sneakoscope 6.0.2 → 6.1.0

package/dist/core/routes/constants.js

@@ -47,5 +47,5 @@ export const RECOMMENDED_SKILLS = [
 // Route-level effort names are scheduling intents, not model compatibility
 // claims. Actual per-model options come from Codex runtime metadata; SKS never
 // derives them from a model slug.
-export const ALLOWED_REASONING_EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'ultra']);
+export const ALLOWED_REASONING_EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max', 'ultra']);
 //# sourceMappingURL=constants.js.map

package/dist/core/routes/evidence.js

@@ -3,12 +3,12 @@ export const CODEX_IN_APP_BROWSER_EVIDENCE_SOURCE = 'codex_in_app_browser';
 export const CODEX_CHROME_EXTENSION_EVIDENCE_SOURCE = 'codex_chrome_extension';
 export const CODEX_WEB_VERIFICATION_EVIDENCE_SOURCE = CODEX_IN_APP_BROWSER_EVIDENCE_SOURCE;
 export const CODEX_IMAGEGEN_EVIDENCE_SOURCE = 'codex_app_imagegen_gpt_image_2';
-export const CODEX_IN_APP_BROWSER_DOC_URL = 'https://developers.openai.com/codex/app/browser';
-export const CODEX_CHROME_EXTENSION_DOC_URL = 'https://developers.openai.com/codex/app/chrome-extension';
-export const CODEX_COMPUTER_USE_DOC_URL = 'https://developers.openai.com/codex/app/computer-use';
+export const CODEX_IN_APP_BROWSER_DOC_URL = 'https://learn.chatgpt.com/docs/browser';
+export const CODEX_CHROME_EXTENSION_DOC_URL = 'https://learn.chatgpt.com/docs/chrome-extension';
+export const CODEX_COMPUTER_USE_DOC_URL = 'https://learn.chatgpt.com/docs/computer-use';
 export const CODEX_RECORD_REPLAY_DOC_URL = 'https://developers.openai.com/codex/record-and-replay';
 export const CODEX_APP_SERVER_DOC_URL = 'https://developers.openai.com/codex/app-server';
-export const CODEX_APP_IMAGE_GENERATION_DOC_URL = 'https://developers.openai.com/codex/app/features#image-generation';
+export const CODEX_APP_IMAGE_GENERATION_DOC_URL = 'https://learn.chatgpt.com/docs/image-generation';
 export const OPENAI_IMAGE_GENERATION_DOC_URL = 'https://developers.openai.com/api/docs/guides/image-generation';
 export const OPENAI_CHATGPT_IMAGES_2_DOC_URL = 'https://openai.com/index/introducing-chatgpt-images-2-0/';
 export const OPENAI_GPT_IMAGE_2_MODEL_DOC_URL = 'https://developers.openai.com/api/docs/models/gpt-image-2';

package/dist/core/routes/model-mode-router.js

@@ -3,6 +3,9 @@ export function resolveSksModelMode(args = []) {
     const hasGlm = normalized.includes('--glm');
     const hasMad = normalized.includes('--mad') || normalized.includes('--MAD') || normalized.includes('--mad-sks');
     const hasNaruto = normalized.includes('--naruto') || normalized.includes('naruto');
+    if (hasGlm && hasNaruto && !hasMad) {
+        return decision('classic-naruto', false, true, 'naruto_command_glm_override_forbidden', normalized);
+    }
     if (hasGlm && hasNaruto) {
         return decision('glm-naruto', true, false, 'explicit_--glm_with_naruto', normalized);
     }

