sneakoscope 6.0.3 → 6.1.2

package/dist/scripts/codex-sdk-all-pipelines-check.js

@@ -16,12 +16,15 @@ const sources = {
     coreSkill: readText('src/core/skills/core-skill-types.ts')
 };
 const teamCreateRedirectsToNaruto = sources.team.includes('redirectTeamCreateToNaruto') && sources.team.includes('narutoCommand');
-assertGate(teamCreateRedirectsToNaruto, 'Team create must route through Naruto codex-sdk SSOT');
+assertGate(teamCreateRedirectsToNaruto, 'Team create must route through the Naruto official-subagent SSOT');
 assertGate(sources.qa.includes("mock ? 'fake' : 'codex-sdk'"), 'QA must route native agents through codex-sdk');
-assertGate(sources.research.includes("mock ? 'fake' : 'codex-sdk'"), 'Research must route native agents through codex-sdk');
-assertGate(sources.naruto.includes("backend: 'codex-sdk'"), 'Naruto defaults must name codex-sdk');
+assertGate(sources.research.includes("backend: mock ? 'mock' : 'codex-sdk'")
+    && sources.research.includes("reviewer_workflow: 'official_codex_subagent'"), 'Research must use the Codex SDK stage backend plus the official subagent reviewer workflow');
+assertGate(sources.naruto.includes('runOfficialSubagentWorkflow'), 'Naruto must invoke the official Codex subagent runner');
+assertGate(sources.naruto.includes("workflow: 'official_codex_subagent'"), 'Naruto must persist the official subagent workflow contract');
+assertGate(!sources.naruto.includes("backend: 'codex-sdk'"), 'Naruto must not select the legacy codex-sdk backend');
 assertGate(sources.coreSkill.includes("'codex-sdk'"), 'Core skill backend type must include codex-sdk');
 const fixture = await runFakeCodexSdkTaskFixture('all-pipelines');
 assertGate(fixture.result.ok === true, 'all pipeline SDK fixture must pass', fixture.result);
-emitGate('codex-sdk:all-pipelines', { gates: required.length, sdk_thread_id: fixture.result.sdkThreadId });
+emitGate('codex-sdk:all-pipelines', { gates: required.length, naruto_workflow: 'official_codex_subagent', sdk_thread_id: fixture.result.sdkThreadId });
 //# sourceMappingURL=codex-sdk-all-pipelines-check.js.map

package/dist/scripts/codex-sdk-research-pipeline-check.js

@@ -5,21 +5,29 @@ import os from 'node:os';
 import path from 'node:path';
 import { assertGate, emitGate, importDist, readText } from './lib/codex-sdk-gate-lib.js';
 const researchCommand = readText('src/core/commands/research-command.ts');
-assertGate(researchCommand.includes("backend: mock ? 'fake' : 'codex-sdk'"), 'Research pipeline must default native agents to codex-sdk');
-assertGate(researchCommand.includes("flag(args, '--autoresearch') ? '$AutoResearch' : '$Research'"), 'Research/AutoResearch route selection missing');
-assertGate(researchCommand.includes('narutoWorkGraph: researchWorkGraph'), 'Research pipeline must pass the stage-aware Naruto work graph');
-assertGate(researchCommand.includes('readonly: true'), 'Research pipeline must force read-only native orchestration');
+assertGate(researchCommand.includes("backend: mock ? 'mock' : 'codex-sdk'"), 'Research stage cycle must use the Codex SDK only as a bounded source/synthesis adapter');
+assertGate(researchCommand.includes("source_acquisition: 'super-search'"), 'Research must route source acquisition through Super Search');
+assertGate(researchCommand.includes("reviewer_workflow: 'official_codex_subagent'"), 'Research must use the official Codex subagent reviewer workflow');
 assertGate(researchCommand.includes('quality_metrics'), 'Research pipeline JSON output must include quality metrics');
 assertGate(researchCommand.includes('const cycleResult = await runResearchCycle({'), 'Research default path must use runResearchCycle');
-assertGate(researchCommand.includes('--legacy-research-cycle'), 'Legacy final.md loop must be opt-in only');
+for (const removed of ['runNativeAgentOrchestrator', 'SKS_RESEARCH_LEGACY_CYCLE', 'runCodexExec({']) {
+    assertGate(!researchCommand.includes(removed), `Research legacy runtime token must be removed: ${removed}`);
+}
+assertGate(researchCommand.includes('REMOVED_RESEARCH_RUNTIME_FLAGS')
+    && researchCommand.includes('Unsupported legacy Research runtime option:'), 'Research must fail closed on removed runtime options');
+for (const removedFlag of ['--legacy-research-cycle', '--native-proof-only']) {
+    assertGate(researchCommand.includes(removedFlag), `Research removed-option blocker must include ${removedFlag}`);
+}
 const researchCore = readText('src/core/research.ts');
 assertGate(researchCore.includes('readResearchQualityContract'), 'Research gate must read research-quality-contract.json');
 assertGate(researchCore.includes('claim_evidence_matrix_missing'), 'Research gate must require claim-evidence-matrix.json');
 assertGate(researchCore.includes('research_final_review_not_approved'), 'Research gate must require final reviewer approval');
 for (const [file, tokens] of Object.entries({
-    'src/core/research/research-work-graph.ts': ['buildResearchWorkGraph', 'source_shard_academic_literature'],
+    'src/core/research/research-work-graph.ts': ['buildResearchWorkGraph', 'REQUIRED_SOURCE_SHARD_IDS', 'source_shard_${layer.id}'],
     'src/core/research/research-cycle-runner.ts': ['runResearchCycle', 'Promise.race'],
-    'src/core/research/research-final-reviewer.ts': ['runResearchCodexFinalReviewer'],
+    'src/core/research/research-final-reviewer.ts': ['runResearchCodexFinalReviewer', 'research_final_reviewer_static_plus_official_subagents'],
+    'src/core/research/research-adversarial-review.ts': ['runResearchAdversarialReviewLoop', 'official_codex_subagent', 'critical_objections_unresolved'],
+    'src/core/research/research-super-search.ts': ['runResearchSuperSearchShard', 'runSuperSearch'],
     'src/core/research/claim-evidence-matrix.ts': ['claim-evidence-matrix'],
     'src/core/research/implementation-blueprint.ts': ['implementation-blueprint'],
     'src/core/research/research-quality-contract.ts': ['research-quality-contract']
@@ -30,6 +38,8 @@ for (const [file, tokens] of Object.entries({
 }
 const research = await importDist('core/research.js');
 const fsx = await importDist('core/fsx.js');
+const adversarial = await importDist('core/research/research-adversarial-review.js');
+const finalReviewer = await importDist('core/research/research-final-reviewer.js');
 const dirShort = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-codex-research-short-'));
 const planShort = await research.writeResearchPlan(dirShort, 'codex sdk short rejection fixture', { missionId: 'M-CODEX-SHORT' });
 await fsx.writeTextAtomic(path.join(dirShort, 'research-report.md'), `# Short Report\n\n${Array.from({ length: 300 }, (_unused, index) => `word${index}`).join(' ')}\n`);
@@ -40,7 +50,19 @@ assertGate(shortGate.passed === false, 'codex-sdk research pipeline must reject
 assertGate((shortGate.reasons || []).includes('research_report_too_short'), 'short rejection must include report length reason', shortGate);
 const dirComplete = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-codex-research-complete-'));
 const planComplete = await research.writeResearchPlan(dirComplete, 'codex sdk complete package fixture', { missionId: 'M-CODEX-COMPLETE' });
-const completeGate = await research.writeMockResearchResult(dirComplete, planComplete);
+await research.writeMockResearchResult(dirComplete, planComplete);
+const adversarialResult = await adversarial.runResearchAdversarialReviewLoop({
+    root: process.cwd(),
+    dir: dirComplete,
+    plan: planComplete,
+    timeoutMs: 1_000,
+    maxCycles: 1,
+    maxThreads: 5,
+    mock: true
+});
+assertGate(adversarialResult.ok === true, 'mock complete package must pass official-subagent adversarial contract', adversarialResult);
+await finalReviewer.runResearchFinalReviewer(dirComplete, { plan: planComplete, root: process.cwd(), mock: true });
+const completeGate = await research.evaluateResearchGate(dirComplete);
 assertGate(completeGate.passed === true, 'codex-sdk research pipeline must pass complete package fixture', completeGate);
 assertGate(completeGate.metrics?.final_review_approved === true, 'complete package must include approved final review', completeGate.metrics);
 emitGate('codex-sdk:research-pipeline', { route: '$Research', short_dir: dirShort, complete_dir: dirComplete });

