sneakoscope 6.1.2 → 6.2.0

package/dist/scripts/codex-lb-gpt56-fast-profile-check.js

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { codexFastModeDesktopStatus, codexLbConfigPath, configureCodexLb, ensureGlobalCodexFastModeDuringInstall, releaseCodexLbAuthHold, repairCodexLbAuth } from '../cli/install-helpers.js';
 import { repairCodexConfigStructure, splitCodexProjectConfigPolicy } from '../core/codex/codex-project-config-policy.js';
 import { parseCodexConfigToml, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
+import { CODEX_LB_TOOL_OUTPUT_RECOVERY_MIN_VERSION } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
 import { normalizeCodexLbToolCatalog } from '../core/codex-lb/codex-lb-tool-catalog.js';
 const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-gpt56-fast-'));
 const home = path.join(tmp, 'home');
@@ -29,13 +30,14 @@ const setup = await configureCodexLb({
     forceFastMode: true,
     forceCodexLbApiKeyAuth: true,
     authMode: 'codex-lb',
-    shellProfile: 'skip'
+    shellProfile: 'skip',
+    toolOutputRecoveryFetch
 });
 const fastOn = await ensureGlobalCodexFastModeDuringInstall({ home, configPath, forceFastMode: true });
 const first = assertFastProfile(await fs.readFile(configPath, 'utf8'), 'setup_fast_on');
 const release = await releaseCodexLbAuthHold({ home, configPath, authPath, backupPath: oauthBackupPath });
 const afterOauth = assertFastProfile(await fs.readFile(configPath, 'utf8'), 'use_oauth_roundtrip');
-const repair = await repairCodexLbAuth({ home, configPath, envPath, forceCodexLbApiKeyAuth: true, forceFastMode: true, authMode: 'codex-lb' });
+const repair = await repairCodexLbAuth({ home, configPath, envPath, forceCodexLbApiKeyAuth: true, forceFastMode: true, authMode: 'codex-lb', toolOutputRecoveryFetch });
 await fs.writeFile(projectConfig, [
     '# SKS managed fixture',
     'default_profile = "sks-fast-high"',
@@ -154,4 +156,13 @@ function codex0144Model(slug) {
         minimal_client_version: '0.144.1'
     };
 }
+async function toolOutputRecoveryFetch() {
+    return new Response('{}', {
+        status: 200,
+        headers: {
+            'content-type': 'application/json',
+            'x-app-version': CODEX_LB_TOOL_OUTPUT_RECOVERY_MIN_VERSION
+        }
+    });
+}
 //# sourceMappingURL=codex-lb-gpt56-fast-profile-check.js.map

