sneakoscope 6.0.2 → 6.0.3

package/README.md

@@ -25,7 +25,7 @@ sneakoscope is a proof-first Codex trust layer for bounded agent workflows, sear
 
 Sneakoscope Codex (`sks`) is a Codex CLI and Codex App harness for people who want parallel AI coding without losing proof. It gives Codex a simple front door, a dynamic worker swarm, a local dashboard, TriWiki project memory, and release gates that separate machine evidence from LLM opinion.
 
-Current release: SKS **6.0.2**. This release lets Codex own the complete model catalog—including current and future GPT-5.6 options—without SKS allowlists or silent model replacement. It also bounds agent, loop, and release concurrency to keep Codex Desktop responsive, preserves explicit user model/provider choices during repair and updates, and adds a clean-build verification path for `npm publish --ignore-scripts`. See [CHANGELOG.md](CHANGELOG.md).
+Current release: SKS **6.0.3**. Normal Codex sessions continue to inherit the complete Codex catalog without silent replacement. Naruto workers now use a scoped, live-catalog-verified GPT-5.6 policy: Terra `xhigh/max` for coding, Sol `max` for refactoring/planning/strategy/integration, and Luna `xhigh/max` for E2E/browser/Computer Use/GUI verification. This release also fixes menu-bar auth restarts, cross-version menu updates, status checkmarks, dashboard readiness, and stale update badges. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Install
 
@@ -107,6 +107,8 @@ It shows the v5 flow: one-line install, `$Plan`, `$Work`/`$Swarm`, `sks review`,
 - macOS optional: menu bar integration and `/usr/bin/open`
   - The menubar icon shows and hides itself automatically as the Codex desktop app launches/quits; set `quit_with_codex: true` in `~/.codex/sks-menubar/config.json` to have the menubar fully quit with Codex instead of just hiding (default `false`).
   - Native input dialogs (API keys, codex-lb setup) pass secrets to `sks` via `--api-key-stdin` instead of a visible Terminal window or process arguments.
+  - Auth/provider changes wait for the ChatGPT/Codex app to exit and reopen by bundle id; a failed restart is reported as a failed menu action.
+  - Update installs always rebuild the companion with the newly installed SKS package, preventing a previous-version updater from restoring a stale menu binary.
   - The menubar dropdown's `View Last Log` item opens the most recent background action's log file, so you don't need to keep a Terminal window open to see command output.
   - `sks menubar status --json` reports a `codex_sync` object with `bundle_id`, `codex_running`, and `icon_visible_expected` to show Codex-lifecycle detection state.
 - Zellij optional but recommended for terminal worker panes

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "6.0.2"
+version = "6.0.3"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "6.0.2"
+version = "6.0.3"
 edition = "2021"
 
 [dependencies]

package/dist/bin/fast-inline.js

@@ -151,3 +151,8 @@ exports.rootJsonFastInline = rootJsonFastInline;
 exports.doctorJsonFastInline = doctorJsonFastInline;
 exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
 exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;
+
+exports.rootJsonFastInline = rootJsonFastInline;
+exports.doctorJsonFastInline = doctorJsonFastInline;
+exports.narutoHelpJsonFastInline = narutoHelpJsonFastInline;
+exports.hookUserPromptSubmitPerfInline = hookUserPromptSubmitPerfInline;

package/dist/bin/sks-dispatch.js

@@ -60,3 +60,5 @@ async function runSks(args) {
 }
 
 exports.runSks = runSks;
+
+exports.runSks = runSks;

