sneakoscope 6.4.0 → 6.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (187) hide show
  1. package/README.md +26 -34
  2. package/config/codex-releases/{rust-v0.144.1.json → rust-v0.144.5.json} +5 -5
  3. package/crates/sks-core/Cargo.lock +1 -1
  4. package/crates/sks-core/Cargo.toml +1 -1
  5. package/dist/bin/install.js +1 -1
  6. package/dist/cli/command-manifest-lite.js +2 -3
  7. package/dist/cli/command-registry.js +6 -4
  8. package/dist/cli/help-fast.js +0 -1
  9. package/dist/cli/router.js +24 -3
  10. package/dist/commands/zellij.js +18 -29
  11. package/dist/config/skills-manifest.json +62 -62
  12. package/dist/core/agent-bridge/agent-manifest.js +22 -1
  13. package/dist/core/agents/agent-codex-cockpit.js +1 -81
  14. package/dist/core/agents/agent-effort-policy.js +13 -7
  15. package/dist/core/agents/agent-orchestrator.js +0 -6
  16. package/dist/core/agents/agent-output-validator.js +2 -1
  17. package/dist/core/agents/agent-patch-queue-store.js +0 -8
  18. package/dist/core/agents/agent-proof-evidence.js +0 -6
  19. package/dist/core/agents/agent-worker-pipeline.js +12 -6
  20. package/dist/core/agents/native-cli-worker-runtime.js +1 -16
  21. package/dist/core/agents/native-worker-backend-router.js +1 -1
  22. package/dist/core/bench.js +1 -1
  23. package/dist/core/codex/official-goal-mode.js +4 -2
  24. package/dist/core/codex-app/codex-app-fast-ui-repair.js +11 -17
  25. package/dist/core/codex-app/codex-app-ui-state-snapshot.js +34 -6
  26. package/dist/core/codex-app/menubar/constants.js +0 -1
  27. package/dist/core/codex-app.js +1 -1
  28. package/dist/core/codex-compat/codex-release-manifest.js +5 -5
  29. package/dist/core/codex-control/codex-0139-image-path-real-probe.js +1 -1
  30. package/dist/core/codex-control/codex-0139-web-search-probe.js +1 -1
  31. package/dist/core/codex-control/codex-control-proof.js +1 -0
  32. package/dist/core/codex-control/codex-fake-sdk-adapter.js +1 -1
  33. package/dist/core/codex-control/codex-lb-launch-recovery.js +7 -3
  34. package/dist/core/codex-control/codex-sdk-adapter.js +8 -7
  35. package/dist/core/codex-control/codex-sdk-config-policy.js +4 -24
  36. package/dist/core/codex-control/codex-sdk-env-policy.js +396 -11
  37. package/dist/core/codex-control/codex-task-runner.js +112 -57
  38. package/dist/core/codex-control/gpt-final-arbiter.js +1 -2
  39. package/dist/core/codex-control/python-codex-sdk-adapter.js +38 -15
  40. package/dist/core/codex-lb/codex-lb-tool-catalog.js +3 -3
  41. package/dist/core/codex-native/core-skill-manifest.js +4 -7
  42. package/dist/core/codex-runtime/resolve-codex-runtime.js +199 -0
  43. package/dist/core/commands/agent-bridge-command.js +46 -15
  44. package/dist/core/commands/basic-cli.js +1 -1
  45. package/dist/core/commands/command-utils.js +2 -2
  46. package/dist/core/commands/eval-command.js +19 -2
  47. package/dist/core/commands/goal-command.js +37 -86
  48. package/dist/core/commands/mad-sks-command.js +0 -2
  49. package/dist/core/commands/naruto-command.js +236 -176
  50. package/dist/core/doctor/current-project-guidance.js +1 -1
  51. package/dist/core/doctor/doctor-dirty-planner.js +1 -1
  52. package/dist/core/doctor/retired-managed-residue-missions.js +26 -11
  53. package/dist/core/doctor/retired-managed-residue-private.js +1 -1
  54. package/dist/core/doctor/retired-managed-residue-runtime.js +12 -2
  55. package/dist/core/doctor/retired-managed-residue-state.js +7 -7
  56. package/dist/core/evaluation.js +83 -21
  57. package/dist/core/feature-fixtures.js +4 -7
  58. package/dist/core/feature-registry.js +0 -1
  59. package/dist/core/fsx.js +169 -14
  60. package/dist/core/goal-workflow.js +71 -140
  61. package/dist/core/hooks-runtime/hook-io.js +2 -2
  62. package/dist/core/hooks-runtime.js +228 -50
  63. package/dist/core/init/skills.js +7 -6
  64. package/dist/core/init.js +52 -33
  65. package/dist/core/install/installed-package-smoke.js +1 -1
  66. package/dist/core/lean-engineering-policy.js +25 -23
  67. package/dist/core/locks/file-lock.js +74 -21
  68. package/dist/core/managed-assets/managed-assets-manifest.js +1 -1
  69. package/dist/core/mcp-config/health-check.js +7 -2
  70. package/dist/core/mission.js +99 -3
  71. package/dist/core/ops/upgrade-migration-fixtures.js +30 -2
  72. package/dist/core/pipeline-internals/runtime-core.js +67 -95
  73. package/dist/core/pipeline-internals/runtime-gates.js +25 -6
  74. package/dist/core/proof/fake-real-proof-policy.js +32 -9
  75. package/dist/core/proof/route-proof-gate.js +49 -1
  76. package/dist/core/provider/model-router.js +2 -0
  77. package/dist/core/questions.js +31 -5
  78. package/dist/core/recallpulse.js +2 -2
  79. package/dist/core/release/canonical-test-proof.js +135 -0
  80. package/dist/core/release/release-closure-contract.js +1 -0
  81. package/dist/core/release/release-closure-validation.js +25 -12
  82. package/dist/core/release/release-closure.js +34 -5
