sneakoscope 7.0.0 → 7.0.3

package/dist/core/agent-bridge/mcp-server.js

@@ -5,9 +5,6 @@ import { exists, runProcess } from '../fsx.js';
 import { commandContract, outputCapFor, timeoutFor, validateJsonSchema } from '../safety/command-contract/index.js';
 const MCP_SERVER_NAME = 'sks-mcp-server';
 const MCP_SERVER_VERSION = '1.0.0';
-// Same dynamic-import trick as the MAD-SKS SQL-plane MCP executor: avoids TS
-// bundling the SDK's ESM entrypoints as a static import target this file must
-// resolve at compile time, while still using the real installed SDK.
 async function loadMcpSdk() {
     const dynamicImport = new Function('specifier', 'return import(specifier)');
     const [{ Server }, { StdioServerTransport }, types] = await Promise.all([
@@ -40,8 +37,6 @@ function toMcpToolDescriptor(entry) {
     };
 }
 async function resolveSksEntrypoint() {
-    // Mirrors src/core/commands/run-command.ts's runSks() bin resolution: prefer the
-    // packaged dist entrypoint, fall back to the source-tree relative path in dev.
     const packedBin = fileURLToPath(new URL('../../bin/sks.js', import.meta.url));
     const sourceBin = fileURLToPath(new URL('../../../bin/sks.js', import.meta.url));
     return (await exists(packedBin)) ? packedBin : sourceBin;
@@ -108,8 +103,6 @@ export async function runMcpServer(opts = {}) {
         const toolName = String(request?.params?.name || '');
         const manifest = buildAgentManifest();
         const allowed = exposedTools(manifest.tools, exposeExec);
-        // Never spawn a child process for a name the caller invented; only names present
-        // in the (possibly exec-filtered) manifest are legitimate `sks <name>` invocations.
         const entry = allowed.find((candidate) => candidate.name === toolName);
         if (!entry) {
             return mcpToolErrorResult(`Unknown or unexposed tool: ${toolName}`);
@@ -137,9 +130,6 @@ export async function runMcpServer(opts = {}) {
     const transport = new StdioServerTransport(input, output);
     await server.connect(transport);
 }
-/** Round-trips initialize -> tools/list over in-memory streams and returns, instead of
- * staying resident on real stdio — this is what `sks mcp-server --probe` runs, so a
- * fixture/CI check can prove the server actually works without hanging on a real client. */
 export async function probeMcpServer(opts = {}) {
     const { PassThrough } = await import('node:stream');
     const clientToServer = new PassThrough();
@@ -156,7 +146,7 @@ export async function probeMcpServer(opts = {}) {
                 try {
                     responses.push(JSON.parse(line));
                 }
-                catch { /* not a complete JSON line yet */ }
+                catch { }
             }
         }
     });

package/dist/core/agents/agent-effort-policy.js

@@ -62,9 +62,6 @@ export function decideAgentEffort(input = {}) {
         ]
     };
 }
-// Official Codex subagents use one of four fixed profiles: Luna Max for tiny
-// mechanical work, Sol High for ordinary implementation, Sol Max for
-// judgment, and Terra Medium for long-context or Codex-tool execution.
 export function decideOfficialSubagentModel(input = {}) {
     const persona = input.persona || {};
     const prompt = String(input.prompt || '');

package/dist/core/agents/agent-orchestrator.js

@@ -83,8 +83,6 @@ export async function runNativeAgentOrchestrator(opts = {}) {
         await setCurrent(root, { mission_id: missionId, mode: 'WORKER_RUNTIME', phase: 'WORKER_RUNTIME_UNSUPPORTED_ARGUMENT', route_command: routeCommand, requested_backend: requestedBackend, updated_at: nowIso() }, { sessionKey });
         return unsupportedBackendRun({ root, missionId, dir, route, routeCommand, routeBlackboxKind, requestedBackend });
     }
-    // Route start: consult this route's deployed Core Skill snapshot (read-only).
-    // Graceful fallback when none is deployed — zero-risk, never invokes the optimizer.
     const routeSkillSelection = await selectRouteSkill(root, route, routeSkillId(route)).catch(() => null);
     const selectedCoreSkill = routeSkillSelection ? skillProofRecord(routeSkillSelection) : null;
     const namespace = await buildProjectNamespace({ root, missionId });
@@ -227,8 +225,6 @@ export async function runNativeAgentOrchestrator(opts = {}) {
     }
     await runAgentJanitor({ missionDir: dir, missionId, projectHash: namespace.root_hash });
     const ledgerRoot = await initializeAgentCentralLedger(dir, { missionId, roster, partition, route, prompt, dynamicScheduler: true });
-    // Consult the TriWiki context pack (read-only) before dispatching workers, and
-    // persist it as a proof artifact so the kernel proof references the wiki it acted on.
     const triwikiContext = await loadTriWikiRuntimeContext(root);
     await writeTriWikiContextArtifact(ledgerRoot, triwikiContext);
     if (opts.narutoWorkGraph?.work_items?.length) {

