sneakoscope 6.0.3 → 6.1.2

package/dist/core/codex-control/codex-0139-image-path-real-probe.js

@@ -1,10 +1,10 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { buildCodexExecArgs, findCodexBinary } from '../codex-adapter.js';
+import { buildCodexExecArgs, findCodexBinary, runCodexExec } from '../codex-adapter.js';
 import { ensureDir, runProcess, writeBinaryAtomic } from '../fsx.js';
 import { buildImageArtifactPathContract } from '../image/image-artifact-path-contract.js';
 import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
-const ONE_BY_ONE_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=', 'base64');
+const ONE_BY_ONE_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR4nGP4//8/AAX+Av4N70a4AAAAAElFTkSuQmCC', 'base64');
 export async function runCodex0139ImageReferencedPathRealProbe(input) {
     const started = Date.now();
     const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `image-path-${Date.now()}`);
@@ -14,10 +14,10 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
     await writeBinaryAtomic(inputA, ONE_BY_ONE_PNG);
     await writeBinaryAtomic(inputB, ONE_BY_ONE_PNG);
     const contract = await buildImageArtifactPathContract(input.root, {
-        missionId: 'codex-0139-image-path-real-probe',
+        missionId: 'codex-0144-image-path-real-probe',
         images: [
-            { id: 'input-a', kind: 'input_attachment', filePath: inputA, route: 'codex-0139-real-probe', stage: 'candidate' },
-            { id: 'input-b', kind: 'input_attachment', filePath: inputB, route: 'codex-0139-real-probe', stage: 'referenced' }
+            { id: 'input-a', kind: 'input_attachment', filePath: inputA, route: 'codex-0144-core-real-probe', stage: 'candidate' },
+            { id: 'input-b', kind: 'input_attachment', filePath: inputB, route: 'codex-0144-core-real-probe', stage: 'referenced' }
         ]
     });
     const codexBin = input.codexBin || await findCodexBinary();
@@ -34,7 +34,7 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
             artifact_paths: [tempDir]
         };
     }
-    if (process.env.SKS_CODEX_0139_IMAGE_REAL_PROBE_ALLOW_SKIP === '1') {
+    if (process.env.SKS_CODEX_0144_IMAGE_REAL_PROBE_ALLOW_SKIP === '1' || process.env.SKS_CODEX_0139_IMAGE_REAL_PROBE_ALLOW_SKIP === '1') {
         return {
             ...skippedCodex0139Probe('codex_image_edit_actual_api_skipped', {
                 codex_bin: codexBin,
@@ -48,17 +48,26 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
     }
     const outputFile = path.join(tempDir, 'last-message.txt');
     const prompt = [
-        'This is a Codex 0.139 image path routing probe.',
+        'This is a Codex 0.144.1 image path routing probe.',
         `Only the image file named ${path.basename(inputB)} is intentionally referenced.`,
         `Return compact JSON {"referenced_path":"${inputB.replace(/\\/g, '\\\\')}","saw_image":true}.`,
         'Do not edit files and do not reference any other image path.'
