sneakoscope 6.0.3 → 6.1.0

package/dist/cli/router.js

@@ -80,6 +80,16 @@ async function dispatchInner(argv) {
     if (!helpRequest) {
         const commandGate = await ensureActiveRouteCommandGate(command, rest);
         if (!commandGate.ok) {
+            if ('command_result' in commandGate && commandGate.command_result) {
+                process.exitCode = 1;
+                if (argv.includes('--json'))
+                    console.log(JSON.stringify(commandGate.command_result, null, 2));
+                else
+                    printHandledCommandBlock(commandGate.command_result);
+                return commandGate.command_result;
+            }
+            if (argv.includes('--json'))
+                console.log(JSON.stringify(commandGate, null, 2));
             console.error(commandGate.message);
             process.exitCode = 1;
             return commandGate;
@@ -92,7 +102,7 @@ async function dispatchInner(argv) {
         const migrationGate = await ensureCurrentMigrationBeforeCommand({
             command,
             args: rest,
-            skipMigrationGate: entry.skipMigrationGate === true || entry.readonly === true
+            skipMigrationGate: entry.skipMigrationGate === true || entry.readonly === true || safeActiveRouteVisualQuery(command, rest)
         });
         if (!migrationGate.ok) {
             console.error('SKS project migration blocked.');
@@ -106,6 +116,8 @@ async function dispatchInner(argv) {
                 console.error(`Optional warning: ${warning}`);
             console.error(`Receipt: ${migrationGate.receipt_path}`);
             console.error('Remedies: run `sks doctor --fix --yes`, then retry; diagnostics that must bypass this gate are marked skipMigrationGate in the command registry.');
+            if (argv.includes('--json'))
+                console.log(JSON.stringify(migrationGate, null, 2));
             process.exitCode = 1;
             return migrationGate;
         }
@@ -136,9 +148,10 @@ async function ensureActiveRouteCommandGate(command, args) {
         return { ok: true, status: 'allowed' };
     if (safeReadOnlySubcommand(args))
         return { ok: true, status: 'allowed_status_subcommand' };
-    if (process.env.SKS_TEST_ISOLATION === '1' && process.env.SKS_RELEASE_FIXTURE_ACTIVE_ROUTE_BYPASS === '1') {
-        return { ok: true, status: 'allowed_release_fixture_isolation' };
-    }
+    if (safeActiveRouteVisualQuery(command, args))
+        return { ok: true, status: 'allowed_visual_query' };
+    if (safeActiveRouteRecoverySubcommand(command, args))
+        return { ok: true, status: 'allowed_active_route_recovery' };
     const [{ projectRoot, readJson }, { stateFile }] = await Promise.all([
         import('../core/fsx.js'),
         import('../core/mission.js')
@@ -147,6 +160,14 @@ async function ensureActiveRouteCommandGate(command, args) {
     const state = await readJson(stateFile(root), {}).catch(() => ({}));
     if (!activeRouteStateBlocksCommand(state))
         return { ok: true, status: 'allowed' };
+    const visualPreflight = await blockedVisualSourcePreflight(command, args);
+    if (visualPreflight) {
+        return {
+            ok: false,
+            status: 'handled_non_mutating_visual_preflight',
+            command_result: visualPreflight
+        };
+    }
     return {
         schema: 'sks.command-gate-active-route.v1',
         ok: false,
@@ -158,12 +179,40 @@ async function ensureActiveRouteCommandGate(command, args) {
         message: `SKS command gate blocked '${command}' because active route mission ${state.mission_id} is not closed. Run: sks route close --mission ${state.mission_id}`
     };
 }
+function safeActiveRouteVisualQuery(command, args) {
+    if (command !== 'computer-use')
+        return false;
+    const sub = String(args.find((arg) => !String(arg).startsWith('-')) || '').toLowerCase();
+    if (sub !== 'require')
+        return false;
+    return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
+}
+async function blockedVisualSourcePreflight(command, args) {
+    if (command !== 'image-ux-review' || String(args[0] || '').toLowerCase() !== 'run')
+        return null;
+    if (!args.includes('--from-chrome-extension') && !args.includes('--from-computer-use'))