  83. package/dist/core/release/release-gate-contract.js +4 -3
  84. package/dist/core/release/release-gate-dag.js +4 -2
  85. package/dist/core/release/release-pack-content-scanner.js +7 -6
  86. package/dist/core/release/release-pack-receipt.js +33 -12
  87. package/dist/core/release/release-real-contract.js +41 -2
  88. package/dist/core/retention.js +95 -16
  89. package/dist/core/routes/constants.js +1 -1
  90. package/dist/core/routes/dollar-manifest-lite.js +1 -1
  91. package/dist/core/routes.js +18 -20
  92. package/dist/core/safety/command-contract/contracts.js +33 -0
  93. package/dist/core/safety/command-contract/types.js +1 -1
  94. package/dist/core/safety/ssot-guard.js +1 -54
  95. package/dist/core/stop-gate/stop-gate-check.js +0 -14
  96. package/dist/core/stop-gate/stop-gate-writer.js +0 -4
  97. package/dist/core/strategy/adhd-orchestrating-gate.js +2 -2
  98. package/dist/core/subagents/agent-catalog.js +28 -5
  99. package/dist/core/subagents/model-policy.js +52 -11
  100. package/dist/core/subagents/naruto-help-contract.js +2 -1
  101. package/dist/core/subagents/naruto-proof-projection.js +449 -0
  102. package/dist/core/subagents/official-subagent-preparation.js +641 -51
  103. package/dist/core/subagents/official-subagent-prompt.js +16 -6
  104. package/dist/core/subagents/official-subagent-runner.js +132 -12
  105. package/dist/core/subagents/subagent-evidence.js +44 -8
  106. package/dist/core/subagents/wave-lifecycle.js +238 -0
  107. package/dist/core/update-check.js +13 -4
  108. package/dist/core/verification/machine-feedback.js +39 -19
  109. package/dist/core/version.js +1 -1
  110. package/dist/core/zellij/zellij-lane-renderer.js +19 -19
  111. package/dist/core/zellij/zellij-official-subagent-activity.js +2 -0
  112. package/dist/core/zellij/zellij-right-column-manager.js +6 -55
  113. package/dist/core/zellij/zellij-slot-column-anchor.js +4 -5
  114. package/dist/core/zellij/zellij-slot-pane-renderer.js +1 -1
  115. package/dist/core/zellij/zellij-ui-mode.js +0 -7
  116. package/dist/core/zellij/zellij-worker-pane-manager.js +3 -11
  117. package/dist/native/sks-menubar/Sources/AppDelegate.swift +0 -1
  118. package/dist/native/sks-menubar/Sources/NotificationCoordinator.swift +1 -3
  119. package/dist/native/sks-menubar/Sources/OverviewViewController.swift +194 -24
  120. package/dist/native/sks-menubar/Sources/ProcessClient.swift +49 -4
  121. package/dist/native/sks-menubar/Sources/ProvidersViewController.swift +38 -10
  122. package/dist/native/sks-menubar/Sources/StatusItemController.swift +73 -11
  123. package/dist/native/sks-menubar/Sources/UpdatesViewController.swift +27 -2
  124. package/dist/scripts/architecture-guard-check.js +1 -9
  125. package/dist/scripts/canonical-test-runner.js +51 -8
  126. package/dist/scripts/check-architecture.js +11 -1
  127. package/dist/scripts/cli-output-consistency-check.js +0 -2
  128. package/dist/scripts/codex-0144-app-server-v2-check.js +4 -4
  129. package/dist/scripts/codex-0144-binary-identity-check.js +10 -4
  130. package/dist/scripts/codex-0144-capability-check.js +5 -5
  131. package/dist/scripts/codex-0144-policy-check.js +4 -0
  132. package/dist/scripts/codex-control-all-pipelines-check.js +2 -1
  133. package/dist/scripts/codex-lb-gpt56-fast-profile-check.js +3 -3
  134. package/dist/scripts/codex-sdk-all-pipelines-check.js +2 -1
  135. package/dist/scripts/codex-sdk-real-smoke-check.js +20 -2
  136. package/dist/scripts/current-command-surface-check.js +5 -3
  137. package/dist/scripts/current-surface-update-e2e-check.js +2 -2
  138. package/dist/scripts/docs-truthfulness-check.js +8 -6
  139. package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js +3 -2
  140. package/dist/scripts/gate-policy-audit-check.js +7 -1
  141. package/dist/scripts/harness-benchmark-check.js +4 -4
  142. package/dist/scripts/hook-latency-quantum-check.js +2 -2
  143. package/dist/scripts/legacy-gate-purge-check.js +4 -2
  144. package/dist/scripts/loop-directive-check-lib.js +14 -13
  145. package/dist/scripts/naruto-codex-e2e-check.js +2 -2
  146. package/dist/scripts/naruto-ssot-gate-aliases-check.js +9 -0
  147. package/dist/scripts/naruto-ssot-pipeline-default-check.js +10 -0
  148. package/dist/scripts/naruto-ssot-route-normalization-check.js +8 -0
  149. package/dist/scripts/naruto-ssot-routing-check.js +12 -0
  150. package/dist/scripts/product-design-plugin-routing-check.js +4 -9
  151. package/dist/scripts/release-affected-selector-check.js +7 -1
  152. package/dist/scripts/release-check-stamp.js +151 -18
  153. package/dist/scripts/release-dynamic-presets-check.js +5 -2
  154. package/dist/scripts/release-metadata-1-19-check.js +4 -0
  155. package/dist/scripts/release-real-check.js +21 -3
  156. package/dist/scripts/sks-menubar-install-check.js +5 -5
  157. package/dist/scripts/upgrade-migration-matrix-check.js +278 -5
  158. package/dist/scripts/zellij-developer-controls-check.js +3 -5
