sneakoscope 6.0.2 → 6.1.0

package/dist/core/codex-control/codex-0139-sandbox-real-probe.js

@@ -16,7 +16,8 @@ export async function runCodex0139SandboxProfileAliasProbe(input) {
     const dryArgs = sandboxHelpMentionsAlias ? ['sandbox', '-P', ':read-only', '--', 'true'] : ['-P', ':read-only', '--version'];
     const dry = await runProcess(codexBin, dryArgs, { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 64 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
     const dryAccepted = dry.code === 0;
-    const ok = topLevelHelpMentionsAlias || sandboxHelpMentionsAlias;
+    const helpMentionsAlias = topLevelHelpMentionsAlias || sandboxHelpMentionsAlias;
+    const ok = helpMentionsAlias && dryAccepted;
     return {
         ok,
         mode: 'actual-cli',
@@ -26,15 +27,18 @@ export async function runCodex0139SandboxProfileAliasProbe(input) {
         stderr_tail: codex0139ProbeTail(`${help.stderr || ''}\n${sandboxHelp.stderr || ''}\n${dry.stderr || ''}`),
         artifact_paths: [],
         evidence: {
-            help_mentions_P: topLevelHelpMentionsAlias || sandboxHelpMentionsAlias,
+            help_mentions_P: helpMentionsAlias,
             top_level_help_mentions_P: topLevelHelpMentionsAlias,
             sandbox_help_mentions_P: sandboxHelpMentionsAlias,
             dry_command_attempted: true,
             dry_command_line: [codexBin, ...dryArgs],
             dry_command_accepted: dryAccepted,
-            dry_command_warning: dryAccepted ? null : 'help proof accepted; dry no-op unsupported in this CLI shape'
+            dry_command_warning: dryAccepted ? null : 'permissions-profile alias was advertised but the real sandbox no-op failed'
         },
-        blockers: ok ? [] : ['codex_sandbox_profile_alias_help_missing']
+        blockers: ok ? [] : [
+            ...(helpMentionsAlias ? [] : ['codex_sandbox_profile_alias_help_missing']),
+            ...(dryAccepted ? [] : ['codex_sandbox_profile_alias_real_command_failed'])
+        ]
     };
 }
 export async function runCodex0139SandboxProxyPreservationProbe(input) {
@@ -44,16 +48,23 @@ export async function runCodex0139SandboxProxyPreservationProbe(input) {
         return skippedCodex0139Probe('codex_cli_missing');
     const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `sandbox-proxy-${Date.now()}`);
     await ensureDir(tempDir);
-    const args = ['sandbox', '-P', ':read-only', '-C', tempDir, '--', 'true'];
+    const proxyState = {
+        HTTPS_PROXY: Boolean(process.env.HTTPS_PROXY),
+        HTTP_PROXY: Boolean(process.env.HTTP_PROXY),
+        ALL_PROXY: Boolean(process.env.ALL_PROXY)
+    };
+    const probeScript = 'process.stdout.write(JSON.stringify({HTTPS_PROXY:Boolean(process.env.HTTPS_PROXY),HTTP_PROXY:Boolean(process.env.HTTP_PROXY),ALL_PROXY:Boolean(process.env.ALL_PROXY)}))';
+    const args = ['sandbox', '-P', ':read-only', '-C', tempDir, '--', process.execPath, '-e', probeScript];
     const result = await runProcess(codexBin, args, {
         cwd: tempDir,
         timeoutMs: input.timeoutMs || 30000,
         maxOutputBytes: 64 * 1024
     }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
     const safeNoopRan = result.code === 0;
-    const proxyMarkerAvailable = Boolean(process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY);
-    const approvedEscalationPreservationScriptable = process.env.SKS_CODEX_0139_SANDBOX_PROXY_APPROVED_ESCALATION_RETRY === '1';
-    const ok = safeNoopRan && (!input.requireReal || approvedEscalationPreservationScriptable);
+    const observedProxyState = parseProxyState(result.stdout);
+    const proxyEnvironmentPreserved = observedProxyState !== null
+        && Object.entries(proxyState).every(([key, value]) => observedProxyState[key] === value);
+    const ok = safeNoopRan && proxyEnvironmentPreserved;
     return {
         ok,
         mode: 'actual-cli',
@@ -64,16 +75,31 @@ export async function runCodex0139SandboxProxyPreservationProbe(input) {
         artifact_paths: [tempDir],
         evidence: {
             safe_noop_ran: safeNoopRan,
-            proxy_marker_available: proxyMarkerAvailable,
-            proxy_marker_checked: proxyMarkerAvailable,
-            approved_escalation_preservation_scriptable: approvedEscalationPreservationScriptable,
-            approved_escalation_retry_env: 'SKS_CODEX_0139_SANDBOX_PROXY_APPROVED_ESCALATION_RETRY=1',
+            host_proxy_presence: proxyState,
+            sandbox_proxy_presence: observedProxyState,
+            proxy_marker_checked: true,
+            proxy_environment_preserved: proxyEnvironmentPreserved,
             permissions_profile: ':read-only'
         },
         blockers: ok ? [] : [
             ...(safeNoopRan ? [] : ['codex_sandbox_proxy_safe_noop_failed']),
-            ...(input.requireReal && !approvedEscalationPreservationScriptable ? ['codex_sandbox_proxy_escalation_preservation_not_safely_scriptable'] : [])
+            ...(proxyEnvironmentPreserved ? [] : ['codex_sandbox_proxy_environment_not_preserved'])
         ]
     };
 }
+function parseProxyState(text) {
+    try {
+        const parsed = JSON.parse(String(text || ''));
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        return {
+            HTTPS_PROXY: parsed.HTTPS_PROXY === true,
+            HTTP_PROXY: parsed.HTTP_PROXY === true,
+            ALL_PROXY: parsed.ALL_PROXY === true
+        };
+    }
+    catch {
+        return null;
+    }
+}
 //# sourceMappingURL=codex-0139-sandbox-real-probe.js.map