     ].join(' ');
-    const extraArgs = ['--image', inputB, '--skip-git-repo-check', '--ephemeral'];
+    const extraArgs = ['-c', 'mcp_servers={}', '--image', inputB, '--skip-git-repo-check', '--ephemeral'];
     const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs });
-    const result = await runProcess(codexBin, args, {
-        cwd: tempDir,
+    const result = await runCodexExec({
+        root: tempDir,
+        recoveryRoot: input.root,
+        prompt,
+        outputFile,
+        json: true,
+        extraArgs,
         timeoutMs: input.timeoutMs || 60000,
-        maxOutputBytes: 512 * 1024
+        maxBufferBytes: 512 * 1024,
+        codexBin,
+        env: input.env || process.env,
+        ...(typeof input.recoveryFetch === 'function' ? { recoveryFetch: input.recoveryFetch } : {}),
+        ...(typeof input.runProcessImpl === 'function' ? { runProcessImpl: input.runProcessImpl } : {})
     }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
     const outputText = await fs.readFile(outputFile, 'utf8').catch(() => '');
     const combined = `${result.stdout || ''}\n${result.stderr || ''}\n${outputText}`;
@@ -68,6 +77,7 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
     const ok = exactReferencedPath
         && commandReferencesOnlyInputB
         && outputReferencesInputB
+        && processExitedSuccessfully
         && contract.blockers.length === 0;
     return {
         ok,
@@ -86,9 +96,16 @@ export async function runCodex0139ImageReferencedPathRealProbe(input) {
             process_exited_successfully: processExitedSuccessfully,
             process_warning: processExitedSuccessfully ? null : 'Codex emitted the referenced path evidence before process timeout/nonzero exit.',
             output_file: outputFile,
+            codex_lb_tool_output_recovery: result.codexLbToolOutputRecovery || null,
             contract_blockers: contract.blockers
         },
-        blockers: ok ? [] : ['codex_image_referenced_path_actual_cli_probe_failed']
+        blockers: ok ? [] : [
+            ...(processExitedSuccessfully ? [] : ['codex_image_referenced_path_process_failed_or_timed_out']),
+            ...(result.codexLbToolOutputRecovery?.blockers || []),
+            ...(!exactReferencedPath || !commandReferencesOnlyInputB || !outputReferencesInputB || contract.blockers.length > 0
+                ? ['codex_image_referenced_path_actual_cli_probe_failed']
+                : [])
+        ]
     };
 }
 //# sourceMappingURL=codex-0139-image-path-real-probe.js.map

package/dist/core/codex-control/codex-0139-probe-runner.js

@@ -1,11 +1,12 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
-import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+import { parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
 import { runProcess } from '../fsx.js';
 import { runCodex0139DoctorEnvRealProbe } from './codex-0139-doctor-real-probe.js';
 import { runCodex0139ImageReferencedPathRealProbe } from './codex-0139-image-path-real-probe.js';
-import { runCodex0139InterruptAgentRealProbe } from './codex-0139-multi-agent-real-probe.js';
+import { runCodex0144CollabAgentToolSchemaRealProbe } from './codex-0144-collab-agent-real-probe.js';
 import { runCodex0139MarketplaceSourceRealProbe, runCodex0139PluginCacheRealProbe } from './codex-0139-plugin-real-probes.js';
 import { buildCodex0139RealProbeResult, CODEX_0139_REAL_PROBE_NAMES, skippedCodex0139Probe } from './codex-0139-real-probes.js';
 import { runCodex0139RichSchemaRealProbe } from './codex-0139-rich-schema-real-probe.js';
@@ -14,34 +15,68 @@ import { runCodex0139WebSearchRealProbe } from './codex-0139-web-search-probe.js
 export async function runCodex0139RealProbes(input) {
     const timeoutMs = Math.max(1, Number(input.timeoutMs || 120000) || 120000);
     const requireReal = input.requireReal === true;
-    const codexBin = input.codexBin || await findCodex0139RealProbeBinary();
+    const codexBin = input.codexBin || await findCurrentCodexRealProbeBinary();
