sneakoscope 6.1.0 → 6.2.0

package/dist/cli/install-tool-helpers.js

@@ -0,0 +1,287 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import readline from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+import { EMPTY_CODEX_INFO, getCodexInfo } from '../core/codex-adapter.js';
+import { exists, globalSksRoot, PACKAGE_VERSION, runProcess, which } from '../core/fsx.js';
+import { hasContext7ConfigText } from '../core/routes.js';
+import { createRequestedScopeContract } from '../core/safety/requested-scope-contract.js';
+import { guardedPackageInstall, guardContextForRoute } from '../core/safety/mutation-guard.js';
+import { checkZellijCapability } from '../core/zellij/zellij-capability.js';
+export async function ensureRelatedCliTools(args = []) {
+    const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
+    const codex = await ensureCodexCliTool({ skip, args });
+    const zellijRepair = skip ? { status: 'skipped', reason: 'SKS_SKIP_CLI_TOOLS=1 or --skip-cli-tools' } : await ensureZellijCliTool(args);
+    const zellij = await checkZellijCapability({ require: false, writeReport: false });
+    return {
+        codex,
+        zellij: {
+            ok: zellij.status === 'ok',
+            bin: zellij.bin,
+            version: zellij.version,
+            min_version: zellij.min_version,
+            current_session: false,
+            repair: zellijRepair,
+            install_hint: zellij.status === 'ok' ? null : zellijInstallHint(),
+            error: zellijRepair.error || zellij.blockers[0] || zellij.warnings[0] || null
+        }
+    };
+}
+export async function ensureMadLaunchDependencies(args = []) {
+    const skip = args.includes('--skip-cli-tools') || process.env.SKS_SKIP_CLI_TOOLS === '1';
+    const zellijRepair = skip ? { target: 'zellij', status: 'skipped', reason: 'SKS_SKIP_CLI_TOOLS=1 or --skip-cli-tools' } : await ensureZellijCliTool(args);
+    const zellij = await checkZellijCapability({ require: false, writeReport: false });
+    const ready = zellij.status === 'ok';
+    return {
+        ready,
+        actions: ready ? [] : [{
+                target: 'zellij',
+                status: zellijRepair.status,
+                command: zellijRepair.command || zellijInstallHint(),
+                error: zellijRepair.error || zellij.blockers[0] || zellij.warnings[0] || null,
+                repair: zellijRepair
+            }],
+        status: {
+            zellij: {
+                ok: ready,
+                status: zellij.status,
+                version: zellij.version,
+                min_version: zellij.min_version,
+                repair: zellijRepair,
+                install_hint: ready ? null : zellijInstallHint()
+            }
+        }
+    };
+}
+export function formatMadLaunchDependencyAction(action = {}) {
+    const command = action.command ? ` Run: ${action.command}.` : '';
+    const error = action.error ? ` ${action.error}` : '';
+    return `${action.target || 'dependency'} ${action.status || 'blocked'}.${command}${error}`.trim();
+}
+export async function ensureCodexCliTool({ skip = false, args = [] } = {}) {
+    if (skip)
+        return { status: 'skipped', reason: 'SKS_SKIP_CLI_TOOLS=1 or --skip-cli-tools' };
+    const before = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
+    if (before.bin)
+        return { status: 'present', bin: before.bin, version: before.version || null };
+    const npmBin = await which('npm');
+    if (!npmBin)
+        return { status: 'failed', error: 'npm not found on PATH; install Codex CLI manually with npm i -g @openai/codex@latest.' };
+    const command = 'npm i -g @openai/codex@latest';
+    if (args.includes('--dry-run'))
+        return { status: 'dry_run', command, error: 'Codex CLI not found on PATH.' };
+    if (!await confirmInstallYesDefault(`Codex CLI is missing. Install latest Codex CLI with ${command}?`, args)) {
+        return { status: 'needs_approval', command, error: 'Codex CLI not found on PATH.' };
+    }
+    const installRoot = globalSksRoot();
+    const installContract = createRequestedScopeContract({
+        route: 'install', userRequest: command, projectRoot: installRoot, overrides: { package_install: true }
+    });
+    const install = await guardedPackageInstall(guardContextForRoute(installRoot, installContract, command), '@openai/codex@latest', { confirmed: true, command: npmBin, args: ['i', '-g', '@openai/codex@latest'], timeoutMs: 120000 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
+    if (install.code !== 0)
+        return { status: 'failed', error: `${install.stderr || install.stdout || 'npm i -g @openai/codex@latest failed'}`.trim() };
+    const after = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
+    return {
+        status: after.bin ? 'installed' : 'installed_not_on_path',
+        bin: after.bin || null,
+        version: after.version || null,
+        hint: after.bin ? null : 'npm completed, but codex is not on PATH. Restart the shell or set SKS_CODEX_BIN.'
