVersionCheck))
         add(menu, "Update SKS Now", #selector(updateSksNow))
@@ -1051,6 +1106,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     func menuWillOpen(_ menu: NSMenu) {
         updateState()
         updateAuthModeChecks()
+        updateFastModeChecks()
     }
 
     func configureStatusButton(_ button: NSStatusBarButton, title: String) {
@@ -1140,7 +1196,7 @@ ${codexLifecycleSource}
                     if code == 0 {
                         showNotification(title, "OK\\n" + redacted)
                     } else {
-                        showAlert(title + " failed", informative: redacted)
+                        showAlert(title + " failed", informative: humanizeSksFailure(redacted))
                     }
                 }
                 completion?(code, redacted)
@@ -1152,6 +1208,15 @@ ${codexLifecycleSource}
         runSksCapture(args, title: title, stdinText: stdinText, notify: true, completion: completion)
     }
 
+    func runSksSilent(_ args: [String], completion: ((Int32, String) -> Void)? = nil) {
+        runProcess(actionScript, args) { code, output in
+            let redacted = redactSecrets(output)
+            DispatchQueue.main.async {
+                completion?(code, redacted)
+            }
+        }
+    }
+
     func startSksDetached(_ args: [String], title: String) {
         let process = Process()
         process.executableURL = URL(fileURLWithPath: actionScript)
@@ -1170,15 +1235,30 @@ ${codexLifecycleSource}
     }
 
     func updateAuthModeChecks() {
-        runSksCapture(["codex-lb", "status", "--json"], title: "SKS Auth Status", notify: false) { [weak self] code, output in
+        runSksSilent(["codex-lb", "status", "--json"]) { [weak self] code, output in
             guard let self = self else { return }
-            let lower = output.lowercased()
-            let codexLbActive = code == 0 && (lower.contains(#""configured": true"#) || lower.contains(#""model_provider": "codex-lb""#) || lower.contains(#""mode": "codex-lb""#))
+            let json = parseJsonObject(output)
+            let selected = json?["selected"] as? Bool == true
+            let provider = (json?["model_provider"] as? String)?.lowercased() == "codex-lb"
+            let mode = (json?["mode"] as? String)?.lowercased() == "codex-lb"
+            let codexLbActive = code == 0 && (selected || provider || mode)
             self.codexLbItem.state = codexLbActive ? .on : .off
             self.oauthItem.state = codexLbActive ? .off : .on
         }
     }
 
+    func updateFastModeChecks() {
+        runSksSilent(["fast-mode", "status", "--json"]) { [weak self] code, output in
+            guard let self = self else { return }
+            let json = parseJsonObject(output)
+            let fastMode = json?["fast_mode"] as? Bool == true
+            let serviceTier = (json?["service_tier"] as? String)?.lowercased()
+            let fastActive = code == 0 && (fastMode || serviceTier == "fast" || serviceTier == "priority")
+            self.fastModeOnItem.state = fastActive ? .on : .off
+            self.fastModeOffItem.state = fastActive ? .off : .on
+        }
+    }
+
     @objc func useCodexLb() {
         runSksBackground(["codex-lb", "use-codex-lb", "--json"], title: "Use codex-lb") { [weak self] code, _ in
             if code == 0 { self?.updateAuthModeChecks() }
@@ -1192,7 +1272,7 @@ ${codexLifecycleSource}
     }
 
     @objc func setCodexLbDomainAndKey() {
-        guard let domain = promptText(title: "Set codex-lb Domain", message: "Enter your codex-lb domain or base URL.", placeholder: "https://lb.example.com/backend-api/codex") else { return }
+        guard let domain = promptText(title: "Set codex-lb Domain", message: "Enter just your codex-lb domain or base URL — the /backend-api/codex path is added automatically.", placeholder: "lb.example.com") else { return }
         guard let key = promptText(title: "Set codex-lb Key", message: "Enter your codex-lb API key.", placeholder: "sk-clb-...", secure: true) else { return }
         runSksBackground(["codex-lb", "setup", "--host", domain, "--api-key-stdin", "--yes", "--json"], title: "Set codex-lb", stdinText: key + "\\n") { [weak self] code, _ in
             if code == 0 { self?.updateAuthModeChecks() }
@@ -1204,6 +1284,18 @@ ${codexLifecycleSource}
         runSksBackground(["codex-app", "set-openrouter-key", "--api-key-stdin", "--json"], title: "Set OpenRouter Key", stdinText: key + "\\n")
     }
 