     const versionText = await readCodexVersionText(codexBin, timeoutMs);
     const parsedVersion = parseCodexVersionText(versionText);
-    const atLeast139 = Boolean(parsedVersion && compareSemverLike(parsedVersion, '0.139.0') >= 0);
-    const requested = new Set((input.probes?.length ? input.probes : CODEX_0139_REAL_PROBE_NAMES).filter((name) => CODEX_0139_REAL_PROBE_NAMES.includes(name)));
+    const currentVersion = parsedVersion === CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion;
+    const requestedRaw = input.probes?.length ? input.probes : CODEX_0139_REAL_PROBE_NAMES;
+    const unknownProbeNames = requestedRaw.filter((name) => !CODEX_0139_REAL_PROBE_NAMES.includes(name));
+    const requested = [...new Set(requestedRaw.filter((name) => CODEX_0139_REAL_PROBE_NAMES.includes(name)))];
     const probes = Object.fromEntries(CODEX_0139_REAL_PROBE_NAMES.map((name) => [name, skippedCodex0139Probe('probe_not_requested')]));
-    const extraBlockers = [];
+    const extraBlockers = unknownProbeNames.map((name) => `unknown_real_probe:${name}`);
     if (!codexBin)
         extraBlockers.push('codex_cli_missing');
-    if (!atLeast139)
-        extraBlockers.push('codex_0_139_required');
-    if (!codexBin || !atLeast139) {
+    if (!currentVersion)
+        extraBlockers.push(`codex_${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion.replaceAll('.', '_')}_required`);
+    if (!codexBin || !currentVersion) {
         for (const name of requested) {
-            probes[name] = skippedCodex0139Probe(!codexBin ? 'codex_cli_missing' : 'codex_0_139_required', { parsed_version: parsedVersion });
+            probes[name] = skippedCodex0139Probe(!codexBin ? 'codex_cli_missing' : 'codex_current_release_required', { parsed_version: parsedVersion });
         }
-        return buildCodex0139RealProbeResult({ codexBin, versionText, parsedVersion, requireReal, timeoutMs, probes, extraBlockers });
+        const tempCleanup = await cleanupProbeTempRoot(input.root);
+        return buildCodex0139RealProbeResult({ codexBin, versionText, parsedVersion, requireReal, timeoutMs, probes, requiredProbeNames: requested, releaseAuthorizing: false, tempCleanup, extraBlockers });
     }
-    for (const name of requested) {
-        probes[name] = await runOne(name, {
-            root: input.root,
-            requireReal,
-            timeoutMs,
-            codexBin,
-            allowNetwork: input.allowNetwork,
-            allowDesktop: input.allowDesktop
-        });
+    let rows = [];
+    let tempCleanup;
+    try {
+        rows = await Promise.all(requested.map(async (name) => {
+            try {
+                const probe = await runOne(name, {
+                    root: input.root,
+                    requireReal,
+                    timeoutMs,
+                    codexBin,
+                    allowNetwork: input.allowNetwork,
+                    allowDesktop: input.allowDesktop
+                });
+                return [name, surfaceRuntimeWarnings(probe)];
+            }
+            catch (err) {
+                const errorClass = err instanceof Error ? err.name : typeof err;
+                extraBlockers.push(`codex_real_probe_runner_failed:${name}`);
+                return [name, skippedCodex0139Probe('codex_real_probe_runner_failed', { error_class: errorClass })];
+            }
+        }));
+    }
+    finally {
+        tempCleanup = await cleanupProbeTempRoot(input.root);
     }
-    return buildCodex0139RealProbeResult({ codexBin, versionText, parsedVersion, requireReal, timeoutMs, probes, extraBlockers });
+    for (const [name, probe] of rows)
+        probes[name] = probe;
+    sanitizeCleanedTempArtifacts(probes, input.root);
+    if (!tempCleanup.ok)
+        extraBlockers.push('codex_real_probe_temp_cleanup_failed');
+    return buildCodex0139RealProbeResult({
+        codexBin,
+        versionText,
+        parsedVersion,
+        requireReal,
+        timeoutMs,
+        probes,
+        requiredProbeNames: requested,