package/dist/core/agents/agent-proof-evidence.js

@@ -233,8 +233,6 @@ export async function writeAgentProofEvidence(root, input) {
         backend: input.backend,
         route,
         route_command: routeCommand,
-        // Deployed Core Skill snapshot consulted at route start (read-only; never
-        // confers mutation rights). Null when no snapshot is deployed for this route.
         selected_core_skill: input.selectedCoreSkill || null,
         git_worktree_runtime: gitWorktreeRuntime,
         route_blackbox_kind: input.routeBlackboxKind || (realRouteCommandUsed ? 'actual_route_command' : 'internal_worker_runtime'),

package/dist/core/agents/agent-runner-ollama.js

@@ -142,9 +142,6 @@ export function classifyOllamaWorkerSlice(slice, input = {}) {
     const collection = /\b(collect|gather|extract|inventory|list|scan|grep|tail|summarize|catalog)\b|수집|추출|목록|스캔|인벤토리/i.test(text);
     const coding = /\b(code|implement|patch|write|edit|fix|mechanical|simple)\b|코드|작성|수정|구현|패치|단순/i.test(text);
     const banned = /\b(strategy|strategize|planning|plan|architecture|architect|design|review|verify|verification|audit|inspect|safety|risk|consensus|debate|orchestrate|policy|decide|decision|migration|database|schema)\b|전략|기획|설계|디자인|검증|검수|리뷰|감사|안전|위험|합의|토론|결정|마이그레이션|데이터베이스/i.test(text);
-    // Web research / external lookup must run on GPT, never on the local model:
-    // local LLMs hallucinate sources and cannot browse. This wins even over the
-    // collection allowlist (e.g. "web research and collect docs" stays on GPT).
     const research = /\b(web|research|browse|browser|crawl|fetch docs|websearch|web search|search the web|investigate|context7)\b|웹|리서치|조사|웹서치|웹 ?검색|검색/i.test(text);
     const allowed = !bannedRole && !banned && !research && (writePaths.length > 0 || collection || coding);
     const blockers = [

package/dist/core/agents/agent-scheduler.js

@@ -144,11 +144,6 @@ export async function runAgentScheduler(input) {
                 batch_id: batchId,
                 meta: { launch_count: launches.length, active_count_before: active.size }
             }).catch(() => undefined);
-            // Telemetry appends run concurrently across launches (per-slot ordering
-            // preserved inside each async chain). Awaiting these file writes in
-            // series before each dispatch serialized worker launch by 2 disk writes
-            // per slot — with 20 slots that is 40 sequential appends before the last
-            // worker even started.
             const dispatchTelemetryWrites = [];
             for (const launch of launches) {
                 const { slot, openedSlot, generation, agent, workItem } = launch;

package/dist/core/agents/native-cli-worker-runtime.js

@@ -170,6 +170,10 @@ class NativeCliWorkerRuntimeRecorder {
             },
             stdio: ['ignore', 'pipe', 'pipe']
         });
+        const exitPromise = new Promise((resolve) => {
+            child.once('close', (code, signal) => resolve({ code, signal }));
+            child.once('error', () => resolve({ code: 1, signal: null }));
+        });
         record.pid = child.pid || null;
         record.process_id = child.pid || null;
         const loopHandle = await registerLoopWorkerHandle({
@@ -202,10 +206,7 @@ class NativeCliWorkerRuntimeRecorder {
         await this.record(record);
         child.stdout?.pipe(stdout);
         child.stderr?.pipe(stderr);
-        const exit = await new Promise((resolve) => {
-            child.on('close', (code, signal) => resolve({ code, signal }));
-            child.on('error', () => resolve({ code: 1, signal: null }));
-        });
+        const exit = await exitPromise;
         stdout.end();
         stderr.end();
         if (child.pid)
@@ -628,14 +629,6 @@ class NativeCliWorkerRuntimeRecorder {
             artifacts: [...new Set([...(Array.isArray(parsed.artifacts) ? parsed.artifacts : []), input.stdoutRel, input.stderrRel, path.join(input.workerDirRel, 'zellij-worker-pane.json')])]
         });
     }
-    // Root-cause-2 fix: a fixed 2-minute wall-clock result timeout killed live codex-sdk
-    // workers (real runs exceed 2 min), marking false zellij_worker_result_timeout failures and
-    // freezing the UI while the worker kept running. Replace it with an activity-aware wait: keep
-    // waiting as long as ANY worker artifact (heartbeat, stdout/stderr, sdk event jsonl) was touched
-    // recently. Only give up after SKS_ZELLIJ_WORKER_INACTIVITY_TIMEOUT_MS of silence (default 5min)
-    // OR an absolute cap SKS_ZELLIJ_WORKER_RESULT_TIMEOUT_MS (default 1h; 0 = no cap). While waiting,
-    // emit a heartbeat telemetry event every ~10s so the SLOTS snapshot updated_at stays fresh from
-    // the orchestrator side too.
     async waitForWorkerResultWithActivity(input) {
         const inactivityTimeoutMs = Math.max(1000, Number(process.env.SKS_ZELLIJ_WORKER_INACTIVITY_TIMEOUT_MS || 300000));
         const absoluteCapRaw = Number(process.env.SKS_ZELLIJ_WORKER_RESULT_TIMEOUT_MS ?? 3600000);
@@ -738,10 +731,6 @@ class NativeCliWorkerRuntimeRecorder {
     summary() {
         const closed = this.records.filter((row) => row.status === 'closed');
         const processIds = this.records.map((row) => row.pid).filter((pid) => Number.isFinite(Number(pid)));
-        // Both pane-backed primitives count as zellij pane worker sessions: the
-        // worker command can run inside the pane (full-debug) or headless behind a
-        // live slot renderer pane (compact-slots default). Counting only the
-        // former under-reported pane sessions as 0 in the default UI mode.
         const paneBackedRecords = this.records.filter((row) => row.scaling_primitive === 'native_cli_process_in_zellij_worker_pane'
             || row.scaling_primitive === 'native_cli_process_with_zellij_slot_renderer');
         return {
@@ -848,7 +837,6 @@ async function newestMtimeMs(files) {
                 newest = mtime;
         }
         catch {
-            // missing file: no activity signal from it
         }
     }
     return newest;