package/dist/scripts/codex-native-agent-role-content-check.js

@@ -10,16 +10,28 @@ const codexHome = path.join(root, 'codex-home');
 const report = await syncCodexAgentRoles({ root, codexHome, apply: true, agentTypeSupported: true });
 const expert = await fs.promises.readFile(path.join(root, '.codex', 'agents', 'expert.toml'), 'utf8');
 const worker = await fs.promises.readFile(path.join(root, '.codex', 'agents', 'worker.toml'), 'utf8');
+const implementation = await fs.promises.readFile(path.join(root, '.codex', 'agents', 'implementation-specialist.toml'), 'utf8');
+const browser = await fs.promises.readFile(path.join(root, '.codex', 'agents', 'browser-use-operator.toml'), 'utf8');
 assertGate(expert.includes('model = "gpt-5.6-sol"') && expert.includes('model_reasoning_effort = "max"'), 'expert role must use Sol Max');
 assertGate(worker.includes('model = "gpt-5.6-luna"') && worker.includes('model_reasoning_effort = "max"'), 'worker role must use Luna Max');
+assertGate(implementation.includes('model = "gpt-5.6-sol"') && implementation.includes('model_reasoning_effort = "high"'), 'implementation role must use Sol High');
+assertGate(browser.includes('model = "gpt-5.6-terra"') && browser.includes('model_reasoning_effort = "medium"'), 'browser role must use Terra Medium');
 assertGate(expert.includes('Do not spawn another subagent.') && worker.includes('Do not redesign the task, expand scope, or spawn another subagent.'), 'official roles must prohibit nested delegation');
 for (const role of MANAGED_OFFICIAL_SUBAGENT_ROLES) {
     const text = await fs.promises.readFile(path.join(root, '.codex', 'agents', role.filename), 'utf8');
     const doc = parse(text);
-    assertGate(doc.name === role.codex_name && doc.model === role.model && doc.model_reasoning_effort === 'max', `official role policy mismatch:${role.codex_name}`);
+    assertGate(doc.name === role.codex_name && doc.model === role.model && doc.model_reasoning_effort === role.model_reasoning_effort, `official role policy mismatch:${role.codex_name}`);
     assertGate(Object.hasOwn(doc, 'sandbox_mode') === (role.sandbox === 'read-only'), `official role sandbox inheritance mismatch:${role.codex_name}`);
     assertGate(doc.sandbox_mode === role.sandbox, `official role sandbox value mismatch:${role.codex_name}`);
 }
+const distribution = Object.fromEntries(['luna_max_mechanical', 'sol_high_implementation', 'sol_max_judgment', 'terra_medium_context_tools']
+    .map((policy) => [policy, MANAGED_OFFICIAL_SUBAGENT_ROLES.filter((role) => role.model_policy === policy).length]));
+assertGate(JSON.stringify(distribution) === JSON.stringify({
+    luna_max_mechanical: 1,
+    sol_high_implementation: 3,
+    sol_max_judgment: 15,
+    terra_medium_context_tools: 6
+}), 'official role policy distribution mismatch');
 assertGate(!fs.existsSync(path.join(codexHome, 'agents')), 'agent role sync must not create global directive roles');
 assertGate(report.strategy === 'agent_type' && report.probe_artifact_path && report.clobbered_user_roles === false && report.official_roles.length === MANAGED_OFFICIAL_SUBAGENT_ROLES.length, 'agent role report strategy/probe/catalog/no-clobber fields missing');
 emitGate('codex-native:agent-role-content');

package/dist/scripts/codex-sdk-backend-router-check.js

@@ -9,6 +9,7 @@ const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-sdk-router-'));
 const old = snapshotEnv();
 process.env.NODE_ENV = 'test';
 process.env.SKS_CODEX_SDK_FAKE = '1';
+process.env.SKS_CODEX_LB_AUTOBYPASS = '1';
 process.env.SKS_DISABLE_ROUTE_RECURSION = '1';
 process.env.SKS_AGENT_WORKER = '1';
 process.env.SKS_FAST_MODE = '1';
@@ -48,6 +49,7 @@ function snapshotEnv() {
     return {
         NODE_ENV: process.env.NODE_ENV,
         SKS_CODEX_SDK_FAKE: process.env.SKS_CODEX_SDK_FAKE,
+        SKS_CODEX_LB_AUTOBYPASS: process.env.SKS_CODEX_LB_AUTOBYPASS,
         SKS_DISABLE_ROUTE_RECURSION: process.env.SKS_DISABLE_ROUTE_RECURSION,
         SKS_AGENT_WORKER: process.env.SKS_AGENT_WORKER,
         SKS_FAST_MODE: process.env.SKS_FAST_MODE,

package/dist/scripts/lib/codex-sdk-gate-lib.js

@@ -17,6 +17,9 @@ export async function runFakeCodexSdkTaskFixture(label = 'fixture', extra = {})
     const old = snapshotEnv();
     process.env.NODE_ENV = 'test';
     process.env.SKS_CODEX_SDK_FAKE = '1';
+    // Hermetic fixture runs must not inherit an operator's live codex-lb
+    // selection. The fake adapter exercises control-plane contracts only.
+    process.env.SKS_CODEX_LB_AUTOBYPASS = '1';
     try {
         const result = await mod.runCodexTask({
             route: extra.route || '$Agent',
@@ -78,6 +81,7 @@ function snapshotEnv() {
     return {
         NODE_ENV: process.env.NODE_ENV,
         SKS_CODEX_SDK_FAKE: process.env.SKS_CODEX_SDK_FAKE,
+        SKS_CODEX_LB_AUTOBYPASS: process.env.SKS_CODEX_LB_AUTOBYPASS,
         SKS_CODEX_SDK_FIXTURE: process.env.SKS_CODEX_SDK_FIXTURE
     };
 }