package/dist/core/codex-control/codex-0139-web-search-probe.js

@@ -14,10 +14,10 @@ export async function runCodex0139WebSearchRealProbe(input) {
         return skippedCodex0139Probe('codex_cli_missing');
     const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `web-search-${Date.now()}`);
     await ensureDir(tempDir);
-    await writeTextAtomic(path.join(tempDir, 'README.md'), 'Temporary Codex 0.139 web-search real probe workspace.\n');
+    await writeTextAtomic(path.join(tempDir, 'README.md'), 'Temporary Codex 0.144.1 web-search real probe workspace.\n');
     const outputFile = path.join(tempDir, 'last-message.txt');
-    const prompt = 'In code mode, use standalone web search to find the title of https://example.com or OpenAI Codex release 0.139. Return JSON {"used_web_search":true,"answer":"...","sources":[...]}.';
-    const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs: [] });
+    const prompt = 'In code mode, use standalone web search to find the title of https://example.com. Return JSON {"used_web_search":true,"answer":"...","sources":[...]}.';
+    const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs: ['-c', 'mcp_servers={}'] });
     const result = await runProcess(codexBin, args, {
         cwd: tempDir,
         timeoutMs: input.timeoutMs || 120000,
@@ -32,13 +32,13 @@ export async function runCodex0139WebSearchRealProbe(input) {
     const output = await fs.readFile(outputFile, 'utf8').catch(() => '');
     const combined = `${result.stdout || ''}\n${result.stderr || ''}\n${output}`;
     const sawWebSearchEvent = /\b(web[_ -]?search|search_result|sources?|tool_call|standalone web search)\b/i.test(combined);
-    const sawPlaintextResult = /(Example Domain|example\.com|OpenAI|Codex|0\.139)/i.test(combined);
+    const sawPlaintextResult = /(Example Domain|example\.com)/i.test(combined);
     const resultContainsExpectedMarker = /"used_web_search"\s*:\s*true|used_web_search/i.test(combined) || sawWebSearchEvent;
     const processExitedSuccessfully = result.code === 0;
-    const ok = sawPlaintextResult && resultContainsExpectedMarker;
+    const ok = processExitedSuccessfully && sawPlaintextResult && resultContainsExpectedMarker;
     if (ok) {
-        await writeJsonAtomic(path.join(input.root, '.sneakoscope', 'codex-0139-code-mode-web-search-policy.json'), {
-            schema: 'sks.codex-0139-code-mode-web-search-policy.v1',
+        await writeJsonAtomic(path.join(input.root, '.sneakoscope', 'codex-0144-code-mode-web-search-policy.json'), {
+            schema: 'sks.codex-0144-code-mode-web-search-policy.v1',
             ok: true,
             generated_at: new Date().toISOString(),
             allow_standalone_web_search_in_code_mode: true,
@@ -66,7 +66,10 @@ export async function runCodex0139WebSearchRealProbe(input) {
             process_warning: processExitedSuccessfully ? null : 'Codex emitted web-search evidence before process timeout/nonzero exit.',
             output_file: outputFile
         },
-        blockers: ok ? [] : ['codex_web_search_real_probe_failed']
+        blockers: ok ? [] : [
+            ...(processExitedSuccessfully ? [] : ['codex_web_search_process_failed_or_timed_out']),
+            ...(!sawPlaintextResult || !resultContainsExpectedMarker ? ['codex_web_search_real_probe_failed'] : [])
+        ]
     };
 }
 //# sourceMappingURL=codex-0139-web-search-probe.js.map