package/dist/cli/install-helpers.js

@@ -1397,6 +1397,30 @@ export async function releaseCodexLbAuthHold(opts = {}) {
     const authPath = opts.authPath || codexAuthPath(home);
     const backupPath = opts.backupPath || codexAuthChatgptBackupPath(home);
     const configPath = opts.configPath || codexLbConfigPath(home);
+    const currentAuthText = await readText(authPath, '');
+    const trimmedCurrent = currentAuthText.trim();
+    // Repeated "Use ChatGPT OAuth" is idempotent. If OAuth/browser auth is
+    // already active, a historical backup is unnecessary; only ensure that the
+    // codex-lb provider is no longer selected.
+    const currentAuthMode = codexAuthModeSummary(currentAuthText);
+    if (!opts.force && (currentAuthMode.mode === 'chatgpt_oauth' || currentAuthMode.mode === 'browser_marker')) {
+        let providerUnselected = false;
+        let providerError = null;
+        if (!opts.keepProvider) {
+            const unselected = await unselectCodexLbProvider({ ...opts, home, configPath });
+            if (unselected.status === 'unselected' || unselected.status === 'not_selected')
+                providerUnselected = true;
+            else if (unselected.status === 'failed')
+                providerError = unselected.error || unselected.reason || 'unselect_failed';
+        }
+        return {
+            status: providerError ? 'failed' : 'already_chatgpt',
+            auth_path: authPath,
+            backup_path: backupPath,
+            provider_unselected: providerUnselected,
+            provider_error: providerError
+        };
+    }
     const backupExists = await exists(backupPath);
     const backupText = backupExists ? await readText(backupPath, '') : '';
     if (!backupExists || !backupText.trim()) {
@@ -1416,8 +1440,6 @@ export async function releaseCodexLbAuthHold(opts = {}) {
             provider_unselected: false
         };
     }
-    const currentAuthText = await readText(authPath, '');
-    const trimmedCurrent = currentAuthText.trim();
     // If auth.json already looks like ChatGPT OAuth (user re-logged in some other way), don't
     // clobber it — but still honor the deselect request so the OAuth blob takes effect.
     if (trimmedCurrent && hasChatgptOAuthTokens(currentAuthText) && !opts.force) {
@@ -1910,7 +1932,9 @@ function normalizeCodexFastModeUiConfigOnce(text = '', opts = {}) {
         'browser_use', 'browser_use_external', 'image_generation', 'in_app_browser',
         'guardian_approval', 'tool_suggest', 'plugins'
     ]) {
-        next = removeTomlTableKey(next, 'features', legacyFlag);
+        // Earlier SKS releases wrote these flags as `true`. Remove only that
+        // managed legacy value; an explicit user `false` remains authoritative.
+        next = removeTomlTableKey(next, 'features', legacyFlag, 'true');
     }
     if (opts.forceFastMode === true) {
         next = upsertTopLevelTomlString(next, 'service_tier', 'fast');
@@ -1990,7 +2014,7 @@ function removeTopLevelTomlKeyIfValue(text = '', key = '', value = '') {
     const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"${escapeRegExp(value)}"\\s*(?:#.*)?$`);
     return lines.filter((line, index) => index >= end || !keyPattern.test(line)).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
 }
-function removeTomlTableKey(text, table, key) {
+function removeTomlTableKey(text, table, key, expectedValue = null) {
     const lines = String(text || '').trimEnd().split('\n');
     if (lines.length === 1 && lines[0] === '')
         return '';
@@ -2008,7 +2032,10 @@ function removeTomlTableKey(text, table, key) {
             break;
         }
     }
-    const keyPattern = new RegExp(`^\\s*${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`);
+    const valuePattern = expectedValue === null
+        ? ''
+        : `\\s*${escapeRegExp(String(expectedValue))}\\s*(?:#.*)?$`;
+    const keyPattern = new RegExp(`^\\s*${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=${valuePattern}`);
     return lines.filter((line, index) => index <= start || index >= end || !keyPattern.test(line)).join('\n').replace(/\n{3,}/g, '\n\n');
 }
 function upsertTomlTableKey(text, table, line) {
@@ -2162,7 +2189,15 @@ export function codexFastModeDesktopStatus(text = '') {
         service_tier: validation.service_tier ?? null,
         model: validation.model ?? null,
         legacy_keys: validation.legacy_keys,
-        validation
+        validation: {
+            ok: validation.ok,
+            blockers: validation.blockers,
+            parse_error: validation.parse_error || null,
+            service_tier: validation.service_tier ?? null,
+            model: validation.model ?? null,
+            model_reasoning_effort: validation.model_reasoning_effort ?? null,
+            legacy_keys: validation.legacy_keys
+        }
     };
 }
 function upsertTopLevelTomlBoolean(text, key, value) {

