sneakoscope 6.0.2 → 6.1.0

package/dist/core/codex-app.js

@@ -9,7 +9,8 @@ import { PRODUCT_DESIGN_AUTO_INSTALL_ENV, ensureProductDesignPluginInstalled, pr
 import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from './codex-app/glm-model-profile.js';
 import { GLM_52_OPENROUTER_MODEL } from './providers/glm/glm-52-settings.js';
 import { resolveOpenRouterApiKey } from './providers/openrouter/openrouter-secret-store.js';
-import { codexLbEnvPath, parseShellEnvValue } from './codex-lb/codex-lb-env.js';
+import { codexLbEnvPath, loadCodexLbEnv, parseShellEnvValue, readCodexLbModelCatalog } from './codex-lb/codex-lb-env.js';
+import { redactString } from './secret-redaction.js';
 export const CODEX_APP_DOCS_URL = 'https://developers.openai.com/codex/app/features';
 export const CODEX_CHANGELOG_URL = 'https://developers.openai.com/codex/changelog';
 export const CODEX_ACCESS_TOKENS_DOCS_URL = 'https://developers.openai.com/codex/enterprise/access-tokens';
@@ -35,6 +36,8 @@ export function codexAppCandidatePaths(home = os.homedir(), env = process.env) {
     if (env.SKS_CODEX_APP_PATH)
         candidates.push(env.SKS_CODEX_APP_PATH);
     if (process.platform === 'darwin') {
+        candidates.push('/Applications/ChatGPT.app');
+        candidates.push(path.join(home || '', 'Applications', 'ChatGPT.app'));
         candidates.push('/Applications/Codex.app');
         candidates.push(path.join(home || '', 'Applications', 'Codex.app'));
     }
@@ -96,30 +99,32 @@ export async function codexMcpList(opts = {}) {
     const codex = opts.codex || await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
     if (!codex.bin)
         return { ok: false, checked: false, stdout: '', stderr: 'Codex CLI missing.' };
-    const out = await runProcess(codex.bin, ['mcp', 'list'], {
+    const execute = opts.runProcess || runProcess;
+    const out = await execute(codex.bin, ['mcp', 'list'], {
         timeoutMs: opts.timeoutMs || 10000,
         maxOutputBytes: 64 * 1024
     }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
     return {
         ok: out.code === 0,
         checked: true,
-        stdout: out.stdout || '',
-        stderr: out.stderr || ''
+        stdout: redactString(out.stdout || ''),
+        stderr: redactString(out.stderr || '')
     };
 }
 export async function codexFeatureList(opts = {}) {
     const codex = opts.codex || await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
     if (!codex.bin)
         return { ok: false, checked: false, stdout: '', stderr: 'Codex CLI missing.' };
-    const out = await runProcess(codex.bin, ['features', 'list'], {
+    const execute = opts.runProcess || runProcess;
+    const out = await execute(codex.bin, ['features', 'list'], {
         timeoutMs: opts.timeoutMs || 10000,
         maxOutputBytes: 64 * 1024
     }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
     return {
         ok: out.code === 0,
         checked: true,
-        stdout: out.stdout || '',
-        stderr: out.stderr || ''
+        stdout: redactString(out.stdout || ''),
+        stderr: redactString(out.stderr || '')
     };
 }
 export async function codexAppIntegrationStatus(opts = {}) {
@@ -161,7 +166,8 @@ export async function codexAppIntegrationStatus(opts = {}) {
     });
     const pluginPickerReady = requiredFeatureFlags.tool_suggest && requiredFeatureFlags.plugins && requiredFeatureFlags.apps && defaultPlugins.ok && pluginSkillShadows.ok && fastModeConfig.ok;
     const gitActions = codexGitActionReadiness({ requiredFeatureFlags, remoteControl });
-    const ready = appInstalled && Boolean(codex.bin) && mcpList.ok && featureList.ok && requiredFeatureFlagsOk && pluginPickerReady && fastModeConfig.ok && imageGenerationReady && gitActions.ok && computerUseReady && browserToolReady && chromeExtension.ok;
+    const selectedProviderReady = providerModelUi.selected_provider_ok !== false;
+    const ready = appInstalled && Boolean(codex.bin) && mcpList.ok && featureList.ok && requiredFeatureFlagsOk && pluginPickerReady && fastModeConfig.ok && selectedProviderReady && imageGenerationReady && gitActions.ok && computerUseReady && browserToolReady && chromeExtension.ok;
     return {
         ok: ready,
         app: {
@@ -194,6 +200,7 @@ export async function codexAppIntegrationStatus(opts = {}) {
             required_flags_ok: requiredFeatureFlagsOk,
             fast_mode_config: fastModeConfig,
             provider_model_ui: providerModelUi,
+            selected_provider_ready: selectedProviderReady,
             git_actions: gitActions,
             image_generation: imageGenerationReady,
             image_generation_source: imageGenerationReady ? 'codex_features_list' : 'missing',
@@ -545,7 +552,8 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
         lines.push(`Run: ${providerModelUi.glm.key_command}; then ${providerModelUi.glm.install_command}; restart Codex App if the model picker was already open.`);
     }
     if (providerModelUi?.codex_lb?.key_entry_visible && providerModelUi.codex_lb.key_present && providerModelUi.codex_lb.provider_present && providerModelUi.codex_lb.provider_contract_ok && providerModelUi.codex_lb.base_url_present) {
-        lines.push(`codex-lb key entry path is visible and configured; update command ${providerModelUi.codex_lb.set_key_command}.`);
+        lines.push(`codex-lb key entry path is configured; provider catalog ${providerModelUi.codex_lb.expected_models_present ? 'contains GPT-5.6 Sol/Terra/Luna' : 'is not verified'}. Update command: ${providerModelUi.codex_lb.set_key_command}.`);
+        lines.push('Provider/config readiness does not by itself prove the already-running Desktop picker; auth/profile actions restart ChatGPT/Codex so it reloads model/list.');
     }
     else if (providerModelUi?.codex_lb?.key_entry_visible) {