package/dist/core/agents/work-partition/repo-inventory.js

@@ -20,8 +20,6 @@ export async function collectRepoInventory(root, opts = {}) {
         seen.add(file);
         files.push(file);
     };
-    // Seed representative source/test/docs entries before any large tree can
-    // exhaust the cap, then expand the priority roots in a stable order.
     for (const name of REPRESENTATIVE_DIRS) {
         const representative = await firstFile(root, path.join(root, name));
         if (representative)

package/dist/core/auto-review.js

@@ -102,13 +102,6 @@ export async function enableAutoReview(opts = {}) {
         launch_args: ['--profile', autoReviewProfileName({ high })]
     };
 }
-// Canonical registry of every SKS config profile. Codex 0.134+ deprecated the
-// `[profiles.*]` tables / top-level `profile=` selector (warns at startup) in favor of
-// per-file `$CODEX_HOME/<name>.config.toml` overlays loaded by `--profile <name>`.
-// `stripTable: true` => remove the legacy `[profiles.<name>]` table from the home
-// config during migration. Fast mode now persists through top-level
-// `service_tier = "fast"` and per-file overlays; `[user.fast_mode]`,
-// `default_profile`, and `[profiles.sks-fast-high]` are stripped as legacy schema.
 export const SKS_CONFIG_PROFILES = [
     { name: 'sks-task-low', stripTable: true, block: sksProfileFileBlock({ effort: 'low' }) },
     { name: 'sks-task-medium', stripTable: true, block: sksProfileFileBlock({ effort: 'medium' }) },
@@ -128,10 +121,6 @@ function sksProfileFileBlock(opts = {}) {
         `model_reasoning_effort = "${opts.effort || 'medium'}"`
     ].join('\n');
 }
-// Migrate every SKS config profile to a per-file `<name>.config.toml` overlay in
-// CODEX_HOME and strip the deprecated legacy `[profiles.sks-*]` tables / `profile=`
-// selectors from the home config. Idempotent (second run is a no-op). This is the
-// step that clears the Codex deprecation warning on `sks --mad`.
 export async function migrateSksProfilesToPerFile(opts = {}) {
     const configPath = opts.configPath || codexConfigPath(opts.env || process.env);
     await ensureDir(path.dirname(configPath));
@@ -252,8 +241,6 @@ export async function ensureMadHighProfileForSetupOrRepair(opts = {}) {
         cause: 'mad-high-profile-setup',
         mutate: () => next
     });
-    // Convert all SKS profiles to per-file overlays and strip the deprecated tables /
-    // selectors so Codex stops warning about the legacy config profile on launch.
     await migrateSksProfilesToPerFile({ configPath, env });
     await writeProfileConfig(configPath, MAD_HIGH_PROFILE, profileConfigBlock({
         effort: 'xhigh',

