sneakoscope 5.6.1 → 5.7.0

package/dist/core/codex-app/sks-menubar.js

@@ -15,6 +15,8 @@ const MENU_ITEMS = [
     'Use ChatGPT OAuth',
     'Set codex-lb Domain and Key',
     'Set OpenRouter Key and GLM Profiles',
+    'Fast Mode On',
+    'Fast Mode Off',
     'Fast Check',
     'SKS Version Check',
     'Update SKS Now',
@@ -63,6 +65,7 @@ export async function installSksMenuBar(opts = {}) {
     const nextActions = defaultNextActions();
     let secretEnvCleanup;
     let codexBundleId = null;
+    let lastTargetCheck;
     if (process.platform !== 'darwin') {
         const result = {
             schema: 'sks.codex-app-sks-menubar.v1',
@@ -170,15 +173,11 @@ export async function installSksMenuBar(opts = {}) {
         actionScriptPath: paths.action_script_path,
         warnings
     });
-    const previousActionScript = await readText(paths.action_script_path, '');
-    if (!target.exists && previousActionScript)
-        actions.push('kept previous action script because resolved SKS entry was missing');
-    if (!target.exists && !previousActionScript) {
-        return await blockedResult('sks_entry_unresolved', `Resolved SKS entry does not exist: ${target.resolved || target.packaged}`);
-    }
-    const actionScript = target.used_previous_script
-        ? previousActionScript
-        : actionScriptSource({ nodeBin: process.execPath, sksEntry: target.resolved || target.packaged });
+    lastTargetCheck = target;
+    if (!target.exists) {
+        return await blockedResult('sks_entry_unresolved', `Resolved SKS entry does not exist: ${target.requested || target.resolved || target.packaged}`);
+    }
+    const actionScript = actionScriptSource({ nodeBin: process.execPath, sksEntry: target.resolved || target.packaged });
     const swiftSource = swiftMenuSource({
         actionScriptPath: paths.action_script_path,
         buildStampPath: paths.build_stamp_path,
@@ -201,7 +200,9 @@ export async function installSksMenuBar(opts = {}) {
     };
     const previousStamp = await readJson(paths.build_stamp_path, null);
     const appInstalled = await exists(paths.executable_path);
-    const stampMatches = appInstalled && buildStampEquals(previousStamp, stamp);
+    const currentActionScript = await readText(paths.action_script_path, '');
+    const actionScriptCurrent = currentActionScript === actionScript;
+    const stampMatches = appInstalled && buildStampEquals(previousStamp, stamp) && actionScriptCurrent;
     const binaryStable = appInstalled
         && previousStamp?.schema === stamp.schema
         && previousStamp.package_version === stamp.package_version
@@ -213,7 +214,7 @@ export async function installSksMenuBar(opts = {}) {
         actions.push('menubar_up_to_date');
     }
     else {
-        if (!target.used_previous_script && await readText(paths.action_script_path, '') !== actionScript) {
+        if (currentActionScript !== actionScript) {
             await writeTextAtomic(paths.action_script_path, actionScript);
             actions.push(`wrote ${paths.action_script_path}`);
         }
@@ -342,6 +343,7 @@ export async function installSksMenuBar(opts = {}) {
             menu_items: MENU_ITEMS,
             actions,
             launch: { requested: false, method: 'none', ok: false, error: detail || reason },
+            target_check: lastTargetCheck,
             build_stamp: null,
             tcc_automation_status: 'unknown',
             secret_env_cleanup: secretEnvCleanup,
@@ -394,7 +396,7 @@ async function writeDefaultMenuBarConfig(configPath, codexBundleId) {
     const previous = await readMenuBarConfig(configPath);
     const config = {
         schema: 'sks.sks-menubar-config.v1',
-        codex_bundle_id: codexBundleId,
+        codex_bundle_id: codexBundleId || previous.codex_bundle_id,
         quit_with_codex: previous.quit_with_codex === true
     };
     await writeJsonAtomic(configPath, config);
@@ -691,16 +693,15 @@ async function resolveSksEntryForInstall(input) {
     if (projectLocal) {
         input.warnings.push('sks_entry_project_local');
     }
-    const usedPreviousScript = !existsResolved && await exists(input.actionScriptPath);
-    if (!existsResolved && usedPreviousScript)
-        input.warnings.push('sks_entry_unresolved_kept_previous_script');
+    if (!existsResolved && await exists(input.actionScriptPath))
+        input.warnings.push('sks_entry_unresolved_stale_action_script_not_reused');
     return {
         requested: input.explicit ? path.resolve(input.explicit) : null,
         resolved: existsResolved ? resolved : null,
         packaged,
         exists: existsResolved,
         project_local: projectLocal,
-        used_previous_script: usedPreviousScript
+        used_previous_script: false
     };
 }
 export function actionScriptSource(input) {
@@ -960,6 +961,11 @@ func promptChoice(title: String, message: String, options: [String]) -> String?
     return popup.titleOfSelectedItem
 }
 