package/dist/commands/codex-app.js

@@ -12,8 +12,11 @@ import { resolveCodexAppExecutionProfile } from '../core/codex-app/codex-app-exe
 import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
 import { doctorCodexAppGlmProfile, installCodexAppGlmProfile } from '../core/codex-app/glm-profile-installer.js';
 import { promptForOpenRouterKeyHidden, writeStoredOpenRouterKey } from '../core/providers/openrouter/openrouter-secret-store.js';
+import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'check';
+    if (action === 'restart')
+        return printCodexAppResult(args, await restartCodexApp());
     if (action === 'remote-control' || action === 'remote')
         return codexAppRemoteControlCommand(args.slice(1));
     if (action === 'harness-matrix') {
@@ -47,15 +50,17 @@ export async function run(_command, args = []) {
         }
         const record = await writeStoredOpenRouterKey(key);
         const profile = await installCodexAppGlmProfile({ root, apply: true });
+        const restart = await restartCodexApp({ enabled: flag(args, '--restart-app') || flag(args, '--restart') });
         const result = {
             schema: 'sks.codex-app-openrouter-key.v1',
-            ok: profile.ok,
-            status: profile.ok ? 'stored' : 'stored_profile_blocked',
+            ok: Boolean(profile.ok && restart.ok),
+            status: !profile.ok ? 'stored_profile_blocked' : restart.ok ? 'stored' : 'stored_restart_blocked',
             key_preview: record.key_preview,
             raw_key_recorded: false,
             secret_store: 'sks-openrouter-secret-store',
             glm_profile: profile,
-            blockers: profile.blockers || [],
+            restart_app: restart,
+            blockers: [...(profile.blockers || []), ...(restart.blockers || [])],
             warnings: profile.warnings || []
         };
         return printCodexAppResult(args, result);