package/dist/scripts/codex-sdk-sandbox-policy-check.js

@@ -12,10 +12,14 @@ const base = {
     mutationLedgerRoot: process.cwd()
 };
 const readOnly = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'read-only', requestedScopeContract: { read_only: true } });
+const readOnlyContract = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'workspace-write', requestedScopeContract: { read_only: true, allowed_paths: ['tmp'], write_paths: ['tmp'] } });
+const emptyWriteScope = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'workspace-write', requestedScopeContract: { read_only: false, allowed_paths: [], write_paths: [] } });
 const workspace = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'workspace-write', requestedScopeContract: { read_only: false, allowed_paths: ['tmp'], write_paths: ['tmp'] } });
 const fullBlocked = mod.mapCodexSdkSandboxPolicy({ ...base, sandboxPolicy: 'full-access', requestedScopeContract: { read_only: false } });
 assertGate(readOnly.ok && readOnly.sandboxMode === 'read-only', 'read-only sandbox mapping failed', readOnly);
+assertGate(readOnlyContract.ok && readOnlyContract.sandboxMode === 'read-only', 'read-only scope contract must not be escalated by a stale workspace policy', readOnlyContract);
+assertGate(emptyWriteScope.ok && emptyWriteScope.sandboxMode === 'read-only', 'empty write scope must collapse to read-only', emptyWriteScope);
 assertGate(workspace.ok && workspace.sandboxMode === 'workspace-write', 'workspace-write sandbox mapping failed', workspace);
 assertGate(!fullBlocked.ok && fullBlocked.blockers.includes('codex_sdk_full_access_requires_explicit_mad_scope'), 'full-access must require explicit authorization', fullBlocked);
-emitGate('codex-sdk:sandbox-policy', { read_only: readOnly.sandboxMode, workspace: workspace.sandboxMode, full_blockers: fullBlocked.blockers });
+emitGate('codex-sdk:sandbox-policy', { read_only: readOnly.sandboxMode, read_only_contract: readOnlyContract.sandboxMode, empty_write_scope: emptyWriteScope.sandboxMode, workspace: workspace.sandboxMode, full_blockers: fullBlocked.blockers });
 //# sourceMappingURL=codex-sdk-sandbox-policy-check.js.map