package/dist/core/codex-control/{codex-0142-capability.js → codex-0144-capability.js}

@@ -5,7 +5,7 @@ import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-ma
 import { compareSemverLike } from '../codex-compat/codex-version-policy.js';
 import { ensureDir, nowIso, packageRoot, readJson, runProcess, sha256, writeJsonAtomic } from '../fsx.js';
 import { resolveCodexRuntime } from '../codex-runtime/resolve-codex-runtime.js';
-export const CODEX_0142_FEATURE_KEYS = [
+export const CODEX_0144_FEATURE_KEYS = [
     'runtime_identity',
     'protocol_schema_generation',
     'multi_agent_mode_schema',
@@ -19,13 +19,13 @@ export const CODEX_0142_FEATURE_KEYS = [
     'remote_native_environment_schema',
     'app_server_overload_schema'
 ];
-export async function detectCodex0142Capability(input = {}) {
-    if (process.env.SKS_CODEX_0142_FAKE === '1')
+export async function detectCodex0144Capability(input = {}) {
+    if (process.env.SKS_CODEX_0144_FAKE === '1')
         return fakeCapability();
     const root = input.root || process.cwd();
     const runtime = await resolveCodexRuntime({
         explicitPath: input.codexBin || null,
-        requestedBy: 'codex-0142-capability'
+        requestedBy: 'codex-0144-capability'
     });
     if (!runtime.identity) {
         return blockedCapability('blocked', null, null, [...runtime.blockers]);
@@ -37,7 +37,7 @@ export async function detectCodex0142Capability(input = {}) {
     const states = featureStatesFromSchema(schemaProbe.text, schemaProbe.ok, appServerClientText);
     const blockers = [
         ...(versionOk ? [] : ['codex_0_142_required']),
-        ...(schemaProbe.ok ? [] : ['codex_0142_schema_generation_failed']),
+        ...(schemaProbe.ok ? [] : ['codex_0144_schema_generation_failed']),
         ...Object.values(states).flatMap((state) => state.blockers)
     ];
     const realEnough = blockers.length === 0
@@ -47,7 +47,7 @@ export async function detectCodex0142Capability(input = {}) {
         && schemaProbe.sha256 === CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256
         && Object.values(states).every((state) => state.certainty === 'actual' || state.certainty === 'discovered');
     return {
-        schema: 'sks.codex-0142-capability.v1',
+        schema: 'sks.codex-0144-capability.v1',
         generated_at: nowIso(),
         ok: blockers.length === 0,
         release_authorizing: realEnough,
@@ -60,23 +60,23 @@ export async function detectCodex0142Capability(input = {}) {
         feature_states: states,
         blockers,
         warnings: [
-            ...(realEnough ? [] : ['codex_0142_not_release_authorizing_until_schema_hash_and_all_required_real_probes_match']),
+            ...(realEnough ? [] : ['codex_0144_not_release_authorizing_until_schema_hash_and_all_required_real_probes_match']),
             ...(input.requireReal && blockers.length ? ['required_real_probe_blocked'] : [])
         ]
     };
 }
-export async function writeCodex0142CapabilityArtifacts(root, input = {}) {
+export async function writeCodex0144CapabilityArtifacts(root, input = {}) {
     const probeInput = { root };
     if (input.codexBin !== undefined)
         probeInput.codexBin = input.codexBin || null;
     if (input.requireReal !== undefined)
         probeInput.requireReal = input.requireReal;
-    const report = await detectCodex0142Capability(probeInput);
-    const rootArtifact = path.join(root, '.sneakoscope', 'codex', 'codex-0142-capability.json');
+    const report = await detectCodex0144Capability(probeInput);
+    const rootArtifact = path.join(root, '.sneakoscope', 'codex', 'codex-0144-capability.json');
     await writeJsonAtomic(rootArtifact, report);
     let missionArtifact = null;
     if (input.missionId) {
-        missionArtifact = path.join(root, '.sneakoscope', 'missions', input.missionId, 'codex-0142-capability.json');
+        missionArtifact = path.join(root, '.sneakoscope', 'missions', input.missionId, 'codex-0144-capability.json');
         await writeJsonAtomic(missionArtifact, report);
     }
     return { report, root_artifact: rootArtifact, mission_artifact: missionArtifact };
@@ -89,7 +89,7 @@ function featureStatesFromSchema(schemaText, schemaOk, appServerClientText = '')
             supported: found,