         lines.push(`codex-lb key entry path is visible, but setup is incomplete: ${providerModelUi.codex_lb.blockers.join(', ') || 'setup required'}.`);
@@ -938,6 +946,14 @@ export async function codexProviderModelUiStatus(opts = {}) {
         && hasTomlBoolean(codexLbProvider, 'supports_websockets', true)
         && hasTomlBoolean(codexLbProvider, 'requires_openai_auth', true);
     const codexLbSelectedDefault = /(?:^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/.test(topLevelToml(globalConfig));
+    let codexLbModelCatalog = opts.codexLbModelCatalog || null;
+    if (!codexLbModelCatalog && codexLbProviderContractOk && codexLbApiKeySource !== 'missing' && codexLbBaseUrlSource !== 'missing') {
+        const loadedEnv = await loadCodexLbEnv({ home, envPath: codexLbEnvFilePath }).catch(() => null);
+        codexLbModelCatalog = loadedEnv ? await readCodexLbModelCatalog({ loadedEnv }).catch(() => null) : null;
+    }
+    const expectedCodexLbModels = ['gpt-5.6-luna', 'gpt-5.6-terra', 'gpt-5.6-sol'];
+    const catalogModels = Array.isArray(codexLbModelCatalog?.models) ? codexLbModelCatalog.models.map(String) : [];
+    const expectedCodexLbModelsPresent = expectedCodexLbModels.every((model) => catalogModels.includes(model));
     const glmBlockers = [
         ...(glmProviderPresent ? [] : ['glm_openrouter_provider_missing']),
         ...glmProfileBlockers,
@@ -947,18 +963,34 @@ export async function codexProviderModelUiStatus(opts = {}) {
         ...(codexLbProviderPresent ? [] : ['codex_lb_provider_missing']),
         ...(codexLbProviderPresent && !codexLbProviderContractOk ? ['codex_lb_provider_contract_drift'] : []),
         ...(codexLbApiKeySource !== 'missing' ? [] : ['codex_lb_api_key_missing']),
-        ...(codexLbBaseUrlSource !== 'missing' ? [] : ['codex_lb_base_url_missing'])
+        ...(codexLbBaseUrlSource !== 'missing' ? [] : ['codex_lb_base_url_missing']),
+        ...(codexLbProviderContractOk && codexLbApiKeySource !== 'missing' && codexLbBaseUrlSource !== 'missing' && !expectedCodexLbModelsPresent
+            ? ['codex_lb_gpt_5_6_catalog_unverified']
+            : [])
     ];
-    const blockers = [...glmBlockers, ...codexLbBlockers];
+    const selectedProviderBlockers = codexLbSelectedDefault ? codexLbBlockers : [];
+    const optionalProviderBlockers = codexLbSelectedDefault
+        ? glmBlockers
+        : [...glmBlockers, ...codexLbBlockers];
     const keyCommand = 'sks codex-app set-openrouter-key --api-key-stdin';
     const installCommand = 'sks codex-app glm-profile install';
     const setupCommand = 'sks codex-lb setup --host <domain> --api-key-stdin --yes';
     const setKeyCommand = 'sks codex-lb set-key --api-key-stdin';
     return {
         schema: 'sks.codex-app-provider-model-ui.v1',
-        ok: blockers.length === 0,
+        // The top-level readiness contract is intentionally scoped to the active
+        // provider. Optional GLM/OpenRouter and codex-lb setup diagnostics remain
+        // visible below without making an unrelated provider selection fail.
+        ok: selectedProviderBlockers.length === 0,
+        selected_provider_ok: selectedProviderBlockers.length === 0,
+        selected_provider: codexLbSelectedDefault ? 'codex-lb' : 'oauth',
+        selected_provider_blockers: selectedProviderBlockers,
+        optional_provider_blockers: optionalProviderBlockers,
         checked: true,
-        status: blockers.length === 0 ? 'ready' : 'setup_required',
+        verification_scope: 'config_and_provider_catalog',
+        desktop_picker_verified: false,
+        status: selectedProviderBlockers.length === 0 ? 'ready' : 'setup_required',
+        optional_provider_status: optionalProviderBlockers.length === 0 ? 'ready' : 'setup_available',
         config_paths: {
             codex_config: globalConfigPath,
             project_config: projectConfig ? projectConfigPath : null,
@@ -988,6 +1020,12 @@ export async function codexProviderModelUiStatus(opts = {}) {
             api_key_source: codexLbApiKeySource,
             base_url_present: codexLbBaseUrlSource !== 'missing',
             base_url_source: codexLbBaseUrlSource,
+            model_catalog_checked: Boolean(codexLbModelCatalog),
+            model_catalog_ok: codexLbModelCatalog?.ok === true,
+            model_catalog_models: catalogModels,
+            expected_models: expectedCodexLbModels,
+            expected_models_present: expectedCodexLbModelsPresent,
+            model_catalog_blockers: codexLbModelCatalog?.blockers || [],
             setup_command: setupCommand,
             set_key_command: setKeyCommand,
             status_command: 'sks codex-lb status',
@@ -1000,7 +1038,7 @@ export async function codexProviderModelUiStatus(opts = {}) {
             setKeyCommand,
             'sks codex-app status'
         ],
-        blockers
+        blockers: selectedProviderBlockers
     };
 }
 async function readTextIfExists(file) {
@@ -1065,9 +1103,14 @@ function productDesignStatusSummary(status = {}) {
 function providerModelUiSummary(status = {}) {
     if (!status?.checked)
         return ' not checked';
-    if (status.ok)
-        return ' ok (GLM + codex-lb)';
-    return ` setup ${(status.blockers || []).join(', ') || 'required'}`;
+    const selected = status.selected_provider || 'oauth';
+    if (status.ok) {
+        const optionalSetup = (status.optional_provider_blockers || []).length > 0
+            ? ', optional providers can be configured'
+            : '';
+        return ` ${selected} ready${optionalSetup} (live picker reload required)`;
+    }
+    return ` ${selected} setup ${(status.selected_provider_blockers || status.blockers || []).join(', ') || 'required'}`;
 }
 function sksNativeMenuSummary(status = {}) {
     if (!status)