package/dist/scripts/codex-sdk-version-compat-check.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 // @ts-nocheck
 import { assertGate, emitGate, readJson } from './sks-1-18-gate-lib.js';
+import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
 const pkg = readJson('package.json');
 const lock = readJson('package-lock.json');
 const dep = pkg.dependencies?.['@openai/codex-sdk'];
 const lockDep = lock.packages?.['node_modules/@openai/codex-sdk']?.version;
-assertGate(dep === '0.142.0' && lockDep === '0.142.0', '@openai/codex-sdk must be pinned to 0.142.0 compatibility in package and lockfile', { dep, lockDep });
+assertGate(dep === CURRENT_CODEX_RELEASE_MANIFEST.sdkVersion && lockDep === CURRENT_CODEX_RELEASE_MANIFEST.sdkVersion, `@openai/codex-sdk must be pinned to ${CURRENT_CODEX_RELEASE_MANIFEST.sdkVersion} compatibility in package and lockfile`, { dep, lockDep, manifestSdkVersion: CURRENT_CODEX_RELEASE_MANIFEST.sdkVersion });
 emitGate('codex-sdk:version-compat', { dependency: dep, lock_version: lockDep });
 //# sourceMappingURL=codex-sdk-version-compat-check.js.map

package/dist/scripts/db-route-materialization-check.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { prepareRoute } from '../core/pipeline-internals/runtime-core.js';
+const root = await fsp.mkdtemp(path.join(os.tmpdir(), 'sks-db-route-materialization-'));
+try {
+    await fsp.writeFile(path.join(root, 'package.json'), `${JSON.stringify({ name: 'sks-db-route-fixture', private: true }, null, 2)}\n`);
+    const prepared = await prepareRoute(root, '$DB inspect the local migration safely', {});
+    const missionId = String(prepared?.mission_id || '');
+    if (!missionId || prepared?.route?.id !== 'DB')
+        throw new Error('DB route did not materialize a mission');
+    const dir = path.join(root, '.sneakoscope', 'missions', missionId);
+    const scan = JSON.parse(await fsp.readFile(path.join(dir, 'db-safety-scan.json'), 'utf8'));
+    const review = JSON.parse(await fsp.readFile(path.join(dir, 'db-review.json'), 'utf8'));
+    if (typeof scan?.ok !== 'boolean')
+        throw new Error('db-safety-scan.json is missing an ok decision');
+    if (typeof review?.scan_ok !== 'boolean' || review?.destructive_operation_zero !== true) {
+        throw new Error('db-review.json is missing the fail-closed safety baseline');
+    }
+    console.log(JSON.stringify({
+        schema: 'sks.db-route-materialization-check.v1',
+        ok: true,
+        route: '$DB',
+        mission_id: missionId,
+        artifacts: ['db-safety-scan.json', 'db-review.json'],
+        legacy_cli_registered: false
+    }, null, 2));
+}
+finally {
+    await fsp.rm(root, { recursive: true, force: true });
+}
+//# sourceMappingURL=db-route-materialization-check.js.map

package/dist/scripts/dfix-fixture-check.js

@@ -2,5 +2,5 @@
 // @ts-nocheck
 import { emitGate, runDfixFixture } from './sks-1-11-gate-lib.js';
 const result = runDfixFixture();
-emitGate('dfix:fixture', { mission_id: result.mission_id });
+emitGate('dfix:fixture', { mission_id: result.mission_id, fixture_root: result.fixture_root });
 //# sourceMappingURL=dfix-fixture-check.js.map

package/dist/scripts/docs-truthfulness-check.js

@@ -12,6 +12,7 @@ const files = [
     'docs/codex-0.136-compat.md',
     'docs/codex-0.135-compat.md',
     'docs/codex-cli-compat.md',
+    'docs/codex-app.md',
     'docs/official-docs-compat.md',
     'docs/hooks-pat.md',
     'docs/known-gaps.md',
@@ -24,8 +25,9 @@ const required = {
     'docs/codex-lb.md': ['durable_env_file', 'durable_keychain', 'shell_profile', 'process_only_ephemeral', 'base URL only'],
     'docs/codex-0.136-compat.md': ['rust-v0.136.0', 'codex:0.136-compat', 'codex archive', 'codex app-server --stdio', 'CODEX_API_KEY', 'server tokens'],
     'docs/codex-0.135-compat.md': ['rust-v0.135.0', 'codex:0.135-compat', 'named permission profiles'],
-    'docs/codex-cli-compat.md': ['rust-v0.136.0', 'session_archive_restore', 'profile_primary_selector', 'managed_network_proxy_env', 'goals_default_enabled', 'permission_profiles_requirements', 'SubagentStart', 'sks_zero_warning_disallowed', 'strict subset'],
-    'docs/official-docs-compat.md': ['official-docs:compat', 'rust-v0.136.0', 'gpt-image-2', 'input_fidelity', 'additionalProperties:false'],
+    'docs/codex-cli-compat.md': ['rust-v0.144.1', 'sks codex 0.144', 'Inherited Codex 0.136 Capabilities', 'session_archive_restore', 'profile_primary_selector', 'managed_network_proxy_env', 'goals_default_enabled', 'permission_profiles_requirements', 'SubagentStart', 'sks_zero_warning_disallowed', 'strict subset'],
+    'docs/codex-app.md': ['rust-v0.144.1', 'sks codex 0.144', 'App Server v2', 'Codex Chrome Extension', 'gpt-image-2'],
+    'docs/official-docs-compat.md': ['official-docs-compat-report.js', 'rust-v0.144.1', 'gpt-image-2', 'input_fidelity', 'additionalProperties:false'],
     'docs/hooks-pat.md': ['SubagentStop', 'strict subset', 'zero-warning'],
     'docs/known-gaps.md': ['No P0', 'P1'],
     'docs/release-readiness.md': ['sks.release-readiness.v1', 'release:readiness', 'official-docs:compat']