             certainty: found ? 'actual' : schemaOk ? 'unverified' : 'failed',
             evidence: found ? needles.map((needle) => `generated_schema_contains:${needle}`) : [],
-            blockers: found ? [] : [`codex_0142_${key}_not_verified`]
+            blockers: found ? [] : [`codex_0144_${key}_not_verified`]
         };
     };
     return {
@@ -132,11 +132,11 @@ function currentTimeState(schemaTextLower, schemaOk, appServerClientText) {
         supported: clientHandlesCurrentTime,
         certainty: clientHandlesCurrentTime ? 'discovered' : schemaOk ? 'unverified' : 'failed',
         evidence: clientHandlesCurrentTime ? ['sks_app_server_v2_client_handles:currentTime/read'] : [],
-        blockers: clientHandlesCurrentTime ? [] : ['codex_0142_current_time_read_handler_not_verified']
+        blockers: clientHandlesCurrentTime ? [] : ['codex_0144_current_time_read_handler_not_verified']
     };
 }
 async function schemaProbeForMode(root, codexBin, requireReal) {
-    if (!requireReal && process.env.SKS_CODEX_0142_REFRESH !== '1') {
+    if (!requireReal && process.env.SKS_CODEX_0144_REFRESH !== '1') {
         const shipped = await shippedSchemaProbe();
         if (shipped.ok)
             return shipped;
@@ -144,7 +144,7 @@ async function schemaProbeForMode(root, codexBin, requireReal) {
     return generateSchemaProbe(root, codexBin);
 }
 async function shippedSchemaProbe() {
-    const schemaRoot = path.join(packageRoot(), 'schemas', 'codex', 'app-server-0.142');
+    const schemaRoot = path.join(packageRoot(), 'schemas', 'codex', 'app-server-0.144');
     const files = await listFiles(schemaRoot).catch(() => []);
     if (!files.length)
         return { ok: false, text: 'shipped schema cache missing', sha256: null, mode: 'shipped-manifest-cache' };
@@ -166,7 +166,7 @@ async function generateSchemaProbe(root, codexBin) {
     if (cached?.ok === true && typeof cached.text === 'string' && cached.sha256) {
         return { ok: true, text: cached.text, sha256: cached.sha256, mode: 'real-schema' };
     }
-    const out = path.join(os.tmpdir(), `sks-codex-0142-schema-${process.pid}-${Date.now()}`);
+    const out = path.join(os.tmpdir(), `sks-codex-0144-schema-${process.pid}-${Date.now()}`);
     await ensureDir(out);
     const result = await runProcess(codexBin, ['app-server', 'generate-json-schema', '--out', out], {
         cwd: root,
@@ -208,7 +208,7 @@ async function schemaCachePath(root, codexBin) {
         platform: process.platform,
         arch: process.arch
     }));
-    return path.join(root, '.sneakoscope', 'cache', 'codex-0142-schema', `${key}.json`);
+    return path.join(root, '.sneakoscope', 'cache', 'codex-0144-schema', `${key}.json`);
 }
 function canonicalSchemaContent(file, text) {
     if (!file.endsWith('.json'))
@@ -240,14 +240,14 @@ async function listFiles(dir) {
     return out.sort();
 }
 function blockedCapability(probeMode, runtime, schemaSha, blockers) {
-    const state = Object.fromEntries(CODEX_0142_FEATURE_KEYS.map((key) => [key, {
+    const state = Object.fromEntries(CODEX_0144_FEATURE_KEYS.map((key) => [key, {
             supported: false,
             certainty: 'failed',
             evidence: [],
             blockers
         }]));
     return {
-        schema: 'sks.codex-0142-capability.v1',
+        schema: 'sks.codex-0144-capability.v1',
         generated_at: nowIso(),
         ok: false,
         release_authorizing: false,
@@ -263,14 +263,14 @@ function blockedCapability(probeMode, runtime, schemaSha, blockers) {
     };
 }
 function fakeCapability() {
-    const state = Object.fromEntries(CODEX_0142_FEATURE_KEYS.map((key) => [key, {
+    const state = Object.fromEntries(CODEX_0144_FEATURE_KEYS.map((key) => [key, {
             supported: true,
             certainty: 'hermetic_fixture',
             evidence: [`fixture:${key}`],
             blockers: []
         }]));
     return {
-        schema: 'sks.codex-0142-capability.v1',
+        schema: 'sks.codex-0144-capability.v1',
         generated_at: nowIso(),
         ok: true,
         release_authorizing: false,
@@ -285,4 +285,4 @@ function fakeCapability() {
         warnings: ['fixture_capability_is_not_release_authorizing']
     };
 }
-//# sourceMappingURL=codex-0142-capability.js.map
+//# sourceMappingURL=codex-0144-capability.js.map