package/dist/core/bench.js

@@ -121,14 +121,6 @@ export async function runCoreBench(root = process.cwd(), { iterations = 3, tier
     for (const [label, args, commandRoot] of coreCommands(benchTrustMission)) {
         const values = [];
         const failures = [];
-        // TRUST_VALIDATE_BENCH_COMMAND measures latency of `sks trust validate` against a
-        // mock fixture mission. A --mock `$Naruto` run can never satisfy the real agent
-        // gate, so `sks trust validate` legitimately exits 1 (report.ok === false,
-        // status: 'blocked') every time regardless of environment. This row exists to
-        // measure command latency, not to assert the mock mission's trust status, so a
-        // well-formed trust-validation report (valid JSON with the expected schema) is
-        // accepted even on a nonzero exit; only a crash/unparseable-output counts as a
-        // bench failure for this specific command.
         const acceptNonZeroExit = label === TRUST_VALIDATE_BENCH_COMMAND;
         for (let i = 0; i < CORE_BENCH_WARMUP_ITERATIONS; i += 1) {
             const result = await runBenchProcess(commandRoot || root, script, args);
@@ -182,12 +174,6 @@ function isWellFormedTrustValidation(stdout) {
 }
 async function ensureBenchTrustMission(root, script) {
     const benchRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-core-bench-trust-')).catch(() => root);
-    // `sks run` blocks the agent gate (and skips writing completion-proof.json) when
-    // its cwd is not a git repo (git_collaboration.status -> not_git_repo). The bench
-    // trust-mission scratch dir must be a git repo so completion-proof.json/
-    // trust-report.json/run-classification.json actually get written and
-    // hasBenchTrustArtifacts() can find a usable mission instead of falling back to
-    // a nonexistent 'bench-fixture-missing' id (which always fails trust validate).
     await runProcess('git', ['init', '-q', '.'], { cwd: benchRoot, timeoutMs: 10_000 }).catch(() => null);
     const beforeMissionIds = await listMissionIds(benchRoot);
     const result = await runProcess(process.execPath, [script, 'run', 'fixture', '--mock', '--json'], {

package/dist/core/code-structure.js

@@ -194,9 +194,6 @@ async function collectChangedScope(root, opts) {
 async function listSourceFiles(root, dir = root, out = []) {
     const entries = await fsp.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
-        // Hidden runtime/worktree directories can contain complete repository copies.
-        // Only .agents is a source-bearing project directory; all other hidden trees
-        // are state, caches, or external workspaces and must stay outside this scan.
         if (entry.name.startsWith('.') && entry.name !== '.agents')
             continue;
         const full = path.join(dir, entry.name);

package/dist/core/codex/agent-config-file-repair.js

@@ -3,11 +3,6 @@ import path from 'node:path';
 import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
 import { backupInvalidToml, inspectOfficialSubagentToml, mergeOfficialSubagentConfig, officialSubagentConfigOwnershipProof, officialSubagentConfigWarnings, readInheritedOfficialSubagentConfigText } from '../subagents/official-subagent-config.js';
 import { writeCodexConfigGuarded } from './codex-config-guard.js';
-/**
- * Compatibility entrypoint retained for doctor callers. It repairs the
- * official project [agents] settings and removes only exact legacy SKS child
- * tables after ownership has been proven. User-authored child tables remain.
- */
 export async function repairAgentConfigFileReferences(input) {
     const root = path.resolve(input.root);
     const configPath = path.join(root, '.codex', 'config.toml');
@@ -113,9 +108,6 @@ export async function repairAgentConfigFileReferences(input) {
     };
     return writeReport(input.reportPath, root, report);
 }
-// Retained for compatibility with the startup postcheck API. Official custom
-// agents are discovered from .codex/agents and do not require config_file
-// references; legacy references are intentionally ignored and preserved.
 export async function missingAgentConfigFiles(_text) {
     return [];
 }

