sneakoscope 6.0.3 → 6.1.2

package/dist/commands/codex-lb.js

@@ -7,7 +7,9 @@ import { printJson } from '../cli/output.js';
 import { codexLbMetrics, readCodexLbCircuit, recordCodexLbHealthEvent, resetCodexLbCircuit, codexLbProofEvidence } from '../core/codex-lb-circuit.js';
 import { checkCodexLbResponseChain, codexLbStatus, configureCodexLb, formatCodexLbStatusText, releaseCodexLbAuthHold, repairCodexLbAuth, unselectCodexLbProvider } from '../cli/install-helpers.js';
 import { buildCodexLbSetupPlan, codexLbPersistenceSummary, renderCodexLbSetupPlan } from '../core/codex-lb/codex-lb-setup.js';
+import { CODEX_LB_TOOL_OUTPUT_RECOVERY_OVERRIDE_FLAG, codexLbToolOutputRecoveryOverrideAcknowledged } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
 import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
+import { repairCodexAppFastUi } from '../core/codex-app/codex-app-fast-ui-repair.js';
 export async function run(command, args = []) {
     const root = await projectRoot();
     const action = args[0] || 'status';
@@ -21,15 +23,19 @@ export async function run(command, args = []) {
         return;
     }
     if (action === 'status' || action === 'check') {
-        const result = await codexLbStatus();
+        const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args });
+        const result = await codexLbStatus({ probeToolOutputRecovery: true, allowUnverifiedToolOutputRecovery });
         const shaped = shapeCodexLbStatus(result);
+        if (result.selected && result.tool_output_recovery?.ok !== true)
+            process.exitCode = 1;
         if (flag(args, '--json'))
             return printJson(shaped);
         process.stdout.write(formatCodexLbStatusText(result));
         return;
     }
     if (action === 'doctor') {
-        const status = shapeCodexLbStatus(await codexLbStatus());
+        const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args });
+        const status = shapeCodexLbStatus(await codexLbStatus({ probeToolOutputRecovery: true, allowUnverifiedToolOutputRecovery }));
         const metrics = codexLbMetrics(await readCodexLbCircuit(root));
         const result = { schema: 'sks.codex-lb-doctor.v1', ok: Boolean(status.ok && metrics.ok), deep: flag(args, '--deep'), status, metrics };
         if (flag(args, '--json'))
@@ -40,9 +46,14 @@ export async function run(command, args = []) {
         return;
     }
     if (action === 'health' || action === 'verify-chain' || action === 'chain') {
-        const status = await codexLbStatus();
+        const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args });
+        const status = await codexLbStatus({ probeToolOutputRecovery: true, allowUnverifiedToolOutputRecovery });
         const blocker = !status.env_key_configured ? 'missing_env_key' : !status.base_url ? 'missing_base_url' : 'not_configured';
-        const result = status.ok ? await checkCodexLbResponseChain(status, { force: true, root, fastMode: flag(args, '--fast') || flag(args, '--priority') }) : { ok: false, status: blocker, codex_lb: status };
+        const result = status.selected && status.tool_output_recovery?.ok !== true
+            ? { ok: false, status: 'tool_output_recovery_blocked', codex_lb: status, tool_output_recovery: status.tool_output_recovery }
+            : status.ok
+                ? await checkCodexLbResponseChain(status, { force: true, root, fastMode: flag(args, '--fast') || flag(args, '--priority') })
+                : { ok: false, status: blocker, codex_lb: status };
         if (flag(args, '--json'))
             return printJson(result);
         console.log(`codex-lb response chain: ${result.ok ? 'ok' : `failed (${result.status})`}`);
@@ -51,37 +62,48 @@ export async function run(command, args = []) {
         return;
     }
     if (action === 'fast-check' || action === 'fast' || action === 'verify-fast') {
-        const status = await codexLbStatus();
+        const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args });
+        const status = await codexLbStatus({ probeToolOutputRecovery: true, allowUnverifiedToolOutputRecovery });
         const blocker = !status.env_key_configured ? 'missing_env_key' : !status.base_url ? 'missing_base_url' : !status.provider_contract_ok ? 'provider_contract_drift' : 'not_configured';
-        const chain = status.env_key_configured && status.base_url
-            ? await checkCodexLbResponseChain(status, { force: true, cache: false, root, fastMode: true })
-            : { ok: false, status: blocker, codex_lb: status };
+        const modelSelection = await resolveCodexLbFastCheckModel(status);
+        const chain = status.selected && status.tool_output_recovery?.ok !== true
+            ? { ok: false, status: 'tool_output_recovery_blocked', codex_lb: status, tool_output_recovery: status.tool_output_recovery }
+            : status.env_key_configured && status.base_url && modelSelection.model
+                ? await checkCodexLbResponseChain(status, { force: true, cache: false, root, fastMode: true, model: modelSelection.model })
+                : { ok: false, status: modelSelection.model ? blocker : 'model_unselected', codex_lb: status };
