sneakoscope 6.1.2 → 6.2.0

package/dist/core/hooks-runtime.js

@@ -12,7 +12,6 @@ import { localizedFinalizationReason } from './language-preference.js';
 import { classifyToolError } from './evaluation.js';
 import { dollarCommand, routeRequiresSubagents, stripVisibleDecisionAnswerBlocks } from './routes.js';
 import { leanEngineeringCompactText } from './lean-engineering-policy.js';
-import { appendMissionStatus } from './recallpulse.js';
 import { scanAgentTextForRecursion } from './agents/agent-recursion-guard.js';
 import { evaluateLoopContinuation } from './loops/loop-continuation-enforcer.js';
 import { diagnosticPromptAllowedDuringNoQuestions } from './routes/diagnostic-allowlist.js';
@@ -22,6 +21,8 @@ import { codePackFreshnessNote } from './hooks-runtime/code-pack-freshness-prefl
 import { claimHookInvocation } from './hooks-runtime/hook-invocation-dedupe.js';
 import { joinSystemMessages, teamLiveDigest } from './hooks-runtime/team-digest.js';
 import { armLightTurnStopBypass, clearLightTurnStopBypass, consumeLightTurnStopBypass, hasMatchingLightTurnStopBypass } from './hooks-runtime/light-turn.js';
+import { evaluateHookNarutoDecisionGate, looksLikeActiveContinuationPrompt } from './hooks-runtime/naruto-decision-gate.js';
+import { finalizationRepeatDecision } from './hooks-runtime/stop-repeat-guard.js';
 import { classifyTaskProfile } from './runtime/task-profile.js';
 import { resolveSubagentThreadBudget } from './subagents/thread-budget.js';
 import { readOfficialSubagentConfig } from './subagents/official-subagent-config.js';
@@ -30,12 +31,8 @@ import { NARUTO_PARENT_EFFORT, NARUTO_PARENT_MODEL } from './subagents/model-pol
 import { officialSubagentRolePlan } from './subagents/agent-catalog.js';
 import { recordOfficialSubagentParentOutcomesTelemetry, recordOfficialSubagentZellijTelemetry } from './zellij/zellij-official-subagent-telemetry.js';
 import { bindTrustworthySubagentParentSummaryToRun, normalizeSubagentParentSummary, persistOrReuseTrustworthySubagentParentSummary, readSubagentEvents, recordSubagentEvent, SUBAGENT_EVIDENCE_FILENAME, SUBAGENT_PARENT_SUMMARY_FILENAME, writeSubagentEvidence } from './subagents/subagent-evidence.js';
-const STOP_REPEAT_GUARD_ARTIFACT = 'stop-hook-repeat-guard.json';
 const LIGHT_ROUTE_STOP_ARTIFACT = 'light-route-stop.json';
 const CODEX_GIT_ACTION_STOP_ARTIFACT = 'codex-git-action-stop-bypass.json';
-const STOP_REPEAT_GUARD_WINDOW_MS = 10 * 60 * 1000;
-const STOP_REPEAT_GUARD_MAX_ENTRIES = 25;
-const DEFAULT_STOP_REPEAT_GUARD_LIMIT = 2;
 const CODEX_GIT_ACTION_STOP_TTL_MS = 15 * 60 * 1000;
 const UPDATE_CHECK_HOOK_INVOCATION_POLICY = 'function-only:no-runSksUpdateCheck-call-in-hooks';
 // Update checks stay function-only in hooks: the policy marker above is checked
@@ -100,22 +97,32 @@ export async function evaluateHookPayload(name, payload = {}, opts = {}) {
     const loadedState = opts.state || await loadState(root, payload);
     const state = { ...loadedState, _session_key: loadedState?._session_key || sessionKey };
     const noQuestion = isNoQuestionRunning(state);
+    const sksNarutoDecision = await evaluateHookNarutoDecisionGate({
+        root,
+        name,
+        payload,
+        state,
+        sessionKey,
+        noQuestion,
+        parentLaunchMissionId: activeNarutoParentLaunchMissionId()
+    });
+    const withNarutoDecision = (result) => ({ ...result, sksNarutoDecision });
     if (name === 'user-prompt-submit') {
-        return hookUserPrompt(root, state, payload, noQuestion, sessionKey);
+        return withNarutoDecision(await hookUserPrompt(root, state, payload, noQuestion, sessionKey));
     }
     if (name === 'pre-tool')
-        return hookPreTool(root, state, payload, noQuestion, sessionKey);
+        return withNarutoDecision(await hookPreTool(root, state, payload, noQuestion, sessionKey));
     if (name === 'post-tool')
-        return hookPostTool(root, state, payload, noQuestion, sessionKey);
+        return withNarutoDecision(await hookPostTool(root, state, payload, noQuestion, sessionKey));
     if (name === 'permission-request')
-        return hookPermission(root, state, payload, noQuestion, sessionKey);
+        return withNarutoDecision(await hookPermission(root, state, payload, noQuestion, sessionKey));
     if (name === 'stop')
-        return hookStop(root, state, payload, noQuestion, sessionKey);
+        return withNarutoDecision(await hookStop(root, state, payload, noQuestion, sessionKey));
     if (name === 'subagent-start')
-        return hookSubagentStart(root, state, payload, sessionKey);
+        return withNarutoDecision(await hookSubagentStart(root, state, payload, sessionKey));
     if (name === 'subagent-stop')
-        return hookSubagentStop(root, state, payload, sessionKey);
-    return { continue: true };
+        return withNarutoDecision(await hookSubagentStop(root, state, payload, sessionKey));
+    return withNarutoDecision({ continue: true });
 }
 async function hookSubagentStart(root, state, payload = {}, sessionKey = null) {
     const artifactDir = officialSubagentArtifactDir(root, state, sessionKey);
@@ -166,6 +173,16 @@ async function recordAndRefreshSubagentEvidence(root, artifactDir, state, payloa
     }, async () => {
         const plan = await readJson(path.join(artifactDir, 'subagent-plan.json'), {});