package/dist/core/routes/ppt-policy.js

@@ -21,6 +21,6 @@ export function pptPipelineAllowlistPolicyText() {
     const conditionalSkills = PPT_CONDITIONAL_SKILL_ALLOWLIST.length
         ? PPT_CONDITIONAL_SKILL_ALLOWLIST.map((entry) => `${entry.skill}=${entry.condition}`).join('; ')
         : 'none';
-    return `PPT pipeline allowlist: during $PPT design/render work, ignore installed skills and MCPs that are not explicitly part of the $PPT pipeline. The purpose is to prevent AI-like generic presentation design: decorative gradients, nested cards, vague SaaS visuals, and style choices not grounded in the audience, source material, Product Design plugin evidence, getdesign fallback reference, or the project design cache. Required SKS skills are ${PPT_PIPELINE_SKILL_ALLOWLIST.join(', ')}. Product Design plugin tools are allowed and preferred for design work: ${PRODUCT_DESIGN_PLUGIN_TOOL_ALLOWLIST.join(', ')}. Use ${PRODUCT_DESIGN_PLUGIN.id} first for get-context/user-context intake, research/ideate exploration, prototype/image-to-code/url-to-code artifact direction, audit/design-qa review, and share handoff when available. The imagegen skill is required for $PPT so Codex App can invoke official built-in $imagegen/gpt-image-2 for every generated raster asset or generated visual-review image; do not route PPT imagery through direct API fallback. Do not use generic design skills such as ${PRODUCT_DESIGN_LEGACY_DESIGN_FALLBACK_SKILLS.join(', ')} for $PPT just because they are installed. $PPT design must use Product Design plugin first; if unavailable, use getdesign-reference plus the built-in PPT design implementation pipeline: existing ${DESIGN_SYSTEM_SSOT.authority_file} when present, ${DESIGN_SYSTEM_SSOT.builder_prompt} as fallback builder prompt when missing, and route-local ppt-style-tokens.json as the fused design projection. Conditional skills/MCPs are allowed only when their condition is sealed in the contract: ${conditionalSkills}; ${PPT_PIPELINE_MCP_ALLOWLIST.map((entry) => `${entry.mcp}=${entry.condition}`).join('; ')}. Fact, image, and review evidence are first-class artifacts: gather user-provided context and required web/Context7 evidence into ppt-fact-ledger.json, block unsupported critical claims, plan required image resources through ppt-image-asset-ledger.json, then run a bounded review loop recorded in ppt-review-policy.json, ppt-review-ledger.json, and ppt-iteration-report.json. Required raster asset or generated visual-review evidence must come from Codex App $imagegen/gpt-image-2; direct API fallback, placeholder files, and prose-only substitutes do not satisfy the route gate. The review loop caps full-deck passes at 2, slide retries at 2, requires P0/P1 issue count to be zero, targets score >= 0.88, and stops when improvement delta is below 0.03 or evidence is missing. For Codex App visual critique, invoke $imagegen/gpt-image-2 (${CODEX_APP_IMAGE_GENERATION_DOC_URL}) when required; never simulate missing gpt-image-2 output. If required image-review evidence is unavailable, record the blocker instead of passing the gate. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY}`;
+    return `PPT pipeline allowlist: during $PPT design/render work, ignore installed skills and MCPs that are not explicitly part of the $PPT pipeline. The purpose is to prevent AI-like generic presentation design: decorative gradients, nested cards, vague SaaS visuals, and style choices not grounded in the audience, source material, Product Design plugin evidence, getdesign fallback reference, or the project design cache. Required SKS skills are ${PPT_PIPELINE_SKILL_ALLOWLIST.join(', ')}. Product Design plugin tools are allowed and preferred for design work: ${PRODUCT_DESIGN_PLUGIN_TOOL_ALLOWLIST.join(', ')}. Use ${PRODUCT_DESIGN_PLUGIN.id} first for get-context/user-context intake, research/ideate exploration, index/image-to-code/url-to-code artifact direction, audit/design-qa review, and share handoff when available. The imagegen skill is required for $PPT so Codex App can invoke official built-in $imagegen/gpt-image-2 for every generated raster asset or generated visual-review image; do not route PPT imagery through direct API fallback. Do not use generic design skills such as ${PRODUCT_DESIGN_LEGACY_DESIGN_FALLBACK_SKILLS.join(', ')} for $PPT just because they are installed. $PPT design must use Product Design plugin first; if unavailable, use getdesign-reference plus the built-in PPT design implementation pipeline: existing ${DESIGN_SYSTEM_SSOT.authority_file} when present, ${DESIGN_SYSTEM_SSOT.builder_prompt} as fallback builder prompt when missing, and route-local ppt-style-tokens.json as the fused design projection. Conditional skills/MCPs are allowed only when their condition is sealed in the contract: ${conditionalSkills}; ${PPT_PIPELINE_MCP_ALLOWLIST.map((entry) => `${entry.mcp}=${entry.condition}`).join('; ')}. Fact, image, and review evidence are first-class artifacts: gather user-provided context and required web/Context7 evidence into ppt-fact-ledger.json, block unsupported critical claims, plan required image resources through ppt-image-asset-ledger.json, then run a bounded review loop recorded in ppt-review-policy.json, ppt-review-ledger.json, and ppt-iteration-report.json. Required raster asset or generated visual-review evidence must come from Codex App $imagegen/gpt-image-2; direct API fallback, placeholder files, and prose-only substitutes do not satisfy the route gate. The review loop caps full-deck passes at 2, slide retries at 2, requires P0/P1 issue count to be zero, targets score >= 0.88, and stops when improvement delta is below 0.03 or evidence is missing. For Codex App visual critique, invoke $imagegen/gpt-image-2 (${CODEX_APP_IMAGE_GENERATION_DOC_URL}) when required; never simulate missing gpt-image-2 output. If required image-review evidence is unavailable, record the blocker instead of passing the gate. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY}`;
 }
 //# sourceMappingURL=ppt-policy.js.map