+        return null;
+    const { imageUxReviewSourcePreflight } = await import('../core/commands/image-ux-review-command.js');
+    const preflight = await imageUxReviewSourcePreflight([...args.slice(1)]);
+    return preflight.result;
+}
+function printHandledCommandBlock(result) {
+    console.error(`SKS command blocked: ${result?.blocker || result?.status || 'preflight_failed'}`);
+    for (const line of Array.isArray(result?.guidance) ? result.guidance : [])
+        console.error(`- ${line}`);
+}
 function safeReadOnlySubcommand(args) {
     const sub = String(args.find((arg) => !String(arg).startsWith('-')) || '').toLowerCase();
     if (!['status', 'show', 'list', 'observe', 'watch', 'doctor', 'help'].includes(sub))
         return false;
     return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
 }
+function safeActiveRouteRecoverySubcommand(command, args) {
+    if (command !== 'agent')
+        return false;
+    const sub = String(args.find((arg) => !String(arg).startsWith('-')) || '').toLowerCase();
+    return ['close', 'cleanup', 'rollback-patches'].includes(sub);
+}
 function activeRouteStateBlocksCommand(state = {}) {
     if (!state?.mission_id || state.route_closed === true)
         return false;

package/dist/commands/codex-lb.js

@@ -8,6 +8,7 @@ import { codexLbMetrics, readCodexLbCircuit, recordCodexLbHealthEvent, resetCode
 import { checkCodexLbResponseChain, codexLbStatus, configureCodexLb, formatCodexLbStatusText, releaseCodexLbAuthHold, repairCodexLbAuth, unselectCodexLbProvider } from '../cli/install-helpers.js';
 import { buildCodexLbSetupPlan, codexLbPersistenceSummary, renderCodexLbSetupPlan } from '../core/codex-lb/codex-lb-setup.js';
 import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
+import { repairCodexAppFastUi } from '../core/codex-app/codex-app-fast-ui-repair.js';
 export async function run(command, args = []) {
     const root = await projectRoot();
     const action = args[0] || 'status';
@@ -53,35 +54,43 @@ export async function run(command, args = []) {
     if (action === 'fast-check' || action === 'fast' || action === 'verify-fast') {
         const status = await codexLbStatus();
         const blocker = !status.env_key_configured ? 'missing_env_key' : !status.base_url ? 'missing_base_url' : !status.provider_contract_ok ? 'provider_contract_drift' : 'not_configured';
-        const chain = status.env_key_configured && status.base_url
-            ? await checkCodexLbResponseChain(status, { force: true, cache: false, root, fastMode: true })
-            : { ok: false, status: blocker, codex_lb: status };
+        const modelSelection = await resolveCodexLbFastCheckModel(status);
+        const chain = status.env_key_configured && status.base_url && modelSelection.model
+            ? await checkCodexLbResponseChain(status, { force: true, cache: false, root, fastMode: true, model: modelSelection.model })
+            : { ok: false, status: modelSelection.model ? blocker : 'model_unselected', codex_lb: status };
         const evidence = await fastEvidenceFromChain(chain, readOption(args, '--request-log', readOption(args, '--request-log-json', null)));
         const providerReady = status.provider_contract_ok === true;
+        const chainVerified = isCodexLbFastChainVerified(chain);
         const result = {
             schema: 'sks.codex-lb-fast-check.v1',
-            ok: Boolean(providerReady && chain.ok && evidence.fast_requested && evidence.fast_actual),
+            ok: Boolean(providerReady && chainVerified && evidence.fast_requested && evidence.fast_actual),
             status: !providerReady
                 ? 'provider_contract_drift'
-                : chain.ok
-                    ? evidence.fast_actual
-                        ? 'fast_verified'
-                        : evidence.fast_requested
-                            ? 'fast_requested_but_actual_unverified'
-                            : 'fast_not_requested'
-                    : chain.status,
+                : chain.skipped === true
+                    ? 'fast_check_chain_skipped'
+                    : chainVerified
+                        ? evidence.fast_actual
+                            ? 'fast_verified'
+                            : evidence.fast_requested