+        releaseAuthorizing: requireReal && currentVersion,
+        tempCleanup,
+        extraBlockers
+    });
 }
 async function runOne(name, input) {
     switch (name) {
@@ -57,11 +92,11 @@ async function runOne(name, input) {
             return runCodex0139PluginCacheRealProbe(input);
         case 'sandbox_profile_alias':
             return runCodex0139SandboxProfileAliasProbe(input);
-        case 'interrupt_agent_event':
-            return runCodex0139InterruptAgentRealProbe(input);
+        case 'collab_agent_tool_schema':
+            return runCodex0144CollabAgentToolSchemaRealProbe(input);
         case 'image_referenced_path':
             return runCodex0139ImageReferencedPathRealProbe(input);
-        case 'sandbox_proxy_preservation':
+        case 'sandbox_proxy_environment':
             return runCodex0139SandboxProxyPreservationProbe(input);
     }
 }
@@ -76,7 +111,7 @@ async function readCodexVersionText(codexBin, timeoutMs) {
     const text = `${result.stdout || ''}${result.stderr || ''}`.trim();
     return text || null;
 }
-export async function findCodex0139RealProbeBinary() {
+export async function findCurrentCodexRealProbeBinary() {
     const candidates = await codexBinaryCandidates();
     let firstExisting = null;
     for (const candidate of candidates) {
@@ -84,18 +119,18 @@ export async function findCodex0139RealProbeBinary() {
             firstExisting = candidate;
         const versionText = await readCodexVersionText(candidate, 30000);
         const parsed = parseCodexVersionText(versionText);
-        if (parsed && compareSemverLike(parsed, '0.139.0') >= 0)
+        if (parsed === CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion)
             return candidate;
     }
     return firstExisting || await findCodexBinary();
 }
 async function codexBinaryCandidates() {
     const raw = [
+        path.join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'codex.cmd' : 'codex'),
         process.env.SKS_CODEX_BIN,
         process.env.DCODEX_CODEX_BIN,
         process.env.CODEX_BIN,
-        ...pathCandidates('codex'),
-        path.join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'codex.cmd' : 'codex')
+        ...pathCandidates('codex')
     ].filter(Boolean).map(String);
     const out = [];
     for (const candidate of raw) {
@@ -110,6 +145,46 @@ async function codexBinaryCandidates() {
     }
     return out;
 }
+function surfaceRuntimeWarnings(probe) {
+    const warnings = [...(probe.warnings || [])];
+    const blockers = [...probe.blockers];
+    const stderr = String(probe.stderr_tail || '');
+    if (/AuthRequired|Auth required|No access token was provided/i.test(stderr)) {
+        warnings.push('codex_real_probe_external_mcp_auth_required');
+    }
+    if (probe.evidence?.process_warning)
+        warnings.push('codex_real_probe_process_warning');
+    return {
+        ...probe,
+        ok: probe.ok && blockers.length === 0,
+        warnings: [...new Set(warnings)],
+        blockers: [...new Set(blockers)]
+    };
+}
+async function cleanupProbeTempRoot(root) {
+    const tempRoot = path.join(root, '.sneakoscope', 'tmp', 'codex-0139-real-probes');
+    await fs.rm(tempRoot, { recursive: true, force: true }).catch(() => undefined);
+    const remainingEntries = await fs.readdir(tempRoot).catch(() => []);
+    return { root: tempRoot, ok: remainingEntries.length === 0, remaining_entries: remainingEntries };
+}
+function sanitizeCleanedTempArtifacts(probes, root) {
+    const tempRoot = path.resolve(root, '.sneakoscope', 'tmp', 'codex-0139-real-probes');
+    for (const probe of Object.values(probes)) {
+        const tempArtifacts = probe.artifact_paths.filter((artifact) => {
+            const resolved = path.resolve(artifact);
+            return resolved === tempRoot || resolved.startsWith(`${tempRoot}${path.sep}`);
+        });
+        if (!tempArtifacts.length)
+            continue;
+        probe.artifact_paths = probe.artifact_paths.filter((artifact) => !tempArtifacts.includes(artifact));