  159. package/dist/scripts/zellij-initial-main-only-blackbox.js +3 -8
  160. package/dist/scripts/zellij-pane-lock-open-worker-integration-blackbox.js +1 -2
  161. package/dist/scripts/zellij-right-column-headless-overflow-check.js +1 -1
  162. package/dist/scripts/zellij-right-column-manager-check.js +3 -4
  163. package/dist/scripts/zellij-slot-only-ui-check.js +2 -2
  164. package/dist/scripts/zellij-stacked-fallback-integration-blackbox.js +1 -2
  165. package/docs/demo.tape +1 -1
  166. package/infra-harness-gates.json +0 -27
  167. package/package.json +11 -6
  168. package/release-gates.v2.json +150 -22
  169. package/schemas/codex/agent-result.schema.json +4 -0
  170. package/schemas/codex/app-server-0.144/codex_app_server_protocol.v2.schemas.json +1 -18812
  171. package/schemas/codex/codex-0139-real-probe-result.schema.json +2 -2
  172. package/schemas/zellij/zellij-right-column-state.schema.json +0 -1
  173. package/dist/core/commands/ui-command.js +0 -198
  174. package/dist/core/loops/goal-to-loop-compat.js +0 -22
  175. package/dist/core/naruto/naruto-allocation-policy.js +0 -98
  176. package/dist/core/naruto/naruto-finalizer.js +0 -22
  177. package/dist/core/naruto/naruto-gpt-final-pack.js +0 -50
  178. package/dist/core/naruto/naruto-real-worker-child.js +0 -209
  179. package/dist/core/naruto/naruto-real-worker-runtime.js +0 -178
  180. package/dist/core/naruto/naruto-rebalance-policy.js +0 -47
  181. package/dist/core/naruto/naruto-verification-pool.js +0 -17
  182. package/dist/core/ui/dashboard-html.js +0 -110
  183. package/dist/core/zellij/zellij-dashboard-pane.js +0 -70
  184. package/dist/core/zellij/zellij-dashboard-renderer.js +0 -59
  185. package/dist/core/zellij/zellij-naruto-dashboard.js +0 -44
  186. package/dist/scripts/zellij-dashboard-pane-check.js +0 -69
  187. package/dist/scripts/zellij-dashboard-watch.js +0 -40
@@ -4,6 +4,8 @@ import os from 'node:os';
4
4
  import path from 'node:path';
5
5
  import { exists, packageRoot, runProcess, which } from '../fsx.js';
6
6
  import { parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
7
+ const OFFICIAL_CODEX_PACKAGE = '@openai/codex';
8
+ const OFFICIAL_CODEX_SDK_PACKAGE = '@openai/codex-sdk';
7
9
  export async function resolveCodexRuntime(input = {}) {
8
10
  const requestedBy = input.requestedBy || 'codex-runtime-resolver';
9
11
  const candidates = await codexRuntimeCandidates(input.explicitPath || null, Boolean(input.includeGlobalDiagnostics));
@@ -25,6 +27,125 @@ export async function resolveCodexRuntime(input = {}) {
25
27
  candidates
26
28
  };
27
29
  }
30
+ export async function resolveOfficialCodexPackageRuntime(input = {}) {
31
+ const requestedBy = input.requestedBy || 'official-codex-package-runtime-resolver';
32
+ const root = packageRoot();
33
+ const nodeModulesRoot = path.join(root, 'node_modules');
34
+ const basePackageRoot = path.join(nodeModulesRoot, '@openai', 'codex');
35
+ const basePackageJsonPath = path.join(basePackageRoot, 'package.json');
36
+ const platformRuntime = officialCodexPlatformRuntime();
37
+ if (!platformRuntime) {
38
+ return officialRuntimeBlocked(basePackageRoot, 'codex_sdk_official_runtime_platform_unsupported');
39
+ }
40
+ const nativePackageRoot = path.join(nodeModulesRoot, ...platformRuntime.packageName.split('/'));
41
+ const nativeBinaryPath = path.join(nativePackageRoot, 'vendor', platformRuntime.targetTriple, 'bin', platformRuntime.binaryName);
42
+ const basePackageManifest = await readPackageManifest(basePackageJsonPath);
43
+ if (!basePackageManifest) {
44
+ return officialRuntimeBlocked(nativeBinaryPath, await exists(basePackageJsonPath)
45
+ ? 'codex_sdk_official_runtime_package_manifest_invalid'
46
+ : 'codex_sdk_official_runtime_package_not_found');
47
+ }
48
+ if (basePackageManifest.name !== OFFICIAL_CODEX_PACKAGE || typeof basePackageManifest.version !== 'string') {
49
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_package_identity_mismatch');
50
+ }
51
+ const sdkPackageRoot = path.join(nodeModulesRoot, '@openai', 'codex-sdk');
52
+ const sdkPackageJsonPath = path.join(sdkPackageRoot, 'package.json');
53
+ const sdkManifest = await readPackageManifest(sdkPackageJsonPath);
54
+ if (!sdkManifest || sdkManifest.name !== OFFICIAL_CODEX_SDK_PACKAGE) {
55
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_sdk_package_identity_mismatch');
56
+ }
57
+ const sdkDependencies = recordValue(sdkManifest.dependencies);
58
+ if (sdkDependencies?.[OFFICIAL_CODEX_PACKAGE] !== basePackageManifest.version) {
59
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_version_mismatch');
60
+ }
61
+ const optionalDependencies = recordValue(basePackageManifest.optionalDependencies);
62
+ const expectedNativeVersion = `${basePackageManifest.version}-${platformRuntime.versionSuffix}`;
63
+ const expectedNativeAlias = `npm:${OFFICIAL_CODEX_PACKAGE}@${expectedNativeVersion}`;
64
+ if (optionalDependencies?.[platformRuntime.packageName] !== expectedNativeAlias) {