+func parseJsonObject(_ text: String) -> [String: Any]? {
+    guard let data = text.data(using: .utf8) else { return nil }
+    return (try? JSONSerialization.jsonObject(with: data, options: [])) as? [String: Any]
+}
+
 func runProcess(_ executable: String, _ args: [String] = [], stdinText: String? = nil, completion: ((Int32, String) -> Void)? = nil) {
     let process = Process()
     let output = Pipe()
@@ -1052,6 +1058,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     var statusLineItem: NSMenuItem!
     var codexLbItem: NSMenuItem!
     var oauthItem: NSMenuItem!
+    var fastModeOnItem: NSMenuItem!
+    var fastModeOffItem: NSMenuItem!
     var timer: Timer?
     var busy = false
     var lastFailure = false
@@ -1077,6 +1085,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         add(menu, "Set codex-lb Domain and Key", #selector(setCodexLbDomainAndKey))
         menu.addItem(NSMenuItem.separator())
         add(menu, "Set OpenRouter Key and GLM Profiles", #selector(setOpenRouterKey))
+        fastModeOnItem = add(menu, "Fast Mode On", #selector(fastModeOn))
+        fastModeOffItem = add(menu, "Fast Mode Off", #selector(fastModeOff))
         add(menu, "Fast Check", #selector(fastCheck))
         add(menu, "SKS Version Check", #selector(sksVersionCheck))
         add(menu, "Update SKS Now", #selector(updateSksNow))
@@ -1096,6 +1106,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     func menuWillOpen(_ menu: NSMenu) {
         updateState()
         updateAuthModeChecks()
+        updateFastModeChecks()
     }
 
     func configureStatusButton(_ button: NSStatusBarButton, title: String) {
@@ -1197,6 +1208,15 @@ ${codexLifecycleSource}
         runSksCapture(args, title: title, stdinText: stdinText, notify: true, completion: completion)
     }
 
+    func runSksSilent(_ args: [String], completion: ((Int32, String) -> Void)? = nil) {
+        runProcess(actionScript, args) { code, output in
+            let redacted = redactSecrets(output)
+            DispatchQueue.main.async {
+                completion?(code, redacted)
+            }
+        }
+    }
+
     func startSksDetached(_ args: [String], title: String) {
         let process = Process()
         process.executableURL = URL(fileURLWithPath: actionScript)
@@ -1215,15 +1235,30 @@ ${codexLifecycleSource}
     }
 
     func updateAuthModeChecks() {
-        runSksCapture(["codex-lb", "status", "--json"], title: "SKS Auth Status", notify: false) { [weak self] code, output in
+        runSksSilent(["codex-lb", "status", "--json"]) { [weak self] code, output in
             guard let self = self else { return }
-            let lower = output.lowercased()
-            let codexLbActive = code == 0 && (lower.contains(#""configured": true"#) || lower.contains(#""model_provider": "codex-lb""#) || lower.contains(#""mode": "codex-lb""#))
+            let json = parseJsonObject(output)
+            let selected = json?["selected"] as? Bool == true
+            let provider = (json?["model_provider"] as? String)?.lowercased() == "codex-lb"
+            let mode = (json?["mode"] as? String)?.lowercased() == "codex-lb"
+            let codexLbActive = code == 0 && (selected || provider || mode)
             self.codexLbItem.state = codexLbActive ? .on : .off
             self.oauthItem.state = codexLbActive ? .off : .on
         }
     }
 