package/dist/commands/codex-lb.js

@@ -126,8 +126,10 @@ export async function run(command, args = []) {
         const host = status.base_url;
         if (!host) {
             const result = { schema: 'sks.codex-lb-set-key.v1', ok: false, status: 'not_configured' };
-            if (flag(args, '--json'))
+            if (flag(args, '--json')) {
+                process.exitCode = 1;
                 return printJson(result);
+            }
             console.error('codex-lb is not configured yet. Run: sks codex-lb setup --host <domain> --api-key-stdin');
             process.exitCode = 1;
             return;
@@ -135,21 +137,26 @@ export async function run(command, args = []) {
         const newKey = await resolveNewApiKey(args);
         if (!newKey) {
             const result = { schema: 'sks.codex-lb-set-key.v1', ok: false, status: 'missing_api_key' };
-            if (flag(args, '--json'))
+            if (flag(args, '--json')) {
+                process.exitCode = 1;
                 return printJson(result);
+            }
             console.error('No new API key provided. Run: sks codex-lb set-key --api-key-stdin   (or --api-key <key>)');
             process.exitCode = 1;
             return;
         }
         const result = await configureCodexLb({ host, apiKey: newKey, authMode: flag(args, '--preserve-auth') ? 'preserve' : 'codex-lb', forceCodexLbApiKeyAuth: !flag(args, '--preserve-auth') });
         const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok));
-        const output = { ...result, action: 'set-key', restart_app: restart };
+        const ok = Boolean(result.ok && restart?.ok !== false);
+        const output = { ...result, ok, action: 'set-key', restart_app: restart };
+        if (!ok)
+            process.exitCode = 1;
         if (flag(args, '--json'))
             return printJson(output);
         console.log(result.ok ? `codex-lb API key updated (${result.base_url || host}).` : `codex-lb key update failed: ${result.status}${result.error ? `: ${result.error}` : ''}`);
         if (restart?.status === 'restarted')
             console.log('Codex App restarted for the new codex-lb auth mode.');
-        if (!result.ok)
+        if (!ok)
             process.exitCode = 1;
         return;
     }
@@ -157,21 +164,30 @@ export async function run(command, args = []) {
         // Switch auth mode -> codex-lb (API key). Re-selects the provider and re-syncs auth.
         const result = await repairCodexLbAuth({ forceCodexLbApiKeyAuth: true, authMode: 'codex-lb', forceFastMode: !flag(args, '--no-fast') });
         const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok));
+        const ok = Boolean(result.ok && restart?.ok !== false);
+        const shaped = { ...result, ok, mode: 'codex-lb', restart_app: restart };
+        if (!ok)
+            process.exitCode = 1;
         if (flag(args, '--json'))
-            return printJson({ ...result, mode: 'codex-lb', restart_app: restart });
+            return printJson(shaped);
         console.log(result.ok ? 'Auth mode: codex-lb selected (API key).' : `Switch to codex-lb failed: ${result.status}${result.error ? `: ${result.error}` : ''}`);
         if (restart?.status === 'restarted')
             console.log('Codex App restarted for codex-lb auth.');
-        if (!result.ok)
+        if (!ok)
             process.exitCode = 1;
         return;
     }
     if (action === 'use-oauth' || action === 'use-chatgpt') {
         // Switch auth mode -> ChatGPT OAuth. Restores the saved OAuth login if present.
         const result = await releaseCodexLbAuthHold({ force: flag(args, '--force') });
-        const restart = await maybeRestartCodexAppForAuthSwitch(args, !['no_backup', 'auth_in_use', 'failed'].includes(result.status));
+        const authOk = !['no_backup', 'auth_in_use', 'failed'].includes(result.status);
+        const restart = await maybeRestartCodexAppForAuthSwitch(args, authOk);
+        const ok = Boolean(authOk && restart?.ok !== false);
+        const shaped = { ...result, ok, mode: 'oauth', restart_app: restart };
+        if (!ok)
+            process.exitCode = 1;
         if (flag(args, '--json'))
-            return printJson({ ...result, mode: 'oauth', restart_app: restart });
+            return printJson(shaped);
         if (result.status === 'no_backup') {
             console.log('No saved ChatGPT OAuth credentials to restore. Switch to OAuth by logging in:');
             console.log('  codex login');
@@ -210,8 +226,10 @@ export async function run(command, args = []) {
                     'Or: sks codex-lb setup --host <domain> --api-key-stdin --yes'
                 ]
             };
-            if (flag(args, '--json'))
+            if (flag(args, '--json')) {
+                process.exitCode = 1;
                 return printJson(result);
+            }
             console.error('codex-lb API key is not configured.');
             console.error('Run:');
             console.error('  sks codex-lb setup');
@@ -222,6 +240,8 @@ export async function run(command, args = []) {
         }
         if (flag(args, '--plan')) {
             const result = { schema: 'sks.codex-lb-setup-plan-result.v1', ok: plan.blockers.length === 0, plan, writes: false, expected_actions: plan.expected_actions, persistence: plan.persistence };
+            if (!result.ok)
+                process.exitCode = 1;
             if (flag(args, '--json'))
                 return printJson(result);
             process.stdout.write(renderCodexLbSetupPlan(plan));
@@ -235,8 +255,10 @@ export async function run(command, args = []) {
             const confirm = (await ask('Apply this codex-lb setup plan? [y/N] ')).trim();
             if (!/^(y|yes|예|네|응)$/i.test(confirm)) {
                 const result = { schema: 'sks.codex-lb-setup.v1', ok: false, status: 'cancelled', plan, applied_actions: [] };
-                if (flag(args, '--json'))
+                if (flag(args, '--json')) {
+                    process.exitCode = 1;
                     return printJson(result);
+                }
                 console.log('codex-lb setup cancelled.');
                 process.exitCode = 1;
                 return;
@@ -298,12 +320,15 @@ export async function run(command, args = []) {
             shaped.applied_actions = [...(shaped.applied_actions || []), { type: 'run_health_check', target: 'codex-lb response chain', ok: true }];
         if (options.health)
             shaped.chain_health = result.ok ? await checkCodexLbResponseChain(result, { force: true, root }) : null;
+        shaped.ok = Boolean(result.ok && restart?.ok !== false);
+        if (!shaped.ok)
+            process.exitCode = 1;
         if (flag(args, '--json'))
             return printJson(shaped);
         console.log(`codex-lb configured: ${result.base_url || result.status}`);
         if (shaped.persistence?.warning)
             console.log(`warning: ${shaped.persistence.warning}`);
-        if (!result.ok)
+        if (!shaped.ok)
             process.exitCode = 1;
         return;
     }
@@ -345,7 +370,7 @@ export async function run(command, args = []) {
 }
 async function maybeRestartCodexAppForAuthSwitch(args = [], enabled) {
     if (!enabled)
-        return { schema: 'sks.codex-app-restart.v1', ok: true, status: 'skipped', skipped: true, reason: 'previous_step_failed', app_name: 'Codex', blockers: [] };
+        return { schema: 'sks.codex-app-restart.v1', ok: true, status: 'skipped', skipped: true, reason: 'previous_step_failed', app_name: 'ChatGPT', bundle_id: 'com.openai.codex', blockers: [] };
     const requested = flag(args, '--restart-app') || flag(args, '--restart');
     const shouldRestart = requested || (!flag(args, '--json') && !flag(args, '--no-restart-app') && !flag(args, '--no-restart'));
     return restartCodexApp({ enabled: shouldRestart });