+                                ? 'fast_requested_but_actual_unverified'
+                                : 'fast_not_requested'
+                        : chain.status,
             codex_lb: status,
+            model_selection: modelSelection,
             chain,
             evidence,
             degraded_models: Array.isArray(chain.degraded_models) ? chain.degraded_models : [],
             quota_low: Boolean(chain.quota_low),
             blockers: [
                 ...(providerReady ? [] : ['codex_lb_provider_contract_drift']),
-                ...(chain.ok
-                    ? evidence.fast_actual
-                        ? []
-                        : ['codex_lb_actual_fast_service_tier_unverified']
-                    : [chain.status || blocker])
+                ...modelSelection.blockers,
+                ...(chain.skipped === true
+                    ? ['codex_lb_fast_check_chain_skipped']
+                    : chainVerified
+                        ? evidence.fast_actual
+                            ? []
+                            : [evidence.fast_requested ? 'codex_lb_actual_fast_service_tier_unverified' : 'codex_lb_fast_service_tier_not_requested']
+                        : [chain.status || blocker])
             ]
         };
         if (flag(args, '--json'))
@@ -95,11 +104,13 @@ export async function run(command, args = []) {
     }
     if (action === 'repair' || action === 'resync' || action === 'login') {
         const result = await repairCodexLbAuth();
-        if (flag(args, '--json'))
-            return printJson(result);
-        console.log(`codex-lb repair: ${result.ok ? 'ok' : result.status}`);
-        if (!result.ok)
+        const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
+        const shaped = { ...result, ok: Boolean(result.ok && fastUi.ok), codex_app_fast_ui: fastUi };
+        if (!shaped.ok)
             process.exitCode = 1;
+        if (flag(args, '--json'))
+            return printJson(shaped);
+        console.log(`codex-lb repair: ${shaped.ok ? 'ok' : result.ok ? 'fast_ui_repair_failed' : result.status}`);
         return;
     }
     if (action === 'release') {
@@ -146,9 +157,10 @@ export async function run(command, args = []) {
             return;
         }
         const result = await configureCodexLb({ host, apiKey: newKey, authMode: flag(args, '--preserve-auth') ? 'preserve' : 'codex-lb', forceCodexLbApiKeyAuth: !flag(args, '--preserve-auth') });
-        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok));
-        const ok = Boolean(result.ok && restart?.ok !== false);
-        const output = { ...result, ok, action: 'set-key', restart_app: restart };
+        const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
+        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok && fastUi.ok));
+        const ok = Boolean(result.ok && fastUi.ok && restart?.ok !== false);
+        const output = { ...result, ok, action: 'set-key', codex_app_fast_ui: fastUi, restart_app: restart };
         if (!ok)
             process.exitCode = 1;
         if (flag(args, '--json'))
@@ -163,9 +175,10 @@ export async function run(command, args = []) {
     if (action === 'use-codex-lb' || action === 'use-lb') {
         // Switch auth mode -> codex-lb (API key). Re-selects the provider and re-syncs auth.
         const result = await repairCodexLbAuth({ forceCodexLbApiKeyAuth: true, authMode: 'codex-lb', forceFastMode: !flag(args, '--no-fast') });
-        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok));
-        const ok = Boolean(result.ok && restart?.ok !== false);
-        const shaped = { ...result, ok, mode: 'codex-lb', restart_app: restart };
+        const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
+        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok && fastUi.ok));
+        const ok = Boolean(result.ok && fastUi.ok && restart?.ok !== false);
+        const shaped = { ...result, ok, mode: 'codex-lb', codex_app_fast_ui: fastUi, restart_app: restart };
         if (!ok)
             process.exitCode = 1;
         if (flag(args, '--json'))
@@ -181,9 +194,10 @@ export async function run(command, args = []) {
         // Switch auth mode -> ChatGPT OAuth. Restores the saved OAuth login if present.