package/dist/scripts/official-subagent-workflow-check.js

@@ -12,7 +12,7 @@ const counts = [4, 8, 12, 20, 100].map((requested) => resolveSubagentThreadBudge
     configuredMaxThreads: requested === 20 ? 12 : undefined
 }));
 const implicitCount = resolveSubagentThreadBudget();
-assertGate(implicitCount.requestedSubagents === 1, 'implicit Naruto must default to one safe child', implicitCount);
+assertGate(implicitCount.requestedSubagents === 2, 'implicit Naruto must default to two independent children', implicitCount);
 assertGate(counts[0]?.requestedSubagents === 4, 'requested 4 must remain 4', counts);
 assertGate(counts[1]?.requestedSubagents === 8, 'requested 8 must remain 8', counts);
 assertGate(counts[2]?.requestedSubagents === 12, 'requested 12 must remain 12', counts);

package/dist/scripts/packlist-performance-check.js

@@ -9,24 +9,7 @@ import { writeNpmPackProof } from '../core/release/npm-pack-proof.js';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 const MAX_FILES = Number(process.env.SKS_MAX_PACK_FILES || 2100);
 const MAX_UNPACKED = Number(process.env.SKS_MAX_UNPACKED_BYTES || DEFAULT_MAX_UNPACKED_BYTES);
-// Raised from 2300 KiB after the 5.4.0 dollar-command hardening pass added
-// src/core/feature-fixture-executor.ts and expanded several command modules
-// (route-success-helpers.ts, seo-command.ts, ppt-command.ts, qa-loop-command.ts,
-// research-command.ts, image-ux-review-command.ts, mad-sks-command.ts,
-// sks-menubar.ts) with genuine new production logic, pushing the packed size
-// to ~2306 KiB. 5.7.0 adds doctor/update migration repair coverage and publish
-// contract checks, pushing the packed tarball to ~2345 KiB. 5.9.0 adds quantum
-// release evidence scripts (installed package smoke, perf budgets, scorecard,
-// Super-Search contracts, and parallel smoke), pushing the packed tarball to
-// ~2354 KiB. Keep a narrow cap rather than giving the package a broad size
-// budget. 5.11.0 adds package-referenced integrity gates for SEO marketing,
-// Naruto write E2E, high-risk contracts, scorecards, and retention long-run
-// checks; keep those scripts publishable because package contract validation
-// rejects scripts that point at files absent from the tarball. 5.12.0 adds ops
-// maturity diagnostics, migration/recovery smokes, and their package-referenced
-// gates, pushing the packed tarball to ~2400 KiB. 6.0.3 adds the menu restart
-// lifecycle and Naruto GPT-5.6 routing enforcement, bringing the measured
-// packed size to ~2411 KiB; keep the next 1 KiB boundary as the narrow cap.
+// Shared measured budgets stay centralized and intentionally narrow.
 const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || DEFAULT_MAX_PACK_BYTES);
 const SURFACE_MAX_PACKED = Number(process.env.SKS_PACKAGE_SURFACE_MAX_PACK_BYTES || 25_000_000);
 const SURFACE_MAX_FILES = Number(process.env.SKS_PACKAGE_SURFACE_MAX_FILES || 2500);

package/dist/scripts/python-codex-sdk-all-pipelines-check.js

@@ -13,7 +13,11 @@ const mod = await importDist('core/codex-control/codex-control-plane.js');
 const schema = await importDist('core/codex-control/schemas/agent-worker-result.schema.js');
 const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-python-codex-sdk-pipeline-'));
 const oldFake = process.env.SKS_PYTHON_CODEX_SDK_FAKE;
+const oldCodexLbAutobypass = process.env.SKS_CODEX_LB_AUTOBYPASS;
 process.env.SKS_PYTHON_CODEX_SDK_FAKE = '1';
+// Keep the hermetic fake backend independent from an operator's live
+// codex-lb configuration. This fixture validates the Python SDK pipeline only.
+process.env.SKS_CODEX_LB_AUTOBYPASS = '1';
 try {
     const result = await mod.runCodexTask({
         route: '$Agent',
@@ -43,5 +47,9 @@ finally {
         delete process.env.SKS_PYTHON_CODEX_SDK_FAKE;
     else
         process.env.SKS_PYTHON_CODEX_SDK_FAKE = oldFake;
+    if (oldCodexLbAutobypass === undefined)
+        delete process.env.SKS_CODEX_LB_AUTOBYPASS;
+    else
+        process.env.SKS_CODEX_LB_AUTOBYPASS = oldCodexLbAutobypass;
 }
 //# sourceMappingURL=python-codex-sdk-all-pipelines-check.js.map