package/dist/core/routes.js

@@ -611,7 +611,7 @@ export const COMMAND_CATALOG = [
     { name: 'update', usage: 'sks update [check|now] [--version <version>] [--json] [--dry-run]', description: 'Check npm for the latest SKS release and update the global package by default; use `check` for status-only.' },
     { name: 'uninstall', usage: 'sks uninstall [--dry-run] [--yes] [--keep-config] [--keep-data] [--purge-projects] [--json]', description: 'Remove SKS global skills, hooks, menu bar, state, temp files, and optional project residue while preserving user-owned content by default.' },
     { name: 'deps', usage: 'sks deps check [--json] [--yes]', description: 'Check Node/npm, Codex CLI, and Zellij readiness; pass --yes to repair missing Codex CLI/Zellij tooling when supported.' },
-    { name: 'codex', usage: 'sks codex compatibility|version|doctor|schema|0.142 [--json]', description: 'Check Codex CLI rust-v0.142.0 compatibility, installed version, 0.142 manifest/capability evidence, inherited legacy baselines, and vendored hook schema snapshot freshness.' },
+    { name: 'codex', usage: 'sks codex compatibility|version|doctor|schema|0.144 [--json]', description: 'Check Codex CLI rust-v0.144.1 compatibility, installed version, current manifest/capability evidence, inherited historical baselines, and vendored hook schema snapshot freshness.' },
     { name: 'codex-app', usage: 'sks codex-app [check|glm-profile install|set-openrouter-key --api-key-stdin|product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App install, GLM/OpenRouter model profile visibility, codex-lb key-entry guidance, Product Design plugin readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, and Codex CLI 0.130.0+ remote-control availability.' },
     { name: 'codex-native', usage: 'sks codex-native status|feature-broker|invocation-plan|init-deep [--json]', description: 'Inspect Codex Native feature broker readiness, invocation routing, pattern evidence, and managed memory setup.' },
     { name: 'hooks', usage: 'sks hooks explain|status|trust-report|replay|codex-validate|warning-check ... [--json]', description: 'Explain Codex hook events, validate vendored latest 10-event output schemas, replay fixtures, and enforce warning-zero SKS hook policies under the 0.134 compatibility matrix.' },
@@ -636,7 +636,7 @@ export const COMMAND_CATALOG = [
     { name: 'recallpulse', usage: 'sks recallpulse run|status|eval|governance|checklist <mission-id|latest>', description: 'Run report-only RecallPulse active recall, durable status, proof capsule, evidence envelope, and governance checks.' },
     { name: 'pipeline', usage: 'sks pipeline status|resume|plan|answer ...', description: 'Inspect the active skill-first route, materialized execution plan, ambiguity gates, and completion gates.' },
     { name: 'guard', usage: 'sks guard check [--json]', description: 'Check SKS harness self-protection lock, fingerprints, and source-repo exception state.' },
-    { name: 'conflicts', usage: 'sks conflicts check|prompt [--json]', description: 'Detect other Codex harnesses such as OMX/DCodex and print the GPT-5.5 high cleanup prompt.' },
+    { name: 'conflicts', usage: 'sks conflicts check|prompt [--json]', description: 'Detect other Codex harnesses such as OMX/DCodex and print the GPT-5.6 high cleanup prompt.' },
     { name: 'versioning', usage: 'sks versioning status|bump|disable [--json]', description: 'Manage explicit project version syncs; SKS does not install Git pre-commit hooks.' },
     { name: 'features', usage: 'sks features list|check|inventory [--json] [--write-docs]', description: 'Build and validate the feature registry that maps CLI commands, hidden handlers, dollar routes, app skill aliases, and skills.' },
     { name: 'all-features', usage: 'sks all-features selftest --mock [--json]', description: 'Run the mock all-features contract selftest for feature registry, proof, Voxel TriWiki, and failure-contract coverage.' },
@@ -655,7 +655,7 @@ export const COMMAND_CATALOG = [
     { name: 'db', usage: 'sks db policy|scan|mcp-config|classify|check ...', description: 'Inspect and enforce database/Supabase safety policy.' },
     { name: 'eval', usage: 'sks eval run|compare|thresholds ...', description: 'Run deterministic context-quality and performance evidence checks.' },