+    };
+}
+export async function ensureZellijCliTool(args = [], opts = {}) {
+    const before = await checkZellijCapability({ require: false, writeReport: false });
+    if (before.status === 'ok')
+        return { target: 'zellij', status: 'present', bin: before.bin, version: before.version || null };
+    const command = zellijInstallHint();
+    if (process.platform !== 'darwin')
+        return { target: 'zellij', status: 'manual_required', command, error: before.blockers[0] || before.warnings[0] || 'zellij not found' };
+    const brew = await which('brew').catch(() => null);
+    if (!brew)
+        return { target: 'zellij', status: 'manual_required', command: 'Install Homebrew, then run: brew install zellij', error: before.blockers[0] || before.warnings[0] || 'zellij not found' };
+    if (args.includes('--dry-run') || opts.dryRun)
+        return { target: 'zellij', status: 'dry_run', command, error: before.blockers[0] || before.warnings[0] || null };
+    const hasInstalledZellij = Boolean(before.version);
+    const question = hasInstalledZellij
+        ? `Homebrew Zellij ${before.version || 'unknown'} is not ready. Upgrade to latest Zellij with ${command}?`
+        : `Zellij is missing. Install latest Zellij with ${command}?`;
+    if (!await confirmInstallYesDefault(question, args))
+        return { target: 'zellij', status: 'needs_approval', command, error: before.blockers[0] || before.warnings[0] || null };
+    const brewArgs = hasInstalledZellij ? ['upgrade', 'zellij'] : ['install', 'zellij'];
+    const zellijRoot = globalSksRoot();
+    const zellijContract = createRequestedScopeContract({
+        route: 'install', userRequest: command, projectRoot: zellijRoot, overrides: { package_install: true, zellij_install: true }
+    });
+    const install = await guardedPackageInstall(guardContextForRoute(zellijRoot, zellijContract, command), 'zellij', { confirmed: true, command: brew, args: brewArgs, timeoutMs: 180000 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
+    if (install.code !== 0)
+        return { target: 'zellij', status: 'failed', command, error: `${install.stderr || install.stdout || command + ' failed'}`.trim() };
+    const after = await checkZellijCapability({ require: false, writeReport: false });
+    if (after.status !== 'ok')
+        return { target: 'zellij', status: 'installed_not_ready', command, error: after.blockers[0] || after.warnings[0] || 'zellij installed but not ready' };
+    return { target: 'zellij', status: hasInstalledZellij ? 'upgraded' : 'installed', command, bin: after.bin, version: after.version || null };
+}
+export async function maybePromptCodexUpdateForLaunch(args = [], opts = {}) {
+    if (hasFlag(args, '--json') || hasFlag(args, '--skip-cli-tools') || hasFlag(args, '--skip-codex-update') || process.env.SKS_SKIP_CODEX_UPDATE === '1')
+        return { status: 'skipped' };
+    const latest = await npmPackageVersion('@openai/codex');
+    const codex = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
+    const current = codexCliVersionNumber(codex.version);
+    const command = 'npm i -g @openai/codex@latest';
+    const label = opts.label || 'Zellij launch';
+    const missing = !codex.bin;
+    const updateAvailable = Boolean(latest.version && current && compareVersions(latest.version, current) > 0);
+    if (!missing && !updateAvailable)
+        return { status: 'current', latest: latest.version || null, current, bin: codex.bin || null, error: latest.error || null };
+    const prompt = missing
+        ? `Codex CLI missing. Install @openai/codex${latest.version ? ` ${latest.version}` : '@latest'} before ${label}? [Y/n] `
+        : `Codex CLI ${current} -> ${latest.version} update before ${label}? [Y/n] `;
+    if (shouldAutoApproveInstall(args))
+        return installCodexLatest(command, latest.version, current);
+    if (!canAskYesNo()) {
+        const reason = missing ? 'Codex CLI missing' : `Codex CLI update available: ${current} -> ${latest.version}`;
+        console.log(`${reason}. Run: ${command}`);
+        return { status: missing ? 'missing' : 'available', latest: latest.version || null, current, command, bin: codex.bin || null };
+    }
+    const answer = (await askQuestion(prompt)).trim();
+    if (!(answer === '' || /^(y|yes|예|네|응)$/i.test(answer)))