         const result = await releaseCodexLbAuthHold({ force: flag(args, '--force') });
         const authOk = !['no_backup', 'auth_in_use', 'failed'].includes(result.status);
-        const restart = await maybeRestartCodexAppForAuthSwitch(args, authOk);
-        const ok = Boolean(authOk && restart?.ok !== false);
-        const shaped = { ...result, ok, mode: 'oauth', restart_app: restart };
+        const fastUi = await repairCodexAppFastUiAfterMutation(root, authOk);
+        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(authOk && fastUi.ok));
+        const ok = Boolean(authOk && fastUi.ok && restart?.ok !== false);
+        const shaped = { ...result, ok, mode: 'oauth', codex_app_fast_ui: fastUi, restart_app: restart };
         if (!ok)
             process.exitCode = 1;
         if (flag(args, '--json'))
@@ -313,14 +327,15 @@ export async function run(command, args = []) {
             apiKeySource: options.apiKeySource,
             allowInsecureHttp: options.allowInsecureLocalhost
         });
-        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok) && !flag(args, '--preserve-auth'));
-        const shaped = { schema: 'sks.codex-lb-setup.v1', ...result, api_key: { present: Boolean(options.apiKey), redacted: true }, env_file_chmod: '0600' };
+        const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
+        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok && fastUi.ok) && !flag(args, '--preserve-auth'));
+        const shaped = { schema: 'sks.codex-lb-setup.v1', ...result, api_key: { present: Boolean(options.apiKey), redacted: true }, env_file_chmod: '0600', codex_app_fast_ui: fastUi };
         shaped.restart_app = restart;
         if (options.health)
             shaped.applied_actions = [...(shaped.applied_actions || []), { type: 'run_health_check', target: 'codex-lb response chain', ok: true }];
         if (options.health)
             shaped.chain_health = result.ok ? await checkCodexLbResponseChain(result, { force: true, root }) : null;
-        shaped.ok = Boolean(result.ok && restart?.ok !== false);
+        shaped.ok = Boolean(result.ok && fastUi.ok && restart?.ok !== false);
         if (!shaped.ok)
             process.exitCode = 1;
         if (flag(args, '--json'))
@@ -375,7 +390,85 @@ async function maybeRestartCodexAppForAuthSwitch(args = [], enabled) {
     const shouldRestart = requested || (!flag(args, '--json') && !flag(args, '--no-restart-app') && !flag(args, '--no-restart'));
     return restartCodexApp({ enabled: shouldRestart });
 }
-async function fastEvidenceFromChain(chain = {}, requestLogPath = null) {
+async function repairCodexAppFastUiAfterMutation(root, enabled) {
+    if (!enabled) {
+        return {
+            schema: 'sks.codex-app-fast-ui-repair.v1',
+            ok: true,
+            status: 'skipped',
+            skipped: true,
+            reason: 'previous_step_failed',
+            actions: [],
+            blockers: []
+        };
+    }
+    try {
+        return await repairCodexAppFastUi(root, { apply: true });
+    }
+    catch (err) {
+        return {
+            schema: 'sks.codex-app-fast-ui-repair.v1',
+            ok: false,
+            status: 'failed',
+            actions: [],
+            blockers: ['codex_app_fast_ui_repair_failed'],
+            error: String(err?.message || err)
+        };
+    }
+}
+export function isCodexLbFastChainVerified(chain = {}) {
+    return chain.ok === true && chain.skipped !== true;
+}
+export async function resolveCodexLbFastCheckModel(status = {}, env = process.env) {
+    const explicit = String(env.SKS_CODEX_MODEL || env.CODEX_MODEL || '').trim();
+    if (explicit)
+        return { model: explicit, source: env.SKS_CODEX_MODEL ? 'SKS_CODEX_MODEL' : 'CODEX_MODEL', blockers: [] };
+    const configPath = String(status.config_path || '').trim();
+    const config = configPath ? await readText(configPath, '').catch(() => '') : '';
+    const configured = topLevelTomlString(config, 'model');
+    if (configured)
+        return { model: configured, source: 'global_config', blockers: [] };
+    const configuredCatalogPath = topLevelTomlString(config, 'model_catalog_json');
+    if (!configuredCatalogPath)
+        return { model: null, source: null, blockers: ['codex_lb_fast_check_model_unselected'] };
+    const home = String(env.HOME || '').trim();