     { name: 'harness', usage: 'sks harness fixture|review [--json]', description: 'Run Harness Growth Factory fixtures for forgetting, skills, experiments, tool taxonomy, permissions, MultiAgentV2, and Zellij views.' },
-    { name: 'perf', usage: 'sks perf run|workflow|cold-start [--json] [--iterations N]', description: 'Measure structured GPT-5.5/SKS performance budgets, including cold-start, Proof Field workflow decisions, and fast-lane evidence.' },
+    { name: 'perf', usage: 'sks perf run|workflow|cold-start [--json] [--iterations N]', description: 'Measure structured GPT-5.6/SKS performance budgets, including cold-start, Proof Field workflow decisions, and fast-lane evidence.' },
     { name: 'bench', usage: 'sks bench core|route-fixtures|blackbox|trust-kernel [--json]', description: 'Measure core trust-kernel hot paths and write performance budget artifacts.' },
     { name: 'proof', usage: 'sks proof show|latest|validate|export|smoke [--json|--md]', description: 'Show, validate, export, or smoke-write the unified Completion Proof Engine surface.' },
     { name: 'trust', usage: 'sks trust report|validate|status|explain [latest|mission-id] [--json]', description: 'Validate route contracts, evidence indexes, stale/mock evidence, and trust report blockers.' },
@@ -1129,6 +1129,7 @@ export function subagentExecutionPolicyText(route, prompt = '') {
         'Native multi-session policy: REQUIRED for code-changing or execution work in this route.',
         'The selected SKS route itself authorizes route-owned worker/reviewer native sessions; the user does not need to separately ask for helper sessions when the default Naruto pipeline is active.',
         'Before editing, the parent orchestrator must visibly state the SKS route, split independent write scopes, and run worker/reviewer native sessions whenever the route can be split safely.',
+        'Determine native tool availability from the callable tool manifest in the current turn and from actual call results. If functions.exec or functions.collaboration.spawn_agent is exposed, use it; never report those tools unavailable because an obsolete CLI alias is missing.',
         'Run workers in parallel only with disjoint ownership. The parent owns integration, verification, and final evidence.',
         'If native sessions are unavailable or the work cannot be safely split, record explicit unavailable/unsplittable native-session evidence before editing.',
         noUnrequestedFallbackCodePolicyText()
@@ -1162,19 +1163,17 @@ export function routeReasoning(route, prompt = '') {
     return reasoning('medium', 'simple_fulfillment');
 }
 function narutoRouteReasoning(text = '') {
-    if (/(frontier|autoresearch|novelty|hypothesis|falsify|forensic|from-chat-img|가설|포렌식)/i.test(text))
-        return reasoning('xhigh', 'naruto_research_or_forensic_signal');
-    if (/(research|current docs?|library|framework|sdk|api|database|supabase|sql|migration|security|permission|mad|release|publish|deploy|commit|push|architecture|algorithm|리서치|문서|데이터베이스|마이그레이션|보안|권한|배포|커밋|푸쉬)/i.test(text))
-        return reasoning('high', 'naruto_knowledge_safety_or_release_signal');
-    if (/(tmux|zellij|terminal|cli|cmd|warp|tool(?:\s|-)?call|hook|router|routing|pipeline|multi[-\s]?pane|pane|process|config|터미널|라우팅|파이프라인|훅|도구|툴)/i.test(text))
-        return reasoning('medium', 'naruto_tooling_or_runtime_signal');
-    if (/(tiny|simple|small|one[-\s]?line|typo|copy|label|spacing|rename|text|readme|docs?|간단|단순|오타|문구|라벨|간격|색상)/i.test(text))
-        return reasoning('low', 'naruto_simple_bounded_work_signal');
-    return reasoning('medium', 'naruto_default_balanced_reasoning');
+    if (/(frontier|autoresearch|novelty|hypothesis|falsify|forensic|from-chat-img|research|current docs?|library|framework|sdk|api|database|supabase|sql|migration|security|permission|mad|release|publish|deploy|commit|push|architecture|algorithm|strategy|planning|integration|refactor|가설|포렌식|리서치|문서|데이터베이스|마이그레이션|보안|권한|배포|커밋|푸쉬|전략|기획|통합|리팩터)/i.test(text))
+        return reasoning('max', 'naruto_complex_or_high_risk_signal');
+    return reasoning('xhigh', 'naruto_gpt56_baseline');
 }
 export function reasoningProfileName(effort) {
     if (effort === 'low')
         return 'sks-task-low';
+    if (effort === 'ultra')
+        return 'sks-research-ultra';
+    if (effort === 'max')
+        return 'sks-research-max';
     if (effort === 'xhigh')
         return 'sks-research-xhigh';
     if (effort === 'high')