         const workflowRunId = String(plan?.workflow_run_id || state?.official_subagent_run_id || '').trim();
+        const terminalGate = plan?.workflow === 'official_codex_subagent'
+            ? await readJson(path.join(artifactDir, 'naruto-gate.json'), null).catch(() => null)
+            : null;
+        const terminalRunId = String(terminalGate?.workflow_run_id || '').trim();
+        if (workflowRunId
+            && terminalRunId === workflowRunId
+            && terminalGate?.passed === true
+            && terminalGate?.terminal === true) {
+            return null;
+        }
         const eventPayload = workflowRunId && payload && typeof payload === 'object' && !Array.isArray(payload)
             ? { ...payload, workflow_run_id: workflowRunId }
             : payload;
@@ -249,9 +266,7 @@ async function hookUserPrompt(root, state, payload, noQuestion, sessionKey = nul
             })
         };
     }
-    const parentLaunchMissionId = process.env.SKS_NARUTO_PARENT_LAUNCH === '1'
-        ? String(process.env.SKS_NARUTO_PARENT_MISSION_ID || '').trim()
-        : '';
+    const parentLaunchMissionId = activeNarutoParentLaunchMissionId();
     if (parentLaunchMissionId) {
         const attachedState = {
             ...state,
@@ -414,15 +429,6 @@ function shouldPrepareFreshRouteOnActivePrompt(prompt, route = null, opts = {})
         return false;
     return routeRequiresSubagents(route, prompt);
 }
-function looksLikeActiveContinuationPrompt(prompt = '') {
-    const text = stripVisibleDecisionAnswerBlocks(String(prompt || ''))
-        .trim()
-        .replace(/[.!?。！？…,:;]+$/u, '')
-        .trim();
-    if (!text)
-        return false;
-    return /^(?:(?:please\s+)?(?:keep\s+going|continue|resume|go\s+on|proceed|carry\s+on)(?:\s+please)?|계속(?:\s*진행)?(?:\s*해\s*줘|\s*해주세요|\s*해)?|이어\s*서(?:\s*해\s*줘|\s*해주세요|\s*진행해)?|이어서(?:\s*해\s*줘|\s*해주세요|\s*진행해)?|진행(?:\s*해\s*줘|\s*해주세요|\s*해)?|마저\s*해(?:\s*줘|\s*주세요)?|다음|next)$/i.test(text);
-}
 function isClarificationAwaiting(state = {}) {
     const phase = String(state.phase || '');
     const stopGate = String(state.stop_gate || '');
@@ -435,6 +441,11 @@ function isClarificationAwaiting(state = {}) {
         return false;
     return Boolean(state.clarification_required || state.implementation_allowed === false);
 }
+function activeNarutoParentLaunchMissionId() {
+    return process.env.SKS_NARUTO_PARENT_LAUNCH === '1'
+        ? String(process.env.SKS_NARUTO_PARENT_MISSION_ID || '').trim()
+        : '';
+}
 function isBlockingClarificationAwaiting(state = {}) {
     return isClarificationAwaiting(state);
 }
@@ -999,86 +1010,6 @@ async function consumeCodexGitActionStopBypass(root, payload = {}) {
     }).catch(() => null);
     return true;
 }
-async function finalizationRepeatDecision(root, state = {}, payload = {}, reason = '', kind = 'finalization') {
-    const now = nowIso();
-    const guardPath = path.join(root, '.sneakoscope', 'state', STOP_REPEAT_GUARD_ARTIFACT);
-    const previous = await readJson(guardPath, {}).catch(() => ({}));
-    const limit = stopRepeatGuardLimit();
-    const entries = pruneStopRepeatEntries(previous.entries || {}, now);
-    const key = stopRepeatKey(state, payload, reason, kind);
-    const prior = entries[key] || {};
-    const repeatCount = stopRepeatInWindow(prior, now)
-        ? Number(prior.repeat_count || 0) + 1
-        : 1;
-    const record = {
-        schema_version: 1,
-        updated_at: now,
-        window_ms: STOP_REPEAT_GUARD_WINDOW_MS,
-        limit,
-        entries: {
-            ...entries,
-            [key]: {
-                kind,
-                route: state.route_command || state.route || state.mode || null,
-                mission_id: state.mission_id || null,
-                conversation_id: conversationId(payload),
-                first_seen: stopRepeatInWindow(prior, now) ? (prior.first_seen || now) : now,
-                last_seen: now,
-                repeat_count: repeatCount,
-                tripped: repeatCount >= limit,
-                reason
-            }
-        }
-    };
-    await writeJsonAtomic(guardPath, record).catch(() => null);
-    if (state.mission_id) {
-        await appendMissionStatus(root, state.mission_id, {
-            category: repeatCount >= limit ? 'warning' : 'blocker',
-            audience: ['user', 'route', 'final-summary'],
-            stage_id: 'before_final',
-            message: repeatCount >= limit
-                ? `Repeated ${kind} stop prompt was suppressed; route completion is still unclaimed until evidence passes.`
-                : reason,
-            dedupe_key: key,
-            evidence: [STOP_REPEAT_GUARD_ARTIFACT]
-        }).catch(() => null);
-    }
-    if (repeatCount < limit)
-        return null;
-    return {
-        continue: true,
-        systemMessage: `SKS stop hook repeat guard suppressed repeated ${kind} prompt after ${repeatCount} identical block(s). No completion success is claimed by the hook.`
-    };
-}
-function stopRepeatKey(state = {}, payload = {}, reason = '', kind = '') {
-    return sha256(JSON.stringify({
-        kind,
-        reason,
-        conversation_id: conversationId(payload),
-        mission_id: state.mission_id || null,
-        route: state.route_command || state.route || state.mode || null,