package/dist/scripts/doctor-codex-startup-repair-check.js

@@ -15,24 +15,17 @@ const codexHome = path.join(tmp, 'codex-home');
 await fs.mkdir(path.join(tmp, '.codex', 'agents'), { recursive: true });
 await fs.mkdir(path.join(codexHome, 'agents'), { recursive: true });
 const staleConfig = [
-    'model = "gpt-5.5"',
+    '# SKS managed Codex config fixture',
+    'model = "gpt-5.6-terra"',
     '',
     '[agents.analysis_scout]',
     'description = "Read-only SKS scout."',
     'config_file = "/Users/alfredo/.codex/agents/analysis-scout.toml"',
     'nickname_candidates = ["Scout", "Mapper"]',
     '',
-    '[agents.analysis_scout]',
-    'description = "SKS scout with bounded write capability."',
-    'config_file = "./agents/analysis-scout.toml"',
-    'nickname_candidates = ["Scout", "Mapper"]',
-    '',
     '[mcp_servers.context7]',
     'url = "https://custom.context7.example/mcp"',
     '',
-    '[mcp_servers.context7]',
-    'url = "https://mcp.context7.com/mcp"',
-    '',
     '[mcp_servers.node_repl]',
     'command = "/definitely/missing/node_repl"',
     'args = []',
@@ -60,20 +53,19 @@ await writeTextAtomic(path.join(codexHome, 'agents', 'sks-checker.toml'), [
     ''
 ].join('\n'));
 const planned = await mod.runDoctorCodexStartupRepair({ root: tmp, codexHome, fix: false });
-assertGate(planned.configs.every((entry) => entry.warnings.some((warning) => warning.includes('agent_config_file_stale'))), 'dry inspect must detect stale agent config_file paths', planned);
+assertGate(planned.configs.every((entry) => !entry.warnings.some((warning) => warning.includes('agent_config_file_stale'))), 'structural startup inspection must ignore preserved legacy agent config_file paths', planned);
 const repaired = await mod.runDoctorCodexStartupRepair({ root: tmp, codexHome, fix: true, includeDefaultNodeReplCandidates: false });
 const projectText = await fs.readFile(path.join(tmp, '.codex', 'config.toml'), 'utf8');
 const globalText = await fs.readFile(path.join(codexHome, 'config.toml'), 'utf8');
 const checkerText = await fs.readFile(path.join(codexHome, 'agents', 'sks-checker.toml'), 'utf8');
-const projectScoutText = await fs.readFile(path.join(tmp, '.codex', 'agents', 'analysis-scout.toml'), 'utf8');
-const globalScoutText = await fs.readFile(path.join(codexHome, 'agents', 'analysis-scout.toml'), 'utf8');
-for (const [scope, text, expectedDir] of [
-    ['project', projectText, path.join(tmp, '.codex', 'agents')],
-    ['global', globalText, path.join(codexHome, 'agents')]
+const projectScoutPresent = await fs.stat(path.join(tmp, '.codex', 'agents', 'analysis-scout.toml')).then(() => true).catch(() => false);
+const globalScoutPresent = await fs.stat(path.join(codexHome, 'agents', 'analysis-scout.toml')).then(() => true).catch(() => false);
+for (const [scope, text] of [
+    ['project', projectText],
+    ['global', globalText]
 ]) {
-    assertGate(!text.includes('/Users/alfredo/'), `${scope} config must drop stale home path`, text);
-    assertGate(text.includes(`config_file = "${path.join(expectedDir, 'analysis-scout.toml').replace(/\\/g, '\\\\')}"`), `${scope} config_file must point at an existing absolute role file`, text);
-    assertGate(text.includes('description = "SKS scout with bounded write capability."'), `${scope} managed agent description must be write-capable`, text);
+    assertGate(text.includes('/Users/alfredo/.codex/agents/analysis-scout.toml'), `${scope} legacy config_file must be preserved`, text);
+    assertGate(text.includes('description = "Read-only SKS scout."'), `${scope} legacy agent description must be preserved`, text);
     assertGate(!text.includes('[mcp_servers.node_repl]'), `${scope} stale node_repl MCP block must be removed`, text);
     assertGate(!text.includes('[mcp_servers.node_repl.env]'), `${scope} stale node_repl child MCP block must be removed`, text);
     assertGate((text.match(/\[mcp_servers\.context7\]/g) || []).length === 1, `${scope} duplicate context7 MCP block must be deduped`, text);
@@ -81,16 +73,45 @@ for (const [scope, text, expectedDir] of [
     assertGate(text.includes('[mcp_servers.supabase_sauron]'), `${scope} optional sauron MCP block must be preserved`, text);
     assertGate(text.includes('[features]') && text.includes('hooks = true'), `${scope} unrelated tables must be preserved`, text);
 }
-for (const [scope, text] of [['project', projectScoutText], ['global', globalScoutText]]) {
-    assertGate(text.includes('sandbox_mode = "workspace-write"'), `${scope} agent role file must be workspace-write`, text);
-    assertGate(!text.includes('Do not edit files.'), `${scope} agent role file must not preserve stale read-only instruction`, text);
-}
-assertGate(!checkerText.includes('message_role_prefix'), 'managed directive agent role must remove unsupported message_role_prefix', checkerText);
+assertGate(projectScoutPresent === false && globalScoutPresent === false, 'structural startup repair must not synthesize legacy role TOMLs', { projectScoutPresent, globalScoutPresent });
+assertGate(checkerText.includes('message_role_prefix'), 'legacy directive role TOMLs must be preserved byte-for-byte', checkerText);
 assertGate(repaired.ok === true, 'startup repair must pass when only optional sauron remains', repaired);
 assertGate(repaired.configs.every((entry) => entry.changed === true && entry.backup_path), 'startup repair must back up changed configs', repaired);
-assertGate(repaired.agent_role_files.created.length >= 10, 'startup repair must create missing project/global role configs', repaired);
+assertGate(repaired.agent_role_files.created.length === 0 && repaired.agent_role_files.sanitized.length === 0, 'startup repair must leave project/global agent role files untouched', repaired);
+assertGate(repaired.configs.every((entry) => entry.agent_config_files_repaired.length === 0), 'startup repair must not rewrite legacy agent config_file references', repaired);
 assertGate(repaired.configs.every((entry) => !entry.warnings.some((warning) => warning.includes('agent_config_file_stale'))), 'startup repair must not keep stale agent config warnings after repair', repaired);
-assertGate(repaired.configs.every((entry) => entry.duplicate_toml_blocks_removed.includes('agents.analysis_scout') && entry.duplicate_toml_blocks_removed.includes('mcp_servers.context7')), 'startup repair must record duplicate managed/external table dedupe without rewriting preserved MCP values', repaired);
+assertGate(repaired.configs.every((entry) => entry.duplicate_toml_blocks_removed.length === 0), 'valid startup repair fixture must not claim duplicate-invalid TOML repair', repaired);
+const tmpInvalid = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-startup-invalid-'));
+const codexHomeInvalid = path.join(tmpInvalid, 'codex-home');
+await fs.mkdir(path.join(tmpInvalid, '.codex'), { recursive: true });
+await fs.mkdir(codexHomeInvalid, { recursive: true });
+const duplicateInvalidConfig = [
+    '# SKS managed Codex config fixture',
+    '[agents.analysis_scout]',
+    'description = "Read-only SKS scout."',
+    'config_file = "/Users/alfredo/.codex/agents/analysis-scout.toml"',
+    '',
+    '[agents.analysis_scout]',
+    'description = "SKS scout with bounded write capability."',
+    'config_file = "./agents/analysis-scout.toml"',
+    ''
+].join('\n');
+const invalidConfigPath = path.join(tmpInvalid, '.codex', 'config.toml');
+await writeTextAtomic(invalidConfigPath, duplicateInvalidConfig);
+const invalidRepair = await mod.runDoctorCodexStartupRepair({
+    root: tmpInvalid,
+    codexHome: codexHomeInvalid,
+    fix: true,
+    includeDefaultNodeReplCandidates: false
+});
+const invalidEntry = invalidRepair.configs.find((entry) => entry.scope === 'project');
+const invalidAfter = await fs.readFile(invalidConfigPath, 'utf8');
+assertGate(invalidRepair.ok === false, 'duplicate-invalid TOML must fail closed instead of being reported repaired', invalidRepair);
+assertGate(invalidAfter === duplicateInvalidConfig, 'duplicate-invalid TOML must remain byte-for-byte unchanged', { before: duplicateInvalidConfig, after: invalidAfter });
+assertGate(invalidEntry?.changed === false, 'guarded refusal must not report the invalid config as changed', invalidEntry);
+assertGate(Boolean(invalidEntry?.backup_path), 'guarded refusal must back up duplicate-invalid TOML', invalidEntry);
+assertGate(invalidEntry?.blockers.includes('config_write_guard:unparseable_config_preserved'), 'guarded refusal status must be a startup repair blocker', invalidEntry);
+assertGate(invalidEntry?.duplicate_toml_blocks_removed.length === 0, 'guarded refusal must not claim duplicate table removal', invalidEntry);
 const tmpCandidate = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-startup-node-repl-'));
 const codexHomeCandidate = path.join(tmpCandidate, 'codex-home');
 const fakeNodeRepl = path.join(tmpCandidate, 'Codex.app', 'Contents', 'Resources', 'cua_node', 'bin', 'node_repl');
@@ -99,6 +120,7 @@ await writeTextAtomic(fakeNodeRepl, '#!/bin/sh\n');
 await fs.mkdir(path.join(tmpCandidate, '.codex'), { recursive: true });
 await fs.mkdir(codexHomeCandidate, { recursive: true });
 const missingNodeReplConfig = [
+    '# SKS managed Codex config fixture',
     '[mcp_servers.node_repl]',
     'command = "/definitely/missing/node_repl"',
     'args = []',