package/dist/core/codex-compat/codex-hook-warning-detector.js

@@ -15,7 +15,8 @@ export async function detectCodexHookOutputWarnings(eventLike, output) {
     const issues = [
         ...validation.structured_issues,
         ...semantic.issues,
-        ...snakeCaseKeyIssues(output)
+        ...snakeCaseKeyIssues(output),
+        ...unknownTopLevelKeyIssues(output)
     ];
     for (const key of LEGACY_TOP_LEVEL_KEYS) {
         if (output && typeof output === 'object' && Object.prototype.hasOwnProperty.call(output, key)) {
@@ -52,6 +53,14 @@ export async function detectCodexHookOutputWarnings(eventLike, output) {
         warnings: [...new Set(warnings)]
     };
 }
+function unknownTopLevelKeyIssues(output) {
+    if (!output || typeof output !== 'object' || Array.isArray(output))
+        return [];
+    const allowed = new Set(['continue', 'decision', 'reason', 'hookSpecificOutput']);
+    return Object.keys(output)
+        .filter((key) => !allowed.has(key))
+        .map((key) => makeCodexHookIssue('policy_disallowed', `unknown_field_${key}`, `Unknown top-level hook field is not accepted by the SKS zero-warning contract: ${key}.`, { path: `$.${key}`, upstream_supported: false, sks_disallowed: true }));
+}
 export async function codexHookWarningCheck(root, opts = {}) {
     root ||= await projectRoot();
     const fixtureValidation = await validateCodexFixtureOutputs(root);