65
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_platform_package_mismatch');
66
+ }
67
+ const nativePackageJsonPath = path.join(nativePackageRoot, 'package.json');
68
+ const nativePackageManifest = await readPackageManifest(nativePackageJsonPath);
69
+ if (!nativePackageManifest
70
+ || nativePackageManifest.name !== OFFICIAL_CODEX_PACKAGE
71
+ || nativePackageManifest.version !== expectedNativeVersion) {
72
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_platform_package_mismatch');
73
+ }
74
+ const runtimeMetadataPath = path.join(nativePackageRoot, 'vendor', platformRuntime.targetTriple, 'codex-package.json');
75
+ const runtimeMetadata = await readPackageManifest(runtimeMetadataPath);
76
+ if (runtimeMetadata?.version !== basePackageManifest.version
77
+ || runtimeMetadata.target !== platformRuntime.targetTriple
78
+ || runtimeMetadata.variant !== 'codex'
79
+ || runtimeMetadata.entrypoint !== `bin/${platformRuntime.binaryName}`) {
80
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_metadata_mismatch');
81
+ }
82
+ const candidateExists = await exists(nativeBinaryPath);
83
+ if (!candidateExists) {
84
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_binary_missing');
85
+ }
86
+ let canonicalNodeModulesRoot;
87
+ let canonicalBasePackageRoot;
88
+ let canonicalSdkPackageRoot;
89
+ let canonicalNativePackageRoot;
90
+ let canonicalBinaryPath;
91
+ try {
92
+ [
93
+ canonicalNodeModulesRoot,
94
+ canonicalBasePackageRoot,
95
+ canonicalSdkPackageRoot,
96
+ canonicalNativePackageRoot,
97
+ canonicalBinaryPath
98
+ ] = await Promise.all([
99
+ fsp.realpath(nodeModulesRoot),
100
+ fsp.realpath(basePackageRoot),
101
+ fsp.realpath(sdkPackageRoot),
102
+ fsp.realpath(nativePackageRoot),
103
+ fsp.realpath(nativeBinaryPath)
104
+ ]);
105
+ }
106
+ catch {
107
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_binary_missing', candidateExists);
108
+ }
109
+ if (!pathIsWithin(canonicalNodeModulesRoot, canonicalBasePackageRoot)
110
+ || !pathIsWithin(canonicalNodeModulesRoot, canonicalSdkPackageRoot)
111
+ || !pathIsWithin(canonicalNodeModulesRoot, canonicalNativePackageRoot)) {
112
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_package_path_mismatch', candidateExists);
113
+ }
114
+ if (!pathIsWithin(canonicalNativePackageRoot, canonicalBinaryPath)) {
115
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_binary_path_mismatch', candidateExists);
116
+ }
117
+ const binaryStat = await fsp.stat(canonicalBinaryPath).catch(() => null);
118
+ if (!binaryStat?.isFile()) {
119
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_binary_path_mismatch', candidateExists);
120
+ }
121
+ const trust = await verifyOfficialCodexRuntimeTrust(canonicalBinaryPath);
122
+ if (!trust.ok) {
123
+ return officialRuntimeBlocked(nativeBinaryPath, trust.blocker, candidateExists);
124
+ }
125
+ let identity;
126
+ try {
127
+ identity = {
128
+ ...await codexRuntimeIdentity(nativeBinaryPath, 'project', requestedBy),
129
+ trusted: true,
130
+ trust_basis: trust.trustBasis
131
+ };
132
+ }
133
+ catch {
134
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_binary_unusable', candidateExists);
135
+ }
136
+ if (identity.realpath !== canonicalBinaryPath
137
+ || identity.packageRoot !== canonicalNativePackageRoot
138
+ || identity.packageVersion !== expectedNativeVersion
139
+ || identity.version !== basePackageManifest.version) {
140
+ return officialRuntimeBlocked(nativeBinaryPath, 'codex_sdk_official_runtime_package_identity_mismatch', candidateExists);
141
+ }
142
+ return {
143
+ ok: true,
144
+ identity,
145
+ blockers: [],
146
+ candidates: [{ source: 'project', path: nativeBinaryPath, exists: candidateExists }]
147
+ };
148
+ }
28
149
  export async function codexRuntimeCandidates(explicitPath, includeGlobalDiagnostics = false) {
29
150
  const rows = [];
30
151
  const add = async (source, value) => {
@@ -99,3 +220,81 @@ async function readPackageVersion(root) {
99
220
  return null;
100
221
  }
101
222
  }
223
+ async function readPackageManifest(file) {
224
+ try {
225
+ return recordValue(JSON.parse(await fsp.readFile(file, 'utf8')));
226
+ }
227
+ catch {
228
+ return null;
229
+ }
230
+ }
231
+ function recordValue(value) {
232
+ return typeof value === 'object' && value !== null && !Array.isArray(value)
233
+ ? value
234
+ : null;
235
+ }
236
+ function officialCodexPlatformRuntime() {
237
+ const binaryName = process.platform === 'win32' ? 'codex.exe' : 'codex';
238
+ if (process.platform === 'darwin' && process.arch === 'arm64') {
239
+ return { packageName: '@openai/codex-darwin-arm64', targetTriple: 'aarch64-apple-darwin', versionSuffix: 'darwin-arm64', binaryName };
240
+ }
241
+ if (process.platform === 'darwin' && process.arch === 'x64') {
242
+ return { packageName: '@openai/codex-darwin-x64', targetTriple: 'x86_64-apple-darwin', versionSuffix: 'darwin-x64', binaryName };
243
+ }
244
+ if (process.platform === 'linux' && process.arch === 'arm64') {