+    const expandedCatalogPath = configuredCatalogPath.startsWith('~/') && home
+        ? path.join(home, configuredCatalogPath.slice(2))
+        : configuredCatalogPath;
+    const catalogPath = path.isAbsolute(expandedCatalogPath)
+        ? expandedCatalogPath
+        : path.resolve(path.dirname(configPath), expandedCatalogPath);
+    try {
+        const payload = JSON.parse(await readText(catalogPath, ''));
+        const model = selectPriorityCapableCatalogModel(payload);
+        return model
+            ? { model, source: 'model_catalog_json', blockers: [] }
+            : { model: null, source: 'model_catalog_json', blockers: ['codex_lb_fast_check_priority_model_unavailable'] };
+    }
+    catch {
+        return { model: null, source: 'model_catalog_json', blockers: ['codex_lb_fast_check_catalog_invalid'] };
+    }
+}
+function topLevelTomlString(text, key) {
+    const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return (topLevel.match(new RegExp(`(?:^|\\n)\\s*${escaped}\\s*=\\s*"([^"]+)"`))?.[1] || '').trim();
+}
+function selectPriorityCapableCatalogModel(payload = {}) {
+    const models = Array.isArray(payload?.models) ? payload.models : Array.isArray(payload?.data) ? payload.data : [];
+    return models
+        .filter((row) => {
+        if (!row || typeof row !== 'object' || row.supported_in_api !== true || typeof row.slug !== 'string' || !row.slug.trim())
+            return false;
+        const serviceTiers = Array.isArray(row.service_tiers) ? row.service_tiers : [];
+        const speedTiers = Array.isArray(row.additional_speed_tiers) ? row.additional_speed_tiers : [];
+        return serviceTiers.some((tier) => normalizeTier(typeof tier === 'string' ? tier : tier?.id) === 'priority')
+            || speedTiers.some((tier) => normalizeTier(tier) === 'priority');
+    })
+        .sort((left, right) => Number(left.priority ?? Number.MAX_SAFE_INTEGER) - Number(right.priority ?? Number.MAX_SAFE_INTEGER)
+        || String(left.slug).localeCompare(String(right.slug)))[0]?.slug || null;
+}
+export async function fastEvidenceFromChain(chain = {}, requestLogPath = null) {
     const chainEvidence = chain.service_tier_evidence || {};
     const logRows = requestLogPath ? await readRequestLogRows(String(requestLogPath)) : [];
     const logEvidence = serviceTierEvidenceFromRows(logRows);
@@ -423,14 +516,14 @@ async function readRequestLogRows(file) {
     }
     return rows;
 }
-function serviceTierEvidenceFromRows(rows = []) {
+export function serviceTierEvidenceFromRows(rows = []) {
     let requested = null;
     let actual = null;
     let effective = null;
     for (const row of rows) {
         requested ||= normalizeTier(row?.requestedServiceTier || row?.requested_service_tier || row?.request?.service_tier || row?.body?.service_tier);
-        actual ||= normalizeTier(row?.actualServiceTier || row?.actual_service_tier || row?.response?.actualServiceTier);
-        effective ||= normalizeTier(row?.serviceTier || row?.service_tier || row?.response?.serviceTier);
+        actual ||= normalizeTier(row?.actualServiceTier || row?.actual_service_tier || row?.response?.actualServiceTier || row?.response?.actual_service_tier);
+        effective ||= responseServiceTier(row);
     }
     return {
         requested_service_tier: requested,
@@ -439,6 +532,17 @@ function serviceTierEvidenceFromRows(rows = []) {
         fast_actual: actual === 'priority' || effective === 'priority'
     };
 }
+function responseServiceTier(row) {
+    const nested = normalizeTier(row?.response?.serviceTier || row?.response?.service_tier || row?.event?.response?.serviceTier || row?.event?.response?.service_tier);
+    if (nested)
+        return nested;
+    const responseKind = String(row?.direction || row?.phase || row?.kind || row?.type || '').trim().toLowerCase();
+    const responseBody = row?.object === 'response' || /^resp[_-]/i.test(String(row?.id || '')) || Array.isArray(row?.output);
+    if (responseBody || responseKind === 'response' || responseKind === 'inbound' || responseKind.startsWith('response.')) {
+        return normalizeTier(row?.serviceTier || row?.service_tier);
+    }
+    return null;
+}
 function normalizeTier(value) {
     const text = String(value || '').trim().toLowerCase();
     if (text === 'fast')