+        return { status: 'skipped_by_user', latest: latest.version || null, current, command, bin: codex.bin || null };
+    return installCodexLatest(command, latest.version, current);
+}
+export async function maybePromptSksUpdateForLaunch(args = [], opts = {}) {
+    void args;
+    void opts;
+    return { status: 'skipped', reason: 'manual_update_commands_only', current: PACKAGE_VERSION, latest: null, command: null };
+}
+export function shouldAutoApproveInstall(args = [], env = process.env) {
+    if (hasFlag(args, '--from-postinstall') && env.SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS !== '1')
+        return false;
+    if (hasFlag(args, '--from-postinstall') && env.SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS === '1')
+        return true;
+    return hasFlag(args, '--yes') || hasFlag(args, '-y') || isAgentRuntime(env);
+}
+export function canAskYesNo() {
+    return Boolean(input.isTTY && output.isTTY && process.env.CI !== 'true');
+}
+export function compareVersions(a, b) {
+    const pa = String(a || '').split(/[.-]/).map((value) => Number.parseInt(value, 10) || 0);
+    const pb = String(b || '').split(/[.-]/).map((value) => Number.parseInt(value, 10) || 0);
+    for (let index = 0; index < Math.max(pa.length, pb.length, 3); index += 1) {
+        if ((pa[index] || 0) > (pb[index] || 0))
+            return 1;
+        if ((pa[index] || 0) < (pb[index] || 0))
+            return -1;
+    }
+    return 0;
+}
+export async function isProjectSetupCandidate(root) {
+    for (const marker of ['package.json', '.git', 'AGENTS.md', '.codex', '.sneakoscope']) {
+        if (await exists(path.join(root, marker)))
+            return true;
+    }
+    return false;
+}
+export function hasTopLevelCodexModeLock(text = '') {
+    const lines = String(text || '').split('\n');
+    const firstTable = lines.findIndex((line) => /^\s*\[.+\]\s*$/.test(line));
+    const top = (firstTable === -1 ? lines : lines.slice(0, firstTable)).join('\n');
+    return /(^|\n)\s*model_reasoning_effort\s*=/.test(top);
+}
+export function hasDeprecatedCodexHooksFeatureFlag(text = '') {
+    const lines = String(text || '').split('\n');
+    const start = lines.findIndex((line) => line.trim() === '[features]');
+    if (start === -1)
+        return false;
+    const end = lines.findIndex((line, index) => index > start && /^\s*\[.+\]\s*$/.test(line));
+    return lines.slice(start + 1, end === -1 ? lines.length : end).some((line) => /^\s*codex_hooks\s*=/.test(line));
+}
+export function hasCodexUnstableFeatureWarningSuppression(text = '') {
+    return /(^|\n)\s*suppress_unstable_features_warning\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(String(text || ''));
+}
+export async function checkContext7(root) {
+    const projectPath = path.join(root, '.codex', 'config.toml');
+    const globalPath = path.join(process.env.HOME || '', '.codex', 'config.toml');
+    const [projectText, globalText] = await Promise.all([safeReadText(projectPath), safeReadText(globalPath)]);
+    const codex = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
+    let list = { checked: false, ok: false, stdout: '', stderr: '' };
+    if (codex.bin) {
+        const out = await runProcess(codex.bin, ['mcp', 'list'], { timeoutMs: 8000, maxOutputBytes: 32 * 1024 }).catch((err) => ({ code: 1, stderr: err.message, stdout: '' }));
+        list = { checked: true, ok: out.code === 0 && /context7/i.test(`${out.stdout}\n${out.stderr}`), stdout: out.stdout || '', stderr: out.stderr || '' };
+    }
+    const result = {
+        ok: false,
+        project: { path: projectPath, ok: hasContext7ConfigText(projectText) },
+        global: { path: globalPath, ok: hasContext7ConfigText(globalText) },
+        codex_mcp_list: list
+    };
+    result.ok = result.project.ok || result.codex_mcp_list.ok || (result.global.ok && !list.checked);
+    return result;
+}
+function zellijInstallHint() {
+    return process.platform === 'darwin' ? 'brew install zellij' : 'Install Zellij from https://zellij.dev/documentation/installation.html';
+}
+async function confirmInstallYesDefault(question, args = []) {
+    if (hasFlag(args, '--from-postinstall') && process.env.SKS_POSTINSTALL_AUTO_INSTALL_CLI_TOOLS !== '1')
+        return false;
+    if (shouldAutoApproveInstall(args))
+        return true;
+    if (!canAskYesNo())
+        return false;