package/dist/scripts/doctor-context7-repair-check.js

@@ -15,7 +15,8 @@ const codexHome = path.join(tmp, 'codex-home');
 await fs.mkdir(path.join(tmp, '.codex'), { recursive: true });
 await fs.mkdir(codexHome, { recursive: true });
 const localBlock = [
-    'model = "gpt-5.5"',
+    '# SKS managed fixture',
+    'model = "gpt-5.6-terra"',
     '',
     '[mcp_servers.context7]',
     'command = "npx"',

package/dist/scripts/doctor-fix-production-blackbox.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
+import fs from 'node:fs/promises';
 import path from 'node:path';
+import { parse } from 'smol-toml';
 import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
 import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
 import { repairContext7Mcp } from '../core/doctor/context7-mcp-repair.js';
@@ -7,8 +9,16 @@ import { repairSupabaseMcp } from '../core/doctor/supabase-mcp-repair.js';
 import { runDoctorFixTransaction } from '../core/doctor/doctor-transaction.js';
 import { doctorRepairPostcheck } from '../core/doctor/doctor-repair-postcheck.js';
 const root = await makeTempRoot('sks-doctor-production-');
-await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.context7]\ncommand = "npx"\n\n[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nread_only = true\n\n[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
-const startup = await repairCodexStartupConfig({ root, apply: true });
+await writeText(path.join(root, '.codex', 'config.toml'), '# SKS-MANAGED-CODEX-CONFIG\n[mcp_servers.context7]\ncommand = "npx"\n\n[mcp_servers.supabase]\nurl = "https://supabase.example/mcp"\nread_only = true\n\n[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
+const startup = await repairCodexStartupConfig({ root, apply: true, home: path.join(root, 'home'), codexHome: path.join(root, 'codex-home') });
+const startupText = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
+const startupConfig = parse(startupText);
+const startupAgents = startupConfig.agents || {};
+const startupAgentFiles = (await fs.readdir(path.join(root, '.codex', 'agents'))).sort();
+assertGate(startup.ok === true, 'doctor production startup repair must pass', startup);
+assertGate(startupAgents.max_threads === 12 && startupAgents.max_depth === 1 && startupAgents.job_max_runtime_seconds === 1200 && startupAgents.interrupt_message === true, 'doctor production startup repair must write official config defaults', startupAgents);
+assertGate(startupAgentFiles.join(',') === 'expert.toml,worker.toml', 'doctor production startup repair must create only official worker/expert TOMLs', startupAgentFiles);
+assertGate(startupText.includes('[agents.analysis_scout]') && startupText.includes('config_file = ".codex/agents/stale.toml"'), 'doctor production startup repair must preserve legacy config tables', startupText);
 const context7 = await repairContext7Mcp({ root, apply: true });
 const supabase = await repairSupabaseMcp({ root, apply: true });
 const tx = await runDoctorFixTransaction({ root, phases: [