package/dist/core/codex-compat/codex-release-manifest.js

@@ -3,13 +3,13 @@ import { packageRoot, readJson, readText, sha256 } from '../fsx.js';
 export const CODEX_RELEASE_MANIFEST_SCHEMA = 'sks.codex-release-manifest.v1';
 export const CURRENT_CODEX_RELEASE_MANIFEST = {
     schema: CODEX_RELEASE_MANIFEST_SCHEMA,
-    targetTag: 'rust-v0.142.0',
-    requiredCliVersion: '0.142.0',
-    sdkVersion: '0.142.0',
-    minimumSupportedVersion: '0.142.0',
+    targetTag: 'rust-v0.144.1',
+    requiredCliVersion: '0.144.1',
+    sdkVersion: '0.144.1',
+    minimumSupportedVersion: '0.144.1',
     protocolMode: 'app-server-v2',
-    generatedSchemaSha256: 'fc3c48943de51865e81c8320876fd5310e9d96bd066fc63b74616d26c0e6dd12',
-    upstreamCommit: 'rust-v0.142.0',
+    generatedSchemaSha256: '2b3f14fa2e728f77a16385ff39f3a1d85ab255c1020498a85c1c0fb24f3d2f3c',
+    upstreamCommit: 'rust-v0.144.1',
     featurePolicies: {
         multiAgentMode: 'probe',
         indexedWebSearch: 'probe',

package/dist/core/codex-control/codex-0139-doctor-real-probe.js

@@ -10,8 +10,13 @@ export async function runCodex0139DoctorEnvRealProbe(input) {
         return skippedCodex0139Probe('codex_cli_missing');
     const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `doctor-${Date.now()}`);
     await ensureDir(tempDir);
+    const isolatedHome = path.join(tempDir, 'home');
+    const isolatedCodexHome = path.join(isolatedHome, '.codex');
+    await ensureDir(isolatedCodexHome);
     const env = {
         ...process.env,
+        HOME: isolatedHome,
+        CODEX_HOME: isolatedCodexHome,
         EDITOR: 'vim',
         PAGER: 'less',
         TERM: 'xterm-256color',
@@ -48,7 +53,8 @@ export async function runCodex0139DoctorEnvRealProbe(input) {
             redacted_marker_or_omitted: redactedMarkerOrOmitted,
             redacted_sample_contains_secret: redactedText.includes('sk-test-secret-value') || redactedText.includes('test-secret-token'),
             process_exited_successfully: processExitedSuccessfully,
-            process_warning: processExitedSuccessfully ? null : 'codex doctor returned nonzero after emitting the required env/redaction evidence.'
+            process_warning: processExitedSuccessfully ? null : 'codex doctor returned nonzero after emitting the scoped env/redaction evidence.',
+            isolated_codex_home: true
         },
         blockers: ok ? [] : ['codex_doctor_env_redaction_real_probe_failed']
     };