package/dist/commands/codex.js

@@ -4,7 +4,8 @@ import { codexCompatibilityReport, codexDoctorReport } from '../core/codex-compa
 import { codexVersionReport } from '../core/codex-compat/codex-version.js';
 import { codexSchemaSnapshotReport } from '../core/codex-compat/codex-schema-snapshot.js';
 import { detectCodex0141Capability } from '../core/codex-control/codex-0141-capability.js';
-import { detectCodex0142Capability } from '../core/codex-control/codex-0142-capability.js';
+import { detectCodex0144Capability } from '../core/codex-control/codex-0144-capability.js';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'compatibility';
     if (action === 'compatibility' || action === 'compat') {
@@ -39,11 +40,11 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    if (action === '0.142' || action === '0142' || action === 'rust-v0.142.0') {
-        const result = await detectCodex0142Capability({ requireReal: flag(args, '--require-real') });
+    if (action === '0.144' || action === '0144' || action === CURRENT_CODEX_RELEASE_MANIFEST.targetTag) {
+        const result = await detectCodex0144Capability({ requireReal: flag(args, '--require-real') });
         if (flag(args, '--json'))
             return printJson(result);
-        console.log(`Codex 0.142 compatibility: ${result.ok ? 'ok' : 'blocked'} (${result.probe_mode})`);
+        console.log(`Codex ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion} compatibility: ${result.ok ? 'ok' : 'blocked'} (${result.probe_mode})`);
         for (const blocker of result.blockers || [])
             console.log(`- blocker: ${blocker}`);
         for (const warning of result.warnings || [])
@@ -70,7 +71,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex compatibility|version|doctor|schema|0.142|0.141 [--json]');
+    console.error('Usage: sks codex compatibility|version|doctor|schema|0.144|0.141 [--json]');
     process.exitCode = 1;
 }
 //# sourceMappingURL=codex.js.map

package/dist/commands/doctor.js

@@ -25,6 +25,7 @@ import { isUpdateMigrationReceiptCurrent, projectUpdateMigrationReceiptPath, wri
 import { inspectSksMenuBarStatus, installSksMenuBar } from '../core/codex-app/sks-menubar.js';
 import { sweepSksTempDirs } from '../core/retention.js';
 import { detectImagegenCapability } from '../core/imagegen/imagegen-capability.js';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
 export async function run(_command, args = []) {
     const root = await projectRoot();
     const doctorFix = flag(args, '--fix');
@@ -773,30 +774,48 @@ async function runDoctor(args = [], root, doctorFix) {
         : null;
     const shouldProbeNativeCapabilityRepairs = doctorFix || deepDiagnostics || nativeCapabilityDiagnosticsRequested;
     const imagegen = await detectImagegenCapability({ codexBin: codexBin || undefined }).catch((err) => ({ ok: false, error: err.message, auth_readiness: null, core_ready: false, blockers: ['imagegen_detection_exception'] }));
-    const imagegenRepair = imagegen.core_ready === true
-        ? {
+    const imagegenRepair = shouldProbeNativeCapabilityRepairs
+        ? await (await import('../core/doctor/imagegen-repair.js')).repairCodexImagegen({ root, apply: doctorFix, codexBin: codexBin || null }).catch((err) => ({
             schema: 'sks.doctor-imagegen-repair.v1',
-            ok: true,
-            attempted: false,
+            ok: false,
+            attempted: true,
             apply: doctorFix,
-            recovered: true,
-            before: imagegen,
-            after: imagegen,
-            steps: [],
-            blockers: [],
-            manual_actions: [],
-            communication_test: { level: 'flag_level', ok: true, checked: 'codex features list --json (feature-flag/plugin metadata only)', real_generation_round_trip_performed: false, blocker: null }
-        }
-        : shouldProbeNativeCapabilityRepairs
-            ? await (await import('../core/doctor/imagegen-repair.js')).repairCodexImagegen({ root, apply: doctorFix, codexBin: codexBin || null }).catch((err) => ({
+            recovered: false,
+            capability_ready: false,
+            route_ready: false,
+            real_generation_verified: false,
+            blockers: [err?.message || String(err)],
+            manual_actions: ['Run `sks doctor --fix --json` after enabling Codex App image_generation.']