         const evidence = await fastEvidenceFromChain(chain, readOption(args, '--request-log', readOption(args, '--request-log-json', null)));
         const providerReady = status.provider_contract_ok === true;
+        const chainVerified = isCodexLbFastChainVerified(chain);
         const result = {
             schema: 'sks.codex-lb-fast-check.v1',
-            ok: Boolean(providerReady && chain.ok && evidence.fast_requested && evidence.fast_actual),
+            ok: Boolean(providerReady && chainVerified && evidence.fast_requested && evidence.fast_actual),
             status: !providerReady
                 ? 'provider_contract_drift'
-                : chain.ok
-                    ? evidence.fast_actual
-                        ? 'fast_verified'
-                        : evidence.fast_requested
-                            ? 'fast_requested_but_actual_unverified'
-                            : 'fast_not_requested'
-                    : chain.status,
+                : chain.skipped === true
+                    ? 'fast_check_chain_skipped'
+                    : chainVerified
+                        ? evidence.fast_actual
+                            ? 'fast_verified'
+                            : evidence.fast_requested
+                                ? 'fast_requested_but_actual_unverified'
+                                : 'fast_not_requested'
+                        : chain.status,
             codex_lb: status,
+            model_selection: modelSelection,
             chain,
             evidence,
             degraded_models: Array.isArray(chain.degraded_models) ? chain.degraded_models : [],
             quota_low: Boolean(chain.quota_low),
             blockers: [
                 ...(providerReady ? [] : ['codex_lb_provider_contract_drift']),
-                ...(chain.ok
-                    ? evidence.fast_actual
-                        ? []
-                        : ['codex_lb_actual_fast_service_tier_unverified']
-                    : [chain.status || blocker])
+                ...modelSelection.blockers,
+                ...(chain.skipped === true
+                    ? ['codex_lb_fast_check_chain_skipped']
+                    : chainVerified
+                        ? evidence.fast_actual
+                            ? []
+                            : [evidence.fast_requested ? 'codex_lb_actual_fast_service_tier_unverified' : 'codex_lb_fast_service_tier_not_requested']
+                        : [chain.status || blocker])
             ]
         };
         if (flag(args, '--json'))
@@ -94,12 +116,16 @@ export async function run(command, args = []) {
         return;
     }
     if (action === 'repair' || action === 'resync' || action === 'login') {
-        const result = await repairCodexLbAuth();
-        if (flag(args, '--json'))
-            return printJson(result);
-        console.log(`codex-lb repair: ${result.ok ? 'ok' : result.status}`);
-        if (!result.ok)
+        const result = await repairCodexLbAuth({
+            allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
+        });
+        const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
+        const shaped = { ...result, ok: Boolean(result.ok && fastUi.ok), codex_app_fast_ui: fastUi };
+        if (!shaped.ok)
             process.exitCode = 1;
+        if (flag(args, '--json'))
+            return printJson(shaped);
+        console.log(`codex-lb repair: ${shaped.ok ? 'ok' : result.ok ? 'fast_ui_repair_failed' : result.status}`);
         return;
     }
     if (action === 'release') {
@@ -145,10 +171,17 @@ export async function run(command, args = []) {
             process.exitCode = 1;
             return;
         }
-        const result = await configureCodexLb({ host, apiKey: newKey, authMode: flag(args, '--preserve-auth') ? 'preserve' : 'codex-lb', forceCodexLbApiKeyAuth: !flag(args, '--preserve-auth') });
-        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok));
-        const ok = Boolean(result.ok && restart?.ok !== false);
-        const output = { ...result, ok, action: 'set-key', restart_app: restart };
+        const result = await configureCodexLb({
+            host,
+            apiKey: newKey,
+            authMode: flag(args, '--preserve-auth') ? 'preserve' : 'codex-lb',
+            forceCodexLbApiKeyAuth: !flag(args, '--preserve-auth'),
+            allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
+        });
+        const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
+        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok && fastUi.ok));
+        const ok = Boolean(result.ok && fastUi.ok && restart?.ok !== false);
+        const output = { ...result, ok, action: 'set-key', codex_app_fast_ui: fastUi, restart_app: restart };
         if (!ok)
             process.exitCode = 1;
         if (flag(args, '--json'))
@@ -162,10 +195,16 @@ export async function run(command, args = []) {
     }
     if (action === 'use-codex-lb' || action === 'use-lb') {
         // Switch auth mode -> codex-lb (API key). Re-selects the provider and re-syncs auth.