245
+ return { packageName: '@openai/codex-linux-arm64', targetTriple: 'aarch64-unknown-linux-musl', versionSuffix: 'linux-arm64', binaryName };
246
+ }
247
+ if (process.platform === 'linux' && process.arch === 'x64') {
248
+ return { packageName: '@openai/codex-linux-x64', targetTriple: 'x86_64-unknown-linux-musl', versionSuffix: 'linux-x64', binaryName };
249
+ }
250
+ if (process.platform === 'win32' && process.arch === 'arm64') {
251
+ return { packageName: '@openai/codex-win32-arm64', targetTriple: 'aarch64-pc-windows-msvc', versionSuffix: 'win32-arm64', binaryName };
252
+ }
253
+ if (process.platform === 'win32' && process.arch === 'x64') {
254
+ return { packageName: '@openai/codex-win32-x64', targetTriple: 'x86_64-pc-windows-msvc', versionSuffix: 'win32-x64', binaryName };
255
+ }
256
+ return null;
257
+ }
258
+ function pathIsWithin(root, candidate) {
259
+ const relative = path.relative(root, candidate);
260
+ return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
261
+ }
262
+ async function verifyOfficialCodexRuntimeTrust(binaryPath) {
263
+ if (process.platform !== 'darwin') {
264
+ return { ok: true, trustBasis: 'official_package_pin' };
265
+ }
266
+ const codesign = '/usr/bin/codesign';
267
+ if (!await exists(codesign)) {
268
+ return { ok: false, blocker: 'codex_sdk_official_runtime_codesign_tool_unavailable' };
269
+ }
270
+ const verified = await runProcess(codesign, ['--verify', '--deep', '--strict', binaryPath], {
271
+ timeoutMs: 15_000,
272
+ maxOutputBytes: 64 * 1024
273
+ }).catch(() => null);
274
+ if (!verified || verified.code !== 0 || verified.timedOut) {
275
+ return { ok: false, blocker: 'codex_sdk_official_runtime_codesign_verify_failed' };
276
+ }
277
+ const described = await runProcess(codesign, ['-dv', '--verbose=4', binaryPath], {
278
+ timeoutMs: 15_000,
279
+ maxOutputBytes: 64 * 1024
280
+ }).catch(() => null);
281
+ if (!described || described.code !== 0 || described.timedOut) {
282
+ return { ok: false, blocker: 'codex_sdk_official_runtime_codesign_identity_unavailable' };
283
+ }
284
+ const details = `${described.stdout || ''}\n${described.stderr || ''}`;
285
+ const identityMatches = /^Identifier=codex$/m.test(details)
286
+ && /^TeamIdentifier=2DC432GLL2$/m.test(details)
287
+ && /^Authority=.*OpenAI.*\(2DC432GLL2\)$/m.test(details);
288
+ if (!identityMatches) {
289
+ return { ok: false, blocker: 'codex_sdk_official_runtime_codesign_identity_mismatch' };
290
+ }
291
+ return { ok: true, trustBasis: 'macos_codesign_openai_team_2DC432GLL2' };
292
+ }
293
+ function officialRuntimeBlocked(binaryPath, blocker, candidateExists = false) {
294
+ return {
295
+ ok: false,
296
+ identity: null,
297
+ blockers: [blocker],
298
+ candidates: [{ source: 'project', path: binaryPath, exists: candidateExists }]
299
+ };
300
+ }
@@ -10,8 +10,8 @@ async function resolveSksEntrypoint() {
10
10
  const sourceBin = fileURLToPath(new URL('../../../bin/sks.js', import.meta.url));
11
11
  return (await exists(packedBin)) ? packedBin : sourceBin;
12
12
  }
13
- async function runNonInteractiveSmoke(entrypoint) {
14
- const result = await runProcess(process.execPath, [entrypoint, 'status', '--json'], {
13
+ async function runJsonSmoke(entrypoint, args, validate, run) {
14
+ const result = await run(process.execPath, [entrypoint, ...args], {
15
15
  env: { SKS_AGENT_MODE: '1' },
16
16
  timeoutMs: 15_000,
17
17
  // Status is intentionally bounded but can exceed 32 KiB when several
@@ -19,23 +19,50 @@ async function runNonInteractiveSmoke(entrypoint) {
19
19
  // bridge report a false non-interactive failure.
20
20
  maxOutputBytes: 512 * 1024
21
21
  }).catch((err) => ({ code: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err) }));
22
- let stdoutIsCleanJson = false;
22
+ let parsed = null;
23
23
  try {
24
- JSON.parse(result.stdout);
25
- stdoutIsCleanJson = true;
24
+ const value = JSON.parse(result.stdout);
25
+ parsed = value && typeof value === 'object' && !Array.isArray(value) ? value : null;
26
26
  }
27
27
  catch {
28
- stdoutIsCleanJson = false;
28
+ parsed = null;
29
29
  }
30
+ const issues = parsed ? validate(parsed) : ['stdout_not_clean_json_object'];
31
+ if (result.code !== 0)
32
+ issues.push(`exit_code:${String(result.code)}`);
30
33
  return {
31
- ok: result.code === 0 && stdoutIsCleanJson,
32
- command: `SKS_AGENT_MODE=1 ${entrypoint} status --json`,
34
+ ok: result.code === 0 && issues.length === 0,
35
+ command: `SKS_AGENT_MODE=1 ${entrypoint} ${args.join(' ')}`,
33
36
  exit_code: result.code,
34
- note: stdoutIsCleanJson
35
- ? 'stdout parsed as clean JSON with SKS_AGENT_MODE=1 set — non-interactive contract verified end-to-end for this one command.'
36
- : 'stdout did not parse as clean JSON; a real agent host would fail to consume this — see exit_code/stderr in the report.'
37
+ note: issues.length === 0
38
+ ? 'stdout parsed as one clean JSON object with SKS_AGENT_MODE=1 set.'