package/dist/core/codex/codex-cli-update.js

@@ -2,23 +2,27 @@ import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { ensureDir, exists, packageRoot, readJson, runProcess, writeJsonAtomic } from '../fsx.js';
+import { redactString } from '../secret-redaction.js';
 export const CODEX_CLI_UPDATE_STATUS_SCHEMA = 'sks.codex-cli-update-status.v1';
 export const CODEX_CLI_UPDATE_RESULT_SCHEMA = 'sks.codex-cli-update-result.v1';
 const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000;
+const CODEX_CLI_UPDATE_JSON_OUTPUT_LIMIT_BYTES = 60 * 1024;
+const CODEX_CLI_UPDATE_RAW_OUTPUT_LIMIT_BYTES = 20 * 1024;
+const CODEX_CLI_UPDATE_ARRAY_LIMIT = 12;
+const CODEX_CLI_UPDATE_ARRAY_ITEM_LIMIT_BYTES = 768;
 const CODEX_STANDALONE_INSTALLER_URL = 'https://chatgpt.com/codex/install.sh';
 const CODEX_STANDALONE_INSTALLER_PS1_URL = 'https://chatgpt.com/codex/install.ps1';
+export function codexCliUpdateConsoleLines(result) {
+    return [
+        `Codex CLI update: ${safeUpdateText(result.status, 64)}${result.after_version ? ` (${safeUpdateText(result.before_version || 'unknown', 128)} -> ${safeUpdateText(result.after_version, 128)})` : ''}`,
+        ...(result.raw_output_truncated ? ['- updater diagnostics were redacted and truncated; use --json for the bounded structured result.'] : []),
+        ...safeUpdateStringArray(result.blockers).map((blocker) => `- blocker: ${blocker}`),
+        ...safeUpdateStringArray(result.guidance).map((line) => `- ${line}`)
+    ];
+}
 export function codexCliUpdateCachePath(home = process.env.HOME || os.homedir()) {
     return path.join(String(home || os.homedir()), '.sneakoscope', 'cache', 'codex-cli-update.json');
 }
-/**
- * Resolve the operator's Codex CLI for menu status/self-update operations.
- *
- * This is intentionally separate from resolveCodexRuntime/getCodexInfo. Runtime
- * execution may use the @openai/codex dependency bundled under Sneakoscope, but
- * self-update must never mutate that package-owned dependency. Explicit operator
- * overrides are considered first, followed by every executable on PATH; any
- * candidate owned by this Sneakoscope package is rejected and resolution continues.
- */
 export async function resolveOperatorCodexCli(opts = {}) {
     const env = opts.env || process.env;
     const run = opts.deps?.runProcessImpl || runProcess;
@@ -690,25 +694,123 @@ function unavailableStatus(codex, now, cachePath, warning) {
     };
 }
 function updateResult(input) {
-    return {
+    const base = {
         schema: CODEX_CLI_UPDATE_RESULT_SCHEMA,
         ok: input.ok,
         status: input.status,
-        command: input.command,
+        command: input.command ? safeUpdateText(input.command, 512) : null,
         update_method: input.updateMethod,
-        bin: input.before.path,
-        cli_path: input.before.path,
+        bin: input.before.path ? safeUpdateText(input.before.path, 2 * 1024) : null,
+        cli_path: input.before.path ? safeUpdateText(input.before.path, 2 * 1024) : null,
         cli_source: input.before.source,
-        post_update_cli_path: input.after?.path || null,
+        post_update_cli_path: input.after?.path ? safeUpdateText(input.after.path, 2 * 1024) : null,
         post_update_cli_source: input.after?.source || 'unavailable',
-        before_version: input.before.version,
-        after_version: input.after?.version || null,
-        raw_output: input.rawOutput,
-        update_status: input.updateStatus,
-        blockers: input.blockers,
-        guidance: input.guidance
+        before_version: input.before.version ? safeUpdateText(input.before.version, 128) : null,
+        after_version: input.after?.version ? safeUpdateText(input.after.version, 128) : null,
+        update_status: sanitizeCodexCliUpdateStatus(input.updateStatus),
+        blockers: safeUpdateStringArray(input.blockers),
+        guidance: safeUpdateStringArray(input.guidance)
+    };
+    const rawOutput = boundedCodexCliUpdateRawOutput(input.rawOutput);
+    return boundCodexCliUpdateResult({
+        ...base,
+        raw_output: rawOutput.value,
+        raw_output_truncated: rawOutput.truncated
+    });
+}
+function boundedCodexCliUpdateRawOutput(value) {
+    const original = String(value || '');
+    const sanitized = sanitizeUpdateControlCharacters(redactString(original));
+    const bounded = boundUtf8Text(sanitized, CODEX_CLI_UPDATE_RAW_OUTPUT_LIMIT_BYTES, true);