package/dist/core/codex-control/codex-0144-collab-agent-real-probe.js

@@ -0,0 +1,63 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { findCodexBinary } from '../codex-adapter.js';
+import { ensureDir, runProcess } from '../fsx.js';
+import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
+const CURRENT_COLLAB_TOOLS = ['spawnAgent', 'sendInput', 'resumeAgent', 'wait', 'closeAgent'];
+export async function runCodex0144CollabAgentToolSchemaRealProbe(input) {
+    const started = Date.now();
+    const codexBin = input.codexBin || await findCodexBinary();
+    if (!codexBin)
+        return skippedCodex0139Probe('codex_cli_missing');
+    const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `collab-schema-${Date.now()}`);
+    await ensureDir(tempDir);
+    const args = ['app-server', 'generate-json-schema', '--out', tempDir];
+    const result = await runProcess(codexBin, args, {
+        cwd: input.root,
+        timeoutMs: Math.min(input.timeoutMs || 60_000, 60_000),
+        maxOutputBytes: 256 * 1024
+    }).catch((err) => ({ code: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err) }));
+    const schemaPath = path.join(tempDir, 'codex_app_server_protocol.v2.schemas.json');
+    const schema = await readJson(schemaPath);
+    const tools = Array.isArray(schema?.definitions?.CollabAgentTool?.enum)
+        ? schema.definitions.CollabAgentTool.enum.map(String)
+        : [];
+    const currentNamesPresent = CURRENT_COLLAB_TOOLS.every((name) => tools.includes(name));
+    const legacyInterruptAbsent = !tools.includes('interruptAgent') && !tools.includes('interrupt_agent');
+    const collabItemPresent = JSON.stringify(schema?.definitions?.ThreadItem || {}).includes('collabAgentToolCall')
+        || JSON.stringify(schema || {}).includes('collabAgentToolCall');
+    const processExitedSuccessfully = result.code === 0;
+    const ok = processExitedSuccessfully && currentNamesPresent && legacyInterruptAbsent && collabItemPresent;
+    return {
+        ok,
+        mode: 'actual-cli',
+        command_line: [codexBin, ...args],
+        duration_ms: Date.now() - started,
+        stdout_tail: codex0139ProbeTail(result.stdout),
+        stderr_tail: codex0139ProbeTail(result.stderr),
+        artifact_paths: [schemaPath],
+        evidence: {
+            schema_generated_by_runtime: processExitedSuccessfully,
+            collab_agent_thread_item_present: collabItemPresent,
+            collab_agent_tools: tools,
+            expected_collab_agent_tools: CURRENT_COLLAB_TOOLS,
+            current_names_present: currentNamesPresent,
+            legacy_interrupt_agent_absent: legacyInterruptAbsent
+        },
+        blockers: ok ? [] : [
+            ...(processExitedSuccessfully ? [] : ['codex_collab_agent_schema_generation_failed']),
+            ...(currentNamesPresent ? [] : ['codex_collab_agent_current_tool_names_missing']),
+            ...(legacyInterruptAbsent ? [] : ['codex_collab_agent_legacy_interrupt_name_present']),
+            ...(collabItemPresent ? [] : ['codex_collab_agent_thread_item_missing'])
+        ]
+    };
+}
+async function readJson(file) {
+    try {
+        return JSON.parse(await fs.readFile(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=codex-0144-collab-agent-real-probe.js.map