+        probe.evidence = {
+            ...probe.evidence,
+            observed_temp_artifact_count: tempArtifacts.length,
+            temp_artifacts_cleaned: true,
+            durable_evidence: 'embedded_in_codex_real_probe_report'
+        };
+    }
+}
 function pathCandidates(command) {
     const exts = process.platform === 'win32' ? ['.cmd', '.exe', '.bat', ''] : [''];
     return (process.env.PATH || '').split(path.delimiter).flatMap((dir) => exts.map((ext) => path.join(dir, `${command}${ext}`)));

package/dist/core/codex-control/codex-0139-real-probe-summary.js

@@ -3,17 +3,21 @@ import { codex0139ProbeArtifactPath } from './codex-0139-real-probes.js';
 import { readJson, writeJsonAtomic } from '../fsx.js';
 export async function buildCodex0139RealProbeSummary(root) {
     const result = await readJson(codex0139ProbeArtifactPath(root));
-    const probes = Object.fromEntries(Object.entries(result.probes || {}).map(([name, probe]) => [name, {
+    const requested = new Set((result.requested_probes?.length ? result.requested_probes : Object.keys(result.probes || {})).map(String));
+    const requestedEntries = Object.entries(result.probes || {}).filter(([name]) => requested.has(name));
+    const probes = Object.fromEntries(requestedEntries.map(([name, probe]) => [name, {
             ok: probe.ok === true,
             mode: probe.mode,
             blockers: probe.blockers || []
         }]));
-    const values = Object.values(result.probes || {});
+    const values = requestedEntries.map(([, probe]) => probe);
     const skippedCount = values.filter((probe) => probe.mode === 'skipped').length;
     const failedCount = values.filter((probe) => probe.ok !== true && probe.mode !== 'skipped').length;
     return {
         schema: 'sks.codex-0139-real-probe-summary.v1',
-        ok: result.require_real ? skippedCount === 0 && failedCount === 0 : result.overall_ok === true,
+        target_version: result.target_version,
+        compatibility_authority: 'deprecated_non_authoritative_lineage_only',
+        ok: result.overall_ok === true,
         require_real: result.require_real,
         codex_bin: result.codex_bin,
         parsed_version: result.parsed_version,

package/dist/core/codex-control/codex-0139-real-probes.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 export const CODEX_0139_REAL_PROBE_NAMES = [
     'code_mode_web_search',
@@ -7,9 +8,9 @@ export const CODEX_0139_REAL_PROBE_NAMES = [
     'marketplace_source_json',
     'plugin_catalog_cache',
     'sandbox_profile_alias',
-    'interrupt_agent_event',
+    'collab_agent_tool_schema',
     'image_referenced_path',
-    'sandbox_proxy_preservation'
+    'sandbox_proxy_environment'
 ];
 export function codex0139ProbeArtifactPath(root) {
     return path.join(root, '.sneakoscope', 'codex-0139-real-probes.json');
@@ -50,24 +51,38 @@ export function codex0139ProbeTail(text, limit = 4000) {
     return raw.length <= limit ? raw : raw.slice(raw.length - limit);
 }
 export function buildCodex0139RealProbeResult(input) {
-    const skipped = CODEX_0139_REAL_PROBE_NAMES.filter((name) => input.probes[name]?.mode === 'skipped');
-    const failed = CODEX_0139_REAL_PROBE_NAMES.filter((name) => input.probes[name] && input.probes[name].ok !== true && input.probes[name].mode !== 'skipped');
+    const requiredProbeNames = input.requiredProbeNames ? [...new Set(input.requiredProbeNames)] : [...CODEX_0139_REAL_PROBE_NAMES];
+    const skipped = requiredProbeNames.filter((name) => input.probes[name]?.mode === 'skipped');
+    const failed = requiredProbeNames.filter((name) => input.probes[name] && input.probes[name].ok !== true && input.probes[name].mode !== 'skipped');
     const blockers = [
         ...(input.extraBlockers || []),
-        ...CODEX_0139_REAL_PROBE_NAMES.flatMap((name) => input.probes[name]?.blockers || []),
+        ...requiredProbeNames.flatMap((name) => input.probes[name]?.blockers || []),
         ...(input.requireReal && skipped.length ? skipped.map((name) => `require_real_skipped:${name}`) : [])