+    const answer = (await askQuestion(`${question} [Y/n] `)).trim();
+    return answer === '' || /^(y|yes|예|네|응)$/i.test(answer);
+}
+async function askQuestion(question) {
+    const rl = readline.createInterface({ input, output });
+    try {
+        return await rl.question(question);
+    }
+    finally {
+        rl.close();
+    }
+}
+function hasFlag(args = [], name) {
+    return args.includes(name);
+}
+function isAgentRuntime(env = process.env) {
+    return ['SKS_OPENCLAW', 'OPENCLAW', 'OPENCLAW_AGENT', 'OPENCLAW_RUN_ID', 'OPENCLAW_SESSION_ID', 'SKS_HERMES', 'HERMES_AGENT', 'HERMES_RUN_ID', 'HERMES_SESSION_ID']
+        .some((key) => /^(1|true|yes|y)$/i.test(String(env[key] || '').trim()));
+}
+async function installCodexLatest(command, latestVersion, previousVersion = null) {
+    const npm = await which('npm').catch(() => null);
+    if (!npm)
+        return { status: 'failed', latest: latestVersion || null, previous: previousVersion || null, command, error: 'npm not found on PATH' };
+    const install = await runProcess(npm, ['i', '-g', '@openai/codex@latest'], { timeoutMs: 180000, maxOutputBytes: 128 * 1024 }).catch((err) => ({ code: 1, stdout: '', stderr: err.message }));
+    if (install.code !== 0)
+        return { status: 'failed', latest: latestVersion || null, previous: previousVersion || null, command, error: `${install.stderr || install.stdout || command + ' failed'}`.trim() };
+    const after = await getCodexInfo().catch(() => EMPTY_CODEX_INFO);
+    const afterVersion = codexCliVersionNumber(after.version);
+    if (!after.bin)
+        return { status: 'updated_not_reflected', latest: latestVersion || null, previous: previousVersion || null, version: afterVersion || null, command, error: 'npm completed, but codex is not on PATH. Restart the shell or set SKS_CODEX_BIN.' };
+    if (latestVersion && afterVersion && compareVersions(afterVersion, latestVersion) < 0) {
+        return { status: 'updated_not_reflected', latest: latestVersion, previous: previousVersion || null, version: afterVersion, bin: after.bin, command, error: `npm completed, but PATH still resolves Codex CLI ${afterVersion}; expected ${latestVersion}.` };
+    }
+    console.log(`Codex CLI ready: ${previousVersion || 'missing'} -> ${after.version || after.bin}`);
+    return { status: previousVersion ? 'updated' : 'installed', latest: latestVersion || null, previous: previousVersion || null, version: afterVersion || null, raw_version: after.version || null, bin: after.bin || null, command };
+}
+function codexCliVersionNumber(versionText = '') {
+    return String(versionText || '').match(/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/)?.[1] || null;
+}
+async function npmPackageVersion(name) {
+    const envName = `SKS_NPM_VIEW_${String(name || '').replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_VERSION`;
+    if (process.env[envName])
+        return { version: process.env[envName] };
+    const npm = await which('npm').catch(() => null);
+    if (!npm)
+        return { error: 'npm not found' };
+    const result = await runProcess(npm, ['view', name, 'version'], { timeoutMs: 5000, maxOutputBytes: 4096 });
+    if (result.code !== 0)
+        return { error: `${result.stderr || result.stdout || 'npm view failed'}`.trim() };
+    return { version: result.stdout.trim().split(/\s+/).pop() };
+}
+async function safeReadText(file) {
+    try {
+        return await fsp.readFile(file, 'utf8');
+    }
+    catch {
+        return '';
+    }
+}
+//# sourceMappingURL=install-tool-helpers.js.map

package/dist/cli/router.js

@@ -73,6 +73,8 @@ async function dispatchInner(argv) {
             command: raw,
             reason: 'unknown_command',
         };
+        if (argv.includes('--json'))
+            console.log(JSON.stringify(result, null, 2));
         return result;
     }
     const entry = COMMAND_MANIFEST_BY_NAME[command];
@@ -102,7 +104,11 @@ async function dispatchInner(argv) {
         const migrationGate = await ensureCurrentMigrationBeforeCommand({
             command,
             args: rest,
-            skipMigrationGate: entry.skipMigrationGate === true || entry.readonly === true || safeActiveRouteVisualQuery(command, rest)
+            skipMigrationGate: entry.skipMigrationGate === true
+                || entry.readonly === true