-        const result = await repairCodexLbAuth({ forceCodexLbApiKeyAuth: true, authMode: 'codex-lb', forceFastMode: !flag(args, '--no-fast') });
-        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok));
-        const ok = Boolean(result.ok && restart?.ok !== false);
-        const shaped = { ...result, ok, mode: 'codex-lb', restart_app: restart };
+        const result = await repairCodexLbAuth({
+            forceCodexLbApiKeyAuth: true,
+            authMode: 'codex-lb',
+            forceFastMode: !flag(args, '--no-fast'),
+            allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
+        });
+        const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
+        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok && fastUi.ok));
+        const ok = Boolean(result.ok && fastUi.ok && restart?.ok !== false);
+        const shaped = { ...result, ok, mode: 'codex-lb', codex_app_fast_ui: fastUi, restart_app: restart };
         if (!ok)
             process.exitCode = 1;
         if (flag(args, '--json'))
@@ -181,9 +220,10 @@ export async function run(command, args = []) {
         // Switch auth mode -> ChatGPT OAuth. Restores the saved OAuth login if present.
         const result = await releaseCodexLbAuthHold({ force: flag(args, '--force') });
         const authOk = !['no_backup', 'auth_in_use', 'failed'].includes(result.status);
-        const restart = await maybeRestartCodexAppForAuthSwitch(args, authOk);
-        const ok = Boolean(authOk && restart?.ok !== false);
-        const shaped = { ...result, ok, mode: 'oauth', restart_app: restart };
+        const fastUi = await repairCodexAppFastUiAfterMutation(root, authOk);
+        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(authOk && fastUi.ok));
+        const ok = Boolean(authOk && fastUi.ok && restart?.ok !== false);
+        const shaped = { ...result, ok, mode: 'oauth', codex_app_fast_ui: fastUi, restart_app: restart };
         if (!ok)
             process.exitCode = 1;
         if (flag(args, '--json'))
@@ -311,16 +351,18 @@ export async function run(command, args = []) {
             shellProfile: options.shellProfile,
             runHealth: options.health,
             apiKeySource: options.apiKeySource,
-            allowInsecureHttp: options.allowInsecureLocalhost
+            allowInsecureHttp: options.allowInsecureLocalhost,
+            allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
         });
-        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok) && !flag(args, '--preserve-auth'));
-        const shaped = { schema: 'sks.codex-lb-setup.v1', ...result, api_key: { present: Boolean(options.apiKey), redacted: true }, env_file_chmod: '0600' };
+        const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
+        const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok && fastUi.ok) && !flag(args, '--preserve-auth'));
+        const shaped = { schema: 'sks.codex-lb-setup.v1', ...result, api_key: { present: Boolean(options.apiKey), redacted: true }, env_file_chmod: '0600', codex_app_fast_ui: fastUi };
         shaped.restart_app = restart;
         if (options.health)
             shaped.applied_actions = [...(shaped.applied_actions || []), { type: 'run_health_check', target: 'codex-lb response chain', ok: true }];
         if (options.health)
             shaped.chain_health = result.ok ? await checkCodexLbResponseChain(result, { force: true, root }) : null;
-        shaped.ok = Boolean(result.ok && restart?.ok !== false);
+        shaped.ok = Boolean(result.ok && fastUi.ok && restart?.ok !== false);
         if (!shaped.ok)
             process.exitCode = 1;
         if (flag(args, '--json'))
@@ -363,6 +405,7 @@ export async function run(command, args = []) {
         return;
     }
     console.error('Usage: sks codex-lb status|metrics|doctor --deep|health|setup|set-key|use-codex-lb|use-oauth|repair|release|unselect|circuit reset|circuit record-fixture|proof-evidence [--json]');
+    console.error(`  ${CODEX_LB_TOOL_OUTPUT_RECOVERY_OVERRIDE_FLAG}  explicitly acknowledge an old/unverified proxy for this command (unsafe)`);