package/dist/scripts/sks-menubar-install-check.js

@@ -109,7 +109,11 @@ const hasBackgroundReadonlyActions = generatedSource.includes('runSksBackground(
     && !generatedSource.includes('runInTerminal');
 const hasNativeModalSource = generatedSource.includes('func promptText(title: String, message: String')
     && generatedSource.includes('NSSecureTextField')
-    && generatedSource.includes('stdinText: key + "\\n"');
+    && generatedSource.includes('stdinText: key + "\\n"')
+    && generatedSource.includes('final class McpManagerController')
+    && generatedSource.includes('add(menu, "Manage MCP Servers…", #selector(manageMcpServers))')
+    && generatedSource.includes('["menubar", "mcp", "list", "--json"]')
+    && generatedSource.includes('["menubar", "mcp", "add", "--stdin-json", "--json"]');
 const hasActionLogSource = generatedSource.includes('lastActionLogPath')
     && generatedSource.includes('.posixPermissions: 0o600')
     && generatedSource.includes('redactSecrets');
@@ -177,6 +181,7 @@ const expectedMenuItems = [
     'Update SKS Now',
     'Codex CLI Version',
     'Update Codex CLI Now',
+    'Manage MCP Servers',
     'Run sks doctor --fix',
     'View Last Log'
 ];

package/dist/scripts/super-search-provider-interface-check.js

@@ -6,22 +6,35 @@ import path from 'node:path';
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const mod = await importDist('core/super-search/index.js');
 const missionDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-super-search-'));
-const result = await mod.runSuperSearch({
-    missionDir,
-    query: 'npm package docs',
-    mode: 'balanced',
-    context7: async () => [{ title: 'npm docs', url: 'https://docs.npmjs.com', snippet: 'official docs' }],
-    codexWebSearch: async () => [{ title: 'npm registry', url: 'https://www.npmjs.com/package/npm', snippet: 'registry' }],
-    env: { SKS_CODEX_WEB_SEARCH_AVAILABLE: '1' }
-});
-assertGate(result.proof.provider_independent === true, 'Super-Search proof must be provider-independent', result.proof);
-assertGate(result.proof.xai_runtime_dependency === false, 'Super-Search must not require xAI runtime', result.proof);
-assertGate(result.sources.some((source) => source.acquisition_verdict === 'verified_content'), 'Super-Search must normalize verified source evidence', result.sources);
-assertGate(result.convergence.schema === 'sks.super-search-convergence.v1', 'Super-Search convergence artifact must be typed', result.convergence);
-emitGate('super-search:provider-interface', {
-    mode: result.mode,
-    sources: result.sources.length,
-    verified: result.proof.verified_source_count,
-    xai_runtime_dependency: result.proof.xai_runtime_dependency
-});
+const originalFetch = globalThis.fetch;
+globalThis.fetch = async (url) => new Response(`Verified provider-interface fixture content for ${url}. This body is long enough to prove hydrated source handling without relying on external network availability or a discovery snippet.`, { status: 200, headers: { 'content-type': 'text/plain' } });
+try {
+    const result = await mod.runSuperSearch({
+        missionDir,
+        query: 'Node.js package and npm registry docs',
+        mode: 'balanced',
+        context7: async () => [{
+                title: 'Node.js package documentation',
+                url: 'https://nodejs.org/api/packages.html',
+                snippet: 'official package docs',
+                content: 'Verified Context7 documentation content for Node.js package behavior. This materialized source is intentionally meaningful and independent from the npm registry source used by the web adapter.'
+            }],
+        codexWebSearch: async () => [{ title: 'npm registry', url: 'https://www.npmjs.com/package/npm', snippet: 'registry result' }],
+        env: { SKS_CODEX_WEB_SEARCH_AVAILABLE: '1' }
+    });
+    assertGate(result.proof.provider_independent === true, 'Super-Search proof must be provider-independent', result.proof);
+    assertGate(result.proof.xai_runtime_dependency === false, 'Super-Search must not require xAI runtime', result.proof);
+    assertGate(result.sources.some((source) => source.acquisition_verdict === 'verified_content'), 'Super-Search must normalize verified source evidence', result.sources);
+    assertGate(result.convergence.schema === 'sks.super-search-convergence.v1', 'Super-Search convergence artifact must be typed', result.convergence);
+    emitGate('super-search:provider-interface', {
+        mode: result.mode,
+        sources: result.sources.length,
+        verified: result.proof.verified_source_count,
+        xai_runtime_dependency: result.proof.xai_runtime_dependency
+    });
+}
+finally {
+    globalThis.fetch = originalFetch;
+    await fs.rm(missionDir, { recursive: true, force: true });
+}
 //# sourceMappingURL=super-search-provider-interface-check.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "6.1.2",
+  "version": "6.2.0",
   "description": "Proof-first Codex trust layer for bounded agent workflows, search visibility evidence, and release integrity gates.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -36,6 +36,8 @@
     "!dist/scripts/*blackbox*.js",
     "!dist/scripts/release-readiness-report.js",
     "!dist/scripts/readme-architecture-imagegen-official-check.js",
+    "!dist/scripts/codex-0139-feature-probes-check.js",
+    "!dist/scripts/codex-0139-marketplace-source-check.js",
     "!dist/scripts/gpt-image-2-real-file-smoke.js",
     "!dist/scripts/official-docs-compat-report.js",
     "!dist/scripts/codex-0-134-official-compat-report.js",