+    @objc func fastModeOn() {
+        runSksBackground(["fast-mode", "on", "--json"], title: "Fast Mode On") { [weak self] code, _ in
+            if code == 0 { self?.updateFastModeChecks() }
+        }
+    }
+
+    @objc func fastModeOff() {
+        runSksBackground(["fast-mode", "off", "--json"], title: "Fast Mode Off") { [weak self] code, _ in
+            if code == 0 { self?.updateFastModeChecks() }
+        }
+    }
+
     @objc func fastCheck() {
         runSksBackground(["codex-lb", "fast-check"], title: "SKS Fast Check")
     }

package/dist/core/commands/run-command.js

@@ -256,14 +256,18 @@ async function executeRouteCommand(root, route, prompt, { auto = false } = {}) {
     // that never saw the prompt cannot claim to have addressed it.
     const isMockFallback = commandArgs.includes('--mock');
     const promptDelivered = Boolean(prompt) && commandArgs.includes(prompt);
+    const deterministicRoute = isSafeDeterministicRoute(route.command);
     const result = await runSks(root, commandArgs);
     return routeExecutionResult(route, ['sks', ...commandArgs].join(' '), result, {
         okStatus: isMockFallback ? 'verified_partial' : 'completed',
         trustStatus: isMockFallback ? 'mock_only' : 'verified_partial',
-        executionKind: isMockFallback ? 'mock_safe' : 'live_route',
+        executionKind: isMockFallback ? 'mock_safe' : deterministicRoute ? 'safe_deterministic' : 'live_route',
         promptDelivered,
     });
 }
+function isSafeDeterministicRoute(command) {
+    return new Set(['$DB', '$Wiki', '$Fast-Mode', '$with-local-llm-on', '$Commit', '$Commit-And-Push']).has(command);
+}
 async function runAutoVerification(root, missionId) {
     const trust = await runSks(root, ['trust', 'validate', missionId, '--json']);
     const status = await runSks(root, ['status', '--json']);

package/dist/core/commands/wiki-command.js

@@ -17,6 +17,7 @@ import { validateImageVoxelLedger } from '../wiki-image/validation.js';
 import { maybeFinalizeRoute } from '../proof/auto-finalize.js';
 import { wikiWrongnessCommand } from '../triwiki-wrongness/wrongness-cli.js';
 import { wrongnessContextForRoute } from '../triwiki-wrongness/wrongness-retrieval.js';
+import { readCombinedWrongnessRecords } from '../triwiki-wrongness/wrongness-ledger.js';
 import { recordImageWrongnessFromValidation } from '../triwiki-wrongness/image-wrongness.js';
 import { publishSharedMemory, rebuildSharedIndexes, sharedMemorySummary, validateSharedMemory } from '../git-hygiene/shared-memory-publish.js';
 import { scanCodebaseIndex } from '../triwiki/code-index-scanner.js';
@@ -249,6 +250,21 @@ async function wikiRefreshCode(args = []) {
 /** Cheap freshness check: compares the code pack's recorded git HEAD sha (at
  * generation time) against the current HEAD. Any uncertainty (no pack, no git,
  * spawn failure) resolves to 'stale' rather than 'fresh', never overclaiming. */
+/** Active-wrongness counts per TriWiki module id (from wrongness records' module_ids),
+ * so attention can hydrate frequently-wrong modules' code entries first. */
+async function buildWrongnessByModule(root) {
+    const records = await readCombinedWrongnessRecords(root, null).catch(() => []);
+    const counts = {};
+    for (const record of records) {
+        if (record?.status && record.status !== 'active')
+            continue;
+        for (const moduleId of Array.isArray(record?.module_ids) ? record.module_ids : []) {
+            if (moduleId)
+                counts[moduleId] = (counts[moduleId] || 0) + 1;
+        }
+    }
+    return counts;
+}
 async function codePackFreshness(root) {
     const packPath = path.join(root, '.sneakoscope', 'wiki', 'code-pack.json');
     if (!(await exists(packPath)))
@@ -383,6 +399,7 @@ export async function writeWikiContextPack(root, args = [], opts = {}) {
     const maxAnchors = Number(readFlagValue(args, '--max-anchors', role.includes('verifier') ? 48 : 32));
     const codePackData = await readJson(path.join(root, '.sneakoscope', 'wiki', 'code-pack.json'), null).catch(() => null);
     const codePackEntries = Array.isArray(codePackData?.entries) ? codePackData.entries : [];
+    const wrongnessByModule = await buildWrongnessByModule(root);
     const pack = contextCapsule({
         mission: { id: 'project-wiki', coord: { rgba: { r: 48, g: 132, b: 212, a: 240 } } },
         role,
@@ -391,7 +408,8 @@ export async function writeWikiContextPack(root, args = [], opts = {}) {
         q4: { mode: 'project-continuity', package: PACKAGE_VERSION, hydrate: 'anchor-first' },
         q3: ['sks', 'llm-wiki', 'wiki-coordinate', 'gx', 'skills'],
         budget: { maxWikiAnchors: maxAnchors, includeTrustSummary: true },
-        codePackEntries
+        codePackEntries,
+        wrongnessByModule
     });
     const wrongnessContext = await wrongnessContextForRoute(root, { route: '$Wiki', limit: 12 });
     // buildTriWikiAttention's use_first/hydrate_first can reference code: ids that were