     ];
+    const warnings = requiredProbeNames.flatMap((name) => input.probes[name]?.warnings || []);
+    const overallOk = input.requireReal ? blockers.length === 0 && failed.length === 0 && skipped.length === 0 : failed.length === 0;
     return {
         schema: 'sks.codex-0139-real-probe-result.v1',
+        target_version: CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+        compatibility_origin: 'codex-0139-real-probe-result-v1',
+        compatibility_authority: 'deprecated_non_authoritative_lineage_only',
         generated_at: nowIso(),
         codex_bin: input.codexBin,
         version_text: input.versionText,
         parsed_version: input.parsedVersion,
         require_real: input.requireReal,
-        overall_ok: input.requireReal ? blockers.length === 0 && failed.length === 0 && skipped.length === 0 : failed.length === 0,
+        release_authorizing: Boolean(input.releaseAuthorizing && overallOk),
+        overall_ok: overallOk,
         probe_timeout_ms: input.timeoutMs,
+        requested_probes: requiredProbeNames,
         probes: input.probes,
         skipped,
+        warnings: [...new Set(warnings)],
+        external_integration_status: {
+            mcp_auth: warnings.includes('codex_real_probe_external_mcp_auth_required') ? 'authentication_required' : 'not_observed',
+            release_authorization_scope: 'codex_core_compatibility_only'
+        },
+        temp_cleanup: input.tempCleanup || { root: '', ok: false, remaining_entries: [] },
         blockers: [...new Set(blockers)]
     };
 }

package/dist/core/codex-control/codex-0139-sandbox-real-probe.js

@@ -16,7 +16,8 @@ export async function runCodex0139SandboxProfileAliasProbe(input) {
     const dryArgs = sandboxHelpMentionsAlias ? ['sandbox', '-P', ':read-only', '--', 'true'] : ['-P', ':read-only', '--version'];
     const dry = await runProcess(codexBin, dryArgs, { timeoutMs: input.timeoutMs || 30000, maxOutputBytes: 64 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
     const dryAccepted = dry.code === 0;
-    const ok = topLevelHelpMentionsAlias || sandboxHelpMentionsAlias;
+    const helpMentionsAlias = topLevelHelpMentionsAlias || sandboxHelpMentionsAlias;
+    const ok = helpMentionsAlias && dryAccepted;
     return {
         ok,
         mode: 'actual-cli',
@@ -26,15 +27,18 @@ export async function runCodex0139SandboxProfileAliasProbe(input) {
         stderr_tail: codex0139ProbeTail(`${help.stderr || ''}\n${sandboxHelp.stderr || ''}\n${dry.stderr || ''}`),
         artifact_paths: [],
         evidence: {
-            help_mentions_P: topLevelHelpMentionsAlias || sandboxHelpMentionsAlias,
+            help_mentions_P: helpMentionsAlias,
             top_level_help_mentions_P: topLevelHelpMentionsAlias,
             sandbox_help_mentions_P: sandboxHelpMentionsAlias,
             dry_command_attempted: true,
             dry_command_line: [codexBin, ...dryArgs],
             dry_command_accepted: dryAccepted,
-            dry_command_warning: dryAccepted ? null : 'help proof accepted; dry no-op unsupported in this CLI shape'
+            dry_command_warning: dryAccepted ? null : 'permissions-profile alias was advertised but the real sandbox no-op failed'
         },
-        blockers: ok ? [] : ['codex_sandbox_profile_alias_help_missing']
+        blockers: ok ? [] : [
+            ...(helpMentionsAlias ? [] : ['codex_sandbox_profile_alias_help_missing']),
+            ...(dryAccepted ? [] : ['codex_sandbox_profile_alias_real_command_failed'])
+        ]
     };
 }
 export async function runCodex0139SandboxProxyPreservationProbe(input) {
@@ -44,16 +48,23 @@ export async function runCodex0139SandboxProxyPreservationProbe(input) {
         return skippedCodex0139Probe('codex_cli_missing');
     const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `sandbox-proxy-${Date.now()}`);
     await ensureDir(tempDir);
-    const args = ['sandbox', '-P', ':read-only', '-C', tempDir, '--', 'true'];
+    const proxyState = {