-        gate: state.stop_gate || null
-    })).slice(0, 24);
-}
-function stopRepeatGuardLimit() {
-    const raw = Number.parseInt(process.env.SKS_STOP_REPEAT_GUARD_LIMIT || '', 10);
-    if (!Number.isFinite(raw))
-        return DEFAULT_STOP_REPEAT_GUARD_LIMIT;
-    return Math.max(1, Math.min(20, raw));
-}
-function stopRepeatInWindow(entry = {}, now = nowIso()) {
-    const last = Date.parse(entry.last_seen || '');
-    const current = Date.parse(now);
-    if (!Number.isFinite(last) || !Number.isFinite(current))
-        return false;
-    return current - last <= STOP_REPEAT_GUARD_WINDOW_MS;
-}
-function pruneStopRepeatEntries(entries = {}, now = nowIso()) {
-    return Object.fromEntries(Object.entries(entries)
-        .filter(([, entry]) => stopRepeatInWindow(entry, now))
-        .sort((a, b) => Date.parse(b[1]?.last_seen || '') - Date.parse(a[1]?.last_seen || ''))
-        .slice(0, STOP_REPEAT_GUARD_MAX_ENTRIES));
-}
 function hasHonestMode(text) {
     const s = String(text || '');
     return /(SKS Honest Mode|솔직모드|Honest Mode)/i.test(s)

package/dist/core/init/skills.js

@@ -34,7 +34,7 @@ async function installOfficialSkills(root) {
         'sks': `---\nname: sks\ndescription: General Sneakoscope Codex command route for $SKS or $sks usage, setup, status, and workflow help.\n---\n\nUse local SKS commands: bootstrap, deps, commands, quickstart, codex-app, context7, guard, conflicts, reasoning, wiki, pipeline status, pipeline plan, skill-dream. Promote code-changing work to Team unless Answer/DFix/Help/Wiki/safety route fits. Surface route/guard/scope, use TriWiki, do not edit installed harness files outside this engine repo, and require human-approved conflict cleanup. ${skillDreamPolicyText()}\n`,
         'plan': `---\nname: plan\ndescription: Plan scaffold only - writes a fixed-template .sneakoscope/plans/<slug>.md, never touches code. Not project-specific decision-complete planning. 예: $Plan "결제 모듈 리팩터"\n---\n\nUse when the user invokes $Plan or asks for a plan-only frontdoor. Produce a concrete plan artifact under .sneakoscope/plans/<slug>.md with goal, scope, files to inspect, implementation steps, acceptance checks, and rollback notes. Do not edit product/source files, generated harness files, package metadata, or docs beyond the plan artifact. Keep implementation_allowed=false and hand off execution to $Work only after the user or route explicitly moves from planning to work. Finish with what is planned, what remains unimplemented, and Honest Mode.\n`,
         'work': `---\nname: work\ndescription: Execute the latest plan with evidence-gated completion. 예: $Work\n---\n\nUse when the user invokes $Work or asks to execute the latest SKS plan. Resolve the newest .sneakoscope/plans/*.md, route execution through Naruto/Team evidence gates, keep leases and verification artifacts current, and do not claim completion without machine evidence or explicit blocker evidence. If no plan exists, block with a clear next action: run $Plan first or provide a task.\n`,
-        'swarm': `---\nname: swarm\ndescription: Deprecated $Swarm compatibility alias for the $Naruto Codex official subagent workflow.\n---\n\nWarn once that $Swarm is a deprecated alias, then follow the naruto skill. Use Codex official subagents and agent threads through \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. The parent runs on GPT-5.6 Sol Max, clear bounded worker slices use GPT-5.6 Luna Max, and reasoning-sensitive expert slices use GPT-5.6 Sol Max. Wait for all requested subagents and keep write slices disjoint. SubagentStart/SubagentStop prove lifecycle only; completion requires subagent-parent-summary.json with one structured parent outcome per thread. Canonical artifacts are subagent-plan.json, subagent-events.jsonl, subagent-parent-summary.json, subagent-evidence.json, naruto-summary.json, and naruto-gate.json. Finish with scoped verification, reflection when required, and Honest Mode.\n`,
+        'swarm': `---\nname: swarm\ndescription: Deprecated $Swarm compatibility alias for the $Naruto Codex official subagent workflow.\n---\n\nWarn once that $Swarm is a deprecated alias, then follow the naruto skill. Use Codex official subagents and agent threads through \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. The parent runs on GPT-5.6 Sol Max. Luna Max is only for tiny short-context mechanical slices; ordinary implementation uses Sol High; review/debug/planning/security and other judgment uses Sol Max; long-context and Computer Use, Browser/Chrome, or image-generation execution uses Terra Medium. Split execution from judgment where possible, with Sol Max winning unsplittable conflicts. Wait for all requested subagents and keep write slices disjoint. SubagentStart/SubagentStop prove lifecycle only; completion requires subagent-parent-summary.json with one structured parent outcome per thread. Canonical artifacts are subagent-plan.json, subagent-events.jsonl, subagent-parent-summary.json, subagent-evidence.json, naruto-summary.json, and naruto-gate.json. Finish with scoped verification, reflection when required, and Honest Mode.\n`,