     console.error('  set-key       swap the codex-lb API key (reuses the stored host): sks codex-lb set-key --api-key-stdin');
     console.error('  use-codex-lb  switch auth mode to codex-lb (API key)');
     console.error('  use-oauth     switch auth mode to ChatGPT OAuth (restores saved login, else: codex login)');
@@ -375,7 +418,85 @@ async function maybeRestartCodexAppForAuthSwitch(args = [], enabled) {
     const shouldRestart = requested || (!flag(args, '--json') && !flag(args, '--no-restart-app') && !flag(args, '--no-restart'));
     return restartCodexApp({ enabled: shouldRestart });
 }
-async function fastEvidenceFromChain(chain = {}, requestLogPath = null) {
+async function repairCodexAppFastUiAfterMutation(root, enabled) {
+    if (!enabled) {
+        return {
+            schema: 'sks.codex-app-fast-ui-repair.v1',
+            ok: true,
+            status: 'skipped',
+            skipped: true,
+            reason: 'previous_step_failed',
+            actions: [],
+            blockers: []
+        };
+    }
+    try {
+        return await repairCodexAppFastUi(root, { apply: true });
+    }
+    catch (err) {
+        return {
+            schema: 'sks.codex-app-fast-ui-repair.v1',
+            ok: false,
+            status: 'failed',
+            actions: [],
+            blockers: ['codex_app_fast_ui_repair_failed'],
+            error: String(err?.message || err)
+        };
+    }
+}
+export function isCodexLbFastChainVerified(chain = {}) {
+    return chain.ok === true && chain.skipped !== true;
+}
+export async function resolveCodexLbFastCheckModel(status = {}, env = process.env) {
+    const explicit = String(env.SKS_CODEX_MODEL || env.CODEX_MODEL || '').trim();
+    if (explicit)
+        return { model: explicit, source: env.SKS_CODEX_MODEL ? 'SKS_CODEX_MODEL' : 'CODEX_MODEL', blockers: [] };
+    const configPath = String(status.config_path || '').trim();
+    const config = configPath ? await readText(configPath, '').catch(() => '') : '';
+    const configured = topLevelTomlString(config, 'model');
+    if (configured)
+        return { model: configured, source: 'global_config', blockers: [] };
+    const configuredCatalogPath = topLevelTomlString(config, 'model_catalog_json');
+    if (!configuredCatalogPath)
+        return { model: null, source: null, blockers: ['codex_lb_fast_check_model_unselected'] };
+    const home = String(env.HOME || '').trim();
+    const expandedCatalogPath = configuredCatalogPath.startsWith('~/') && home
+        ? path.join(home, configuredCatalogPath.slice(2))
+        : configuredCatalogPath;
+    const catalogPath = path.isAbsolute(expandedCatalogPath)
+        ? expandedCatalogPath
+        : path.resolve(path.dirname(configPath), expandedCatalogPath);
+    try {
+        const payload = JSON.parse(await readText(catalogPath, ''));
+        const model = selectPriorityCapableCatalogModel(payload);
+        return model
+            ? { model, source: 'model_catalog_json', blockers: [] }
+            : { model: null, source: 'model_catalog_json', blockers: ['codex_lb_fast_check_priority_model_unavailable'] };
+    }
+    catch {
+        return { model: null, source: 'model_catalog_json', blockers: ['codex_lb_fast_check_catalog_invalid'] };
+    }
+}
+function topLevelTomlString(text, key) {
+    const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return (topLevel.match(new RegExp(`(?:^|\\n)\\s*${escaped}\\s*=\\s*"([^"]+)"`))?.[1] || '').trim();
+}
+function selectPriorityCapableCatalogModel(payload = {}) {
+    const models = Array.isArray(payload?.models) ? payload.models : Array.isArray(payload?.data) ? payload.data : [];
+    return models
+        .filter((row) => {
+        if (!row || typeof row !== 'object' || row.supported_in_api !== true || typeof row.slug !== 'string' || !row.slug.trim())
+            return false;
+        const serviceTiers = Array.isArray(row.service_tiers) ? row.service_tiers : [];
+        const speedTiers = Array.isArray(row.additional_speed_tiers) ? row.additional_speed_tiers : [];
+        return serviceTiers.some((tier) => normalizeTier(typeof tier === 'string' ? tier : tier?.id) === 'priority')