39
+ : `non-interactive JSON contract failed: ${issues.join(', ')}`,
40
+ issues,
41
+ starts_mission: false
37
42
  };
38
43
  }
44
+ export async function runAgentBridgeContractSmokes(entrypoint, manifest, run = runProcess) {
45
+ const naruto = manifest.tools.find((tool) => tool.name === 'naruto');
46
+ const manifestActions = naruto?.input_schema?.properties?.action?.enum;
47
+ const [status, narutoHelp] = await Promise.all([
48
+ runJsonSmoke(entrypoint, ['status', '--json'], () => [], run),
49
+ runJsonSmoke(entrypoint, ['naruto', 'help', '--json'], (value) => {
50
+ const issues = [];
51
+ if (value.schema !== 'sks.naruto-subagent-workflow.v1')
52
+ issues.push('naruto_help_schema');
53
+ if (value.action !== 'help')
54
+ issues.push('naruto_help_action');
55
+ if (value.workflow !== 'official_codex_subagent')
56
+ issues.push('naruto_help_workflow');
57
+ if (value.max_depth !== 1)
58
+ issues.push('naruto_help_max_depth');
59
+ if (JSON.stringify(value.commands) !== JSON.stringify(manifestActions))
60
+ issues.push('naruto_help_manifest_actions');
61
+ return issues;
62
+ }, run)
63
+ ]);
64
+ return { status, naruto_help: narutoHelp };
65
+ }
39
66
  function registrationSnippets() {
40
67
  return {
41
68
  generic_mcp_host: { command: 'sks', args: ['mcp-server'] },
@@ -80,17 +107,20 @@ export async function agentBridgeCommand(subcommand, args = []) {
80
107
  await ensureDir(path.dirname(manifestPath));
81
108
  await writeJsonAtomic(manifestPath, manifest);
82
109
  const entrypoint = await resolveSksEntrypoint();
83
- const smoke = await runNonInteractiveSmoke(entrypoint);
110
+ const smokes = await runAgentBridgeContractSmokes(entrypoint, manifest);
84
111
  const result = {
85
112
  schema: 'sks.agent-bridge-setup.v1',
86
113
  generated_at: nowIso(),
87
- ok: smoke.ok,
114
+ ok: smokes.status.ok && smokes.naruto_help.ok,
88
115
  manifest_path: manifestPath,
89
116
  tool_count: manifest.tools.length,
90
117
  manifest_validation: manifestValidation,
91
118
  registration_snippets: registrationSnippets(),
92
- non_interactive_smoke: smoke
119
+ non_interactive_smoke: smokes.status,
120
+ naruto_help_smoke: smokes.naruto_help
93
121
  };
122
+ if (!result.ok)
123
+ process.exitCode = 1;
94
124
  if (flag(args, '--json')) {
95
125
  console.log(JSON.stringify(result, null, 2));
96
126
  }
@@ -100,7 +130,8 @@ export async function agentBridgeCommand(subcommand, args = []) {
100
130
  console.log(` ${JSON.stringify(registrationSnippets().generic_mcp_host)}`);
101
131
  console.log('Register with Codex CLI:');
102
132
  console.log(` ${registrationSnippets().codex_cli}`);
103
- console.log(`Non-interactive smoke test: ${smoke.ok ? 'ok' : 'FAILED'} (${smoke.note})`);
133
+ console.log(`Non-interactive status smoke: ${smokes.status.ok ? 'ok' : 'FAILED'} (${smokes.status.note})`);
134
+ console.log(`Naruto help contract smoke: ${smokes.naruto_help.ok ? 'ok' : 'FAILED'} (${smokes.naruto_help.note})`);
104
135
  }
105
136
  return result;
106
137
  }
@@ -17,7 +17,7 @@ import { createMission } from '../mission.js';
17
17
  import { formatSksUpdateStatusText, runSksUpdateNow, runSksUpdateReview, runSksUpdateRollback, runSksUpdateStatus } from '../update-check.js';
18
18
  import { persistSksUpdateNoticeFromVersions } from '../update/update-notice.js';
19
19
  import { withSecretPreservationGuard } from '../config/config-migration-journal.js';
20
- const REMOVED_USAGE_TOPICS = new Set(['db']);
20
+ const REMOVED_USAGE_TOPICS = new Set(['db', 'ui']);
21
21
  export async function helpCommand(args = []) {
22
22
  const topic = args[0];
23
23
  if (topic)
@@ -84,10 +84,10 @@ export function ambientGoalContinuation() {
84
84
  return {
85
85
  schema_version: 1,
86
86
  enabled: true,
87
- mode: 'ambient_codex_native_goal_overlay',
87
+ mode: 'codex_native_goal_only',
88
88
  native_slash_command: '/goal',
89
89
  non_disruptive: true,
90
- rule: 'Use Codex native goal persistence to keep long work resumable when available, but never replace Naruto, TriWiki, verification, or Honest Mode route gates.'
90
+ rule: 'Use Codex native Goal as the only persisted goal owner. Never create SKS Goal missions, bridge artifacts, compatibility loops, or fallback goal state.'