+    func updateFastModeChecks() {
+        runSksSilent(["fast-mode", "status", "--json"]) { [weak self] code, output in
+            guard let self = self else { return }
+            let json = parseJsonObject(output)
+            let fastMode = json?["fast_mode"] as? Bool == true
+            let serviceTier = (json?["service_tier"] as? String)?.lowercased()
+            let fastActive = code == 0 && (fastMode || serviceTier == "fast" || serviceTier == "priority")
+            self.fastModeOnItem.state = fastActive ? .on : .off
+            self.fastModeOffItem.state = fastActive ? .off : .on
+        }
+    }
+
     @objc func useCodexLb() {
         runSksBackground(["codex-lb", "use-codex-lb", "--json"], title: "Use codex-lb") { [weak self] code, _ in
             if code == 0 { self?.updateAuthModeChecks() }
@@ -1249,6 +1284,18 @@ ${codexLifecycleSource}
         runSksBackground(["codex-app", "set-openrouter-key", "--api-key-stdin", "--json"], title: "Set OpenRouter Key", stdinText: key + "\\n")
     }
 
+    @objc func fastModeOn() {
+        runSksBackground(["fast-mode", "on", "--json"], title: "Fast Mode On") { [weak self] code, _ in
+            if code == 0 { self?.updateFastModeChecks() }
+        }
+    }
+
+    @objc func fastModeOff() {
+        runSksBackground(["fast-mode", "off", "--json"], title: "Fast Mode Off") { [weak self] code, _ in
+            if code == 0 { self?.updateFastModeChecks() }
+        }
+    }
+
     @objc func fastCheck() {
         runSksBackground(["codex-lb", "fast-check"], title: "SKS Fast Check")
     }

package/dist/core/commands/run-command.js

@@ -256,14 +256,18 @@ async function executeRouteCommand(root, route, prompt, { auto = false } = {}) {
     // that never saw the prompt cannot claim to have addressed it.
     const isMockFallback = commandArgs.includes('--mock');
     const promptDelivered = Boolean(prompt) && commandArgs.includes(prompt);
+    const deterministicRoute = isSafeDeterministicRoute(route.command);
     const result = await runSks(root, commandArgs);
     return routeExecutionResult(route, ['sks', ...commandArgs].join(' '), result, {
         okStatus: isMockFallback ? 'verified_partial' : 'completed',
         trustStatus: isMockFallback ? 'mock_only' : 'verified_partial',
-        executionKind: isMockFallback ? 'mock_safe' : 'live_route',
+        executionKind: isMockFallback ? 'mock_safe' : deterministicRoute ? 'safe_deterministic' : 'live_route',
         promptDelivered,
     });
 }
+function isSafeDeterministicRoute(command) {
+    return new Set(['$DB', '$Wiki', '$Fast-Mode', '$with-local-llm-on', '$Commit', '$Commit-And-Push']).has(command);
+}
 async function runAutoVerification(root, missionId) {
     const trust = await runSks(root, ['trust', 'validate', missionId, '--json']);
     const status = await runSks(root, ['status', '--json']);

package/dist/core/fsx.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-export const PACKAGE_VERSION = '5.6.1';
+export const PACKAGE_VERSION = '5.7.0';
 export const DEFAULT_PROCESS_TAIL_BYTES = 256 * 1024;
 export const DEFAULT_PROCESS_TIMEOUT_MS = 30 * 60 * 1000;
 export function nowIso() {