package/dist/core/feature-fixtures.js

@@ -141,10 +141,10 @@ const FIXTURES = Object.freeze({
     'route-swarm': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --backend fake --work-items 4 --json', ['naruto-gate.json', 'work-order-ledger.json'], 'pass', { timeout_ms: 285000, reason: 'Same as route-work: naruto-command.ts never invokes the completion-proof pipeline.' }),
     'route-plan': fixture('execute', 'sks plan "fixture" --json', [], 'pass'),
     'route-review': fixture('execute', 'sks review --diff HEAD --json', [], 'pass'),
-    'route-shadowclone': fixture('mock', '$ShadowClone alias of $Naruto shadow-clone swarm route', [], 'pass', {
+    'route-shadowclone': fixture('static', '$ShadowClone alias of $Naruto shadow-clone swarm route', [], 'pass', {
         reason: 'Pure alias of $Naruto; no independent behavior to verify beyond route-naruto\'s own execute_and_validate_artifacts fixture.'
     }),
-    'route-kagebunshin': fixture('mock', '$Kagebunshin alias of $Naruto shadow-clone swarm route', [], 'pass', {
+    'route-kagebunshin': fixture('static', '$Kagebunshin alias of $Naruto shadow-clone swarm route', [], 'pass', {
         reason: 'Pure alias of $Naruto; no independent behavior to verify beyond route-naruto\'s own execute_and_validate_artifacts fixture.'
     }),
     'route-qa-loop': fixture('execute_and_validate_artifacts', 'sks qa-loop run latest --mock --json', ['completion-proof.json', 'qa-gate.json'], 'blocked', { timeout_ms: 180000, reason: 'qaLoopRun() resolves "latest" via the same globally-unscoped findLatestMission used everywhere else and qa-loop is a two-step prepare-then-run workflow gated between steps by an active-route-not-closed check a single fixture command cannot express.' }),
@@ -152,11 +152,11 @@ const FIXTURES = Object.freeze({
     'route-ppt': fixture('mock', 'sks ppt fixture --mock --json', ['completion-proof.json', { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }, 'ppt-imagegen-review-gate.json', 'ppt-slide-issue-ledger.json'], 'pass', { reason: 'Underlying command intentionally exits non-zero and reports ok:false by honest design (mockPptFixtureGate() hardcodes a blocked mock PPT gate); it does write all four declared artifacts.' }),
     'route-image-ux-review': fixture('mock', 'sks image-ux-review fixture --mock --json', ['completion-proof.json', { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }, 'image-ux-generated-review-ledger.json'], 'pass', { reason: 'imageUxFixture() intentionally overrides the gate to passed:false/execution_class:mock_fixture and always exits non-zero for mock fixture runs so they can never claim a real pass; it does write the declared artifacts.' }),
     'route-computer-use': fixture('execute_and_validate_artifacts', 'sks computer-use import-fixture --mock --json', ['computer-use-evidence-ledger.json', { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }, 'completion-proof.json'], 'blocked', { reason: 'importFixture() unconditionally sets process.exitCode=1 by design (execution_class: mock_fixture) so a mock Computer Use import can never claim a real pass.' }),
-    'route-cu': fixture('mock', '$CU mock evidence ledger', ['computer-use-evidence-ledger.json', 'image-voxel-ledger.json', 'completion-proof.json'], 'pass', {
-        reason: 'Underlying command (`sks cu import-fixture --mock`, same handler as route-computer-use) intentionally exits non-zero for mock Computer Use evidence imports (import-fixture in computer-use-command.ts always sets ok:false/process.exitCode=1, by honest design: mock evidence can never claim a real Computer Use verification). It does write the declared artifacts, but an execute_and_validate_artifacts fixture would need to special-case exit-code-1-as-expected for this one command, which would weaken the generic exit-code pass/fail contract; left as documented mock rather than encode that special case.'
+    'route-cu': fixture('execute_and_validate_artifacts', 'sks computer-use import-fixture --mock --json', ['computer-use-evidence-ledger.json', { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }, 'completion-proof.json'], 'blocked', {