package/dist/core/codex-control/codex-0139-image-path-real-probe.js

@@ -4,7 +4,7 @@ import { buildCodexExecArgs, findCodexBinary } from '../codex-adapter.js';
 import { ensureDir, runProcess, writeBinaryAtomic } from '../fsx.js';
 import { buildImageArtifactPathContract } from '../image/image-artifact-path-contract.js';
 import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
-const ONE_BY_ONE_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=', 'base64');
+const ONE_BY_ONE_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR4nGP4//8/AAX+Av4N70a4AAAAAElFTkSuQmCC', 'base64');
 export async function runCodex0139ImageReferencedPathRealProbe(input) {
     const started = Date.now();
     const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `image-path-${Date.now()}`);
@@ -14,10 +14,10 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
     await writeBinaryAtomic(inputA, ONE_BY_ONE_PNG);
     await writeBinaryAtomic(inputB, ONE_BY_ONE_PNG);
     const contract = await buildImageArtifactPathContract(input.root, {
-        missionId: 'codex-0139-image-path-real-probe',
+        missionId: 'codex-0144-image-path-real-probe',
         images: [
-            { id: 'input-a', kind: 'input_attachment', filePath: inputA, route: 'codex-0139-real-probe', stage: 'candidate' },
-            { id: 'input-b', kind: 'input_attachment', filePath: inputB, route: 'codex-0139-real-probe', stage: 'referenced' }
+            { id: 'input-a', kind: 'input_attachment', filePath: inputA, route: 'codex-0144-core-real-probe', stage: 'candidate' },
+            { id: 'input-b', kind: 'input_attachment', filePath: inputB, route: 'codex-0144-core-real-probe', stage: 'referenced' }
         ]
     });
     const codexBin = input.codexBin || await findCodexBinary();
@@ -34,7 +34,7 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
             artifact_paths: [tempDir]
         };
     }
-    if (process.env.SKS_CODEX_0139_IMAGE_REAL_PROBE_ALLOW_SKIP === '1') {
+    if (process.env.SKS_CODEX_0144_IMAGE_REAL_PROBE_ALLOW_SKIP === '1' || process.env.SKS_CODEX_0139_IMAGE_REAL_PROBE_ALLOW_SKIP === '1') {
         return {
             ...skippedCodex0139Probe('codex_image_edit_actual_api_skipped', {
                 codex_bin: codexBin,
@@ -48,12 +48,12 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
     }
     const outputFile = path.join(tempDir, 'last-message.txt');
     const prompt = [
-        'This is a Codex 0.139 image path routing probe.',
+        'This is a Codex 0.144.1 image path routing probe.',
         `Only the image file named ${path.basename(inputB)} is intentionally referenced.`,
         `Return compact JSON {"referenced_path":"${inputB.replace(/\\/g, '\\\\')}","saw_image":true}.`,
         'Do not edit files and do not reference any other image path.'
     ].join(' ');
-    const extraArgs = ['--image', inputB, '--skip-git-repo-check', '--ephemeral'];
+    const extraArgs = ['-c', 'mcp_servers={}', '--image', inputB, '--skip-git-repo-check', '--ephemeral'];
     const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs });
     const result = await runProcess(codexBin, args, {
         cwd: tempDir,
@@ -68,6 +68,7 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
     const ok = exactReferencedPath
         && commandReferencesOnlyInputB
         && outputReferencesInputB
+        && processExitedSuccessfully
         && contract.blockers.length === 0;
     return {
         ok,
@@ -88,7 +89,12 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
             output_file: outputFile,
             contract_blockers: contract.blockers
         },
-        blockers: ok ? [] : ['codex_image_referenced_path_actual_cli_probe_failed']
+        blockers: ok ? [] : [
+            ...(processExitedSuccessfully ? [] : ['codex_image_referenced_path_process_failed_or_timed_out']),
+            ...(!exactReferencedPath || !commandReferencesOnlyInputB || !outputReferencesInputB || contract.blockers.length > 0
+                ? ['codex_image_referenced_path_actual_cli_probe_failed']
+                : [])
+        ]
     };
 }
 //# sourceMappingURL=codex-0139-image-path-real-probe.js.map