         'review': `---\nname: review\ndescription: Parallel diff review with machine-evidence first findings. 예: $Review 또는 sks review --staged\n---\n\nUse when the user asks for $Review or sks review. Review the selected diff read-only unless --fix is explicitly supplied. Machine evidence such as TypeScript, lint, tests, conflict markers, or secret scans outranks LLM findings and must be tagged evidence: machine; judgment-only findings must be tagged evidence: llm. --fix may attempt at most one machine-evidence fix pass and must re-run verification once. Do not mutate code for LLM-only opinions.\n`,
         'fast-mode': `---\nname: fast-mode\ndescription: Dollar-command route for $Fast-Mode, $Fast-On, and $Fast-Off global Codex Desktop Fast mode toggles.\n---\n\nUse when the user invokes $Fast-Mode, $Fast-On, $Fast-Off, or asks to turn SKS Fast mode on/off. Prefer \`sks fast-mode on|off|status|clear --json\`. By default on/off updates the global Codex Desktop config so GPT 5.5 Fast persists and also keeps .sneakoscope/state/fast-mode.json in sync for SKS workers. Use \`--project\` only when the user explicitly wants project-local worker preference without touching global Codex config. Explicit runtime flags still win: \`--fast\`, \`--no-fast\`, and \`--service-tier standard|fast\` override the saved preference for that run. Finish with a short status and Honest Mode; do not start Team or broad implementation for a toggle-only request.\n`,
         'fast-on': `---\nname: fast-on\ndescription: Alias for $Fast-On global Codex Desktop GPT 5.5 Fast enablement.\n---\n\nUse the same rules as fast-mode. Run or instruct \`sks fast-mode on --json\`, then report Global (desktop), Project (sks workers), state file, and the fact that explicit per-run flags still override the saved preference.\n`,
@@ -42,10 +42,10 @@ async function installOfficialSkills(root) {
         'with-local-llm-on': `---\nname: with-local-llm-on\ndescription: Dollar-command route for $with-local-llm-on local Ollama worker enablement.\n---\n\nUse when the user invokes $with-local-llm-on or asks to enable the optional local Ollama worker backend. Prefer \`sks with-local-llm on --json\`. The command writes the machine-local config at \`~/.sneakoscope/local-model.json\`. Default off means SKS stays GPT-only until this command enables local workers. Enabled mode only lets policy-eligible simple code patch-envelope or read-only collection worker slices use Ollama; GPT/Codex still owns strategy, planning, design, review, verification, safety, and integration. \`--no-ollama\` and \`SKS_OLLAMA_WORKERS=0\` still force local workers off for a run. Finish with a short status and Honest Mode; do not start Team for a toggle-only request.\n`,
         'with-local-llm-off': `---\nname: with-local-llm-off\ndescription: Dollar-command route for $with-local-llm-off local Ollama worker disablement.\n---\n\nUse when the user invokes $with-local-llm-off or asks to disable the optional local Ollama worker backend. Prefer \`sks with-local-llm off --json\`. The command writes the machine-local config at \`~/.sneakoscope/local-model.json\`. Disabled mode keeps SKS GPT-only by default. Strategy, planning, design, review, verification, safety, and integration remain GPT/Codex-owned regardless of this toggle. Finish with a short status and Honest Mode; do not start Team for a toggle-only request.\n`,
         'wiki': `---\nname: wiki\ndescription: Dollar-command route for $Wiki TriWiki refresh, pack, validate, and prune commands.\n---\n\nUse for $Wiki or Korean wiki-refresh requests. Refresh/update/갱신: run sks wiki refresh, then validate .sneakoscope/wiki/context-pack.json. Pack: run sks wiki pack, then validate. Prune/clean/정리: use sks wiki refresh --prune, or sks wiki prune --dry-run for inspection. Report claims, anchors, trust, attention.use_first/hydrate_first, validation, and blockers. Do not start ambiguity-gated implementation, subagents, or unrelated work.\n`,
-        'team': `---\nname: team\ndescription: Deprecated $Team compatibility alias; new execution missions use the $Naruto Codex official subagent workflow.\n---\n\nWarn once that $Team and \`sks team "<task>"\` are deprecated for new execution, then redirect implementation to \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. Only legacy \`sks team log|tail|watch|lane|status\` remains, and it is strictly read-only observability for old missions. New work uses a GPT-5.6 Sol Max parent, Luna Max worker agents for clear bounded slices, Sol Max expert agents for judgment work, lifecycle-only SubagentStart/SubagentStop evidence, and a durable subagent-parent-summary.json containing one structured outcome per thread. Follow the canonical six-artifact Naruto contract. ${leanEngineeringCompactText()} ${outcomeRubricPolicyText()} ${speedLanePolicyText()} ${solutionScoutPolicyText('fix this broken behavior')} ${skillDreamPolicyText()}\n`,
+        'team': `---\nname: team\ndescription: Deprecated $Team compatibility alias; new execution missions use the $Naruto Codex official subagent workflow.\n---\n\nWarn once that $Team and \`sks team "<task>"\` are deprecated for new execution, then redirect implementation to \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. Only legacy \`sks team log|tail|watch|lane|status\` remains, and it is strictly read-only observability for old missions. New work uses a GPT-5.6 Sol Max parent and the fixed four-profile policy: Luna Max for tiny short-context mechanical work, Sol High for ordinary implementation, Sol Max for judgment-heavy work, and Terra Medium for long-context or Computer Use, Browser/Chrome, and image-generation execution. Split mixed execution/judgment slices when possible and prefer Sol Max when they cannot be separated. SubagentStart/SubagentStop are lifecycle-only evidence, and completion requires a durable subagent-parent-summary.json containing one structured outcome per thread. Follow the canonical six-artifact Naruto contract. ${leanEngineeringCompactText()} ${outcomeRubricPolicyText()} ${speedLanePolicyText()} ${solutionScoutPolicyText('fix this broken behavior')} ${skillDreamPolicyText()}\n`,