package/dist/core/secret-redaction.js

@@ -17,6 +17,9 @@ const SECRET_PATTERNS = [
     /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
     /\bghp_[A-Za-z0-9_]{20,}\b/g,
     /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}\b/gi,
+    /\bAuthorization\s*:\s*[^\r\n,}]+/gi,
+    /\b(?:Cookie|Set-Cookie)\s*:\s*[^\r\n,}]+/gi,
+    /\b[A-Za-z0-9-]+-Auth\s*:\s*[^\r\n,}]+/gi,
     /\b(?:access[_-]?token|api[_-]?key|secret|password|token)\s*[:=]\s*["']?[A-Za-z0-9._~+/=-]{12,}["']?/gi
 ];
 export const REDACTION_MARKER = '[redacted]';
@@ -62,6 +65,7 @@ export function containsPlaintextSecret(value, env = process.env) {
 }
 function secretKeyName(key = '') {
     return /(?:access[_-]?token|api[_-]?key|secret|password|token)$/i.test(String(key || ''))
+        || /(?:^|[_-])(?:auth|authorization|headers?|cookies?|bearer|credentials?|env)$/i.test(String(key || ''))
         || SECRET_ENV_NAMES.includes(String(key || '').toUpperCase());
 }
 function redactKeyValue(match) {