package/dist/core/codex-control/codex-0139-probe-runner.js

@@ -1,11 +1,12 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
-import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+import { parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
 import { runProcess } from '../fsx.js';
 import { runCodex0139DoctorEnvRealProbe } from './codex-0139-doctor-real-probe.js';
 import { runCodex0139ImageReferencedPathRealProbe } from './codex-0139-image-path-real-probe.js';
-import { runCodex0139InterruptAgentRealProbe } from './codex-0139-multi-agent-real-probe.js';
+import { runCodex0144CollabAgentToolSchemaRealProbe } from './codex-0144-collab-agent-real-probe.js';
 import { runCodex0139MarketplaceSourceRealProbe, runCodex0139PluginCacheRealProbe } from './codex-0139-plugin-real-probes.js';
 import { buildCodex0139RealProbeResult, CODEX_0139_REAL_PROBE_NAMES, skippedCodex0139Probe } from './codex-0139-real-probes.js';
 import { runCodex0139RichSchemaRealProbe } from './codex-0139-rich-schema-real-probe.js';
@@ -14,34 +15,68 @@ import { runCodex0139WebSearchRealProbe } from './codex-0139-web-search-probe.js
 export async function runCodex0139RealProbes(input) {
     const timeoutMs = Math.max(1, Number(input.timeoutMs || 120000) || 120000);
     const requireReal = input.requireReal === true;
-    const codexBin = input.codexBin || await findCodex0139RealProbeBinary();
+    const codexBin = input.codexBin || await findCurrentCodexRealProbeBinary();
     const versionText = await readCodexVersionText(codexBin, timeoutMs);
     const parsedVersion = parseCodexVersionText(versionText);
-    const atLeast139 = Boolean(parsedVersion && compareSemverLike(parsedVersion, '0.139.0') >= 0);
-    const requested = new Set((input.probes?.length ? input.probes : CODEX_0139_REAL_PROBE_NAMES).filter((name) => CODEX_0139_REAL_PROBE_NAMES.includes(name)));
+    const currentVersion = parsedVersion === CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion;
+    const requestedRaw = input.probes?.length ? input.probes : CODEX_0139_REAL_PROBE_NAMES;
+    const unknownProbeNames = requestedRaw.filter((name) => !CODEX_0139_REAL_PROBE_NAMES.includes(name));
+    const requested = [...new Set(requestedRaw.filter((name) => CODEX_0139_REAL_PROBE_NAMES.includes(name)))];
     const probes = Object.fromEntries(CODEX_0139_REAL_PROBE_NAMES.map((name) => [name, skippedCodex0139Probe('probe_not_requested')]));
-    const extraBlockers = [];
+    const extraBlockers = unknownProbeNames.map((name) => `unknown_real_probe:${name}`);
     if (!codexBin)
         extraBlockers.push('codex_cli_missing');
-    if (!atLeast139)
-        extraBlockers.push('codex_0_139_required');
-    if (!codexBin || !atLeast139) {
+    if (!currentVersion)
+        extraBlockers.push(`codex_${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion.replaceAll('.', '_')}_required`);
+    if (!codexBin || !currentVersion) {
         for (const name of requested) {
-            probes[name] = skippedCodex0139Probe(!codexBin ? 'codex_cli_missing' : 'codex_0_139_required', { parsed_version: parsedVersion });
+            probes[name] = skippedCodex0139Probe(!codexBin ? 'codex_cli_missing' : 'codex_current_release_required', { parsed_version: parsedVersion });
         }
-        return buildCodex0139RealProbeResult({ codexBin, versionText, parsedVersion, requireReal, timeoutMs, probes, extraBlockers });
+        const tempCleanup = await cleanupProbeTempRoot(input.root);
+        return buildCodex0139RealProbeResult({ codexBin, versionText, parsedVersion, requireReal, timeoutMs, probes, requiredProbeNames: requested, releaseAuthorizing: false, tempCleanup, extraBlockers });
     }
-    for (const name of requested) {
-        probes[name] = await runOne(name, {
-            root: input.root,
-            requireReal,
-            timeoutMs,
-            codexBin,
-            allowNetwork: input.allowNetwork,
-            allowDesktop: input.allowDesktop
-        });
+    let rows = [];
+    let tempCleanup;
+    try {
+        rows = await Promise.all(requested.map(async (name) => {
+            try {
+                const probe = await runOne(name, {
+                    root: input.root,
+                    requireReal,
+                    timeoutMs,
+                    codexBin,
+                    allowNetwork: input.allowNetwork,
+                    allowDesktop: input.allowDesktop
+                });
+                return [name, surfaceRuntimeWarnings(probe)];
+            }
+            catch (err) {
+                const errorClass = err instanceof Error ? err.name : typeof err;
+                extraBlockers.push(`codex_real_probe_runner_failed:${name}`);
+                return [name, skippedCodex0139Probe('codex_real_probe_runner_failed', { error_class: errorClass })];
+            }
+        }));
+    }
+    finally {
+        tempCleanup = await cleanupProbeTempRoot(input.root);
     }
-    return buildCodex0139RealProbeResult({ codexBin, versionText, parsedVersion, requireReal, timeoutMs, probes, extraBlockers });