+        }))
+        : imagegen.core_ready === true
+            ? {
                 schema: 'sks.doctor-imagegen-repair.v1',
                 ok: false,
-                attempted: true,
+                attempted: false,
                 apply: doctorFix,
                 recovered: false,
-                blockers: [err?.message || String(err)],
-                manual_actions: ['Run `sks doctor --fix --json` after enabling Codex App image_generation.']
-            }))
+                capability_ready: true,
+                configuration_ready: true,
+                route_ready: false,
+                real_generation_verified: false,
+                current_task_tool_manifest_verified: false,
+                requires_new_task: true,
+                before: imagegen,
+                after: imagegen,
+                steps: [],
+                blockers: ['codex_imagegen_current_task_tool_manifest_unverified', 'codex_imagegen_real_output_unverified'],
+                manual_actions: [
+                    'Start a fresh Codex/Work task so $imagegen is present in its tool manifest.',
+                    'Invoke $imagegen with gpt-image-2 and bind the selected raster output path to route evidence.'
+                ],
+                communication_test: {
+                    level: 'flag_level',
+                    ok: false,
+                    checked: 'codex features list (feature-flag/plugin metadata only)',
+                    real_generation_round_trip_performed: false,
+                    blocker: 'codex_imagegen_real_output_unverified'
+                }
+            }
             : deferredNativeRepair('sks.doctor-imagegen-repair.v1', doctorFix, [
                 'Run `sks doctor --fix --repair-native-capabilities --json` after enabling Codex App image_generation.'
             ]);
@@ -843,12 +862,23 @@ async function runDoctor(args = [], root, doctorFix) {
         : null;
     const nativeCapabilityReadinessStatus = (repair) => repair?.skipped === true
         ? (repair.status || 'deferred')
-        : (repair?.recovered === true || repair?.ok === true ? 'ok' : repair?.attempted ? 'blocked' : 'not-needed');
+        : repair?.route_ready === true
+            ? 'ok'
+            : repair?.capability_ready === true
+                ? 'available-unverified'
+                : (repair?.recovered === true || repair?.ok === true ? 'ok' : repair?.attempted ? 'blocked' : 'not-needed');
     const nativeCapabilityReadiness = {
         schema: 'sks.native-capability-readiness.v1',
         generated_at: nowIso(),
         apply: doctorFix,
-        imagegen: { status: nativeCapabilityReadinessStatus(imagegenRepair), communication_test: imagegenRepair?.communication_test || null, blockers: imagegenRepair?.blockers || [] },
+        imagegen: {
+            status: nativeCapabilityReadinessStatus(imagegenRepair),
+            capability_ready: imagegenRepair?.capability_ready === true,
+            route_ready: imagegenRepair?.route_ready === true,
+            generated_output_verified: imagegenRepair?.real_generation_verified === true,
+            communication_test: imagegenRepair?.communication_test || null,
+            blockers: imagegenRepair?.blockers || []
+        },
         computer_use: { status: nativeCapabilityReadinessStatus(computerUseRepair), blockers: computerUseRepair?.blockers || [], next_actions: computerUseRepair?.next_actions || [] },
         browser_use: { status: nativeCapabilityReadinessStatus(browserUseRepair), blockers: browserUseRepair?.blockers || [], next_actions: browserUseRepair?.next_actions || [] }
     };
@@ -1080,7 +1110,11 @@ async function runDoctor(args = [], root, doctorFix) {
             error: sksTempSweep.error || null
         },
         imagegen: {
-            ok: imagegen.auth_readiness?.available_paths?.length > 0,
+            ok: imagegenRepair?.route_ready === true,