         'from-chat-img': `---\nname: from-chat-img\ndescription: Explicit $From-Chat-IMG Naruto add-on gate for chat screenshot plus attachment analysis.\n---\n\nUse only for From-Chat-IMG/$From-Chat-IMG. It enters the Naruto pipeline with from_chat_img_required=true and an add-on coverage gate, not the legacy Team pipeline. Treat uploads as chat screenshot plus originals. For web/browser/webapp targets use Codex Chrome Extension first; for native Mac/non-web app surfaces use Codex Computer Use visual inspection when available. List requirements first, match regions to attachments with confidence, write ${FROM_CHAT_IMG_COVERAGE_ARTIFACT}, ${FROM_CHAT_IMG_CHECKLIST_ARTIFACT}, ${FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT}, and ${FROM_CHAT_IMG_QA_LOOP_ARTIFACT}, then continue Naruto worker proof, review, reflection, and Honest Mode. ${CODEX_WEB_VERIFICATION_POLICY} ${CODEX_COMPUTER_USE_ONLY_POLICY} The ledger must account for every visible customer request, screenshot image region, and separate attachment; ${FROM_CHAT_IMG_CHECKLIST_ARTIFACT} must have a checked item for each request, image-region/attachment match, work item, scoped QA-LOOP, and verification step; ${FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT} stores temporary TriWiki-backed session context with expires_after_sessions=${FROM_CHAT_IMG_TEMP_TRIWIKI_SESSIONS}. ${FROM_CHAT_IMG_QA_LOOP_ARTIFACT} must prove QA-LOOP ran over the exact customer-request work-order range after implementation, with every work item covered, post-fix verification complete, and zero unresolved findings. naruto-gate.json cannot pass From-Chat-IMG completion until from_chat_img_request_coverage=true, unresolved_items is empty, every checklist box is checked, and scoped_qa_loop_completed=true.\n`,
-        'shadow-clone': `---\nname: shadow-clone\ndescription: Deprecated $ShadowClone compatibility alias for the $Naruto Codex official subagent workflow.\n---\n\nEmit one deprecation warning, translate the request to $Naruto, and use \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. Do not describe the new default as clones, a process swarm, or a native kernel. Follow the naruto skill's Sol Max parent, Luna Max worker, Sol Max expert, lifecycle-only event evidence, structured subagent-parent-summary.json, max_depth=1, canonical six-artifact contract, scoped verification, reflection, and Honest Mode rules.\n`,
-        'kage-bunshin': `---\nname: kage-bunshin\ndescription: Deprecated $Kagebunshin compatibility alias for the $Naruto Codex official subagent workflow.\n---\n\nEmit one deprecation warning, translate the request to $Naruto, and use \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. Legacy 影分身 terminology is compatibility-only and must not define the new runtime. Follow the naruto skill's Sol Max parent, Luna Max worker, Sol Max expert, lifecycle-only event evidence, structured subagent-parent-summary.json, max_depth=1, canonical six-artifact contract, scoped verification, reflection, and Honest Mode rules.\n`,
+        'shadow-clone': `---\nname: shadow-clone\ndescription: Deprecated $ShadowClone compatibility alias for the $Naruto Codex official subagent workflow.\n---\n\nEmit one deprecation warning, translate the request to $Naruto, and use \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. Do not describe the new default as clones, a process swarm, or a native kernel. Follow the naruto skill's Sol Max parent and four-profile child policy: Luna Max mechanical, Sol High implementation, Sol Max judgment, Terra Medium long-context/tool execution. Preserve lifecycle-only event evidence, structured subagent-parent-summary.json, max_depth=1, the canonical six-artifact contract, scoped verification, reflection, and Honest Mode rules.\n`,
+        'kage-bunshin': `---\nname: kage-bunshin\ndescription: Deprecated $Kagebunshin compatibility alias for the $Naruto Codex official subagent workflow.\n---\n\nEmit one deprecation warning, translate the request to $Naruto, and use \`sks naruto run "<task>" [--agents N] [--max-threads N] [--json]\`. Legacy 影分身 terminology is compatibility-only and must not define the new runtime. Follow the naruto skill's Sol Max parent and four-profile child policy: Luna Max mechanical, Sol High implementation, Sol Max judgment, Terra Medium long-context/tool execution. Preserve lifecycle-only event evidence, structured subagent-parent-summary.json, max_depth=1, the canonical six-artifact contract, scoped verification, reflection, and Honest Mode rules.\n`,