package/dist/core/triwiki/code-pack.js

@@ -14,14 +14,20 @@ export function codePackPrevPath(root) {
     return path.join(codePackDir(root), 'code-pack.prev.json');
 }
 export function buildCodePack(root, index, tokenBudget = DEFAULT_CODE_PACK_TOKEN_BUDGET) {
+    const normalizedBudget = Number.isFinite(tokenBudget) && tokenBudget >= 0
+        ? Math.floor(tokenBudget)
+        : DEFAULT_CODE_PACK_TOKEN_BUDGET;
     const entries = [];
+    let totalTokenCost = 0;
     for (const card of index.modules) {
         const entry = buildEntryForModule(card);
         if (!entry)
             continue;
+        if (totalTokenCost + entry.token_cost > normalizedBudget)
+            continue;
         entries.push(entry);
+        totalTokenCost += entry.token_cost;
     }
-    const totalTokenCost = entries.reduce((sum, entry) => sum + entry.token_cost, 0);
     return {
         schema: CODE_PACK_SCHEMA,
         generated_at: nowIso(),
@@ -29,7 +35,7 @@ export function buildCodePack(root, index, tokenBudget = DEFAULT_CODE_PACK_TOKEN
         source_file_count: index.scanned_file_count,
         index_digest: computeIndexDigest(index),
         entries,
-        token_budget: tokenBudget,
+        token_budget: normalizedBudget,
         total_token_cost: totalTokenCost
     };
 }