+            capability_ready: imagegen.codex_app?.available === true,
+            route_ready: imagegenRepair?.route_ready === true,
+            generated_output_verified: imagegenRepair?.real_generation_verified === true,
+            auth_ready: imagegen.auth_readiness?.headless_auto_available === true,
             auth_readiness: imagegen.auth_readiness || null,
             codex_app_builtin_available: imagegen.codex_app?.available === true
         },
@@ -1252,7 +1286,7 @@ async function runDoctor(args = [], root, doctorFix) {
                 console.log(`  - ${action}`);
         }
     }
-    console.log(`Image Gen repair: ${imagegenRepair.recovered ? 'ok' : imagegenRepair.attempted ? 'blocked' : 'not-needed'}`);
+    console.log(`Image Gen repair: ${nativeCapabilityReadiness.imagegen.status}`);
     for (const action of imagegenRepair.manual_actions || [])
         console.log(`  - ${action}`);
     console.log(`Computer Use repair: ${computerUseRepair.recovered ? 'ok' : computerUseRepair.attempted ? 'blocked' : 'not-needed'}`);
@@ -1272,7 +1306,7 @@ async function runDoctor(args = [], root, doctorFix) {
     }
     const codex0138 = codex0138Capability.report || {};
     console.log('Codex current compatibility:');
-    console.log(`  target: rust-v0.142.0`);
+    console.log(`  target: ${CURRENT_CODEX_RELEASE_MANIFEST.targetTag}`);
     console.log(`  runtime: ${codex.version || 'unknown'}`);
     console.log(`  multi-agent mode: ${codexNativeFeatureMatrix.features?.multi_agent_mode?.ok ? 'verified' : 'unverified'}`);
     console.log(`  rollout budget: ${codexNativeFeatureMatrix.features?.rollout_budget?.ok ? 'verified' : 'unverified'}`);
@@ -1378,9 +1412,9 @@ function buildRuntimeReadiness(zellijReadiness, matrix) {
             ...(zellijStatus === 'headless_available' ? ['MAD can run with --headless; live panes require repair'] : []),
             ...(hookPolicy !== 'approved-only' ? ['hook-derived evidence will not count'] : []),
             ...(agentStrategy !== 'agent_type' ? ['message-role fallback active'] : []),
-            ...(multiAgentMode === 'proactive' ? ['Codex 0.142 multi-agent proactive mode available for Naruto-style routes'] : []),
-            ...(rolloutBudget === 'codex-0142-shared' ? ['Codex 0.142 rollout budget can be recorded in route proof'] : []),
-            ...(researchSource === 'indexed-web-search' ? ['Codex 0.142 indexed web search selected for source-intelligence routes'] : [])
+            ...(multiAgentMode === 'proactive' ? [`Codex ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion} multi-agent proactive mode available for Naruto-style routes`] : []),
+            ...(rolloutBudget === 'codex-0144-shared' ? [`Codex ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion} rollout budget can be recorded in route proof`] : []),
+            ...(researchSource === 'indexed-web-search' ? [`Codex ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion} indexed web search selected for source-intelligence routes`] : [])
         ],
         repair_actions: [...new Set(repairActions)]
     };

package/dist/commands/versioning.js

@@ -3,6 +3,13 @@ import { bumpProjectVersion, disableVersionGitHook, versioningStatus } from '../
 import { flag } from '../cli/args.js';
 import { printJson } from '../cli/output.js';
 export async function run(_command, args = []) {
+    if (flag(args, '--help') || flag(args, '-h')) {
+        const usage = 'Usage: sks versioning status|bump [major|minor|patch]|disable [--json]';
+        if (flag(args, '--json'))
+            return printJson({ ok: true, command: 'versioning', usage, mutated: false });
+        console.log(usage);
+        return;
+    }
     const root = await projectRoot();
     const action = args[0] || 'status';
     const bump = ['major', 'minor', 'patch'].includes(String(args[1] || '')) ? String(args[1]) : null;