+                || safeReadOnlySubcommand(command, rest)
+                || safeActiveRouteVisualQuery(command, rest)
+                || safeActiveRouteRecoverySubcommand(command, rest)
         });
         if (!migrationGate.ok) {
             console.error('SKS project migration blocked.');
@@ -146,7 +152,7 @@ async function ensureActiveRouteCommandGate(command, args) {
     }
     if (entry.mutatesRouteState !== true)
         return { ok: true, status: 'allowed' };
-    if (safeReadOnlySubcommand(args))
+    if (safeReadOnlySubcommand(command, args))
         return { ok: true, status: 'allowed_status_subcommand' };
     if (safeActiveRouteVisualQuery(command, args))
         return { ok: true, status: 'allowed_visual_query' };
@@ -158,6 +164,8 @@ async function ensureActiveRouteCommandGate(command, args) {
     ]);
     const root = await projectRoot(process.cwd()).catch(() => process.cwd());
     const state = await readJson(stateFile(root), {}).catch(() => ({}));
+    if (safeActiveRouteContinuation(command, args, state))
+        return { ok: true, status: 'allowed_active_route_continuation' };
     if (!activeRouteStateBlocksCommand(state))
         return { ok: true, status: 'allowed' };
     const visualPreflight = await blockedVisualSourcePreflight(command, args);
@@ -201,8 +209,11 @@ function printHandledCommandBlock(result) {
     for (const line of Array.isArray(result?.guidance) ? result.guidance : [])
         console.error(`- ${line}`);
 }
-function safeReadOnlySubcommand(args) {
-    const sub = String(args.find((arg) => !String(arg).startsWith('-')) || '').toLowerCase();
+export function safeReadOnlySubcommand(command, args) {
+    const sub = String(args[0] || '').toLowerCase();
+    if (command === 'naruto' && ['status', 'subagents', 'workers', 'proof'].includes(sub)) {
+        return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
+    }
     if (!['status', 'show', 'list', 'observe', 'watch', 'doctor', 'help'].includes(sub))
         return false;
     return !args.some((arg) => ['--fix', '--yes', '-y', '--write', '--apply', '--execute', '--force', '--real'].includes(String(arg)));
@@ -213,6 +224,31 @@ function safeActiveRouteRecoverySubcommand(command, args) {
     const sub = String(args.find((arg) => !String(arg).startsWith('-')) || '').toLowerCase();
     return ['close', 'cleanup', 'rollback-patches'].includes(sub);
 }
+function safeActiveRouteContinuation(command, args, state = {}) {
+    const expectedRoutes = new Map([
+        ['research', ['RESEARCH']],
+        ['autoresearch', ['AUTORESEARCH', 'RESEARCH']],
+        ['qa-loop', ['QALOOP']]
+    ]).get(command);
+    if (!expectedRoutes)
+        return false;
+    const subcommand = String(args[0] || '').toLowerCase();
+    const activeRoute = String(state.route || state.route_command || state.mode || '').replace(/^\$/, '').replace(/[-_]/g, '').toUpperCase();
+    if (!expectedRoutes.includes(activeRoute))
+        return false;
+    if (subcommand === 'prepare') {
+        const parentMissionId = String(process.env.SKS_RUN_PARENT_MISSION_ID || '').trim();
+        return command !== 'autoresearch'
+            && String(state.mode || '').toUpperCase() === 'RUN'
+            && String(state.phase || '').toUpperCase() === 'RUN_ROUTE_SELECTED'
+            && Boolean(parentMissionId)
+            && parentMissionId === String(state.mission_id || '');
+    }
+    if (subcommand !== 'run')
+        return false;
+    const requestedMission = String(args[1] || '').trim();
+    return Boolean(state.mission_id) && (requestedMission === String(state.mission_id) || requestedMission === 'latest');
+}
 function activeRouteStateBlocksCommand(state = {}) {
     if (!state?.mission_id || state.route_closed === true)
         return false;

package/dist/commands/codex-lb.js

@@ -7,6 +7,7 @@ import { printJson } from '../cli/output.js';
 import { codexLbMetrics, readCodexLbCircuit, recordCodexLbHealthEvent, resetCodexLbCircuit, codexLbProofEvidence } from '../core/codex-lb-circuit.js';
 import { checkCodexLbResponseChain, codexLbStatus, configureCodexLb, formatCodexLbStatusText, releaseCodexLbAuthHold, repairCodexLbAuth, unselectCodexLbProvider } from '../cli/install-helpers.js';
 import { buildCodexLbSetupPlan, codexLbPersistenceSummary, renderCodexLbSetupPlan } from '../core/codex-lb/codex-lb-setup.js';