package/dist/core/codex-control/codex-model-metadata.js

@@ -57,19 +57,23 @@ async function readCodexCliMetadata(model) {
     return null;
 }
 function normalizePayload(payload, fallbackModel, source) {
-    const catalog = Array.isArray(payload?.models) ? payload.models : null;
+    const catalog = Array.isArray(payload?.data) ? payload.data : Array.isArray(payload?.models) ? payload.models : null;
     const reportedSelection = String(payload?.selected_model || payload?.current_model || payload?.active_model || '').trim();
     const requestedModel = String(fallbackModel || reportedSelection).trim();
     const row = catalog
         ? requestedModel
-            ? catalog.find((candidate) => String(candidate?.id || candidate?.model || candidate?.name || '') === requestedModel) || null
+            ? catalog.find((candidate) => String(candidate?.id || candidate?.model || candidate?.slug || candidate?.name || '') === requestedModel) || null
             : null
         : payload?.model_metadata || payload?.metadata || payload;
     if (!row) {
         return metadata(requestedModel, [], 'medium', source, [requestedModel ? 'codex_model_not_found_in_advertised_catalog' : 'codex_model_selection_unknown']);
     }
-    const efforts = normalizeAdvertisedEfforts(row?.advertised_efforts || row?.advertisedEfforts || row?.reasoning_efforts || row?.reasoningEfforts || payload?.advertised_efforts);
-    return metadata(String(row?.model || row?.id || row?.name || requestedModel), efforts, row?.default_effort || row?.defaultEffort || payload?.default_effort || 'medium', source, efforts.length ? [] : ['codex_model_metadata_efforts_missing']);
+    const effortRows = row?.supportedReasoningEfforts || row?.supported_reasoning_levels || row?.supported_reasoning_efforts || [];
+    const structuredEfforts = Array.isArray(effortRows)
+        ? effortRows.map((entry) => entry?.reasoningEffort || entry?.effort || entry)
+        : [];
+    const efforts = normalizeAdvertisedEfforts(structuredEfforts.length ? structuredEfforts : row?.advertised_efforts || row?.advertisedEfforts || row?.reasoning_efforts || row?.reasoningEfforts || payload?.advertised_efforts);
+    return metadata(String(row?.model || row?.id || row?.slug || row?.name || requestedModel), efforts, row?.default_reasoning_level || row?.defaultReasoningLevel || row?.default_effort || row?.defaultEffort || payload?.default_effort || 'medium', source, efforts.length ? [] : ['codex_model_metadata_efforts_missing']);
 }
 function metadata(model, efforts, defaultEffort, source, blockers) {
     const advertised = normalizeAdvertisedEfforts(efforts);

package/dist/core/codex-control/codex-multi-agent-event-normalizer.js

@@ -1,6 +1,10 @@
 export function normalizeCodexMultiAgentEventName(name) {
     const sourceName = String(name || '');
-    const normalized = sourceName.trim().toLowerCase().replace(/[-.\s]+/g, '_');
+    const normalized = sourceName
+        .trim()
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .toLowerCase()
+        .replace(/[-.\s]+/g, '_');
     if (normalized === 'start_agent' || normalized === 'spawn_agent' || normalized === 'subagent_start') {
         return { canonical: 'start_agent', stage: 'start', source_name: sourceName };
     }

package/dist/core/codex-control/codex-reliability-shield.js

@@ -1,8 +1,11 @@
 import { nowIso } from '../fsx.js';
 export const CODEX_RELIABILITY_SHIELD_SCHEMA = 'sks.codex-reliability-shield.v1';
+export function codexTimeoutClassForRoute(route, fallback = 'standard') {
+    return /^\$?naruto$/i.test(String(route || '').trim()) ? 'long' : fallback;
+}
 export function normalizeCodexReliabilityPolicy(input) {
     const policy = input.reliabilityPolicy || {};
-    const timeoutClass = policy.timeoutClass || (input.tier === 'orchestrator' ? 'long' : 'standard');
+    const timeoutClass = codexTimeoutClassForRoute(input.route, policy.timeoutClass || (input.tier === 'orchestrator' ? 'long' : 'standard'));
     const fallbackIdle = timeoutClass === 'short' ? 20_000 : timeoutClass === 'long' ? 180_000 : 60_000;
     return {
         maxEmptyResultRetries: clampInt(policy.maxEmptyResultRetries, 1, 0, 3),