package/dist/core/update/update-migration-state.js

@@ -8,6 +8,7 @@ import { COMMANDS } from '../../cli/command-registry.js';
 import { reconcileSkills } from '../init/skills.js';
 import { codexHookTrustDoctor } from '../codex-hooks/codex-hook-trust-doctor.js';
 import { writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
+import { REQUIRED_CODEX_MODEL } from '../codex-model-guard.js';
 export const UPDATE_MIGRATION_SCHEMA = 'sks.project-migration-receipt.v2';
 export const INSTALLATION_EPOCH_SCHEMA = 'sks.installation-epoch.v1';
 export function installationEpochPath() {
@@ -343,53 +344,71 @@ async function runMenubarRetargetStage(root) {
         return { ok: true, status: 'ok', actions: ['menubar_action_script_absent'], blockers: [], warnings: [] };
     const desired = path.join(packageRoot(), 'dist', 'bin', 'sks.js');
     const line = `SKS_ENTRY=${JSON.stringify(desired)}`;
+    const actions = [];
     const next = /^\s*SKS_ENTRY\s*=.*$/m.test(text)
         ? text.replace(/^\s*SKS_ENTRY\s*=.*$/m, line)
         : `${line}\n${text}`;
     if (next !== text) {
         await writeTextAtomic(actionScript, next);
-        return { ok: true, status: 'ok', actions: ['retargeted_menubar_action_script'], blockers: [], warnings: [], detail: { action_script: actionScript } };
+        actions.push('retargeted_menubar_action_script');
+    }
+    const stat = await fsp.stat(actionScript).catch(() => null);
+    if (!stat || (stat.mode & 0o111) === 0) {
+        await fsp.chmod(actionScript, 0o755);
+        actions.push('restored_menubar_action_executable_bit');
     }
-    return { ok: true, status: 'ok', actions: ['menubar_action_script_current'], blockers: [], warnings: [], detail: { action_script: actionScript } };
+    return {
+        ok: true,
+        status: 'ok',
+        actions: actions.length ? actions : ['menubar_action_script_current'],
+        blockers: [],
+        warnings: [],
+        detail: { action_script: actionScript }
+    };
 }
 async function runConfigFastModeNormalizeStage() {
     const configPath = path.join(os.homedir(), '.codex', 'config.toml');
     const text = await readText(configPath, null);
     if (typeof text !== 'string')
         return { ok: true, status: 'ok', actions: ['codex_config_absent'], blockers: [], warnings: [] };
-    const table = text.match(/(^|\n)\[user\.fast_mode\][\s\S]*?(?=\n\[|$)/);
-    const misplaced = table?.[0]?.match(/^\s*default_profile\s*=\s*"([^"]+)"\s*$/m)?.[1] || null;
-    const hasTopLevel = /^\s*default_profile\s*=\s*"[^"]+"\s*$/m.test(text.slice(0, Math.max(0, text.search(/^\s*\[/m))));
-    if (!misplaced)
-        return { ok: true, status: 'ok', actions: ['fastmode_default_profile_current'], blockers: [], warnings: [] };
-    let next = text.replace(/(^|\n)(\[user\.fast_mode\][\s\S]*?)(?=\n\[|$)/, (_match, prefix, block) => {
-        const cleaned = String(block).split(/\r?\n/).filter((line) => !/^\s*default_profile\s*=/.test(line)).join('\n').trimEnd();
-        return `${prefix}${cleaned}`;
-    });
-    if (!hasTopLevel)
-        next = insertTopLevelTomlKey(next, `default_profile = ${JSON.stringify(misplaced)}`);
+    const normalized = normalizeLegacyFastModeConfigForUpdate(text);
+    if (normalized.text === ensureTrailingNewline(text)) {
+        return {
+            ok: true,
+            status: 'ok',
+            actions: ['fastmode_config_current'],
+            blockers: [],
+            warnings: [],
+            detail: { config_path: configPath, default_profile: normalized.defaultProfile }
+        };
+    }
     let guardResult = null;
-    if (next !== text) {
-        guardResult = await writeCodexConfigGuarded({
-            configPath,
-            before: text,
-            mutate: () => `${next.trim()}\n`,
-            cause: 'project-update-fastmode-default-profile',