package/dist/core/triwiki/triwiki-cache-key.js

@@ -9,7 +9,11 @@ const DEFAULT_EXCLUDED_DIRS = new Set([
     '.sneakoscope/reports',
     '.sneakoscope/missions',
     '.sneakoscope/quarantine',
-    'dist'
+    'dist',
+    '.claude',
+    '.cache',
+    'coverage',
+    'build'
 ]);
 export function computeTriWikiCacheKey(input) {
     const root = path.resolve(input.root);
@@ -69,7 +73,12 @@ export function collectInputFiles(root, patterns) {
             unsupported.push(`unsupported_brace_glob:${pattern}`);
             continue;
         }
-        const matches = expandInputPattern(root, pattern);
+        const normalized = normalizePattern(pattern);
+        if (!isSafeRelativePattern(root, normalized)) {
+            unsupported.push(`outside_root_or_unsafe_input:${pattern}`);
+            continue;
+        }
+        const matches = expandInputPattern(root, normalized);
         if (!matches.length) {
             const literal = path.resolve(root, pattern);
             if (fs.existsSync(literal))
@@ -87,44 +96,75 @@ export function collectInputFiles(root, patterns) {
         const hashed = hashPathIfPresent(root, rel);
         if (hashed.missing.length)
             missing.push(rel);
+        else if (hashed.unsupported?.length)
+            unsupported.push(...hashed.unsupported);
         else if (hashed.record)
             records.push(hashed.record);
     }
     return { records, missing: [...new Set(missing)].sort(), unsupported: [...new Set(unsupported)].sort() };
 }
-function expandInputPattern(root, pattern) {
-    const normalized = normalizePattern(pattern);
+function expandInputPattern(root, normalized) {
     if (!normalized.includes('*')) {
         const absolute = path.resolve(root, normalized);
-        if (!fs.existsSync(absolute))
+        if (!fs.existsSync(absolute) || !safeInputPath(root, absolute, true))
             return [];
         return listFiles(root, absolute);
     }
     const regex = globToRegex(normalized);
-    return listFiles(root, root).filter((rel) => regex.test(rel));
+    const prefix = staticGlobPrefix(normalized);
+    const start = path.resolve(root, prefix || '.');
+    if (!isWithinRoot(root, start) || !safeInputPath(root, start, false))
+        return [];
+    return listFiles(root, start).filter((rel) => regex.test(rel));
 }
 function normalizePattern(pattern) {
     return pattern.replace(/\\/g, '/').replace(/^\.\//, '');
 }
 function globToRegex(pattern) {
-    const escaped = pattern
-        .split('')
-        .map((char) => {
-        if (char === '*')
-            return '*';
-        return /[\\^$+?.()|{}[\]]/.test(char) ? `\\${char}` : char;
-    })
-        .join('');
-    const regex = escaped
-        .replace(/\*\*\//g, '(?:.*/)?')
-        .replace(/\*\*/g, '.*')
-        .replace(/\*/g, '[^/]*');
-    return new RegExp(`^${regex}$`);
+    let regex = '^';
+    for (let index = 0; index < pattern.length; index += 1) {
+        const char = pattern[index] || '';
+        if (char === '*' && pattern[index + 1] === '*') {
+            if (pattern[index + 2] === '/') {
+                regex += '(?:.*/)?';
+                index += 2;
+            }
+            else {
+                regex += '.*';
+                index += 1;
+            }
+            continue;
+        }
+        if (char === '*') {
+            regex += '[^/]*';
+            continue;
+        }
+        regex += /[\\^$+?.()|{}[\]]/.test(char) ? `\\${char}` : char;
+    }
+    return new RegExp(`${regex}$`);
+}
+function staticGlobPrefix(pattern) {
+    const segments = pattern.split('/');
+    const fixed = segments.slice(0, segments.findIndex((segment) => segment.includes('*')) < 0
+        ? segments.length
+        : segments.findIndex((segment) => segment.includes('*')));
+    return fixed.join('/');
+}
+function isSafeRelativePattern(root, pattern) {
+    if (!pattern || path.isAbsolute(pattern) || pattern === '..' || pattern.startsWith('../'))
+        return false;
+    return isWithinRoot(root, path.resolve(root, pattern.replace(/\*.*$/, '')));
+}
+function isWithinRoot(root, candidate) {
+    const relative = path.relative(path.resolve(root), path.resolve(candidate));
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
 }
 function listFiles(root, start) {
     const out = [];
     if (!fs.existsSync(start))
         return out;
+    if (!safeInputPath(root, start, true))
+        return out;
     let stat;
     try {
         stat = fs.lstatSync(start);
@@ -174,6 +214,9 @@ function isMissingOrInaccessible(error) {
     return code === 'ENOENT' || code === 'EACCES' || code === 'ENOTDIR' || code === 'EPERM';
 }
 function isExcluded(rel) {
+    const segments = normalizePattern(rel).split('/');
+    if (segments.some((segment) => segment === 'node_modules' || segment === '.git' || segment === '.claude' || segment === '.cache'))
+        return true;
     for (const dir of DEFAULT_EXCLUDED_DIRS) {
         if (rel === dir || rel.startsWith(`${dir}/`))
             return true;
@@ -182,8 +225,12 @@ function isExcluded(rel) {
 }
 function hashPathIfPresent(root, rel) {
     const absolute = path.resolve(root, rel);
+    if (!isWithinRoot(root, absolute))
+        return { hash: 'unsupported', missing: [], unsupported: [`outside_root:${rel}`] };
     if (!fs.existsSync(absolute))
         return { hash: 'missing', missing: [rel] };
+    if (!safeInputPath(root, absolute, true))
+        return { hash: 'unsupported', missing: [], unsupported: [`symlink_escape_or_unsafe_input:${rel}`] };
     const stat = fs.lstatSync(absolute);
     const mode = stat.isSymbolicLink() ? 'symlink' : stat.isDirectory() ? 'dir' : 'file';
     if (stat.isDirectory()) {
@@ -198,25 +245,57 @@ function hashPathIfPresent(root, rel) {
         const hash = hashJson({ rel, target, mode, outside_root: outsideRoot });
         return { hash, missing: [], record: { path: normalizePattern(rel), hash, size: target.length, mode } };
     }
+    if (!stat.isFile())
+        return { hash: 'unsupported', missing: [], unsupported: [`non_regular_input:${rel}`] };
     const hash = hashFileChunked(absolute, stat.size);
     return { hash, missing: [], record: { path: normalizePattern(rel), hash, size: stat.size, mode } };
 }
+function safeInputPath(root, candidate, allowFinalSymlink) {
+    const resolvedRoot = path.resolve(root);
+    const resolvedCandidate = path.resolve(candidate);
+    if (!isWithinRoot(resolvedRoot, resolvedCandidate))
+        return false;
+    const relative = path.relative(resolvedRoot, resolvedCandidate);
+    const segments = relative ? relative.split(path.sep).filter(Boolean) : [];
+    let cursor = resolvedRoot;
+    for (let index = 0; index < segments.length; index += 1) {
+        cursor = path.join(cursor, segments[index]);
+        let stat;
+        try {
+            stat = fs.lstatSync(cursor);
+        }
+        catch (error) {
+            return false;
+        }
+        if (stat.isSymbolicLink() && !(allowFinalSymlink && index === segments.length - 1))
+            return false;
+    }
+    try {
+        const finalStat = fs.lstatSync(resolvedCandidate);
+        if (finalStat.isSymbolicLink() && allowFinalSymlink)
+            return true;
+        const realRoot = fs.realpathSync(resolvedRoot);
+        const realCandidate = fs.realpathSync(resolvedCandidate);
+        return isWithinRoot(realRoot, realCandidate);
+    }
+    catch (error) {
+        return false;
+    }
+}
 function hashFileChunked(file, size) {
     const h = crypto.createHash('sha256');
     h.update(`size:${size}:`);
     const chunk = 256 * 1024;
     const fd = fs.openSync(file, 'r');
     try {
-        if (size <= chunk * 3) {
-            h.update(fs.readFileSync(file));
-        }
-        else {
-            for (const offset of [0, Math.max(0, Math.floor(size / 2) - Math.floor(chunk / 2)), Math.max(0, size - chunk)]) {
-                const buffer = Buffer.alloc(chunk);
-                const read = fs.readSync(fd, buffer, 0, chunk, offset);
-                h.update(`@${offset}:`);
-                h.update(buffer.subarray(0, read));
-            }
+        const buffer = Buffer.allocUnsafe(chunk);
+        let offset = 0;
+        while (offset < size) {
+            const read = fs.readSync(fd, buffer, 0, Math.min(buffer.length, size - offset), offset);
+            if (read <= 0)
+                break;
+            h.update(buffer.subarray(0, read));
+            offset += read;
         }
     }
     finally {