package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js

@@ -1,28 +1,39 @@
 #!/usr/bin/env node
 import fs from 'node:fs/promises';
+import syncFs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { repairCodexAppFastUi } from '../core/codex-app/codex-app-fast-ui-repair.js';
+const tempRoots = new Set();
+process.once('exit', cleanupTempRoots);
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fast-ui-'));
+tempRoots.add(root);
 const codexHome = path.join(root, 'home', '.codex');
 await fs.mkdir(path.join(root, '.codex'), { recursive: true });
 await fs.mkdir(codexHome, { recursive: true });
 await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'model = "future-codex-model"\nmodel_reasoning_effort = "medium"\nmodel_provider = "codex-lb"\n');
 await fs.writeFile(path.join(codexHome, 'config.toml'), '# SKS forced fast UI during legacy install\nmodel = "legacy-sks-model"\nmodel_reasoning_effort = "xhigh"\nmodel_provider = "codex-lb"\nservice_tier = "fast"\n[features]\nfast_mode = false # user disabled, must remain untouched\n\n[profiles.sks-fast-high]\nmodel = "legacy-profile-model"\nservice_tier = "fast"\n\n[model_providers.codex-lb]\nname = "openai"\nbase_url = "https://lb.example.test/backend-api/codex"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = true\n');
-const plan = await repairCodexAppFastUi(root, { codexHome, apply: false });
-const repaired = await repairCodexAppFastUi(root, { codexHome, apply: true });
+// Keep this hermetic: selected codex-lb readiness must not inherit the release
+// runner's machine credentials or perform a real model-catalog lookup.
+const fixtureEnv = {};
+const plan = await repairCodexAppFastUi(root, { codexHome, apply: false, env: fixtureEnv });
+const repaired = await repairCodexAppFastUi(root, { codexHome, apply: true, env: fixtureEnv });
 const projectAfter = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
 const homeAfter = await fs.readFile(path.join(codexHome, 'config.toml'), 'utf8');
 const homeTopLevel = homeAfter.split(/\n\s*\[/)[0] || '';
 const backups = repaired.actions.filter((action) => action.changed).map((action) => action.backup_path).filter(Boolean);
 const unsafeRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fast-ui-unsafe-'));
+tempRoots.add(unsafeRoot);
 const unsafeCodexHome = path.join(unsafeRoot, 'home', '.codex');
 await fs.mkdir(path.join(unsafeRoot, '.codex'), { recursive: true });
 await fs.mkdir(unsafeCodexHome, { recursive: true });
 await fs.writeFile(path.join(unsafeCodexHome, 'config.toml'), 'service_tier = "standard"\n');
-const unsafePlan = await repairCodexAppFastUi(unsafeRoot, { codexHome: unsafeCodexHome, apply: false });
+const unsafePlan = await repairCodexAppFastUi(unsafeRoot, { codexHome: unsafeCodexHome, apply: false, env: fixtureEnv });
+const unsafeAfter = await fs.readFile(path.join(unsafeCodexHome, 'config.toml'), 'utf8');
 const ok = plan.fast_selector === 'manual_action_required'
     && plan.provider_selector === 'manual_action_required'
+    && plan.selected_provider_blockers.includes('codex_lb_api_key_missing')
+    && plan.selected_provider_blockers.includes('codex_lb_base_url_missing')
     && plan.provider_actions.includes('sks codex-app set-openrouter-key --api-key-stdin')
     && plan.provider_actions.includes('sks codex-lb setup --host <domain> --api-key-stdin --yes')
     && plan.safe_auto_apply === true
@@ -35,18 +46,34 @@ const ok = plan.fast_selector === 'manual_action_required'
     && !/^model\s*=/m.test(homeTopLevel)
     && !/^model_reasoning_effort\s*=/m.test(homeTopLevel)
     && /model_provider\s*=\s*"codex-lb"/.test(projectAfter)
-    && !/service_tier\s*=/.test(homeTopLevel)
+    && /^service_tier\s*=\s*"fast"$/m.test(homeTopLevel)
     && /fast_mode = false/.test(homeAfter)
     && /model_provider = "codex-lb"/.test(homeAfter)
     && !/\[user\.fast_mode\]/.test(homeAfter)
     && !/\[profiles\.sks-fast-high\]/.test(homeAfter)
     && /\[model_providers\.codex-lb\]/.test(homeAfter)
-    && unsafePlan.requires_confirmation === true
-    && unsafePlan.safe_auto_apply === false;
-emit({ schema: 'sks.doctor-fixes-codex-app-fast-ui-check.v1', ok, plan, repaired, unsafe_plan: unsafePlan, project_after: projectAfter, home_after: homeAfter, blockers: ok ? [] : ['doctor_fixes_codex_app_fast_ui_check_failed'] });
+    && unsafePlan.requires_confirmation === false
+    && unsafePlan.safe_auto_apply === false
+    && unsafePlan.actions.every((action) => action.changed === false)
+    && unsafeAfter === 'service_tier = "standard"\n';
+await Promise.all([
+    fs.rm(root, { recursive: true, force: true }),
+    fs.rm(unsafeRoot, { recursive: true, force: true })
+]);
+tempRoots.clear();
+process.removeListener('exit', cleanupTempRoots);
+emit({ schema: 'sks.doctor-fixes-codex-app-fast-ui-check.v1', ok, plan, repaired, unsafe_plan: unsafePlan, project_after: projectAfter, home_after: homeAfter, unsafe_after: unsafeAfter, blockers: ok ? [] : ['doctor_fixes_codex_app_fast_ui_check_failed'] });
 function emit(report) {
     console.log(JSON.stringify(report, null, 2));
     if (!report.ok)
         process.exitCode = 1;
 }
+function cleanupTempRoots() {
+    for (const candidate of tempRoots) {
+        try {
+            syncFs.rmSync(candidate, { recursive: true, force: true });
+        }
+        catch { }
+    }
+}
 //# sourceMappingURL=doctor-fixes-codex-app-fast-ui-check.js.map