+    return {
+        value: bounded.value,
+        truncated: bounded.truncated || sanitized !== original
+    };
+}
+function sanitizeCodexCliUpdateStatus(value) {
+    if (!value)
+        return null;
+    return {
+        schema: CODEX_CLI_UPDATE_STATUS_SCHEMA,
+        ok: value.ok === true,
+        status: value.status,
+        installed: value.installed === true,
+        bin: value.bin ? safeUpdateText(value.bin, 2 * 1024) : null,
+        cli_path: value.cli_path ? safeUpdateText(value.cli_path, 2 * 1024) : null,
+        cli_source: value.cli_source,
+        current_version: value.current_version ? safeUpdateText(value.current_version, 128) : null,
+        raw_version: value.raw_version ? safeUpdateText(value.raw_version, 1024) : null,
+        latest_version: value.latest_version ? safeUpdateText(value.latest_version, 128) : null,
+        update_available: typeof value.update_available === 'boolean' ? value.update_available : null,
+        update_command: 'sks codex update',
+        source: value.source,
+        checked_at: safeUpdateText(value.checked_at, 128),
+        cache_path: safeUpdateText(value.cache_path, 2 * 1024),
+        warnings: safeUpdateStringArray(value.warnings),
+        blockers: safeUpdateStringArray(value.blockers),
+        guidance: safeUpdateStringArray(value.guidance)
+    };
+}
+function boundCodexCliUpdateResult(result) {
+    if (codexCliUpdateSerializedBytes(result) <= CODEX_CLI_UPDATE_JSON_OUTPUT_LIMIT_BYTES)
+        return result;
+    const withoutRaw = {
+        ...result,
+        raw_output: '',
+        raw_output_truncated: true
+    };
+    if (codexCliUpdateSerializedBytes(withoutRaw) <= CODEX_CLI_UPDATE_JSON_OUTPUT_LIMIT_BYTES)
+        return withoutRaw;
+    const withoutNestedStatus = {
+        ...withoutRaw,
+        update_status: null,
+        blockers: safeUpdateStringArray(withoutRaw.blockers, 6, 384),
+        guidance: safeUpdateStringArray(withoutRaw.guidance, 6, 384)
+    };
+    if (codexCliUpdateSerializedBytes(withoutNestedStatus) <= CODEX_CLI_UPDATE_JSON_OUTPUT_LIMIT_BYTES)
+        return withoutNestedStatus;
+    return {
+        ...withoutNestedStatus,
+        command: withoutNestedStatus.command ? safeUpdateText(withoutNestedStatus.command, 256) : null,
+        bin: withoutNestedStatus.bin ? safeUpdateText(withoutNestedStatus.bin, 512) : null,
+        cli_path: withoutNestedStatus.cli_path ? safeUpdateText(withoutNestedStatus.cli_path, 512) : null,
+        post_update_cli_path: withoutNestedStatus.post_update_cli_path ? safeUpdateText(withoutNestedStatus.post_update_cli_path, 512) : null,
+        blockers: safeUpdateStringArray(withoutNestedStatus.blockers, 4, 256),
+        guidance: safeUpdateStringArray(withoutNestedStatus.guidance, 4, 256)
     };
 }
+function codexCliUpdateSerializedBytes(value) {
+    return Buffer.byteLength(`${JSON.stringify(value, null, 2)}\n`, 'utf8');
+}
+function safeUpdateStringArray(values = [], maxItems = CODEX_CLI_UPDATE_ARRAY_LIMIT, maxBytes = CODEX_CLI_UPDATE_ARRAY_ITEM_LIMIT_BYTES) {
+    return values.slice(0, maxItems).map((value) => safeUpdateText(value, maxBytes));
+}
+function safeUpdateText(value, maxBytes) {
+    const sanitized = sanitizeUpdateControlCharacters(redactString(String(value || '')));
+    return boundUtf8Text(sanitized, Math.max(0, maxBytes), false).value;
+}
+function sanitizeUpdateControlCharacters(value) {
+    return value
+        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, ' ')
+        .replace(/[ \t]+\n/g, '\n');
+}
+function boundUtf8Text(value, maxBytes, keepTail) {
+    if (Buffer.byteLength(value, 'utf8') <= maxBytes)
+        return { value, truncated: false };
+    const codePoints = Array.from(value);
+    let low = 0;
+    let high = codePoints.length;
+    while (low < high) {
+        const midpoint = Math.floor((low + high + 1) / 2);
+        const candidate = keepTail ? codePoints.slice(codePoints.length - midpoint).join('') : codePoints.slice(0, midpoint).join('');
+        if (Buffer.byteLength(candidate, 'utf8') <= maxBytes)
+            low = midpoint;
+        else
+            high = midpoint - 1;
+    }
+    const bounded = keepTail ? codePoints.slice(codePoints.length - low).join('') : codePoints.slice(0, low).join('');
+    return { value: bounded, truncated: true };
+}
 function failedProcessResult(err) {
     return {
         code: 1,