-            backupTag: 'project-update-fastmode-default-profile',
-            preserveFastUiKeys: true
-        });
-        if (!guardResult.ok) {
-            return {
-                ok: false,
-                status: 'failed',
-                actions: ['normalize_fastmode_default_profile_blocked'],
-                blockers: [`codex_config_guard:${guardResult.status}`],
-                warnings: [],
-                detail: { config_path: configPath, default_profile: misplaced, guard: guardResult }
-            };
-        }
+    guardResult = await writeCodexConfigGuarded({
+        configPath,
+        before: text,
+        mutate: () => normalized.text,
+        cause: 'project-update-fastmode-normalize',
+        backupTag: 'project-update-fastmode-normalize',
+        preserveFastUiKeys: true
+    });
+    if (!guardResult.ok) {
+        return {
+            ok: false,
+            status: 'failed',
+            actions: ['normalize_fastmode_config_blocked'],
+            blockers: [`codex_config_guard:${guardResult.status}`],
+            warnings: [],
+            detail: { config_path: configPath, default_profile: normalized.defaultProfile, guard: guardResult }
+        };
     }
-    return { ok: true, status: 'ok', actions: ['normalized_fastmode_default_profile'], blockers: [], warnings: [], detail: { config_path: configPath, default_profile: misplaced, guard: guardResult } };
+    return {
+        ok: true,
+        status: 'ok',
+        actions: normalized.actions.length ? normalized.actions : ['fastmode_config_current'],
+        blockers: [],
+        warnings: [],
+        detail: { config_path: configPath, default_profile: normalized.defaultProfile, guard: guardResult }
+    };
 }
 async function runHookTrustRefreshStage(root) {
     const result = await codexHookTrustDoctor(root, { fix: true, managed: true, actual: true });
@@ -456,6 +475,132 @@ function insertTopLevelTomlKey(text, line) {
         return `${line}\n${raw}`.trim() + '\n';
     return `${raw.slice(0, firstTable).trimEnd()}\n${line}\n\n${raw.slice(firstTable).trimStart()}`.trim() + '\n';
 }
+function normalizeLegacyFastModeConfigForUpdate(text) {
+    let next = String(text || '');
+    const actions = [];
+    const misplaced = tomlTableString(next, 'user.fast_mode', 'default_profile');
+    const topLevel = topLevelTomlString(next, 'default_profile');
+    if (misplaced) {
+        next = removeTomlTableKeyLocal(next, 'user.fast_mode', 'default_profile');
+        actions.push('normalized_fastmode_default_profile_location');
+    }
+    if (topLevel && topLevel !== 'sks-fast-high' && !tomlTableBlock(next, `profiles.${topLevel}`)) {
+        next = upsertTopLevelTomlStringLocal(next, 'default_profile', 'sks-fast-high');
+        actions.push('retargeted_missing_fastmode_default_profile_target');
+    }
+    else if (!topLevel && misplaced === 'sks-fast-high') {
+        next = insertTopLevelTomlKey(next, `default_profile = ${JSON.stringify(misplaced)}`);
+        actions.push('restored_fastmode_top_level_default_profile');
+    }
+    const beforeUi = next;
+    next = upsertTomlTableKeyIfAbsentLocal(next, 'user.fast_mode', 'visible = true');
+    next = upsertTomlTableKeyIfAbsentLocal(next, 'user.fast_mode', 'enabled = true');
+    if (next !== beforeUi)
+        actions.push('ensured_fastmode_ui_visibility');
+    const beforeProfile = next;
+    next = upsertTomlTableKeyLocal(next, 'profiles.sks-fast-high', `model = "${REQUIRED_CODEX_MODEL}"`);
+    next = upsertTomlTableKeyLocal(next, 'profiles.sks-fast-high', 'service_tier = "fast"');
+    if (next !== beforeProfile)
+        actions.push('normalized_sks_fast_high_profile');
+    return { text: ensureTrailingNewline(next), actions, defaultProfile: misplaced || topLevel };
+}
+function tomlTableString(text, table, key) {
+    const block = tomlTableBlock(text, table);