91
91
  };
92
92
  }
93
93
  export function knownGeneratedSkillNames() {
@@ -47,11 +47,28 @@ async function saveEvalReport(root, args, report, prefix) {
47
47
  function pct(x) {
48
48
  return `${(100 * x).toFixed(1)}%`;
49
49
  }
50
+ function printSizeAndTokens(report, comparison) {
51
+ const baselineSize = report.baseline.serialized_size_bytes;
52
+ const candidateSize = report.candidate.serialized_size_bytes;
53
+ if (baselineSize !== undefined && candidateSize !== undefined) {
54
+ const delta = comparison.serialized_size_savings_pct;
55
+ const suffix = delta === null || delta === undefined
56
+ ? ''
57
+ : delta >= 0 ? ` (${pct(delta)} smaller)` : ` (${pct(-delta)} larger)`;
58
+ console.log(`JSON size: ${baselineSize} B -> ${candidateSize} B${suffix} (non-token proxy)`);
59
+ }
60
+ if (comparison.token_measurement?.available) {
61
+ console.log(`Tokens: ${report.baseline.token_count} -> ${report.candidate.token_count} (${pct(comparison.token_savings_pct)} saved)`);
62
+ }
63
+ else {
64
+ console.log('Tokens: not measured (actual token counts with evidence required)');
65
+ }
66
+ }
50
67
  function printEvalRun(report, saved) {
51
68
  const c = report.comparison;
52
69
  console.log('Sneakoscope Eval');
53
70
  console.log(`Scenario: ${report.scenario.id}`);
54
- console.log(`Tokens: ${report.baseline.estimated_tokens} -> ${report.candidate.estimated_tokens} (${pct(c.token_savings_pct)} saved)`);
71
+ printSizeAndTokens(report, c);
55
72
  console.log(`Accuracy: ${report.baseline.quality.accuracy_proxy} -> ${report.candidate.quality.accuracy_proxy} (${c.accuracy_delta >= 0 ? '+' : ''}${c.accuracy_delta})`);
56
73
  console.log(`Meaningful improvement: ${c.meaningful_improvement ? 'yes' : 'no'}`);
57
74
  if (saved)
@@ -62,7 +79,7 @@ function printEvalCompare(report, saved) {
62
79
  console.log('Sneakoscope Eval Compare');
63
80
  console.log(`Baseline: ${report.baseline_label}`);
64
81
  console.log(`Candidate: ${report.candidate_label}`);
65
- console.log(`Tokens: ${report.baseline.estimated_tokens} -> ${report.candidate.estimated_tokens} (${pct(c.token_savings_pct)} saved)`);
82
+ printSizeAndTokens(report, c);
66
83
  console.log(`Accuracy: ${report.baseline.quality.accuracy_proxy} -> ${report.candidate.quality.accuracy_proxy} (${c.accuracy_delta >= 0 ? '+' : ''}${c.accuracy_delta})`);
67
84
  console.log(`Meaningful improvement: ${c.meaningful_improvement ? 'yes' : 'no'}`);
68
85
  if (saved)
@@ -1,92 +1,43 @@
1
- import path from 'node:path';
2
- import { exists, readJson, sksRoot } from '../fsx.js';
3
- import { initProject } from '../init.js';
4
- import { createMission, loadMission, setCurrent, stateFile } from '../mission.js';
5
- import { createAndWriteWorkOrderLedgerForPrompt, closeWorkOrderLedgerForRouteResult } from '../work-order-ledger.js';
6
- import { GOAL_BRIDGE_ARTIFACT, GOAL_WORKFLOW_ARTIFACT, updateGoalWorkflow, writeGoalWorkflow } from '../goal-workflow.js';
7
- import { flag, promptOf, resolveMissionId } from './command-utils.js';
8
- import { compileGoalToLoopPlan } from '../loops/goal-to-loop-compat.js';
9
- import { runLoopPlan } from '../loops/loop-runtime.js';
10
- import { evaluateLocalGate } from './route-success-helpers.js';
1
+ import { buildNativeGoalRequest } from '../goal-workflow.js';
2
+ import { flag, promptOf } from './command-utils.js';
3
+ const ACTIONS = new Set(['create', 'edit', 'pause', 'resume', 'clear', 'status']);
11
4
  export async function goalCommand(sub, args = []) {
12
- const known = new Set(['create', 'pause', 'resume', 'clear', 'status', 'help', '--help', '-h']);
13
- const action = known.has(sub) ? sub : 'create';
14
- const actionArgs = action === 'create' && sub && !known.has(sub) ? [sub, ...args] : args;
15
- if (action === 'create')
16
- return goalCreate(actionArgs);
17
- if (action === 'pause' || action === 'resume' || action === 'clear')
18
- return goalControl(action, actionArgs);
19
- if (action === 'status')
20
- return goalStatus(actionArgs);
21
- console.log(`SKS Goal
5
+ if (sub === 'help' || sub === '--help' || sub === '-h')
6
+ return printHelp();
7
+ if (flag(args, '--legacy-goal-runtime') || process.env.SKS_LEGACY_GOAL_RUNTIME === '1') {
8
+ throw new Error('The SKS Goal runtime was removed. Use Codex native /goal only.');
9
+ }
10
+ const action = ACTIONS.has(sub) ? sub : 'create';
11
+ const actionArgs = action === 'create' && sub && !ACTIONS.has(sub) ? [sub, ...args] : args;
12
+ const prompt = action === 'create' || action === 'edit' ? promptOf(actionArgs) : '';
13
+ const request = buildNativeGoalRequest(action, prompt);
14
+ if (flag(args, '--json')) {
15
+ console.log(JSON.stringify(request, null, 2));
16
+ return;
17
+ }
18
+ console.log([
19
+ 'Codex native Goal only; SKS did not create or modify goal state.',
20
+ 'Run this in Codex:',
21
+ '',
22
+ request.slash_command
23
+ ].join('\n'));
24
+ }
25
+ function printHelp() {
26
+ console.log(`SKS Goal compatibility helper (stateless)
27
+
28
+ Codex native /goal is the only goal owner. This command writes no SKS mission,
29
+ artifact, loop, fallback state, or current-route state.
22
30
 
23
31
  Usage:
24
32
  sks goal create "task"
25
- sks goal pause <mission-id|latest>
26
- sks goal resume <mission-id|latest>
27
- sks goal clear <mission-id|latest>
28
- sks goal status <mission-id|latest>
33
+ sks goal edit "revised task"
34
+ sks goal pause
35
+ sks goal resume
36
+ sks goal clear
37
+ sks goal status
38
+
39
+ The create/edit helper expands the task into Outcome, Scope, Constraints,
40
+ Verification, Done when, Stop conditions, and Non-goals before printing the
41
+ native Codex command. Prefer using /goal directly in Codex.