+    for (const [name, probe] of rows)
+        probes[name] = probe;
+    sanitizeCleanedTempArtifacts(probes, input.root);
+    if (!tempCleanup.ok)
+        extraBlockers.push('codex_real_probe_temp_cleanup_failed');
+    return buildCodex0139RealProbeResult({
+        codexBin,
+        versionText,
+        parsedVersion,
+        requireReal,
+        timeoutMs,
+        probes,
+        requiredProbeNames: requested,
+        releaseAuthorizing: requireReal && currentVersion,
+        tempCleanup,
+        extraBlockers
+    });
 }
 async function runOne(name, input) {
     switch (name) {
@@ -57,11 +92,11 @@ async function runOne(name, input) {
             return runCodex0139PluginCacheRealProbe(input);
         case 'sandbox_profile_alias':
             return runCodex0139SandboxProfileAliasProbe(input);
-        case 'interrupt_agent_event':
-            return runCodex0139InterruptAgentRealProbe(input);
+        case 'collab_agent_tool_schema':
+            return runCodex0144CollabAgentToolSchemaRealProbe(input);
         case 'image_referenced_path':
             return runCodex0139ImageReferencedPathRealProbe(input);
-        case 'sandbox_proxy_preservation':
+        case 'sandbox_proxy_environment':
             return runCodex0139SandboxProxyPreservationProbe(input);
     }
 }
@@ -76,7 +111,7 @@ async function readCodexVersionText(codexBin, timeoutMs) {
     const text = `${result.stdout || ''}${result.stderr || ''}`.trim();
     return text || null;
 }
-export async function findCodex0139RealProbeBinary() {
+export async function findCurrentCodexRealProbeBinary() {
     const candidates = await codexBinaryCandidates();
     let firstExisting = null;
     for (const candidate of candidates) {
@@ -84,18 +119,18 @@ export async function findCodex0139RealProbeBinary() {
             firstExisting = candidate;
         const versionText = await readCodexVersionText(candidate, 30000);
         const parsed = parseCodexVersionText(versionText);
-        if (parsed && compareSemverLike(parsed, '0.139.0') >= 0)
+        if (parsed === CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion)
             return candidate;
     }
     return firstExisting || await findCodexBinary();
 }
 async function codexBinaryCandidates() {
     const raw = [
+        path.join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'codex.cmd' : 'codex'),
         process.env.SKS_CODEX_BIN,
         process.env.DCODEX_CODEX_BIN,
         process.env.CODEX_BIN,
-        ...pathCandidates('codex'),
-        path.join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'codex.cmd' : 'codex')
+        ...pathCandidates('codex')
     ].filter(Boolean).map(String);
     const out = [];
     for (const candidate of raw) {
@@ -110,6 +145,46 @@ async function codexBinaryCandidates() {
     }
     return out;
 }
+function surfaceRuntimeWarnings(probe) {
+    const warnings = [...(probe.warnings || [])];
+    const blockers = [...probe.blockers];
+    const stderr = String(probe.stderr_tail || '');
+    if (/AuthRequired|Auth required|No access token was provided/i.test(stderr)) {
+        warnings.push('codex_real_probe_external_mcp_auth_required');
+    }
+    if (probe.evidence?.process_warning)
+        warnings.push('codex_real_probe_process_warning');
+    return {
+        ...probe,
+        ok: probe.ok && blockers.length === 0,
+        warnings: [...new Set(warnings)],
+        blockers: [...new Set(blockers)]
+    };
+}
+async function cleanupProbeTempRoot(root) {
+    const tempRoot = path.join(root, '.sneakoscope', 'tmp', 'codex-0139-real-probes');
+    await fs.rm(tempRoot, { recursive: true, force: true }).catch(() => undefined);
+    const remainingEntries = await fs.readdir(tempRoot).catch(() => []);
+    return { root: tempRoot, ok: remainingEntries.length === 0, remaining_entries: remainingEntries };
+}
+function sanitizeCleanedTempArtifacts(probes, root) {
+    const tempRoot = path.resolve(root, '.sneakoscope', 'tmp', 'codex-0139-real-probes');
+    for (const probe of Object.values(probes)) {
+        const tempArtifacts = probe.artifact_paths.filter((artifact) => {
+            const resolved = path.resolve(artifact);
+            return resolved === tempRoot || resolved.startsWith(`${tempRoot}${path.sep}`);
+        });
+        if (!tempArtifacts.length)
+            continue;
+        probe.artifact_paths = probe.artifact_paths.filter((artifact) => !tempArtifacts.includes(artifact));
+        probe.evidence = {
+            ...probe.evidence,
+            observed_temp_artifact_count: tempArtifacts.length,
+            temp_artifacts_cleaned: true,
+            durable_evidence: 'embedded_in_codex_real_probe_report'
+        };
+    }
+}
 function pathCandidates(command) {
     const exts = process.platform === 'win32' ? ['.cmd', '.exe', '.bat', ''] : [''];
     return (process.env.PATH || '').split(path.delimiter).flatMap((dir) => exts.map((ext) => path.join(dir, `${command}${ext}`)));