         'qa-loop': `---\nname: qa-loop\ndescription: $QA-LOOP dogfoods UI/API as human proxy with safety gates, Codex Chrome Extension-first web UI evidence, safe fixes, rechecks, and a QA report.\n---\n\nUse only $QA-LOOP. Infer scope, target, mutation policy, and login boundary from the prompt plus TriWiki/current-code defaults; do not surface a prequestion sheet. Credentials are runtime-only; never save secrets. Web/browser/webapp UI-level E2E must run the Codex Chrome Extension readiness gate first; if the extension is missing or disabled, rapidly halt and ask the user to set it up, then resume only after the user confirms installation is complete. Codex Computer Use is reserved for native Mac/non-web surfaces and must not satisfy web UI evidence. Playwright, Selenium, Puppeteer, Browser Use, Chrome MCP, screenshots fabricated from code, and prose-only checks do not satisfy web UI/browser verification. ${CODEX_WEB_VERIFICATION_POLICY} Deployed targets are read-only; destructive removal is forbidden. After answer/run, dogfood real flows, apply safe contract-allowed code/test/docs fixes, recheck, and do not pass qa-gate.json with unresolved findings or without post_fix_verification_complete. Finish qa-ledger, date/version report, gate, completion summary, and Honest Mode.\n`,
         'ppt': `---\nname: ppt\ndescription: $PPT information-first HTML/PDF presentation pipeline with inferred STP, audience, pain-point, format, research, design-system, and verification contract.\n---\n\nUse only when the user invokes $PPT or asks to create a presentation, deck, slides, pitch deck, proposal deck, HTML presentation, or PDF presentation artifact. Before artifact work, auto-seal presentation-specific answers from prompt, TriWiki/current-code defaults, and conservative policy: delivery context, target audience profile including role/average age/job/industry/topic familiarity/decision power, STP strategy, decision context and objections, and 3+ pain-point to solution mappings with expected aha moments. Do not surface a prequestion sheet. Presentation design must be simple, restrained, and information-first: avoid over-designed decoration, ornamental gradients, nested cards, and effects that compete with the message. Design detail should be embedded through typography hierarchy, spacing, alignment, thin rules, source clarity, and subtle accents. ${pptPipelineAllowlistPolicyText()} Use Product Design plugin first for context, ideation, prototype direction, audit, design QA, and share handoff. Use design.md only as an existing project-local cache or fallback SSOT when Product Design is unavailable; if fallback creation is needed, use docs/Design-Sys-Prompt.md plus getdesign-reference and curated DESIGN.md examples from ${AWESOME_DESIGN_MD_REFERENCE.url} only as source inputs, then fuse them into route-local PPT style tokens with a recorded design_ssot instead of treating references as parallel authorities. The $PPT route always loads imagegen as a required skill, checks Codex App imagegen at route start, and runs SKS auto-repair once before any image-dependent build/review work. If repair fails, stop with codex_imagegen_unavailable and do not continue with image-free or API-substituted evidence. When the sealed contract needs a generated raster asset or generated slide visual critique, immediately invoke Codex App \`$imagegen\` with gpt-image-2, move/copy the selected output into the mission assets or review evidence path, and record the real file path in ppt-image-asset-ledger.json or ppt-review-ledger.json before building or passing the gate. Direct API fallback, placeholder files, HTML/CSS stand-ins, and prose-only substitutes do not satisfy the route gate. ${productDesignPluginPolicyText()} ${CODEX_IMAGEGEN_REQUIRED_POLICY} Use web or Context7 evidence only when external facts/libraries/current docs are required by the PPT contract, record verified claims in ppt-fact-ledger.json, record generated image asset plans/results/blockers in ppt-image-asset-ledger.json, then create the PDF plus editable source HTML under source-html/, keep independent strategy/render/file-write phases parallel where inputs allow, record ppt-parallel-report.json, run the bounded ppt-review-policy/ppt-review-ledger/ppt-iteration-report loop, and verify readability, overlap, format fit, source coverage, export state, unsupported-claim status, image-asset completion, review-loop termination, and temporary build files cleanup. Finish with reflection and Honest Mode.\n`,
         'computer-use-fast': `---\nname: computer-use-fast\ndescription: Alias for the maximum-speed $Computer-Use/$CU native Codex Computer Use lane.\n---\n\nUse the same rules as computer-use: skip Team debate, QA-LOOP clarification, upfront TriWiki refresh, Context7, subagents, and reflection unless explicitly requested. Use Codex Computer Use directly only for native macOS, desktop-app, OS-settings, or non-web visual tasks. Browser, localhost, website, webapp, and web-based app verification must use the Codex Chrome Extension path first and must halt if that extension is not installed/enabled. At the end only, refresh/pack TriWiki, validate it, then provide a concise completion summary plus Honest Mode. ${CODEX_WEB_VERIFICATION_POLICY} ${CODEX_COMPUTER_USE_ONLY_POLICY}\n`,

package/dist/core/init.js

@@ -234,7 +234,7 @@ function isSksManagedHook(hook) {
