sneakoscope 6.7.0 → 7.0.0

package/README.md

@@ -18,11 +18,11 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current release: **SKS 6.7.0**, validated against the official stable **Codex CLI 0.144.5** release from July 16, 2026. It makes the Control Center Overview report build, install, cache, rebuild, and probe health from their real authorities; adds root-owned Naruto follow-up waves with recovered thread capacity; separates Terra Medium exploration, Sol High implementation, and Sol Max judgment; and replaces duplicated global guidance with one concise Core Engineering Directive. The `0.145.0-alpha` line is intentionally excluded from the stable release baseline. See [CHANGELOG.md](CHANGELOG.md).
+Current release: **SKS 7.0.0**, validated against the official stable **Codex CLI 0.144.5** release from July 16, 2026. It makes the Control Center Overview report build, install, cache, rebuild, and probe health from their real authorities; adds root-owned Naruto follow-up waves with recovered thread capacity; separates Terra Medium exploration, Sol High implementation, and Sol Max judgment; and replaces duplicated global guidance with one concise Core Engineering Directive. The `0.145.0-alpha` line is intentionally excluded from the stable release baseline. See [CHANGELOG.md](CHANGELOG.md).
 
-## What 6.7.0 Fixes
+## What 7.0.0 Ships
 
-| Problem | 6.7.0 behavior |
+| Problem | 7.0.0 behavior |
 | --- | --- |
 | Overview mixed Menu Bar, installed SKS, and cached registry versions | Each value is labeled by authority, stale or unavailable probes remain explicit, and Refresh forces a bounded update-status refresh. |
 | Naruto stopped creating children after its first wave | The root parent records settled waves, recovers open-thread capacity, rescans the ready DAG, and can launch later direct-child waves under the same workflow run. |

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "6.7.0"
+version = "7.0.0"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "6.7.0"
+version = "7.0.0"
 edition = "2021"
 
 [dependencies]

package/dist/cli/install-helpers-codex-lb-config.js

@@ -21,6 +21,50 @@ export function upsertCodexLbConfig(text = '', baseUrl, selectDefault = true) {
     next = upsertTomlTable(next, 'model_providers.codex-lb', block);
     return `${next.trim()}\n`;
 }
+const CODEX_LB_SHARED_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
+// Codex App can retain a per-thread `model_provider = "openai"` selection even
+// after the global provider changes. While SKS places the codex-lb key in the
+// shared OpenAI auth store, pin the built-in provider to the same LB endpoint so
+// that stale threads cannot send that key to api.openai.com. A different existing
+// override is user-owned and must never be clobbered.
+export function codexLbSharedOpenAiRoutingState(text = '', baseUrl = '') {
+    const expectedBaseUrl = normalizeCodexLbBaseUrl(baseUrl);
+    const configuredBaseUrl = topLevelTomlString(text, 'openai_base_url');
+    return {
+        status: !configuredBaseUrl ? 'missing' : configuredBaseUrl === expectedBaseUrl ? 'matched' : 'conflict',
+        expected_base_url: expectedBaseUrl,
+        configured_base_url: configuredBaseUrl || null,
+        managed: topLevelHasLine(text, CODEX_LB_SHARED_OPENAI_ROUTING_MARKER)
+    };
+}
+export function upsertCodexLbSharedOpenAiRouting(text = '', baseUrl = '') {
+    const state = codexLbSharedOpenAiRoutingState(text, baseUrl);
+    if (!state.expected_base_url)
+        return { ...state, routing_status: state.status, ok: false, status: 'missing_base_url', text: String(text || '') };
+    if (state.status === 'conflict')
+        return { ...state, routing_status: state.status, ok: false, status: 'conflicting_user_openai_base_url', text: String(text || '') };
+    if (state.status === 'matched' && state.managed) {
+        return { ...state, routing_status: state.status, ok: true, status: 'present', text: String(text || '') };
+    }
+    // Matched-but-unmanaged means the URL already points at codex-lb. Claim the SKS
+    // marker so release/unselect can remove only this activation pin later.
+    const withValue = state.status === 'matched'
+        ? String(text || '')
+        : upsertTopLevelTomlString(text, 'openai_base_url', state.expected_base_url);
+    const next = addTopLevelMarkerBeforeKey(withValue, 'openai_base_url', CODEX_LB_SHARED_OPENAI_ROUTING_MARKER);
+    return { ...state, routing_status: state.status, ok: true, status: 'added', text: `${next.trim()}\n`, managed: true };
+}
+export function removeCodexLbSharedOpenAiRouting(text = '', baseUrl = '') {
+    const state = codexLbSharedOpenAiRoutingState(text, baseUrl);
+    if (state.status !== 'matched' || !state.managed)
+        return { ...state, changed: false, text: String(text || '') };
+    const withoutValue = removeTopLevelTomlKeyIfValue(text, 'openai_base_url', state.expected_base_url);
+    return {
+        ...state,
+        changed: true,
+        text: removeTopLevelLine(withoutValue, CODEX_LB_SHARED_OPENAI_ROUTING_MARKER)
+    };
+}
 export function upsertCodexAppGlmConfig(text = '') {
     let next = String(text || '');
     const providerBlock = [
@@ -189,3 +233,30 @@ export async function sha256Text(value = '') {
 function escapeRegExp(value) {
     return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
+function topLevelTomlString(text = '', key) {
+    const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
+    return topLevel.match(new RegExp(`(^|\\n)\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]+)"\\s*(?:#.*)?(?=\\n|$)`))?.[2] || '';
+}
+function topLevelHasLine(text = '', line) {
+    const topLevel = String(text || '').split(/\n\s*\[/)[0] || '';
+    return topLevel.split(/\r?\n/).some((candidate) => candidate.trim() === line);
+}
+function addTopLevelMarkerBeforeKey(text = '', key, marker) {
+    const lines = String(text || '').split('\n');
+    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+    const end = firstTable === -1 ? lines.length : firstTable;
+    const keyIndex = lines.slice(0, end).findIndex((line) => new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(line));
+    if (keyIndex >= 0 && !lines.slice(0, end).some((line) => line.trim() === marker))
+        lines.splice(keyIndex, 0, marker);
+    return lines.join('\n');
+}
+function removeTopLevelLine(text = '', target) {
+    const lines = String(text || '').split('\n');
+    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+    const end = firstTable === -1 ? lines.length : firstTable;
+    for (let index = end - 1; index >= 0; index -= 1) {
+        if (lines[index]?.trim() === target)
+            lines.splice(index, 1);
+    }
+    return lines.join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n');
+}