package/dist/core/codex/codex-config-eperm-repair.js

@@ -13,10 +13,6 @@ export async function repairCodexConfigEperm(rootInput = process.cwd(), opts = {
     const codexHome = path.resolve(opts.codexHome || process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex'));
     const codexHomeConfigPath = path.join(codexHome, 'config.toml');
     const before = await inspectCodexConfigReadability(root, { ...opts, configPath, writeReport: false });
-    // Structural recovery FIRST: hoist machine-local keys that a prior buggy move
-    // absorbed into a table back to the root, on both the project config and the
-    // global CODEX_HOME config (the file Codex actually loads). Runs before the
-    // splitter so recovered keys can then be migrated cleanly.
     const structureRepairs = [];
     if (opts.fix === true) {
         structureRepairs.push({ scope: 'project', ...(await repairCodexConfigStructure(configPath, { apply: true })) });

package/dist/core/codex/codex-config-guard.js

@@ -4,7 +4,6 @@ import { randomBytes } from 'node:crypto';
 import { appendJsonl, ensureDir, nowIso, readText, sha256, writeTextAtomic } from '../fsx.js';
 import { diffCodexAppUiSnapshots, snapshotCodexAppUiState } from '../codex-app/codex-app-ui-state-snapshot.js';
 import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from './codex-config-toml.js';
-// fast_mode_ui was removed from the [features] schema in the 2026-07 renewal.
 const FAST_FEATURE_KEYS = ['fast_mode'];
 export async function writeCodexConfigGuarded(input) {
     const configPath = path.resolve(input.configPath);
@@ -372,8 +371,6 @@ function isSksModeLockMarker(value = '') {
 function mergeLostFastUiKeys(before, nextInput) {
     let next = String(nextInput || '');
     const keys = [];
-    // [user.fast_mode] left the config schema in the 2026-07 renewal — it is no
-    // longer restored when lost; SKS strips it everywhere else.
     for (const key of FAST_FEATURE_KEYS) {
         const line = tomlTableKeyLine(before, 'features', key);
         if (line && !hasTomlTableKey(next, 'features', key)) {

package/dist/core/codex/codex-config-readability.js

@@ -22,13 +22,6 @@ export async function inspectCodexConfigReadability(rootInput = process.cwd(), o
     for (const dir of parentDirsFor(root, configPath)) {
         add(await accessCheck('parent_traverse', dir, fs.constants.X_OK));
     }
-    // Fresh project: the managed config simply does not exist yet. Every downstream check
-    // (stat, symlink, macOS ACL/flags/xattr, node/child read, codex config load) would
-    // operate on a nonexistent path and fail with ENOENT, turning the single real cause —
-    // a missing config — into a misleading cascade (`macos_acl_ls_le_failed`,
-    // `macos_flags_ls_lO_failed`, `spawned_child_read_failed`, ...). Skip them and report
-    // only the honest `missing_config` / `missing_codex_dir` blocker so the caller can
-    // regenerate the managed config instead of chasing phantom ACL/permission problems.
     const configMissing = projectConfigExists.error?.code === 'ENOENT';
     if (!configMissing) {
         const lstatCheck = await statCheck('config_lstat', configPath, 'lstat');
@@ -55,8 +48,6 @@ export async function inspectCodexConfigReadability(rootInput = process.cwd(), o
             childReadCheck(configPath, root),
             codexCliConfigLoadCheck(root, configPath, opts)
         ]);
-        // These are independent read-only metadata probes. Running them serially
-        // multiplied a single TCC/ACL timeout by three on the MAD launch path.
         const macChecksPromise = process.platform === 'darwin'
             ? Promise.all([
                 commandCheck('macos_acl_ls_le', 'ls', ['-le', configPath], root),
@@ -224,7 +215,6 @@ function errorDetail(err) {
     return { name: err?.name || 'Error', code: err?.code || '', message: err?.message || String(err) };
 }
 function resolveCodexConfigLoadProbe() {
-    // The probe ships as executable runtime JS under dist/scripts.
     const candidates = [
         path.join(packageRoot(), 'dist', 'scripts', 'codex-config-load-probe.js')
     ];
@@ -234,7 +224,6 @@ function resolveCodexConfigLoadProbe() {
                 return candidate;
         }
         catch {
-            // ignore and try the next candidate
         }
     }
     return null;
@@ -250,8 +239,6 @@ async function codexCliConfigLoadCheck(root, configPath, opts = {}) {
     }
     const script = resolveCodexConfigLoadProbe();
     if (!script) {
-        // The probe ships in dist/scripts; if it is genuinely absent (packaging gap),
-        // do not block MAD preflight on an unverifiable check — degrade gracefully.
         return {
             name: 'actual_codex_cli_config_load',
             ok: true,