package/dist/core/codex-control/codex-sdk-adapter.js

@@ -1,9 +1,12 @@
+import os from 'node:os';
 import path from 'node:path';
 import { appendJsonlBounded } from '../fsx.js';
 import { buildCodexExecutionPolicy, buildCodexSdkConfig } from './codex-sdk-config-policy.js';
 import { buildCodexSdkEnv } from './codex-sdk-env-policy.js';
 import { translateCodexSdkEvent } from './codex-event-translator.js';
+import { codexTimeoutClassForRoute } from './codex-reliability-shield.js';
 import { resolveCodexRuntime } from '../codex-runtime/resolve-codex-runtime.js';
+import { codexLbToolCatalogPath, ensureCodexLbToolCatalog, isCodexLbGpt56Model } from '../codex-lb/codex-lb-tool-catalog.js';
 export async function runRealCodexSdkTask(input, policy) {
     const mod = await import('@openai/codex-sdk');
     const Codex = mod.Codex || mod.default?.Codex || mod.default;
@@ -15,11 +18,30 @@ export async function runRealCodexSdkTask(input, policy) {
     });
     if (!runtime.identity)
         throw new Error(`Codex runtime not found: ${runtime.blockers.join(',')}`);
+    const toolCatalog = await prepareCodexLbToolCatalog(input, policy);
+    if (toolCatalog.required && !toolCatalog.ok) {
+        return {
+            ok: false,
+            sdkThreadId: '',
+            sdkRunId: null,
+            events: [],
+            finalResponse: '',
+            structuredOutput: null,
+            blockers: [...new Set(['codex_lb_gpt56_tool_catalog_unavailable', ...(toolCatalog.blockers || [])])],
+            liveEventsWritten: false,
+            runtimeIdentity: runtime.identity,
+            executionPolicy: buildCodexExecutionPolicy(input),
+            raw: { tool_catalog: toolCatalog }
+        };
+    }
     const executionPolicy = buildCodexExecutionPolicy(input);
+    const runtimeConfig = toolCatalog.ok && toolCatalog.path
+        ? { ...policy.config, model_catalog_json: toolCatalog.path }
+        : policy.config;
     const codex = new Codex({
         codexPathOverride: runtime.identity.realpath,
         env: policy.env,
-        config: policy.config
+        config: runtimeConfig
     });
     const threadOptions = {
         workingDirectory: input.cwd,
@@ -71,7 +93,7 @@ export async function runRealCodexSdkTask(input, policy) {
             liveEventsWritten,
             runtimeIdentity: runtime.identity,
             executionPolicy,
-            raw: { timeout_ms: timeoutMs, aborted: true }
+            raw: { timeout_ms: timeoutMs, aborted: true, tool_catalog: toolCatalog }
         };
     }
     finally {
@@ -90,7 +112,7 @@ export async function runRealCodexSdkTask(input, policy) {
             liveEventsWritten,
             runtimeIdentity: runtime.identity,
             executionPolicy,
-            raw: { failed_event: failed }
+            raw: { failed_event: failed, tool_catalog: toolCatalog }
         };
     }
     const structuredOutput = parseStructuredOutput(finalResponse, Boolean(input.outputSchema));
@@ -105,7 +127,7 @@ export async function runRealCodexSdkTask(input, policy) {
         runtimeIdentity: runtime.identity,
         executionPolicy,
         liveEventsWritten,
-        raw: { item_count: events.filter((event) => String(event?.type || '').startsWith('item.')).length }
+        raw: { item_count: events.filter((event) => String(event?.type || '').startsWith('item.')).length, tool_catalog: toolCatalog }
     };
 }
 export function codexSdkRuntimePolicies(input) {
@@ -113,11 +135,36 @@ export function codexSdkRuntimePolicies(input) {
     const config = buildCodexSdkConfig(input);
     return { env, config };
 }
-function codexSdkTurnTimeoutMs(input) {
+async function prepareCodexLbToolCatalog(input, policy) {
+    const provider = String(policy.config.model_provider || '');
+    const model = String(policy.config.model || input.model || '');
+    if (provider !== 'codex-lb' || !isCodexLbGpt56Model(model)) {
+        return { schema: 'sks.codex-lb-tool-catalog.v1', ok: true, required: false, status: 'not_required', path: null, blockers: [] };
+    }
+    const providers = policy.config.model_providers;
+    const baseUrl = String(providers?.['codex-lb']?.base_url || policy.env.CODEX_LB_BASE_URL || '');
+    const apiKey = String(policy.env.CODEX_LB_API_KEY || '');
+    const isolatedCodexHome = String(policy.env.CODEX_HOME || '');
+    if (!isolatedCodexHome) {
+        return { schema: 'sks.codex-lb-tool-catalog.v1', ok: false, required: true, status: 'blocked', path: null, blockers: ['codex_sdk_isolated_codex_home_missing'] };
+    }
+    // Model catalogs contain no bearer secret and are identity-bound, owner-only
+    // files. Keep one validated global cache so isolated worker CODEX_HOME roots do
+    // not each spend a model-call slot fetching the same catalog.
+    const sharedCodexHome = String(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'));
+    return ensureCodexLbToolCatalog({
+        codexHome: isolatedCodexHome,
+        outputPath: codexLbToolCatalogPath(sharedCodexHome),
+        baseUrl,
+        apiKey,
+        timeoutMs: 5000
+    });
+}
+export function codexSdkTurnTimeoutMs(input) {
     const explicit = Number(process.env.SKS_CODEX_SDK_TURN_TIMEOUT_MS);
     if (Number.isFinite(explicit) && explicit > 0)
         return Math.max(1000, Math.floor(explicit));
-    const timeoutClass = input.reliabilityPolicy?.timeoutClass || (input.tier === 'orchestrator' ? 'long' : 'standard');
+    const timeoutClass = codexTimeoutClassForRoute(input.route, input.reliabilityPolicy?.timeoutClass || (input.tier === 'orchestrator' ? 'long' : 'standard'));
     if (timeoutClass === 'short')
         return 45_000;
     if (timeoutClass === 'long')