+        reason: 'Same handler as route-computer-use: importFixture() unconditionally sets process.exitCode=1 by design (execution_class: mock_fixture) so a mock Computer Use import can never claim a real pass. execute_and_validate_artifacts already treats a matching claimed_status:\'blocked\' as ok (see feature-fixture-executor.ts\'s statusMatches check), so no special-casing is needed - upgraded from the previous mock registration to get real command-exit and artifact-schema verification.'
     }),
     'route-dfix': fixture('execute_and_validate_artifacts', 'sks dfix fixture --json', ['completion-proof.json', 'dfix-gate.json', 'dfix-verification.json'], 'pass'),
-    'route-answer': fixture('mock', '$Answer answer-only route policy', [], 'pass', {
+    'route-answer': fixture('static', '$Answer answer-only route policy', [], 'pass', {
         reason: 'Policy-only route (answer-only conversational mode with no writes); nothing executable to run beyond static contract text.'
     }),
     'route-goal': fixture('mock', '$Goal bridge route', ['goal-workflow.json', 'completion-proof.json'], 'pass', {
@@ -183,24 +183,24 @@ const FIXTURES = Object.freeze({
     }),
     'route-wiki': fixture('execute_and_validate_artifacts', 'sks wiki image-ingest test/fixtures/images/one-by-one.png --json', [{ path: 'completion-proof.json', schema: 'sks.completion-proof.v1' }, { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }], 'pass'),
     'route-gx': fixture('execute_and_validate_artifacts', 'sks gx validate fixture --mock --json', ['completion-proof.json', { path: 'image-voxel-ledger.json', schema: 'sks.image-voxel-ledger.v1' }, 'gx-validation.json'], 'blocked', { reason: 'gxValidateFixture() intentionally exits non-zero (execution_class: mock_fixture) for an honest mock/blocked result; it does write all three declared artifacts.' }),
-    'route-sks': fixture('mock', '$SKS control-surface route', ['completion-proof.json'], 'pass', {
+    'route-sks': fixture('static', '$SKS control-surface route', ['completion-proof.json'], 'pass', {
         reason: 'Pure control-surface alias route with no independent behavior beyond the underlying CLI command fixtures it dispatches to.'
     }),
     'route-fast-mode': fixture('execute', 'sks fast-mode status --json', [], 'pass'),
-    'route-fast-on': fixture('mock', '$Fast-On covered by hermetic fast-mode blackbox toggle test', [], 'pass', {
+    'route-fast-on': fixture('static', '$Fast-On covered by hermetic fast-mode blackbox toggle test', [], 'pass', {
         reason: 'Toggle-only dollar-command alias; behavior is covered by the hermetic fast-mode blackbox toggle test suite, not a standalone CLI invocation.'
     }),
-    'route-fast-off': fixture('mock', '$Fast-Off covered by hermetic fast-mode blackbox toggle test', [], 'pass', {
+    'route-fast-off': fixture('static', '$Fast-Off covered by hermetic fast-mode blackbox toggle test', [], 'pass', {
         reason: 'Toggle-only dollar-command alias; behavior is covered by the hermetic fast-mode blackbox toggle test suite, not a standalone CLI invocation.'
     }),
     'route-local-model': fixture('execute', 'sks with-local-llm status --json', [], 'pass'),
-    'route-with-local-llm-on': fixture('mock', '$with-local-llm-on covered by hermetic local-model dollar-command blackbox toggle test', [], 'pass', {
+    'route-with-local-llm-on': fixture('static', '$with-local-llm-on covered by hermetic local-model dollar-command blackbox toggle test', [], 'pass', {
         reason: 'Toggle-only dollar-command alias; behavior is covered by the hermetic local-model dollar-command blackbox toggle test suite, not a standalone CLI invocation.'
     }),
-    'route-with-local-llm-off': fixture('mock', '$with-local-llm-off covered by hermetic local-model dollar-command blackbox toggle test', [], 'pass', {
+    'route-with-local-llm-off': fixture('static', '$with-local-llm-off covered by hermetic local-model dollar-command blackbox toggle test', [], 'pass', {
         reason: 'Toggle-only dollar-command alias; behavior is covered by the hermetic local-model dollar-command blackbox toggle test suite, not a standalone CLI invocation.'
     }),
-    'route-help': fixture('mock', '$Help lightweight route', [], 'pass', {
+    'route-help': fixture('static', '$Help lightweight route', [], 'pass', {
         reason: 'Pure alias of the cli-help command; no independent behavior to verify beyond cli-help\'s own execute fixture.'
     }),
     'route-commit': fixture('mock', '$Commit git route', ['completion-proof.json'], 'pass', {