package/dist/core/codex-control/codex-0139-real-probe-summary.js

@@ -3,17 +3,21 @@ import { codex0139ProbeArtifactPath } from './codex-0139-real-probes.js';
 import { readJson, writeJsonAtomic } from '../fsx.js';
 export async function buildCodex0139RealProbeSummary(root) {
     const result = await readJson(codex0139ProbeArtifactPath(root));
-    const probes = Object.fromEntries(Object.entries(result.probes || {}).map(([name, probe]) => [name, {
+    const requested = new Set((result.requested_probes?.length ? result.requested_probes : Object.keys(result.probes || {})).map(String));
+    const requestedEntries = Object.entries(result.probes || {}).filter(([name]) => requested.has(name));
+    const probes = Object.fromEntries(requestedEntries.map(([name, probe]) => [name, {
             ok: probe.ok === true,
             mode: probe.mode,
             blockers: probe.blockers || []
         }]));
-    const values = Object.values(result.probes || {});
+    const values = requestedEntries.map(([, probe]) => probe);
     const skippedCount = values.filter((probe) => probe.mode === 'skipped').length;
     const failedCount = values.filter((probe) => probe.ok !== true && probe.mode !== 'skipped').length;
     return {
         schema: 'sks.codex-0139-real-probe-summary.v1',
-        ok: result.require_real ? skippedCount === 0 && failedCount === 0 : result.overall_ok === true,
+        target_version: result.target_version,
+        compatibility_authority: 'deprecated_non_authoritative_lineage_only',
+        ok: result.overall_ok === true,
         require_real: result.require_real,
         codex_bin: result.codex_bin,
         parsed_version: result.parsed_version,

package/dist/core/codex-control/codex-0139-real-probes.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 export const CODEX_0139_REAL_PROBE_NAMES = [
     'code_mode_web_search',
@@ -7,9 +8,9 @@ export const CODEX_0139_REAL_PROBE_NAMES = [
     'marketplace_source_json',
     'plugin_catalog_cache',
     'sandbox_profile_alias',
-    'interrupt_agent_event',
+    'collab_agent_tool_schema',
     'image_referenced_path',
-    'sandbox_proxy_preservation'
+    'sandbox_proxy_environment'
 ];
 export function codex0139ProbeArtifactPath(root) {
     return path.join(root, '.sneakoscope', 'codex-0139-real-probes.json');
@@ -50,24 +51,38 @@ export function codex0139ProbeTail(text, limit = 4000) {
     return raw.length <= limit ? raw : raw.slice(raw.length - limit);
 }
 export function buildCodex0139RealProbeResult(input) {
-    const skipped = CODEX_0139_REAL_PROBE_NAMES.filter((name) => input.probes[name]?.mode === 'skipped');
-    const failed = CODEX_0139_REAL_PROBE_NAMES.filter((name) => input.probes[name] && input.probes[name].ok !== true && input.probes[name].mode !== 'skipped');
+    const requiredProbeNames = input.requiredProbeNames ? [...new Set(input.requiredProbeNames)] : [...CODEX_0139_REAL_PROBE_NAMES];
+    const skipped = requiredProbeNames.filter((name) => input.probes[name]?.mode === 'skipped');
+    const failed = requiredProbeNames.filter((name) => input.probes[name] && input.probes[name].ok !== true && input.probes[name].mode !== 'skipped');
     const blockers = [
         ...(input.extraBlockers || []),
-        ...CODEX_0139_REAL_PROBE_NAMES.flatMap((name) => input.probes[name]?.blockers || []),
+        ...requiredProbeNames.flatMap((name) => input.probes[name]?.blockers || []),
         ...(input.requireReal && skipped.length ? skipped.map((name) => `require_real_skipped:${name}`) : [])
     ];
+    const warnings = requiredProbeNames.flatMap((name) => input.probes[name]?.warnings || []);
+    const overallOk = input.requireReal ? blockers.length === 0 && failed.length === 0 && skipped.length === 0 : failed.length === 0;
     return {
         schema: 'sks.codex-0139-real-probe-result.v1',
+        target_version: CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+        compatibility_origin: 'codex-0139-real-probe-result-v1',
+        compatibility_authority: 'deprecated_non_authoritative_lineage_only',
         generated_at: nowIso(),
         codex_bin: input.codexBin,
         version_text: input.versionText,
         parsed_version: input.parsedVersion,
         require_real: input.requireReal,
-        overall_ok: input.requireReal ? blockers.length === 0 && failed.length === 0 && skipped.length === 0 : failed.length === 0,
+        release_authorizing: Boolean(input.releaseAuthorizing && overallOk),
+        overall_ok: overallOk,
         probe_timeout_ms: input.timeoutMs,
+        requested_probes: requiredProbeNames,
         probes: input.probes,
         skipped,
+        warnings: [...new Set(warnings)],
+        external_integration_status: {
+            mcp_auth: warnings.includes('codex_real_probe_external_mcp_auth_required') ? 'authentication_required' : 'not_observed',
+            release_authorization_scope: 'codex_core_compatibility_only'
+        },
+        temp_cleanup: input.tempCleanup || { root: '', ok: false, remaining_entries: [] },
         blockers: [...new Set(blockers)]
     };
 }