+    const match = block?.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"\\s*$`, 'm'));
+    return match?.[1] || null;
+}
+function topLevelTomlString(text, key) {
+    const top = String(text || '').slice(0, Math.max(0, String(text || '').search(/^\s*\[/m)));
+    const match = top.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"\\s*$`, 'm'));
+    return match?.[1] || null;
+}
+function tomlTableBlock(text, table) {
+    const lines = String(text || '').split(/\r?\n/);
+    const start = lines.findIndex((line) => tableHeaderMatches(line, table));
+    if (start < 0)
+        return null;
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (/^\s*\[[^\]]+\]\s*$/.test(lines[index] || '')) {
+            end = index;
+            break;
+        }
+    }
+    return lines.slice(start, end).join('\n');
+}
+function removeTomlTableKeyLocal(text, table, key) {
+    const lines = String(text || '').split(/\r?\n/);
+    let inTable = false;
+    const out = [];
+    for (const line of lines) {
+        if (/^\s*\[[^\]]+\]\s*$/.test(line))
+            inTable = tableHeaderMatches(line, table);
+        if (inTable && new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(line))
+            continue;
+        out.push(line);
+    }
+    return out.join('\n');
+}
+function upsertTomlTableKeyIfAbsentLocal(text, table, line) {
+    const key = tomlLineKey(line);
+    return tomlTableHasKey(text, table, key) ? text : upsertTomlTableKeyLocal(text, table, line);
+}
+function upsertTomlTableKeyLocal(text, table, line) {
+    const raw = String(text || '').trimEnd();
+    const key = tomlLineKey(line);
+    const lines = raw ? raw.split(/\r?\n/) : [];
+    const start = lines.findIndex((candidate) => tableHeaderMatches(candidate, table));
+    if (start < 0) {
+        return `${raw}${raw ? '\n\n' : ''}[${table}]\n${line}\n`;
+    }
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (/^\s*\[[^\]]+\]\s*$/.test(lines[index] || '')) {
+            end = index;
+            break;
+        }
+    }
+    for (let index = start + 1; index < end; index += 1) {
+        if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(lines[index] || '')) {
+            if (lines[index] === line)
+                return `${lines.join('\n')}\n`;
+            lines[index] = line;
+            return `${lines.join('\n')}\n`;
+        }
+    }
+    lines.splice(end, 0, line);
+    return `${lines.join('\n')}\n`;
+}
+function upsertTopLevelTomlStringLocal(text, key, value) {
+    const raw = String(text || '').trimEnd();
+    const line = `${key} = ${JSON.stringify(value)}`;
+    const lines = raw ? raw.split(/\r?\n/) : [];
+    const firstTable = lines.findIndex((candidate) => /^\s*\[[^\]]+\]\s*$/.test(candidate || ''));
+    const end = firstTable < 0 ? lines.length : firstTable;
+    for (let index = 0; index < end; index += 1) {
+        if (new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(lines[index] || '')) {
+            lines[index] = line;
+            return `${lines.join('\n')}\n`;
+        }
+    }
+    return insertTopLevelTomlKey(raw, line);
+}
+function tomlTableHasKey(text, table, key) {
+    const block = tomlTableBlock(text, table);
+    return Boolean(block && new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`, 'm').test(block));
+}
+function tableHeaderMatches(line, table) {
+    return new RegExp(`^\\s*\\[${escapeRegExp(table)}\\]\\s*$`).test(line || '');
+}
+function tomlLineKey(line) {
+    return String(line || '').split('=')[0]?.trim() || '';
+}
+function ensureTrailingNewline(text) {
+    return `${String(text || '').trim()}\n`;
+}
+function escapeRegExp(value) {
+    return String(value || '').replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 export async function ensureCurrentMigrationBeforeCommand(input) {
     const env = input.env || process.env;
     const command = input.command;