+        HTTPS_PROXY: Boolean(process.env.HTTPS_PROXY),
+        HTTP_PROXY: Boolean(process.env.HTTP_PROXY),
+        ALL_PROXY: Boolean(process.env.ALL_PROXY)
+    };
+    const probeScript = 'process.stdout.write(JSON.stringify({HTTPS_PROXY:Boolean(process.env.HTTPS_PROXY),HTTP_PROXY:Boolean(process.env.HTTP_PROXY),ALL_PROXY:Boolean(process.env.ALL_PROXY)}))';
+    const args = ['sandbox', '-P', ':read-only', '-C', tempDir, '--', process.execPath, '-e', probeScript];
     const result = await runProcess(codexBin, args, {
         cwd: tempDir,
         timeoutMs: input.timeoutMs || 30000,
         maxOutputBytes: 64 * 1024
     }).catch((err) => ({ code: 1, stdout: '', stderr: err?.message || String(err) }));
     const safeNoopRan = result.code === 0;
-    const proxyMarkerAvailable = Boolean(process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY);
-    const approvedEscalationPreservationScriptable = process.env.SKS_CODEX_0139_SANDBOX_PROXY_APPROVED_ESCALATION_RETRY === '1';
-    const ok = safeNoopRan && (!input.requireReal || approvedEscalationPreservationScriptable);
+    const observedProxyState = parseProxyState(result.stdout);
+    const proxyEnvironmentPreserved = observedProxyState !== null
+        && Object.entries(proxyState).every(([key, value]) => observedProxyState[key] === value);
+    const ok = safeNoopRan && proxyEnvironmentPreserved;
     return {
         ok,
         mode: 'actual-cli',
@@ -64,16 +75,31 @@ export async function runCodex0139SandboxProxyPreservationProbe(input) {
         artifact_paths: [tempDir],
         evidence: {
             safe_noop_ran: safeNoopRan,
-            proxy_marker_available: proxyMarkerAvailable,
-            proxy_marker_checked: proxyMarkerAvailable,
-            approved_escalation_preservation_scriptable: approvedEscalationPreservationScriptable,
-            approved_escalation_retry_env: 'SKS_CODEX_0139_SANDBOX_PROXY_APPROVED_ESCALATION_RETRY=1',
+            host_proxy_presence: proxyState,
+            sandbox_proxy_presence: observedProxyState,
+            proxy_marker_checked: true,
+            proxy_environment_preserved: proxyEnvironmentPreserved,
             permissions_profile: ':read-only'
         },
         blockers: ok ? [] : [
             ...(safeNoopRan ? [] : ['codex_sandbox_proxy_safe_noop_failed']),
-            ...(input.requireReal && !approvedEscalationPreservationScriptable ? ['codex_sandbox_proxy_escalation_preservation_not_safely_scriptable'] : [])
+            ...(proxyEnvironmentPreserved ? [] : ['codex_sandbox_proxy_environment_not_preserved'])
         ]
     };
 }
+function parseProxyState(text) {
+    try {
+        const parsed = JSON.parse(String(text || ''));
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        return {
+            HTTPS_PROXY: parsed.HTTPS_PROXY === true,
+            HTTP_PROXY: parsed.HTTP_PROXY === true,
+            ALL_PROXY: parsed.ALL_PROXY === true
+        };
+    }
+    catch {
+        return null;
+    }
+}
 //# sourceMappingURL=codex-0139-sandbox-real-probe.js.map

package/dist/core/codex-control/codex-0139-web-search-probe.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { buildCodexExecArgs, findCodexBinary } from '../codex-adapter.js';
+import { buildCodexExecArgs, findCodexBinary, runCodexExec } from '../codex-adapter.js';
 import { ensureDir, runProcess, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
 import { codex0139ProbeTail, skippedCodex0139Probe } from './codex-0139-real-probes.js';
 export async function runCodex0139WebSearchRealProbe(input) {
@@ -14,16 +14,25 @@ export async function runCodex0139WebSearchRealProbe(input) {
         return skippedCodex0139Probe('codex_cli_missing');
     const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-0139-real-probes', `web-search-${Date.now()}`);
     await ensureDir(tempDir);
-    await writeTextAtomic(path.join(tempDir, 'README.md'), 'Temporary Codex 0.139 web-search real probe workspace.\n');