package/dist/cli/install-helpers-codex-lb-selftest.js

@@ -234,11 +234,11 @@ export async function selftestCodexLb(tmp) {
     const codexLbReconcileRestoreJson = JSON.parse(codexLbReconcileRestoreRepair.stdout);
     const codexLbReconcileRestoreAuth = await safeReadText(path.join(codexLbHome, '.codex', 'auth.json'));
     const codexLbReconcileRestoreConfig = await safeReadText(path.join(codexLbHome, '.codex', 'config.toml'));
-    if (codexLbReconcileRestoreJson.auth_reconcile?.status !== 'oauth_restored' || !codexLbReconcileRestoreAuth.includes('oauth-id') || codexLbReconcileRestoreAuth.includes('sk-test') || !hasTopLevelCodexLbSelected(codexLbReconcileRestoreConfig))
-        throw new Error('selftest: codex-lb oauth restore should replace apikey auth.json with ChatGPT OAuth backup while keeping codex-lb selected');
+    if (codexLbReconcileRestoreJson.auth_reconcile?.status !== 'oauth_restored' || !codexLbReconcileRestoreAuth.includes('oauth-id') || codexLbReconcileRestoreAuth.includes('sk-test') || hasTopLevelCodexLbSelected(codexLbReconcileRestoreConfig) || /sks-codex-lb-managed-openai-base-url/.test(codexLbReconcileRestoreConfig))
+        throw new Error('selftest: codex-lb oauth restore should replace apikey auth.json with ChatGPT OAuth backup and leave an unselected, unpinned provider state');
     // codex-lb auth: release flow — restore ChatGPT OAuth from backup so the user can return to
-    // the official ChatGPT account login. Default deselects model_provider; flags control whether
-    // the provider stays selected and whether the backup file is removed after restore.
+    // the official ChatGPT account login. Default deselects model_provider; keeping codex-lb
+    // selected with shared OAuth is rejected because it would route OAuth credentials to the LB.
     const codexLbReleaseConfig = 'model_provider = "codex-lb"\n\n[model_providers.codex-lb]\nname = "openai"\nbase_url = "https://lb.example.test/backend-api/codex"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = true\n';
     const codexLbReleaseEnv = "export CODEX_LB_BASE_URL='https://lb.example.test/backend-api/codex'\nexport CODEX_LB_API_KEY='sk-test'\n";
     const codexLbReleaseApikeyAuth = '{"auth_mode":"apikey","OPENAI_API_KEY":"sk-test"}\n';
@@ -257,17 +257,16 @@ export async function selftestCodexLb(tmp) {
     const codexLbReleaseConfigAfter = await safeReadText(path.join(codexLbHome, '.codex', 'config.toml'));
     if (codexLbReleaseJson.status !== 'released' || codexLbReleaseJson.provider_unselected !== true || codexLbReleaseJson.backup_removed !== false || !codexLbReleaseAuth.includes('oauth-id') || !codexLbReleaseAuth.includes('oauth-refresh') || codexLbReleaseAuth.includes('apikey') || !codexLbReleaseBackupAfter.includes('oauth-id') || hasTopLevelCodexLbSelected(codexLbReleaseConfigAfter))
         throw new Error('selftest: codex-lb release happy path did not restore OAuth, preserve backup, and deselect model_provider');
-    // --keep-provider: restore auth.json but leave model_provider = "codex-lb" alone.
+    // --keep-provider is unsafe with shared OpenAI auth and must fail without changing either file.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), codexLbReleaseApikeyAuth);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'), codexLbReleaseOauthBackup);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'config.toml'), codexLbReleaseConfig);
     const codexLbReleaseKeepRun = await runProcess(process.execPath, [packagedSksEntrypoint(), 'codex-lb', 'release', '--keep-provider', '--json'], { cwd: tmp, env: codexLbEnvForSelftest, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
-    if (codexLbReleaseKeepRun.code !== 0)