29
42
  `);
30
43
  }
31
- async function goalCreate(args) {
32
- const root = await sksRoot();
33
- if (!(await exists(path.join(root, '.sneakoscope'))))
34
- await initProject(root, {});
35
- const prompt = promptOf(args);
36
- if (!prompt)
37
- throw new Error('Missing goal task prompt.');
38
- if (flag(args, '--legacy-goal-runtime') || process.env.SKS_LEGACY_GOAL_RUNTIME === '1')
39
- return legacyGoalCreate(root, prompt, args);
40
- const { id, dir, mission } = await createMission(root, { mode: 'goal', prompt });
41
- await createAndWriteWorkOrderLedgerForPrompt(dir, { missionId: id, route: 'Goal', prompt });
42
- const workflow = await writeGoalWorkflow(dir, mission, { action: 'create', prompt });
43
- const plan = await compileGoalToLoopPlan({ root, missionId: id, goalText: prompt, legacyGoalOptions: { native_goal: workflow.native_goal } });
44
- const result = await runLoopPlan({ root, plan, parallelism: 'balanced' });
45
- const gate = await evaluateLocalGate({ root, missionId: id, gateFile: 'loop-graph-proof.json' });
46
- const ok = result.ok === true && gate.ok === true;
47
- await closeWorkOrderLedgerForRouteResult(dir, { ok, blockers: gate.blockers || [] });
48
- await setCurrent(root, { mission_id: id, mode: 'GOAL', route: 'Goal', route_command: '$Goal', phase: ok ? 'GOAL_LOOP_COMPLETED' : 'GOAL_LOOP_BLOCKED', questions_allowed: true, implementation_allowed: true, native_goal: workflow.native_goal, stop_gate: 'loop-graph-proof.json', stop_gate_blockers: gate.blockers }, { replace: true });
49
- if (!ok)
50
- process.exitCode = 1;
51
- if (flag(args, '--json'))
52
- return console.log(JSON.stringify({ schema: 'sks.goal-create.v1', ok, mission_id: id, workflow, loop_plan: plan, loop_result: result, gate }, null, 2));
53
- console.log(`Goal compiled to Loop Graph: ${id}`);
54
- if (!ok)
55
- console.log(`Gate blocked: ${gate.blockers.join(', ') || 'loop_result_not_ok'}`);
56
- console.log('Use `sks loop status latest` to inspect.');
57
- console.log(`Artifact: ${path.relative(root, path.join(dir, GOAL_WORKFLOW_ARTIFACT))}`);
58
- console.log(`Bridge: ${path.relative(root, path.join(dir, GOAL_BRIDGE_ARTIFACT))}`);
59
- console.log(`Native Codex control: ${workflow.native_goal.slash_command}`);
60
- }
61
- async function legacyGoalCreate(root, prompt, args) {
62
- const { id, dir, mission } = await createMission(root, { mode: 'goal', prompt });
63
- const workflow = await writeGoalWorkflow(dir, mission, { action: 'create', prompt });
64
- await setCurrent(root, { mission_id: id, mode: 'GOAL', route: 'Goal', route_command: '$Goal', phase: 'GOAL_READY', questions_allowed: true, implementation_allowed: true, native_goal: workflow.native_goal, stop_gate: 'none' }, { replace: true });
65
- if (flag(args, '--json'))
66
- return console.log(JSON.stringify({ schema: 'sks.goal-create.v1', ok: true, mission_id: id, workflow, runtime: 'legacy-goal' }, null, 2));
67
- console.log(`Goal mission created: ${id}`);
68
- console.log(`Artifact: ${path.relative(root, path.join(dir, GOAL_WORKFLOW_ARTIFACT))}`);
69
- console.log(`Bridge: ${path.relative(root, path.join(dir, GOAL_BRIDGE_ARTIFACT))}`);
70
- console.log(`Native Codex control: ${workflow.native_goal.slash_command}`);
71
- }
72
- async function goalControl(action, args) {
73
- const root = await sksRoot();
74
- const id = await resolveMissionId(root, args[0]);
75
- if (!id)
76
- throw new Error(`Usage: sks goal ${action} <mission-id|latest>`);
77
- const { dir } = await loadMission(root, id);
78
- const workflow = await updateGoalWorkflow(dir, action);
79
- await setCurrent(root, { mission_id: id, mode: 'GOAL', route: 'Goal', route_command: '$Goal', phase: `GOAL_${String(action).toUpperCase()}`, native_goal: workflow.native_goal, questions_allowed: true, implementation_allowed: action !== 'pause' && action !== 'clear', stop_gate: 'none' }, { replace: true });
80
- console.log(`Goal ${action}: ${id}`);
81
- console.log(`Native Codex control: ${workflow.native_goal.slash_command}`);
82
- }
83
- async function goalStatus(args) {
84
- const root = await sksRoot();
85
- const id = await resolveMissionId(root, args[0]);
86
- if (!id)
87
- throw new Error('Usage: sks goal status <mission-id|latest>');
88
- const { dir, mission } = await loadMission(root, id);
89
- const state = await readJson(stateFile(root), {});
90
- const workflow = await readJson(path.join(dir, GOAL_WORKFLOW_ARTIFACT), null);
91
- console.log(JSON.stringify({ mission, state, goal_workflow: workflow }, null, 2));
92
- }
@@ -374,7 +374,6 @@ export async function madHighCommand(args = [], deps = {}) {
374
374
  session_name: launch.session_name || null,
375
375
  live_panes: !headlessZellij,
376
376
  initial_panes: 'orchestrator-monitor-viewports',
377
- dashboard_created: true,
378
377
  worker_panes_created: 0,
379
378
  viewport_panes_created: Number(madSksEnv.SKS_ZELLIJ_VIEWPORTS),
380
379
  ui_architecture: 'monitor_plus_viewports',
@@ -720,7 +719,6 @@ function baseMadLaunchOnlyFlags() {
720
719
  '--install-homebrew',
721
720
  '--headless',
722
721
  '--zellij-compact-slots',
723
- '--zellij-dashboard',
724
722
  '--zellij-full-debug',
725
723
  '--allow-system',
726
724
  '--allow-db-write',