package/dist/scripts/doctor-imagegen-repair-check.js

@@ -44,20 +44,30 @@ const report = await repairCodexImagegen({
 const reportFile = JSON.parse(await fs.readFile(reportPath, 'utf8'));
 const ok = report.schema === 'sks.doctor-imagegen-repair.v1'
     && report.attempted === true
-    && report.recovered === true
+    && report.recovered === false
+    && report.capability_ready === true
+    && report.configuration_recovered === true
+    && report.route_ready === false
+    && report.real_generation_verified === false
     && report.after?.core_ready === true
     && report.steps?.some((step) => step.id === 'image_generation_feature_enable' && step.ok === true)
     && report.communication_test?.level === 'flag_level'
-    && report.communication_test?.ok === true
+    && report.communication_test?.ok === false
     && report.communication_test?.real_generation_round_trip_performed === false
-    && reportFile.recovered === true
-    && reportFile.communication_test?.level === 'flag_level';
+    && report.blockers?.includes('codex_imagegen_real_output_unverified')
+    && reportFile.recovered === false
+    && reportFile.route_ready === false
+    && reportFile.communication_test?.level === 'flag_level'
+    && reportFile.communication_test?.ok === false;
 console.log(JSON.stringify({
     schema: 'sks.doctor-imagegen-repair-check.v1',
     ok,
     repair_schema: report.schema,
     attempted: report.attempted,
     recovered: report.recovered,
+    capability_ready: report.capability_ready,
+    route_ready: report.route_ready,
+    real_generation_verified: report.real_generation_verified,
     after_core_ready: report.after?.core_ready === true,
     communication_test_level: report.communication_test?.level,
     report_path: reportPath

package/dist/scripts/doctor-startup-config-repair-blackbox.js

@@ -3,11 +3,17 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
 import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+import { parse } from 'smol-toml';
 const root = await makeTempRoot('sks-startup-config-blackbox-');
-await writeText(path.join(root, '.codex', 'config.toml'), '[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
-const report = await repairCodexStartupConfig({ root, apply: true });
+await writeText(path.join(root, '.codex', 'config.toml'), '# SKS managed Codex config fixture\n[agents.analysis_scout]\nconfig_file = ".codex/agents/stale.toml"\nmessage_role_prefix = "legacy"\n');
+const report = await repairCodexStartupConfig({ root, apply: true, home: path.join(root, 'home'), codexHome: path.join(root, 'codex-home') });
 const text = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
+const parsed = parse(text);
+const agents = parsed.agents || {};
+const files = (await fs.readdir(path.join(root, '.codex', 'agents'))).sort();
 assertGate(report.ok === true, 'startup config blackbox must pass postcheck', report);
-assertGate(!text.includes('message_role_prefix') && /config_file = "\//.test(text), 'startup config blackbox must rewrite to absolute config paths and remove unsupported fields', { text });
+assertGate(agents.max_threads === 12 && agents.max_depth === 1 && agents.job_max_runtime_seconds === 1200 && agents.interrupt_message === true, 'startup config blackbox must persist official settings', agents);
+assertGate(files.join(',') === 'expert.toml,worker.toml', 'startup config blackbox must create only official worker/expert TOMLs', files);
+assertGate(text.includes('config_file = ".codex/agents/stale.toml"') && text.includes('message_role_prefix = "legacy"'), 'startup config blackbox must preserve legacy compatibility tables', { text });
 emitGate('doctor:startup-config-repair-blackbox');
 //# sourceMappingURL=doctor-startup-config-repair-blackbox.js.map