-        throw new Error(`selftest: codex-lb release --keep-provider exited ${codexLbReleaseKeepRun.code}: ${codexLbReleaseKeepRun.stderr}`);
     const codexLbReleaseKeepJson = JSON.parse(codexLbReleaseKeepRun.stdout);
     const codexLbReleaseKeepConfig = await safeReadText(path.join(codexLbHome, '.codex', 'config.toml'));
-    if (codexLbReleaseKeepJson.status !== 'released' || codexLbReleaseKeepJson.provider_unselected !== false || !hasTopLevelCodexLbSelected(codexLbReleaseKeepConfig))
-        throw new Error('selftest: codex-lb release --keep-provider should leave model_provider = "codex-lb" intact');
+    const codexLbReleaseKeepAuth = await safeReadText(path.join(codexLbHome, '.codex', 'auth.json'));
+    if (codexLbReleaseKeepRun.code === 0 || codexLbReleaseKeepJson.status !== 'failed' || codexLbReleaseKeepJson.reason !== 'keep_provider_unsafe_with_shared_auth' || !hasTopLevelCodexLbSelected(codexLbReleaseKeepConfig) || !codexLbReleaseKeepAuth.includes('apikey'))
+        throw new Error('selftest: codex-lb release --keep-provider should fail closed without changing the coherent codex-lb state');
     // --delete-backup: restore auth.json and remove the backup file.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), codexLbReleaseApikeyAuth);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'), codexLbReleaseOauthBackup);
@@ -288,17 +287,15 @@ export async function selftestCodexLb(tmp) {
     const codexLbReleaseMissingAuth = await safeReadText(path.join(codexLbHome, '.codex', 'auth.json'));
     if (codexLbReleaseMissingRun.code === 0 || codexLbReleaseMissingJson.status !== 'no_backup' || !codexLbReleaseMissingAuth.includes('apikey'))
         throw new Error('selftest: codex-lb release with no backup should exit non-zero and report no_backup without touching auth.json');
-    // unselect: flip model_provider off without touching auth.json or env file.
+    // unselect must refuse while the shared auth store still contains the codex-lb key.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), codexLbReleaseApikeyAuth);
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'config.toml'), codexLbReleaseConfig);
     const codexLbUnselectRun = await runProcess(process.execPath, [packagedSksEntrypoint(), 'codex-lb', 'unselect', '--json'], { cwd: tmp, env: codexLbEnvForSelftest, timeoutMs: 15000, maxOutputBytes: 64 * 1024 });
-    if (codexLbUnselectRun.code !== 0)
-        throw new Error(`selftest: codex-lb unselect exited ${codexLbUnselectRun.code}: ${codexLbUnselectRun.stderr}`);
     const codexLbUnselectJson = JSON.parse(codexLbUnselectRun.stdout);
     const codexLbUnselectConfig = await safeReadText(path.join(codexLbHome, '.codex', 'config.toml'));
     const codexLbUnselectAuth = await safeReadText(path.join(codexLbHome, '.codex', 'auth.json'));
-    if (codexLbUnselectJson.status !== 'unselected' || hasTopLevelCodexLbSelected(codexLbUnselectConfig) || !codexLbUnselectConfig.includes('[model_providers.codex-lb]') || !codexLbUnselectAuth.includes('apikey'))
-        throw new Error('selftest: codex-lb unselect should drop model_provider but preserve [model_providers.codex-lb] and auth.json');
+    if (codexLbUnselectRun.code === 0 || codexLbUnselectJson.status !== 'failed' || codexLbUnselectJson.reason !== 'shared_codex_lb_auth_active' || !hasTopLevelCodexLbSelected(codexLbUnselectConfig) || !codexLbUnselectAuth.includes('apikey'))
+        throw new Error('selftest: codex-lb unselect should fail closed while shared codex-lb auth is active');
     // Restore the doctor-test auth.json shape so downstream selftest assertions still hold.
     await writeTextAtomic(path.join(codexLbHome, '.codex', 'auth.json'), '{"auth_mode":"browser"}\n');
     await fsp.rm(path.join(codexLbHome, '.codex', 'auth.chatgpt-backup.json'), { force: true });