+import { CODEX_LB_TOOL_OUTPUT_RECOVERY_OVERRIDE_FLAG, codexLbToolOutputRecoveryOverrideAcknowledged } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
 import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
 import { repairCodexAppFastUi } from '../core/codex-app/codex-app-fast-ui-repair.js';
 export async function run(command, args = []) {
@@ -22,15 +23,19 @@ export async function run(command, args = []) {
         return;
     }
     if (action === 'status' || action === 'check') {
-        const result = await codexLbStatus();
+        const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args });
+        const result = await codexLbStatus({ probeToolOutputRecovery: true, allowUnverifiedToolOutputRecovery });
         const shaped = shapeCodexLbStatus(result);
+        if (result.selected && result.tool_output_recovery?.ok !== true)
+            process.exitCode = 1;
         if (flag(args, '--json'))
             return printJson(shaped);
         process.stdout.write(formatCodexLbStatusText(result));
         return;
     }
     if (action === 'doctor') {
-        const status = shapeCodexLbStatus(await codexLbStatus());
+        const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args });
+        const status = shapeCodexLbStatus(await codexLbStatus({ probeToolOutputRecovery: true, allowUnverifiedToolOutputRecovery }));
         const metrics = codexLbMetrics(await readCodexLbCircuit(root));
         const result = { schema: 'sks.codex-lb-doctor.v1', ok: Boolean(status.ok && metrics.ok), deep: flag(args, '--deep'), status, metrics };
         if (flag(args, '--json'))
@@ -41,9 +46,14 @@ export async function run(command, args = []) {
         return;
     }
     if (action === 'health' || action === 'verify-chain' || action === 'chain') {
-        const status = await codexLbStatus();
+        const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args });
+        const status = await codexLbStatus({ probeToolOutputRecovery: true, allowUnverifiedToolOutputRecovery });
         const blocker = !status.env_key_configured ? 'missing_env_key' : !status.base_url ? 'missing_base_url' : 'not_configured';
-        const result = status.ok ? await checkCodexLbResponseChain(status, { force: true, root, fastMode: flag(args, '--fast') || flag(args, '--priority') }) : { ok: false, status: blocker, codex_lb: status };
+        const result = status.selected && status.tool_output_recovery?.ok !== true
+            ? { ok: false, status: 'tool_output_recovery_blocked', codex_lb: status, tool_output_recovery: status.tool_output_recovery }
+            : status.ok
+                ? await checkCodexLbResponseChain(status, { force: true, root, fastMode: flag(args, '--fast') || flag(args, '--priority') })
+                : { ok: false, status: blocker, codex_lb: status };
         if (flag(args, '--json'))
             return printJson(result);
         console.log(`codex-lb response chain: ${result.ok ? 'ok' : `failed (${result.status})`}`);
@@ -52,12 +62,15 @@ export async function run(command, args = []) {
         return;
     }
     if (action === 'fast-check' || action === 'fast' || action === 'verify-fast') {
-        const status = await codexLbStatus();
+        const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args });
+        const status = await codexLbStatus({ probeToolOutputRecovery: true, allowUnverifiedToolOutputRecovery });
         const blocker = !status.env_key_configured ? 'missing_env_key' : !status.base_url ? 'missing_base_url' : !status.provider_contract_ok ? 'provider_contract_drift' : 'not_configured';
         const modelSelection = await resolveCodexLbFastCheckModel(status);
-        const chain = status.env_key_configured && status.base_url && modelSelection.model
-            ? await checkCodexLbResponseChain(status, { force: true, cache: false, root, fastMode: true, model: modelSelection.model })
-            : { ok: false, status: modelSelection.model ? blocker : 'model_unselected', codex_lb: status };
+        const chain = status.selected && status.tool_output_recovery?.ok !== true
+            ? { ok: false, status: 'tool_output_recovery_blocked', codex_lb: status, tool_output_recovery: status.tool_output_recovery }
+            : status.env_key_configured && status.base_url && modelSelection.model