 const AGENTS_BLOCK = "\n# Sneakoscope Codex Managed Rules\n\nThis repository uses Sneakoscope Codex.\n\n## Core Rules\n\n- Codex native `/goal` workflows are the persisted continuation surface; Ralph is removed from the user-facing SKS surface.\n- Keep runtime state bounded: raw logs go to files, prompts get tails/summaries, and `sks gc` may prune stale artifacts.\n- Codex App hooks, launch paths, and `sks doctor --fix` do not force SKS update prompts during ordinary work. Manual CLI update surfaces (`sks update-check`, `sks update check`, and `sks update now`) remain available when the operator explicitly asks for them.\n- Versioning is explicit: use `sks versioning bump` when preparing release metadata. SKS must not install Git pre-commit hooks.\n- Installed harness files are immutable to LLM edits: `.codex/*`, `.agents/skills/`, `.codex/agents/`, `.sneakoscope/*policy*.json`, `AGENTS.md`, and `node_modules/sneakoscope`. The Sneakoscope engine source repo is the only automatic exception.\n- OMX/DCodex conflicts block setup/doctor. Show `sks conflicts prompt`; cleanup requires explicit human approval.\n- Do not stop at a plan when implementation was requested. Finish, verify, or report the hard blocker.\n- Do not create unrequested fallback implementation code. If the requested path is impossible, block with evidence instead of inventing substitute behavior.\n\n## Routes\n\n- General execution/code-changing prompts default to `$Team`: native agent intake agents, TriWiki refresh/validate, read-only debate, consensus, concrete runtime task graph/inboxes, fresh executor team, minimum five-lane Team review, integration, Honest Mode.\n- `$Computer-Use` / `$CU` is the maximum-speed Codex Computer Use lane for native macOS, desktop-app, OS-settings, and non-web visual tasks only. Web, browser, localhost, website, webapp, and web-based app verification must use the Codex Chrome Extension path first and halt rapidly if the extension is not installed/enabled.\n- `$Goal` is a fast bridge/overlay for Codex native `/goal` create/pause/resume/clear persistence controls; implementation continues through the selected SKS execution route.\n- TriWiki recall must stay bounded. Use `sks wiki sweep` to record demote, soft-forget, archive, delete, promote-to-skill, and promote-to-rule candidates instead of injecting every old claim.\n- Team missions must keep schema-backed evidence current: `work-order-ledger.json`, `effort-decision.json`, `team-dashboard-state.json`, and route-specific visual/dogfood artifacts where applicable. Team completion requires at least five independent reviewer/QA validation lanes before integration or final, even when a prompt requests fewer reviewers. Use `sks validate-artifacts latest` before claiming those artifacts pass.\n- `$DFix` is Direct Fix: only tiny copy/config/docs/labels/spacing/translation/simple mechanical edits, bypassing the main pipeline, Team, TriWiki/TriFix/reflection recording, and persistent route state; it still uses a one-line DFix-specific Honest check before final. Broad implementation stays on `$Team`, while UI design specifics follow the relevant design/UI route rules. `$PPT` is the restrained, information-first HTML/PDF presentation route and must seal delivery context, audience profile, STP, decision context, and 3+ pain-point/solution/aha mappings before design/render work. It must avoid over-designed visuals, carry detail through hierarchy, spacing, alignment, thin rules, source clarity, and subtle accents, preserve editable source HTML under `source-html/`, record `ppt-parallel-report.json`, and clean PPT-only temporary build files before completion. `$Image-UX-Review` / `$UX-Review` is the imagegen/gpt-image-2 UI/UX review route: source screenshots must become generated annotated review images, those generated images must be extracted into issue ledgers, and text-only critique cannot pass the route gate. `$Answer`, `$Help`, and `$Wiki` stay lightweight.\n- For code work, surface route/guard/write scopes first, split independent worker scopes when available, and keep parent-owned integration and verification.\n- Design work reads `design.md` as the only design decision SSOT. If missing, create it through `design-system-builder` from `docs/Design-Sys-Prompt.md`; getdesign.md, getdesign-reference, and curated DESIGN.md examples from https://github.com/VoltAgent/awesome-design-md are source inputs to fuse into that SSOT or route-local style tokens, not parallel design authorities. Image/logo/raster assets use `imagegen`, which must prefer official Codex App built-in image generation via `$imagegen` / `gpt-image-2`; for newest-model image requests prompt explicitly for ChatGPT Images 2.0 / GPT Image 2.0 with `gpt-image-2`. Do not replace required raster evidence with placeholder SVG/HTML/CSS, prose-only reviews, or fabricated files.\n- Research, AutoResearch, performance, token, accuracy, SEO/GEO, or workflow-improvement claims need experiment/eval evidence. Do not claim live model accuracy without a scored dataset.\n- Treat handwritten files above 3000 lines as split-review risks. Run `sks code-structure scan` and prefer extraction before adding substantial logic.\n- Skill dreaming stays lightweight: route use records JSON counters in `.sneakoscope/skills/dream-state.json`, and full skill inventory/recommendation runs only after the configured 10-route-event threshold and cooldown. Reports are recommendation-only; deleting or merging skills needs explicit user approval.