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '5.6.0';
+export const PACKAGE_VERSION = '5.7.0';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/hooks-runtime/code-pack-freshness-preflight.js

@@ -0,0 +1,48 @@
+import path from 'node:path';
+import { exists, readJson, runProcess } from '../fsx.js';
+/** Bounded, non-blocking code-pack staleness nudge for the user-prompt-submit hook.
+ *
+ * Returns a one-line context note when a published code pack
+ * (.sneakoscope/wiki/code-pack.json) exists but was generated against a different
+ * git HEAD than the current one — i.e. the codebase moved and the LLM-facing code
+ * summaries are now out of date. Returns null (silent) when there is no pack at all
+ * (repos that never opted into `sks wiki refresh --code` must not be nagged) or when
+ * the check can't complete cheaply. It NEVER regenerates the pack and NEVER blocks:
+ * the whole check is one JSON read plus one `git rev-parse HEAD`, wrapped in a hard
+ * timeout so it cannot blow the hook latency budget. Any failure resolves to null. */
+export async function codePackFreshnessNote(root, opts = {}) {
+    const budgetMs = opts.budgetMs ?? 250;
+    return raceWithTimeout(computeNote(root), budgetMs).catch(() => null);
+}
+async function computeNote(root) {
+    const packPath = path.join(root, '.sneakoscope', 'wiki', 'code-pack.json');
+    if (!(await exists(packPath)))
+        return null;
+    const pack = await readJson(packPath, null).catch(() => null);
+    const packSha = pack?.git_head_sha || null;
+    // A pack with no recorded sha (non-git build) can't be compared; stay silent
+    // rather than nag with a comparison we can't actually make.
+    if (!packSha)
+        return null;
+    const head = await runProcess('git', ['rev-parse', 'HEAD'], { cwd: root, timeoutMs: 200 }).catch(() => null);
+    const currentSha = head && head.code === 0 ? String(head.stdout || '').trim() : null;
+    if (!currentSha || currentSha === packSha)
+        return null;
+    return 'SKS note: the codebase code pack is stale (HEAD moved since it was built). Run `sks wiki refresh --code` to refresh source-cited code context.';
+}
+async function raceWithTimeout(work, ms) {
+    let timer = null;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), ms);
+        if (timer.unref)
+            timer.unref();
+    });
+    try {
+        return await Promise.race([work, timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=code-pack-freshness-preflight.js.map