+                ? await checkCodexLbResponseChain(status, { force: true, cache: false, root, fastMode: true, model: modelSelection.model })
+                : { ok: false, status: modelSelection.model ? blocker : 'model_unselected', codex_lb: status };
         const evidence = await fastEvidenceFromChain(chain, readOption(args, '--request-log', readOption(args, '--request-log-json', null)));
         const providerReady = status.provider_contract_ok === true;
         const chainVerified = isCodexLbFastChainVerified(chain);
@@ -103,7 +116,9 @@ export async function run(command, args = []) {
         return;
     }
     if (action === 'repair' || action === 'resync' || action === 'login') {
-        const result = await repairCodexLbAuth();
+        const result = await repairCodexLbAuth({
+            allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
+        });
         const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
         const shaped = { ...result, ok: Boolean(result.ok && fastUi.ok), codex_app_fast_ui: fastUi };
         if (!shaped.ok)
@@ -156,7 +171,13 @@ export async function run(command, args = []) {
             process.exitCode = 1;
             return;
         }
-        const result = await configureCodexLb({ host, apiKey: newKey, authMode: flag(args, '--preserve-auth') ? 'preserve' : 'codex-lb', forceCodexLbApiKeyAuth: !flag(args, '--preserve-auth') });
+        const result = await configureCodexLb({
+            host,
+            apiKey: newKey,
+            authMode: flag(args, '--preserve-auth') ? 'preserve' : 'codex-lb',
+            forceCodexLbApiKeyAuth: !flag(args, '--preserve-auth'),
+            allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
+        });
         const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
         const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok && fastUi.ok));
         const ok = Boolean(result.ok && fastUi.ok && restart?.ok !== false);
@@ -174,7 +195,12 @@ export async function run(command, args = []) {
     }
     if (action === 'use-codex-lb' || action === 'use-lb') {
         // Switch auth mode -> codex-lb (API key). Re-selects the provider and re-syncs auth.
-        const result = await repairCodexLbAuth({ forceCodexLbApiKeyAuth: true, authMode: 'codex-lb', forceFastMode: !flag(args, '--no-fast') });
+        const result = await repairCodexLbAuth({
+            forceCodexLbApiKeyAuth: true,
+            authMode: 'codex-lb',
+            forceFastMode: !flag(args, '--no-fast'),
+            allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
+        });
         const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
         const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok && fastUi.ok));
         const ok = Boolean(result.ok && fastUi.ok && restart?.ok !== false);
@@ -325,7 +351,8 @@ export async function run(command, args = []) {
             shellProfile: options.shellProfile,
             runHealth: options.health,
             apiKeySource: options.apiKeySource,
-            allowInsecureHttp: options.allowInsecureLocalhost
+            allowInsecureHttp: options.allowInsecureLocalhost,
+            allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
         });
         const fastUi = await repairCodexAppFastUiAfterMutation(root, Boolean(result.ok));
         const restart = await maybeRestartCodexAppForAuthSwitch(args, Boolean(result.ok && fastUi.ok) && !flag(args, '--preserve-auth'));
@@ -378,6 +405,7 @@ export async function run(command, args = []) {
         return;
     }
     console.error('Usage: sks codex-lb status|metrics|doctor --deep|health|setup|set-key|use-codex-lb|use-oauth|repair|release|unselect|circuit reset|circuit record-fixture|proof-evidence [--json]');
+    console.error(`  ${CODEX_LB_TOOL_OUTPUT_RECOVERY_OVERRIDE_FLAG}  explicitly acknowledge an old/unverified proxy for this command (unsafe)`);
     console.error('  set-key       swap the codex-lb API key (reuses the stored host): sks codex-lb set-key --api-key-stdin');
     console.error('  use-codex-lb  switch auth mode to codex-lb (API key)');
     console.error('  use-oauth     switch auth mode to ChatGPT OAuth (restores saved login, else: codex login)');
@@ -587,9 +615,10 @@ function shapeCodexLbStatus(status = {}) {
     return {
         schema: 'sks.codex-lb-status.v1',
         ...status,