\n\n## Evidence And Context\n\n- Context7 is required for external libraries, APIs, MCPs, package managers, SDKs, and generated docs: resolve-library-id then query-docs.\n- When tech stack, framework, package, runtime, or deployment-platform versions change, use Context7 or official vendor web docs, record current syntax/security/limit guidance as high-priority TriWiki claims, then refresh and validate before coding.\n- TriWiki is the context-tracking SSOT for long-running missions, Team handoffs, and context-pressure recovery. Read `.sneakoscope/wiki/context-pack.json` before each stage, use `attention.use_first` for compact high-trust recall, hydrate `attention.hydrate_first` from source before risky or lower-trust decisions, refresh after findings or artifact changes, and validate before handoffs/final claims.\n- Source priority: current code/tests/config, decision contract, vgraph, beta, GX render/snapshot metadata, LLM Wiki coordinate index, then model knowledge only if allowed.\n- Final response before stop: summarize what was done, what changed for the user/repo, what was verified, and what remains unverified or blocked; then run Honest Mode. Say what passed and what was not verified.\n- `$From-Chat-IMG` uses forensic visual effort, not ordinary Team effort. Completion is blocked until source inventory, visual mapping, work-order coverage, scoped dogfood/QA, and post-fix verification artifacts are present and valid.\n\n## Safety\n\n- Database access is high risk. Use read-only inspection by default; live data mutation is out of scope unless a sealed contract allows local or branch-only migration files.\n- MAD and MAD-SKS widen only explicit scoped permissions; they still do not authorize unrequested fallback implementation code.\n- Task completion requires relevant tests or justification, zero unsupported critical claims, accepted visual/wiki drift, and final evidence.\n\n## Codex App\n\nUse `.codex/SNEAKOSCOPE.md`, generated `.agents/skills`, `.codex/hooks.json`, and SKS dollar commands (`$sks`, `$team`, `$computer-use`, `$cu`, `$ppt`, `$image-ux-review`, `$ux-review`, `$goal`, `$dfix`, `$qa-loop`, etc.) as the app control surface.\n";
 function agentsBlockText() {
     return AGENTS_BLOCK
-        .replace('General execution/code-changing prompts default to `$Team`: native agent intake agents, TriWiki refresh/validate, read-only debate, consensus, concrete runtime task graph/inboxes, fresh executor team, minimum five-lane Team review, integration, Honest Mode.', 'General execution/code-changing prompts default to `$Team`, a compatibility alias for the `$Naruto` Codex official subagent workflow: parent-owned decomposition, project-scoped custom agents, disjoint write scopes, bounded TriWiki use, one child by default, risk-scoped expansion to at most three automatic children, parent integration, and Honest Mode.')
+        .replace('General execution/code-changing prompts default to `$Team`: native agent intake agents, TriWiki refresh/validate, read-only debate, consensus, concrete runtime task graph/inboxes, fresh executor team, minimum five-lane Team review, integration, Honest Mode.', 'General execution/code-changing prompts default to `$Team`, a compatibility alias for the `$Naruto` Codex official subagent workflow: parent-owned decomposition, project-scoped custom agents, disjoint write scopes, bounded query-aware TriWiki use, two independent children for non-trivial work, risk-scoped expansion to at most three automatic children, parent integration, and Honest Mode.\n- Official subagent model routing is fixed: Luna Max only for tiny short-context mechanical work; Sol High for ordinary UI/logic/backend/native implementation; Sol Max for review, debugging, planning, architecture, security, database, research, release, ambiguity, and judgment; Terra Medium for long-context analysis and direct Computer Use, Browser/Chrome, or image-generation execution. Split mixed execution and judgment when possible; otherwise Sol Max wins.')
         .replace('Team missions must keep schema-backed evidence current: `work-order-ledger.json`, `effort-decision.json`, `team-dashboard-state.json`, and route-specific visual/dogfood artifacts where applicable. Team completion requires at least five independent reviewer/QA validation lanes before integration or final, even when a prompt requests fewer reviewers. Use `sks validate-artifacts latest` before claiming those artifacts pass.', 'New `$Team` execution redirects to the Naruto official subagent workflow and must keep `subagent-plan.json`, `subagent-events.jsonl`, `subagent-parent-summary.json`, `subagent-evidence.json`, the work-order ledger, and route-specific visual/dogfood artifacts current where applicable. New work uses one focused reviewer by default, two only for independent review domains, and at most three automatic reviewers for critical multi-domain risk. Legacy Team observe/watch commands remain read-only for old missions. Use `sks validate-artifacts latest` before claiming artifacts pass.')
         .replace('TriWiki is the context-tracking SSOT for long-running missions, Team handoffs, and context-pressure recovery.', 'TriWiki is the context-tracking SSOT for long-running missions, official subagent handoffs, and context-pressure recovery.');
 }