package/dist/scripts/doctor-startup-config-repair-check.js

@@ -1,10 +1,20 @@
 #!/usr/bin/env node
 import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
 import { repairCodexStartupConfig } from '../core/doctor/codex-startup-config-repair.js';
+import fs from 'node:fs/promises';
 import path from 'node:path';
+import { parse } from 'smol-toml';
 const root = await makeTempRoot('sks-startup-config-');
-await writeText(path.join(root, '.codex', 'config.toml'), '[agents.analysis_scout]\nconfig_file = ".codex/agents/missing.toml"\nmessage_role_prefix = "legacy"\n');
-const report = await repairCodexStartupConfig({ root, apply: true });
-assertGate(report.ok === true, 'startup config repair must repair stale config_file paths and unsupported fields', report);
+await writeText(path.join(root, '.codex', 'config.toml'), '# SKS managed Codex config fixture\n[agents.analysis_scout]\nconfig_file = ".codex/agents/missing.toml"\nmessage_role_prefix = "legacy"\n');
+const codexHome = path.join(root, 'codex-home');
+const report = await repairCodexStartupConfig({ root, apply: true, home: path.join(root, 'home'), codexHome });
+const text = await fs.readFile(path.join(root, '.codex', 'config.toml'), 'utf8');
+const parsed = parse(text);
+const agents = parsed.agents || {};
+const files = (await fs.readdir(path.join(root, '.codex', 'agents'))).sort();
+assertGate(report.ok === true, 'startup config repair must install the official project config and agent files', report);
+assertGate(agents.max_threads === 12 && agents.max_depth === 1 && agents.job_max_runtime_seconds === 1200 && agents.interrupt_message === true, 'startup config repair must write official [agents] defaults', agents);
+assertGate(files.length === 2 && files[0] === 'expert.toml' && files[1] === 'worker.toml', 'startup config repair must create only worker/expert TOMLs', files);
+assertGate(text.includes('[agents.analysis_scout]') && text.includes('config_file = ".codex/agents/missing.toml"') && text.includes('message_role_prefix = "legacy"'), 'legacy agent config must be preserved without synthesizing its TOML', text);
 emitGate('doctor:startup-config-repair');
 //# sourceMappingURL=doctor-startup-config-repair-check.js.map

package/dist/scripts/install-update-preserves-config-check.js

@@ -29,6 +29,9 @@ const results = [];
         '',
         '[mcp_servers.custom]',
         'command = "npx"',
+        '',
+        '[agents]',
+        'max_threads = 20',
         ''
     ].join('\n');
     await fs.writeFile(cfg, userConfig);
@@ -41,6 +44,7 @@ const results = [];
         /^model_reasoning_effort = "high"/m.test(after) && // user effort NOT stripped
         /# my hand-tuned Codex config/.test(after) && // user comment preserved
         /\[mcp_servers\.custom\]/.test(after) && // user table preserved
+        /\[agents\][\s\S]*max_threads = 20/.test(after) && // user concurrency preserved
         !/\[profiles\.sks-fast-high\]/.test(after) && // legacy profile table stripped
         !/\[user\.fast_mode\]/.test(after) && // legacy fast UI table stripped
         backups.length >= 1 && // backup created
@@ -59,7 +63,8 @@ const results = [];
         && !/^model\s*=/m.test(topLevel)
         && !/^model_reasoning_effort\s*=/m.test(topLevel)
         && !/^service_tier = "fast"/m.test(topLevel)
-        && /\[features\]/.test(after);
+        && /\[features\]/.test(after)
+        && !/^max_threads\s*=/m.test(after);
     results.push({ case: 'fresh_config_seeds_defaults', ok, status: res.status });
 }
 // --- Case 3: unparseable config is preserved + backed up, NOT overwritten ---
@@ -68,7 +73,7 @@ const results = [];
     const codexDir = path.join(dir, '.codex');
     await fs.mkdir(codexDir, { recursive: true });
     const cfg = path.join(codexDir, 'config.toml');
-    const broken = 'model = "gpt-5.5"\n[features\nhooks = true\n'; // malformed table header
+    const broken = 'model = "gpt-5.6-terra"\n[features\nhooks = true\n'; // malformed table header
     await fs.writeFile(cfg, broken);
     const res = await helpers.ensureGlobalCodexFastModeDuringInstall({ home: dir, configPath: cfg });
     const after = await fs.readFile(cfg, 'utf8');

package/dist/scripts/legacy-gate-inventory-check.js

@@ -1,7 +1,9 @@
 import { assertGate, emitGate, readJson, readText } from './sks-1-18-gate-lib.js';
 const gates = (readJson('release-gates.v2.json').gates || []);
 const migration = readText('docs/sks-4-migration.md');
-const allowlist = parseAllowlist(migration);
+const currentVersion = String(readJson('package.json').version || '');
+assertGate(/^\d+\.\d+\.\d+(?:[-+].*)?$/.test(currentVersion), 'package version must be valid before evaluating legacy allowlist expiry', { currentVersion });
+const allowlist = parseAllowlist(migration, currentVersion);
 const legacy = gates
     .filter((gate) => gate.preset?.includes('release'))
     .filter((gate) => removableLegacy(gate.id, gate.command))
@@ -19,7 +21,7 @@ function removableLegacy(id, command) {
         || /codex[:.-]?0139/.test(id)
         || /codex-0139/.test(command);
 }
-function parseAllowlist(text) {
+function parseAllowlist(text, currentVersion) {
     return [...text.matchAll(/<!--\s*sks-legacy-allowlist\s*([\s\S]*?)-->/g)].map((match) => {
         const body = match[1] || '';
         return {
@@ -28,7 +30,7 @@ function parseAllowlist(text) {
             owner: field(body, 'owner'),
             expires: field(body, 'expires')
         };
-    }).filter((row) => row.id && row.reason && row.owner && compareVersion(row.expires, '4.0.2') > 0);
+    }).filter((row) => row.id && row.reason && row.owner && compareVersion(row.expires, currentVersion) > 0);
 }
 function isAllowed(id, allowlist) {
     return allowlist.some((row) => row.id.endsWith('*') ? id.startsWith(row.id.slice(0, -1)) : row.id === id);
@@ -37,8 +39,8 @@ function field(body, name) {
     return body.match(new RegExp(`^${name}:\\s*(.+)$`, 'm'))?.[1]?.trim() || '';
 }
 function compareVersion(a, b) {
-    const left = a.split('.').map(Number);
-    const right = b.split('.').map(Number);
+    const left = (a.split(/[+-]/, 1)[0] || '').split('.').map(Number);
+    const right = (b.split(/[+-]/, 1)[0] || '').split('.').map(Number);
     for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
         const delta = (left[i] || 0) - (right[i] || 0);
         if (delta !== 0)