+            || speedTiers.some((tier) => normalizeTier(tier) === 'priority');
+    })
+        .sort((left, right) => Number(left.priority ?? Number.MAX_SAFE_INTEGER) - Number(right.priority ?? Number.MAX_SAFE_INTEGER)
+        || String(left.slug).localeCompare(String(right.slug)))[0]?.slug || null;
+}
+export async function fastEvidenceFromChain(chain = {}, requestLogPath = null) {
     const chainEvidence = chain.service_tier_evidence || {};
     const logRows = requestLogPath ? await readRequestLogRows(String(requestLogPath)) : [];
     const logEvidence = serviceTierEvidenceFromRows(logRows);
@@ -423,14 +544,14 @@ async function readRequestLogRows(file) {
     }
     return rows;
 }
-function serviceTierEvidenceFromRows(rows = []) {
+export function serviceTierEvidenceFromRows(rows = []) {
     let requested = null;
     let actual = null;
     let effective = null;
     for (const row of rows) {
         requested ||= normalizeTier(row?.requestedServiceTier || row?.requested_service_tier || row?.request?.service_tier || row?.body?.service_tier);
-        actual ||= normalizeTier(row?.actualServiceTier || row?.actual_service_tier || row?.response?.actualServiceTier);
-        effective ||= normalizeTier(row?.serviceTier || row?.service_tier || row?.response?.serviceTier);
+        actual ||= normalizeTier(row?.actualServiceTier || row?.actual_service_tier || row?.response?.actualServiceTier || row?.response?.actual_service_tier);
+        effective ||= responseServiceTier(row);
     }
     return {
         requested_service_tier: requested,
@@ -439,6 +560,17 @@ function serviceTierEvidenceFromRows(rows = []) {
         fast_actual: actual === 'priority' || effective === 'priority'
     };
 }
+function responseServiceTier(row) {
+    const nested = normalizeTier(row?.response?.serviceTier || row?.response?.service_tier || row?.event?.response?.serviceTier || row?.event?.response?.service_tier);
+    if (nested)
+        return nested;
+    const responseKind = String(row?.direction || row?.phase || row?.kind || row?.type || '').trim().toLowerCase();
+    const responseBody = row?.object === 'response' || /^resp[_-]/i.test(String(row?.id || '')) || Array.isArray(row?.output);
+    if (responseBody || responseKind === 'response' || responseKind === 'inbound' || responseKind.startsWith('response.')) {
+        return normalizeTier(row?.serviceTier || row?.service_tier);
+    }
+    return null;
+}
 function normalizeTier(value) {
     const text = String(value || '').trim().toLowerCase();
     if (text === 'fast')
@@ -483,9 +615,10 @@ function shapeCodexLbStatus(status = {}) {
     return {
         schema: 'sks.codex-lb-status.v1',
         ...status,
-        configured: Boolean(status.ok),
-        setup_needed: !status.ok,
-        repair_available: !status.ok,
+        configured: Boolean(status.provider_ready ?? status.ok),
+        setup_needed: !Boolean(status.provider_ready ?? status.ok),
+        upgrade_needed: Boolean(status.selected && status.tool_output_recovery?.ok !== true),
+        repair_available: !Boolean(status.provider_ready ?? status.ok),
         api_key: {
             present: Boolean(status.env_key_configured),
             source: status.env_loader?.api_key?.source || null,
@@ -494,11 +627,13 @@ function shapeCodexLbStatus(status = {}) {
         persistence,
         env_loader: status.env_loader || null,
         env_auto_load: Boolean(status.env_file && status.env_key_configured),
-        guidance: status.ok ? [] : [
-            'codex-lb API key is not configured.',
-            'Run: sks codex-lb setup',
-            'Or: sks codex-lb setup --host <domain> --api-key-stdin --yes'
-        ]
+        guidance: status.selected && status.tool_output_recovery?.ok !== true
+            ? status.tool_output_recovery.operator_actions || []
+            : status.ok ? [] : [
+                'codex-lb API key is not configured.',
+                'Run: sks codex-lb setup',
+                'Or: sks codex-lb setup --host <domain> --api-key-stdin --yes'
+            ]
     };
 }
 async function codexLbSetupOptions(args = []) {

package/dist/commands/codex.js