package/dist/scripts/codex-0139-feature-probes-check.js

@@ -1,30 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-0139-capability.js');
-process.env.SKS_CODEX_0139_FAKE = '1';
-process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.139.0';
-process.env.SKS_CODEX_0139_PROBE = '1';
-clearFailureEnv();
-const cap = await mod.detectCodex0139Capability({ codexBin: 'codex' });
-assertGate(cap.ok === true && cap.probe_mode === 'feature-probe', 'Codex 0.139 feature probe mode must pass fixture', cap);
-for (const [name, status] of Object.entries(cap.feature_probe_results || {})) {
-    assertGate(status === 'passed', `feature probe must pass: ${name}`, cap.feature_probe_results);
-}
-process.env.SKS_CODEX_0139_FAKE_RICH_SCHEMA_FAIL = '1';
-const failed = await mod.detectCodex0139Capability({ codexBin: 'codex' });
-assertGate(failed.ok === false && failed.blockers.includes('codex_rich_tool_schema_probe_failed'), 'rich schema probe failure must block capability', failed);
-clearFailureEnv();
-emitGate('codex:0139-feature-probes', { probe_mode: cap.probe_mode, probe_count: Object.keys(cap.feature_probe_results || {}).length });
-function clearFailureEnv() {
-    for (const key of [
-        'SKS_CODEX_0139_FAKE_MARKETPLACE_FAIL',
-        'SKS_CODEX_0139_FAKE_PROFILE_ALIAS_FAIL',
-        'SKS_CODEX_0139_FAKE_INTERRUPT_FAIL',
-        'SKS_CODEX_0139_FAKE_RICH_SCHEMA_FAIL',
-        'SKS_CODEX_0139_FAKE_DOCTOR_ENV_FAIL',
-        'SKS_CODEX_0139_FAKE_WEB_SEARCH_FAIL'
-    ])
-        delete process.env[key];
-}
-//# sourceMappingURL=codex-0139-feature-probes-check.js.map

package/dist/scripts/codex-0139-marketplace-source-check.js

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-// @ts-nocheck
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
-const mod = await importDist('core/codex-control/codex-0139-capability.js');
-assertGate(mod.marketplaceSourcesPresent(JSON.stringify([{ name: 'default', source: 'remote' }])) === true, 'array marketplace shape with source must pass');
-assertGate(mod.marketplaceSourcesPresent(JSON.stringify({ marketplaces: [{ name: 'default', source: 'remote' }] })) === true, 'marketplaces wrapper with source must pass');
-assertGate(mod.marketplaceSourcesPresent(JSON.stringify({ items: [{ name: 'default', source: 'remote' }] })) === true, 'items wrapper with source must pass');
-assertGate(mod.marketplaceSourcesPresent(JSON.stringify({ marketplaces: [{ name: 'default', root: '/tmp/codex-marketplace' }] })) === true, 'marketplaces wrapper with root locator must pass');
-assertGate(mod.marketplaceSourcesPresent(JSON.stringify([])) === true, 'empty marketplace list must not fail');
-assertGate(mod.marketplaceSourcesPresent('not-json') === false, 'non-json marketplace output must fail');
-assertGate(mod.marketplaceSourcesPresent(JSON.stringify([{ name: 'missing-source' }])) === false, 'non-empty rows must expose source locator');
-emitGate('codex:0139-marketplace-source');
-//# sourceMappingURL=codex-0139-marketplace-source-check.js.map