package/dist/core/triwiki-attention.js

@@ -229,8 +229,10 @@ function uniqueAttentionRows(rows = [], max = 4) {
  * independent of the policy-claim RGBA/geometric selection above: code entries carry
  * no meaningful mission-coordinate proximity, so competing them against policy claims
  * for the same fixed slot budget would make their appearance arbitrary. Each surviving
- * entry becomes a use_first row (bare id, no fabricated RGBA) plus a hydrate_first row
- * pointing at its source citations, so a consumer knows which real files back it. */
+ * high-trust, clean entry becomes a use_first row (bare id, no fabricated RGBA).
+ * Lower-trust or wrongness-linked entries are hydrate-only so negative evidence can
+ * never be promoted into the high-trust fast path. Citation-backed hydrate rows tell
+ * consumers which real files must be read before relying on a summary. */
 function codePackAttentionRows(codePackEntries = [], tokenBudget = 2000, wrongnessByModule = {}) {
     const moduleWrongness = (entryId) => Number(wrongnessByModule[String(entryId || '').replace(/^code:/, '')] || 0);
     const sorted = [...(codePackEntries || [])]
@@ -245,13 +247,18 @@ function codePackAttentionRows(codePackEntries = [], tokenBudget = 2000, wrongne
         if (tokens + cost > tokenBudget)
             continue;
         tokens += cost;
-        useFirst.push([entry.id, null, null]);
         const citationPaths = Array.isArray(entry.citations) ? entry.citations.map((c) => c?.path).filter(Boolean) : [];
         const citationReason = citationPaths.length ? `code_citations:${citationPaths.join(',')}` : null;
         const wrongCount = moduleWrongness(entry.id);
-        // A module with past wrongness earns a hydrate row even without citations, tagged
-        // with a wrongness:<count> signal so a consumer re-reads it before trusting recall.
-        const reason = wrongCount > 0 ? `wrongness:${wrongCount}${citationReason ? `;${citationReason}` : ''}` : citationReason;
+        const action = trustAction(entry);
+        if (action === 'use' && wrongCount === 0)
+            useFirst.push([entry.id, null, null]);
+        const reasons = [
+            wrongCount > 0 ? `wrongness:${wrongCount}` : null,
+            action !== 'use' ? `trust_action:${action}` : null,
+            citationReason
+        ].filter(Boolean);
+        const reason = reasons.join(';');
         if (reason)
             hydrateFirst.push([entry.id, reason]);
     }