package/dist/core/hooks-runtime.js

@@ -18,6 +18,7 @@ import { scanAgentTextForRecursion } from './agents/agent-recursion-guard.js';
 import { evaluateLoopContinuation } from './loops/loop-continuation-enforcer.js';
 import { diagnosticPromptAllowedDuringNoQuestions } from './routes/diagnostic-allowlist.js';
 import { maybeReconcileProjectSkillsPreflight } from './hooks-runtime/skill-reconcile-preflight.js';
+import { codePackFreshnessNote } from './hooks-runtime/code-pack-freshness-preflight.js';
 import { buildCompactContinue, buildPermissionRequestAllow, buildPermissionRequestDeny, buildPostToolUseBlock, buildPostToolUseContinue, buildPreToolUseContinue, buildPreToolUseDeny, buildSessionStartContinue, buildStopBlock, buildStopContinue, buildSubagentStartContinue, buildSubagentStopBlock, buildSubagentStopContinue, buildUserPromptSubmitBlock, buildUserPromptSubmitContinue } from './codex-compat/codex-hook-output-builders.js';
 import { joinSystemMessages, teamLiveDigest } from './hooks-runtime/team-digest.js';
 const STOP_REPEAT_GUARD_ARTIFACT = 'stop-hook-repeat-guard.json';
@@ -340,6 +341,9 @@ async function hookUserPrompt(root, state, payload, noQuestion, sessionKey = nul
             contexts.push(goalOverlay);
         if (teamDigest?.context)
             contexts.push(teamDigest.context);
+        const codePackNote = await codePackFreshnessNote(root);
+        if (codePackNote)
+            contexts.push(codePackNote);
         const additionalContext = contexts.filter(Boolean).join('\n\n');
         return { continue: true, additionalContext, systemMessage: joinSystemMessages(visibleHookMessage('user-prompt-submit', additionalContext), teamDigest?.system) };
     }

package/dist/core/triwiki-attention.js

@@ -231,10 +231,12 @@ function uniqueAttentionRows(rows = [], max = 4) {
  * for the same fixed slot budget would make their appearance arbitrary. Each surviving
  * entry becomes a use_first row (bare id, no fabricated RGBA) plus a hydrate_first row
  * pointing at its source citations, so a consumer knows which real files back it. */
-function codePackAttentionRows(codePackEntries = [], tokenBudget = 2000) {
+function codePackAttentionRows(codePackEntries = [], tokenBudget = 2000, wrongnessByModule = {}) {
+    const moduleWrongness = (entryId) => Number(wrongnessByModule[String(entryId || '').replace(/^code:/, '')] || 0);
     const sorted = [...(codePackEntries || [])]
         .filter((entry) => entry && typeof entry.id === 'string')
-        .sort((a, b) => Number(b.trust_score || 0) - Number(a.trust_score || 0));
+        // Modules SKS has been wrong about before are worth re-reading first, then rank by trust.
+        .sort((a, b) => (moduleWrongness(b.id) - moduleWrongness(a.id)) || (Number(b.trust_score || 0) - Number(a.trust_score || 0)));
     const useFirst = [];
     const hydrateFirst = [];
     let tokens = 0;
@@ -245,12 +247,17 @@ function codePackAttentionRows(codePackEntries = [], tokenBudget = 2000) {
         tokens += cost;
         useFirst.push([entry.id, null, null]);
         const citationPaths = Array.isArray(entry.citations) ? entry.citations.map((c) => c?.path).filter(Boolean) : [];
-        if (citationPaths.length)
-            hydrateFirst.push([entry.id, `code_citations:${citationPaths.join(',')}`]);
+        const citationReason = citationPaths.length ? `code_citations:${citationPaths.join(',')}` : null;
+        const wrongCount = moduleWrongness(entry.id);
+        // A module with past wrongness earns a hydrate row even without citations, tagged
+        // with a wrongness:<count> signal so a consumer re-reads it before trusting recall.
+        const reason = wrongCount > 0 ? `wrongness:${wrongCount}${citationReason ? `;${citationReason}` : ''}` : citationReason;
+        if (reason)
+            hydrateFirst.push([entry.id, reason]);
     }
     return { useFirst, hydrateFirst };
 }
-export function buildTriWikiAttention({ selected = [], wiki = {}, role = 'worker', maxUse = 4, maxHydrate = 4, codePackEntries = [], codePackTokenBudget = 2000 } = {}) {
+export function buildTriWikiAttention({ selected = [], wiki = {}, role = 'worker', maxUse = 4, maxHydrate = 4, codePackEntries = [], codePackTokenBudget = 2000, wrongnessByModule = {} } = {}) {
     const anchors = attentionAnchorMap(wiki);
     const ranked = [...(selected || [])]
         .map((claim, index) => ({ claim, index }))
@@ -276,7 +283,7 @@ export function buildTriWikiAttention({ selected = [], wiki = {}, role = 'worker
         ...voxelRows,
         ...selectedHydrateRows
     ], maxHydrate);
-    const codeRows = codePackAttentionRows(codePackEntries, codePackTokenBudget);
+    const codeRows = codePackAttentionRows(codePackEntries, codePackTokenBudget, wrongnessByModule);
     return {
         mode: 'aggressive_triwiki_active_recall',
         use_first: uniqueAttentionRows([...useFirst, ...codeRows.useFirst], maxUse + codeRows.useFirst.length),
@@ -309,7 +316,7 @@ export function geometricOffsets(max = 65536) {
         out.push(x);
     return out;
 }
-export function contextCapsule({ mission, role = 'worker', contractHash = null, claims = [], q4 = {}, q3 = [], budget = {}, codePackEntries = [] }) {
+export function contextCapsule({ mission, role = 'worker', contractHash = null, claims = [], q4 = {}, q3 = [], budget = {}, codePackEntries = [], wrongnessByModule = {} }) {
     const trustPolicy = budget.trustPolicy || DEFAULT_TRUST_POLICY;
     const claimsWithTrust = (claims || []).map((claim) => withTrust(claim, trustPolicy));
     const selected = selectClaims(mission, claims, { maxClaims: budget.maxClaims ?? (role.includes('verifier') ? 16 : 9), trustPolicy });
@@ -342,7 +349,8 @@ export function contextCapsule({ mission, role = 'worker', contractHash = null,
             maxUse: budget.maxAttentionUse ?? (role.includes('verifier') ? 7 : 4),
             maxHydrate: budget.maxAttentionHydrate ?? (role.includes('verifier') ? 7 : 4),
             codePackEntries,
-            codePackTokenBudget: budget.codePackTokenBudget ?? 2000
+            codePackTokenBudget: budget.codePackTokenBudget ?? 2000,
+            wrongnessByModule
         }),
         claims: selected.map((c) => {
             const anchor = anchorsById.get(c.id);