package/dist/core/version.js

@@ -1,2 +1,2 @@
-export const PACKAGE_VERSION = '5.6.1';
+export const PACKAGE_VERSION = '5.7.0';
 //# sourceMappingURL=version.js.map

package/dist/scripts/codex-lb-gpt55-fast-profile-check.js

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { codexFastModeDesktopStatus, codexLbConfigPath, configureCodexLb, ensureGlobalCodexFastModeDuringInstall, releaseCodexLbAuthHold, repairCodexLbAuth } from '../cli/install-helpers.js';
 import { repairCodexConfigStructure, splitCodexProjectConfigPolicy } from '../core/codex/codex-project-config-policy.js';
 import { parseCodexConfigToml, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
+import { REQUIRED_CODEX_MODEL } from '../core/codex-model-guard.js';
 const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-gpt55-fast-'));
 const home = path.join(tmp, 'home');
 const root = path.join(tmp, 'project');
@@ -44,7 +45,7 @@ await fs.writeFile(projectConfig, [
     'enabled = true',
     '',
     '[profiles.sks-fast-high]',
-    'model = "gpt-5.5"',
+    `model = "${REQUIRED_CODEX_MODEL}"`,
     'service_tier = "fast"',
     ''
 ].join('\n'));
@@ -85,7 +86,7 @@ function assertFastProfile(text, label) {
         ...validation.blockers,
         ...(parsed.default_profile === 'sks-fast-high' ? [] : ['default_profile_not_sks_fast_high']),
         ...(parsed.user?.fast_mode?.default_profile === undefined ? [] : ['default_profile_inside_user_fast_mode']),
-        ...(profile.model === 'gpt-5.5' ? [] : ['sks_fast_high_model_not_gpt55']),
+        ...(profile.model === REQUIRED_CODEX_MODEL ? [] : ['sks_fast_high_model_not_required_codex_model']),
         ...(profile.service_tier === 'fast' ? [] : ['sks_fast_high_service_tier_not_fast']),
         ...(provider.requires_openai_auth === true ? [] : ['codex_lb_requires_openai_auth_not_true']),
         ...(provider.wire_api === 'responses' ? [] : ['codex_lb_wire_api_not_responses']),

package/dist/scripts/packlist-performance-check.js

@@ -12,8 +12,10 @@ const MAX_UNPACKED = Number(process.env.SKS_MAX_UNPACKED_BYTES || 10 * 1024 * 10
 // (route-success-helpers.ts, seo-command.ts, ppt-command.ts, qa-loop-command.ts,
 // research-command.ts, image-ux-review-command.ts, mad-sks-command.ts,
 // sks-menubar.ts) with genuine new production logic, pushing the packed size
-// to ~2306 KiB. Kept modest headroom rather than a large jump.
-const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2340 * 1024);
+// to ~2306 KiB. 5.7.0 adds doctor/update migration repair coverage and publish
+// contract checks, pushing the packed tarball to ~2345 KiB. Keep a narrow cap
+// rather than giving the package a broad size budget.
+const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || 2350 * 1024);
 function runNpmPack() {
     const npmCli = process.env.npm_execpath; // set when invoked via `npm run`
     const npmCache = process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache');

package/dist/scripts/release-metadata-1-19-check.js

@@ -393,7 +393,18 @@ for (const gate of allManifestGates)
 assertGate(pkg.bin?.sks === 'dist/bin/sks.js', 'package runtime must use dist/bin/sks.js');
 assertGate(pkg.bin?.sneakoscope === 'dist/bin/sks.js', 'sneakoscope runtime must use dist/bin/sks.js');
 assertGate(!pkg.files?.includes('src'), 'package files must not include src runtime shadows');
-assertGate(pkg.scripts?.['publish:prep-ignore-scripts'] === 'npm run prepublishOnly', 'publish:prep-ignore-scripts must run the prepublishOnly release gate before lifecycle-disabled publish', { script: pkg.scripts?.['publish:prep-ignore-scripts'] || null });
+const publishPrepIgnoreScripts = String(pkg.scripts?.['publish:prep-ignore-scripts'] || '');
+assertGate(!/\bprepublishOnly\b/.test(publishPrepIgnoreScripts), 'publish:prep-ignore-scripts must not depend on npm lifecycle hooks that --ignore-scripts disables', { script: publishPrepIgnoreScripts || null });
+for (const required of [
+    'build:incremental',
+    'release:version-truth',
+    'publish:packlist-performance',
+    'package-published-contract-check.js',
+    'release-registry-check.js --require-unpublished --require-publish-auth',
+    'publish-tag:check'
+]) {
+    assertGate(publishPrepIgnoreScripts.includes(required), `publish:prep-ignore-scripts missing lifecycle-disabled publish preflight: ${required}`, { script: publishPrepIgnoreScripts || null });
+}
 assertGate(String(pkg.scripts?.['publish:ignore-scripts'] || '').includes('npm run publish:prep-ignore-scripts'), 'publish:ignore-scripts must run publish:prep-ignore-scripts before npm publish --ignore-scripts', { script: pkg.scripts?.['publish:ignore-scripts'] || null });
 assertGate(String(pkg.scripts?.['publish:ignore-scripts'] || '').includes('--ignore-scripts'), 'publish:ignore-scripts must keep npm lifecycle scripts disabled for the final publish', { script: pkg.scripts?.['publish:ignore-scripts'] || null });
 for (const file of requiredDocs) {