package/dist/core/codex-control/codex-sdk-config-policy.js

@@ -1,3 +1,4 @@
+import { mapCodexSdkSandboxPolicy } from './codex-sdk-sandbox-policy.js';
 export function buildCodexSdkConfig(input) {
     const model = String(input.model || process.env.SKS_CODEX_MODEL || process.env.CODEX_MODEL || '').trim();
     const serviceTier = String(input.serviceTier || process.env.SKS_SERVICE_TIER || 'fast');
@@ -37,7 +38,7 @@ export function buildCodexSdkConfig(input) {
     return config;
 }
 export function buildCodexExecutionPolicy(input) {
-    const sandbox = String(input.requestedScopeContract?.sandbox || process.env.SKS_CODEX_SANDBOX || 'workspace-write');
+    const sandbox = mapCodexSdkSandboxPolicy(input).sandboxMode;
     const approval = String(process.env.SKS_CODEX_APPROVAL || (String(input.tier || '') === 'verifier' ? 'never' : 'on-request'));
     const network = String(process.env.SKS_CODEX_NETWORK || 'disabled');
     const webSearch = String(process.env.SKS_CODEX_WEB_SEARCH || 'cached');

package/dist/core/codex-control/codex-sdk-sandbox-policy.js

@@ -1,15 +1,18 @@
 export function mapCodexSdkSandboxPolicy(input) {
     const contract = input.requestedScopeContract || {};
-    if (input.sandboxPolicy === 'read-only')
+    if (input.sandboxPolicy === 'read-only' || contract.read_only === true || contract.sandbox === 'read-only') {
         return { ok: true, sandboxMode: 'read-only', blockers: [] };
+    }
     if (input.sandboxPolicy === 'workspace-write') {
         const allowed = Array.isArray(contract.allowed_paths) ? contract.allowed_paths : [];
         const writes = Array.isArray(contract.write_paths) ? contract.write_paths : [];
         const scoped = allowed.length > 0 || writes.length > 0;
+        if (!scoped)
+            return { ok: true, sandboxMode: 'read-only', blockers: [] };
         return {
-            ok: scoped,
+            ok: true,
             sandboxMode: 'workspace-write',
-            blockers: scoped ? [] : ['codex_sdk_workspace_write_scope_contract_missing']
+            blockers: []
         };
     }
     const confirmed = contract.user_confirmed_full_access === true && contract.mad_sks_authorized === true;