package/dist/core/codex/codex-project-config-policy.js

@@ -26,16 +26,6 @@ const MACHINE_LOCAL_TABLE_PREFIXES = [
     'telemetry',
     'experimental_telemetry'
 ];
-// Codex 0.134+ removed the legacy config-profile consumers: `--profile NAME` now
-// layers `$CODEX_HOME/<name>.config.toml` over the base config and the top-level
-// `profile = "..."` selector / `[profiles.*]` tables are deprecated and warned about
-// at startup. So these are NO LONGER machine-local-and-moved-to-home — they are
-// DROPPED from the project config entirely. The per-file profiles are owned by
-// migrateSksProfilesToPerFile (src/core/auto-review.ts), which runs on `sks --mad`.
-// 2026-07 ChatGPT desktop merge: `default_profile` and `[user.fast_mode]` left the
-// config schema entirely (alongside the already-removed [profiles.*] tables), so
-// they are DROPPED from project configs, not relocated to the home config.
-// `service_tier` remains a real, machine-local top-level key and still moves home.
 const DEPRECATED_LEGACY_PROFILE_TOP_LEVEL_KEYS = new Set(['profile', 'profiles', 'default_profile']);
 const DEPRECATED_LEGACY_PROFILE_TABLE_PREFIXES = ['profiles', 'user.fast_mode'];
 const FAST_MODE_GLOBAL_TOP_LEVEL_KEYS = new Set(['service_tier']);
@@ -52,10 +42,6 @@ export async function splitCodexProjectConfigPolicy(rootInput = process.cwd(), o
     const codexHome = path.resolve(opts.codexHome || process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex'));
     const reportPath = opts.reportPath || path.join(root, '.sneakoscope', 'reports', 'codex-project-config-policy.json');
     const codexHomeConfigPath = path.join(codexHome, 'config.toml');
-    // Guard: never split the global Codex home config against itself. When `sks`
-    // runs from (or near) the home directory the project config can resolve to the
-    // same file as the move target. Splitting it would strip machine-local keys and
-    // re-append them, corrupting the file. Treat this as a no-op.
     if (await isSameFile(configPath, codexHomeConfigPath)) {
         const report = {
             schema: CODEX_PROJECT_CONFIG_POLICY_SCHEMA,
@@ -195,13 +181,6 @@ export async function splitCodexProjectConfigPolicy(rootInput = process.cwd(), o
         await writeJsonAtomic(reportPath, { ...report, report_path: reportPath });
     return report;
 }
-// Recovery pass for already-corrupted configs. The pre-fix mover appended
-// machine-local top-level keys after the last [table], so TOML absorbed them
-// into that table (e.g. `notify`/`model_provider` landing inside
-// `[mcp_servers.*.env]`, which Codex rejects with
-// `invalid type: sequence, expected a string`). The splitter cannot recover this
-// because it now sees those lines as table members, not top-level keys. This pass
-// hoists them back above the first table so Codex can load the config again.
 export async function repairCodexConfigStructure(configPathInput, opts = {}) {
     const configPath = path.resolve(configPathInput);
     const original = await readText(configPath, null);
@@ -262,9 +241,6 @@ function hoistMisplacedMachineLocalKeys(text) {
         }
         const lines = block.text.split('\n');
         const header = lines[0];
-        // `mcp_servers.*` / `*.env` tables never legitimately contain machine-local
-        // Codex root keys; treat keys found there (or anything after an absorbed
-        // SKS-moved comment) as misplaced.
         const corruptionProne = /^mcp_servers(\.|$)/.test(block.table) || /\.env$/.test(block.table) || block.table === 'env';
         const kept = [header];
         let sawMovedComment = false;
@@ -297,8 +273,6 @@ function hoistMisplacedMachineLocalKeys(text) {
     const sections = [head, ...tables.map((table) => table.trim())].filter(Boolean);
     return { changed: true, text: normalizeProjectText(sections.join('\n\n')), hoisted_keys: [...new Set(hoistedKeys)] };
 }
-// Capture a TOML assignment that may span multiple lines (multiline arrays
-// `[ ... ]` or triple-quoted strings) so hoisting never splits a value.
 function captureAssignmentSpan(lines, start) {
     const first = lines[start] ?? '';
     const collected = [first];
@@ -338,8 +312,6 @@ function splitProjectToml(text) {
     let profileName = null;
     let deprecatedFixed = false;
     for (const block of blocks) {
-        // Deprecated legacy config profiles are DROPPED, not moved to the home config
-        // (Codex 0.134+ warns about `[profiles.*]` tables and the `profile=` selector).
         if (block.table && isFastModeGlobalTable(block.table)) {
             moved.push(block.text);
             machineBlocks.push(block);
@@ -513,11 +485,6 @@ async function isSameFile(a, b) {
         return false;
     }
 }
-// Merge machine-local Codex config into the user (CODEX_HOME) config while
-// preserving TOML structure: bare top-level keys must appear before any
-// `[table]` header, otherwise they are parsed as members of the preceding
-// table. Appending moved keys blindly at end-of-file corrupted configs
-// (e.g. `notify`/`model_provider` landing inside `[mcp_servers.*.env]`).
 function mergeMachineLocalIntoUserConfig(userText, machineText, commentLine) {
     const preamble = [];
     const tables = [];

package/dist/core/codex/official-goal-mode.js

@@ -31,8 +31,6 @@ export async function detectOfficialGoalMode(opts = {}) {
         warnings: official ? [] : ['official_goal_unavailable_no_fallback']
     };
 }
-// Capability evidence for non-Goal routes. This records whether the active
-// Codex runtime exposes native Goal; it never creates or controls a goal.
 export async function writeOfficialGoalModeArtifact(dir, detection) {
     const artifact = path.join(dir, 'goal-mode-applied.json');
     await writeJsonAtomic(artifact, detection);