@@ -4,7 +4,9 @@ import { codexCompatibilityReport, codexDoctorReport } from '../core/codex-compa
 import { codexVersionReport } from '../core/codex-compat/codex-version.js';
 import { codexSchemaSnapshotReport } from '../core/codex-compat/codex-schema-snapshot.js';
 import { detectCodex0141Capability } from '../core/codex-control/codex-0141-capability.js';
-import { detectCodex0142Capability } from '../core/codex-control/codex-0142-capability.js';
+import { detectCodex0144Capability } from '../core/codex-control/codex-0144-capability.js';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
+import { inspectCodexCliUpdate, updateCodexCliNow } from '../core/codex/codex-cli-update.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'compatibility';
     if (action === 'compatibility' || action === 'compat') {
@@ -26,6 +28,43 @@ export async function run(_command, args = []) {
         console.log(`Codex detected: ${result.detected.version || 'not installed'} (${result.policy.status})`);
         return;
     }
+    if (action === 'update-status' || action === 'update-check') {
+        const result = await inspectCodexCliUpdate({ force: flag(args, '--refresh') || flag(args, '--force') });
+        if (flag(args, '--json')) {
+            printJson(result);
+            if (!result.ok)
+                process.exitCode = 1;
+            return;
+        }
+        console.log(`Codex CLI: ${result.current_version || 'not installed'}${result.latest_version ? ` (latest ${result.latest_version})` : ''}`);
+        console.log(`Update: ${result.update_available === true ? 'available' : result.update_available === false ? 'current' : 'unverified'}`);
+        for (const warning of result.warnings)
+            console.log(`- warning: ${warning}`);
+        for (const actionLine of result.guidance)
+            console.log(`- ${actionLine}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
+    if (action === 'update' || action === 'update-now') {
+        const result = await updateCodexCliNow();
+        if (flag(args, '--json')) {
+            printJson(result);
+            if (!result.ok)
+                process.exitCode = 1;
+            return;
+        }
+        console.log(`Codex CLI update: ${result.status}${result.after_version ? ` (${result.before_version || 'unknown'} -> ${result.after_version})` : ''}`);
+        if (result.raw_output)
+            console.log(result.raw_output);
+        for (const blocker of result.blockers)
+            console.log(`- blocker: ${blocker}`);
+        for (const actionLine of result.guidance)
+            console.log(`- ${actionLine}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
     if (action === '0.141' || action === '0141' || action === 'rust-v0.141.0') {
         const result = await detectCodex0141Capability();
         if (flag(args, '--json'))
@@ -39,11 +78,11 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    if (action === '0.142' || action === '0142' || action === 'rust-v0.142.0') {
-        const result = await detectCodex0142Capability({ requireReal: flag(args, '--require-real') });
+    if (action === '0.144' || action === '0144' || action === CURRENT_CODEX_RELEASE_MANIFEST.targetTag) {
+        const result = await detectCodex0144Capability({ requireReal: flag(args, '--require-real') });
         if (flag(args, '--json'))
             return printJson(result);
-        console.log(`Codex 0.142 compatibility: ${result.ok ? 'ok' : 'blocked'} (${result.probe_mode})`);
+        console.log(`Codex ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion} compatibility: ${result.ok ? 'ok' : 'blocked'} (${result.probe_mode})`);
         for (const blocker of result.blockers || [])
             console.log(`- blocker: ${blocker}`);
         for (const warning of result.warnings || [])
@@ -70,7 +109,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex compatibility|version|doctor|schema|0.142|0.141 [--json]');
+    console.error('Usage: sks codex compatibility|version|update-status [--refresh]|update|doctor|schema|0.144|0.141 [--json]');
     process.exitCode = 1;
 }
 //# sourceMappingURL=codex.js.map