package/dist/core/triwiki-wrongness/wrongness-schema.js

@@ -1,4 +1,5 @@
 import { nowIso, randomId, sha256 } from '../fsx.js';
+import { moduleIdsForPath } from '../triwiki/triwiki-module-card.js';
 export const WRONGNESS_RECORD_SCHEMA = 'sks.triwiki-wrongness.v1';
 export const WRONGNESS_LEDGER_SCHEMA = 'sks.triwiki-wrongness-ledger.v1';
 export const WRONGNESS_INDEX_SCHEMA = 'sks.triwiki-wrongness-index.v1';
@@ -122,6 +123,8 @@ export function createWrongnessRecord(input = {}) {
     const avoidanceText = stringOrNull(asRecord(row.avoidance_rule).text)
         || stringOrNull(row.avoidance_rule)
         || defaultAvoidanceRule(kind, claim.text);
+    const links = normalizeLinks(row.links);
+    const moduleIds = moduleIdsForWrongness(links.files);
     return {
         schema: WRONGNESS_RECORD_SCHEMA,
         id: stringOrNull(row.id) || wrongnessId(kind),
@@ -140,11 +143,25 @@ export function createWrongnessRecord(input = {}) {
         corrective_action: normalizeCorrectiveAction(row.corrective_action),
         avoidance_rule: normalizeAvoidanceRule(row.avoidance_rule, kind, avoidanceText, severity),
         correction: normalizeCorrection(row.correction ?? row.corrected_anchor),
-        links: normalizeLinks(row.links),
+        links,
+        ...(moduleIds.length ? { module_ids: moduleIds } : (Array.isArray(row.module_ids) ? { module_ids: stringList(row.module_ids) } : {})),
         ...(row.rule_compiled === undefined ? {} : { rule_compiled: Boolean(row.rule_compiled) }),
         ...(row.compiled_rule_id === undefined ? {} : { compiled_rule_id: stringOrNull(row.compiled_rule_id) })
     };
 }
+/** Best-effort module attribution from the wrongness's linked files. Excludes the
+ * 'unknown' sentinel moduleIdsForPath returns for unmapped paths, so a record only
+ * carries module_ids when at least one file maps to a real TriWiki module. */
+function moduleIdsForWrongness(files) {
+    const ids = new Set();
+    for (const file of files) {
+        for (const id of moduleIdsForPath(String(file || ''))) {
+            if (id && id !== 'unknown')
+                ids.add(id);
+        }
+    }
+    return [...ids];
+}
 export function emptyWrongnessLedger(scope = 'project', missionId = null) {
     return {
         schema: WRONGNESS_LEDGER_SCHEMA,