-        configured: Boolean(status.ok),
-        setup_needed: !status.ok,
-        repair_available: !status.ok,
+        configured: Boolean(status.provider_ready ?? status.ok),
+        setup_needed: !Boolean(status.provider_ready ?? status.ok),
+        upgrade_needed: Boolean(status.selected && status.tool_output_recovery?.ok !== true),
+        repair_available: !Boolean(status.provider_ready ?? status.ok),
         api_key: {
             present: Boolean(status.env_key_configured),
             source: status.env_loader?.api_key?.source || null,
@@ -598,11 +627,13 @@ function shapeCodexLbStatus(status = {}) {
         persistence,
         env_loader: status.env_loader || null,
         env_auto_load: Boolean(status.env_file && status.env_key_configured),
-        guidance: status.ok ? [] : [
-            'codex-lb API key is not configured.',
-            'Run: sks codex-lb setup',
-            'Or: sks codex-lb setup --host <domain> --api-key-stdin --yes'
-        ]
+        guidance: status.selected && status.tool_output_recovery?.ok !== true
+            ? status.tool_output_recovery.operator_actions || []
+            : status.ok ? [] : [
+                'codex-lb API key is not configured.',
+                'Run: sks codex-lb setup',
+                'Or: sks codex-lb setup --host <domain> --api-key-stdin --yes'
+            ]
     };
 }
 async function codexLbSetupOptions(args = []) {

package/dist/commands/codex.js

@@ -6,6 +6,7 @@ import { codexSchemaSnapshotReport } from '../core/codex-compat/codex-schema-sna
 import { detectCodex0141Capability } from '../core/codex-control/codex-0141-capability.js';
 import { detectCodex0144Capability } from '../core/codex-control/codex-0144-capability.js';
 import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
+import { inspectCodexCliUpdate, updateCodexCliNow } from '../core/codex/codex-cli-update.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'compatibility';
     if (action === 'compatibility' || action === 'compat') {
@@ -27,6 +28,43 @@ export async function run(_command, args = []) {
         console.log(`Codex detected: ${result.detected.version || 'not installed'} (${result.policy.status})`);
         return;
     }
+    if (action === 'update-status' || action === 'update-check') {
+        const result = await inspectCodexCliUpdate({ force: flag(args, '--refresh') || flag(args, '--force') });
+        if (flag(args, '--json')) {
+            printJson(result);
+            if (!result.ok)
+                process.exitCode = 1;
+            return;
+        }
+        console.log(`Codex CLI: ${result.current_version || 'not installed'}${result.latest_version ? ` (latest ${result.latest_version})` : ''}`);
+        console.log(`Update: ${result.update_available === true ? 'available' : result.update_available === false ? 'current' : 'unverified'}`);
+        for (const warning of result.warnings)
+            console.log(`- warning: ${warning}`);
+        for (const actionLine of result.guidance)
+            console.log(`- ${actionLine}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
+    if (action === 'update' || action === 'update-now') {
+        const result = await updateCodexCliNow();
+        if (flag(args, '--json')) {
+            printJson(result);
+            if (!result.ok)
+                process.exitCode = 1;
+            return;
+        }
+        console.log(`Codex CLI update: ${result.status}${result.after_version ? ` (${result.before_version || 'unknown'} -> ${result.after_version})` : ''}`);
+        if (result.raw_output)
+            console.log(result.raw_output);
+        for (const blocker of result.blockers)
+            console.log(`- blocker: ${blocker}`);
+        for (const actionLine of result.guidance)
+            console.log(`- ${actionLine}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
     if (action === '0.141' || action === '0141' || action === 'rust-v0.141.0') {
         const result = await detectCodex0141Capability();
         if (flag(args, '--json'))
@@ -71,7 +109,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex compatibility|version|doctor|schema|0.144|0.141 [--json]');
+    console.error('Usage: sks codex compatibility|version|update-status [--refresh]|update|doctor|schema|0.144|0.141 [--json]');
     process.exitCode = 1;
 }
 //# sourceMappingURL=codex.js.map