+    await writeTextAtomic(path.join(tempDir, 'README.md'), 'Temporary Codex 0.144.1 web-search real probe workspace.\n');
     const outputFile = path.join(tempDir, 'last-message.txt');
-    const prompt = 'In code mode, use standalone web search to find the title of https://example.com or OpenAI Codex release 0.139. Return JSON {"used_web_search":true,"answer":"...","sources":[...]}.';
-    const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs: [] });
-    const result = await runProcess(codexBin, args, {
-        cwd: tempDir,
+    const prompt = 'In code mode, use standalone web search to find the title of https://example.com. Return JSON {"used_web_search":true,"answer":"...","sources":[...]}.';
+    const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs: ['-c', 'mcp_servers={}'] });
+    const result = await runCodexExec({
+        root: tempDir,
+        recoveryRoot: input.root,
+        prompt,
+        outputFile,
+        json: true,
+        extraArgs: ['-c', 'mcp_servers={}'],
         timeoutMs: input.timeoutMs || 120000,
-        maxOutputBytes: 512 * 1024,
+        maxBufferBytes: 512 * 1024,
         stdoutFile: path.join(tempDir, 'codex.stdout.log'),
-        stderrFile: path.join(tempDir, 'codex.stderr.log')
+        stderrFile: path.join(tempDir, 'codex.stderr.log'),
+        codexBin,
+        env: input.env || process.env,
+        ...(typeof input.recoveryFetch === 'function' ? { recoveryFetch: input.recoveryFetch } : {}),
+        ...(typeof input.runProcessImpl === 'function' ? { runProcessImpl: input.runProcessImpl } : {})
     }).catch((err) => ({
         code: 1,
         stdout: '',
@@ -32,13 +41,13 @@ export async function runCodex0139WebSearchRealProbe(input) {
     const output = await fs.readFile(outputFile, 'utf8').catch(() => '');
     const combined = `${result.stdout || ''}\n${result.stderr || ''}\n${output}`;
     const sawWebSearchEvent = /\b(web[_ -]?search|search_result|sources?|tool_call|standalone web search)\b/i.test(combined);
-    const sawPlaintextResult = /(Example Domain|example\.com|OpenAI|Codex|0\.139)/i.test(combined);
+    const sawPlaintextResult = /(Example Domain|example\.com)/i.test(combined);
     const resultContainsExpectedMarker = /"used_web_search"\s*:\s*true|used_web_search/i.test(combined) || sawWebSearchEvent;
     const processExitedSuccessfully = result.code === 0;
-    const ok = sawPlaintextResult && resultContainsExpectedMarker;
+    const ok = processExitedSuccessfully && sawPlaintextResult && resultContainsExpectedMarker;
     if (ok) {
-        await writeJsonAtomic(path.join(input.root, '.sneakoscope', 'codex-0139-code-mode-web-search-policy.json'), {
-            schema: 'sks.codex-0139-code-mode-web-search-policy.v1',
+        await writeJsonAtomic(path.join(input.root, '.sneakoscope', 'codex-0144-code-mode-web-search-policy.json'), {
+            schema: 'sks.codex-0144-code-mode-web-search-policy.v1',
             ok: true,
             generated_at: new Date().toISOString(),
             allow_standalone_web_search_in_code_mode: true,
@@ -64,9 +73,14 @@ export async function runCodex0139WebSearchRealProbe(input) {
             result_contains_expected_marker: resultContainsExpectedMarker,
             process_exited_successfully: processExitedSuccessfully,
             process_warning: processExitedSuccessfully ? null : 'Codex emitted web-search evidence before process timeout/nonzero exit.',
-            output_file: outputFile
+            output_file: outputFile,
+            codex_lb_tool_output_recovery: result.codexLbToolOutputRecovery || null
         },
-        blockers: ok ? [] : ['codex_web_search_real_probe_failed']
+        blockers: ok ? [] : [
+            ...(processExitedSuccessfully ? [] : ['codex_web_search_process_failed_or_timed_out']),
+            ...(result.codexLbToolOutputRecovery?.blockers || []),
+            ...(!sawPlaintextResult || !resultContainsExpectedMarker ? ['codex_web_search_real_probe_failed'] : [])
+        ]
     };
 }
 //# sourceMappingURL=codex-0139-web-search-probe.js.map