sneakoscope 7.0.2 → 7.0.5

package/dist/core/codex-app/menubar/launch-agent.js

@@ -93,6 +93,7 @@ export async function inspectLaunchdService(env = process.env) {
 }
 export async function restartLaunchAgent(paths, env) {
     const launchctl = env.SKS_MENUBAR_LAUNCHCTL || await which('launchctl').catch(() => null) || '/bin/launchctl';
+    const open = env.SKS_MENUBAR_OPEN || await which('open').catch(() => null) || '/usr/bin/open';
     const service = launchServiceName();
     const result = await runProcess(launchctl, ['kickstart', '-k', service], {
         timeoutMs: timeoutFromEnv(env, 'SKS_MENUBAR_KICKSTART_TIMEOUT_MS', 5_000),
@@ -108,11 +109,46 @@ export async function restartLaunchAgent(paths, env) {
             print_code: probe.code,
             verified_running_after_timeout: result.timedOut && probe.running,
             terminal_uncertain: terminalUncertain,
+            recovered_via_bootstrap: false,
             error: probe.running ? null : probe.error || (result.timedOut ? 'launchctl_kickstart_timed_out' : 'launchctl_kickstart_not_running'),
             paths
         };
     }
-    return { ok: false, code: result.code, timed_out: false, print_code: null, verified_running_after_timeout: false, terminal_uncertain: false, error: String(result.stderr || result.stdout).trim(), paths };
+    const kickstartError = String(result.stderr || result.stdout).trim();
+    if (await exists(paths.launch_agent_path) && await exists(paths.executable_path) && isUnloadableLaunchdKickstartError(kickstartError)) {
+        const launch = await launchMenuBar({ launchctl, open, paths, env });
+        return {
+            ok: launch.ok,
+            code: launch.kickstart_code ?? launch.bootstrap_code ?? result.code,
+            timed_out: Boolean(launch.kickstart_timed_out || launch.bootstrap_timed_out),
+            print_code: launch.print_code ?? null,
+            verified_running_after_timeout: Boolean(launch.verified_running_after_timeout),
+            terminal_uncertain: Boolean(launch.terminal_uncertain),
+            recovered_via_bootstrap: true,
+            error: launch.error ?? (launch.ok ? null : kickstartError),
+            paths
+        };
+    }
+    return {
+        ok: false,
+        code: result.code,
+        timed_out: false,
+        print_code: null,
+        verified_running_after_timeout: false,
+        terminal_uncertain: false,
+        recovered_via_bootstrap: false,
+        error: kickstartError,
+        paths
+    };
+}
+export function isUnloadableLaunchdKickstartError(text) {
+    const normalized = String(text || '').toLowerCase();
+    return normalized.includes('could not find service')
+        || normalized.includes('could not kickstart service')
+        || /\bbad request\b/.test(normalized)
+        || normalized.includes('operation not permitted')
+        || normalized.includes('no such process')
+        || normalized.includes('input/output error');
 }
 export async function removeLaunchAgent(paths, env) {
     const actions = [];

package/dist/core/codex-app/openrouter-activate.js

@@ -0,0 +1,152 @@
+import path from 'node:path';
+import os from 'node:os';
+import { ensureDir, readText, nowIso } from '../fsx.js';
+import { resolveOpenRouterApiKey } from '../providers/openrouter/openrouter-secret-store.js';
+import { OPENROUTER_DEFAULT_MODEL, OPENROUTER_PROVIDER_ID, normalizeOpenRouterModelId } from './openrouter-provider.js';
+import { installCodexAppGlmProfile } from './glm-profile-installer.js';
+import { restartCodexApp } from './codex-app-restart.js';
+import { codexLbConfigPath, ensureGlobalCodexAppGlmProfile, unselectCodexLbProvider } from '../../cli/install-helpers.js';
+import { ensureTrailingNewline, safeWriteCodexConfigToml, upsertTopLevelTomlString } from '../codex-runtime/codex-desktop-config-policy.js';
+function topLevelTomlString(text, key) {
+    const match = String(text || '').match(new RegExp(`(?:^|\\n)${key}\\s*=\\s*\"([^\"]*)\"`));
+    return match?.[1] ?? null;
+}
+export async function openRouterStatus(input = {}) {
+    const home = input.home || process.env.HOME || os.homedir();
+    const configPath = input.configPath || codexLbConfigPath(home);
+    const config = await readText(configPath, '');
+    const key = await resolveOpenRouterApiKey({ env: input.env || process.env });
+    const providerPresent = new RegExp(`\\[model_providers\\.${OPENROUTER_PROVIDER_ID}\\]`).test(config);
+    const selected = topLevelTomlString(config, 'model_provider') === OPENROUTER_PROVIDER_ID;
+    const model = topLevelTomlString(config, 'model');
+    const blockers = [];
+    if (!key.key)
+        blockers.push('openrouter_key_missing');
+    if (!providerPresent)
+        blockers.push('openrouter_provider_missing');
+    return {
+        schema: 'sks.codex-app-openrouter-status.v1',
+        ok: blockers.length === 0 && (selected ? Boolean(model) : true),
+        key_present: Boolean(key.key),
+        key_source: key.source || null,
+        provider_present: providerPresent,
+        selected,
+        model: model || (selected ? OPENROUTER_DEFAULT_MODEL : null),
+        model_source: model ? 'config' : selected ? 'default' : null,
+        config_path: configPath,
+        blockers,
+        warnings: []
+    };
+}
+export async function useOpenRouter(input) {
+    const model = normalizeOpenRouterModelId(input.model || OPENROUTER_DEFAULT_MODEL);
+    if (!model) {
+        return {
+            schema: 'sks.codex-app-use-openrouter.v1',
+            generated_at: nowIso(),
+            ok: false,
+            status: 'blocked',
+            mode: 'openrouter',
+            blockers: ['openrouter_model_invalid'],
+            warnings: [],
+            hint: 'Pass --model <openrouter-model-id>, for example z-ai/glm-5.2'
+        };
+    }
+    const home = input.home || process.env.HOME || os.homedir();
+    const configPath = input.configPath || codexLbConfigPath(home);
+    const env = input.env || process.env;
+    await ensureDir(path.dirname(configPath));
+    const key = await resolveOpenRouterApiKey({ env });
+    if (!key.key) {
+        return {
+            schema: 'sks.codex-app-use-openrouter.v1',
+            generated_at: nowIso(),
+            ok: false,
+            status: 'blocked',
+            mode: 'openrouter',
+            model,
+            blockers: ['openrouter_key_missing'],
+            warnings: [],
+            hint: 'Save a key first: sks codex-app set-openrouter-key --api-key-stdin'
+        };
+    }
+    const profile = await installCodexAppGlmProfile({
+        root: input.root,
+        apply: true,
+        home,
+        env,
+        configPath
+    });
+    if (!profile.ok) {
+        return {
+            schema: 'sks.codex-app-use-openrouter.v1',
+            generated_at: nowIso(),
+            ok: false,
+            status: 'blocked',
+            mode: 'openrouter',
+            model,
+            profile,
+            blockers: profile.blockers,
+            warnings: profile.warnings || []
+        };
+    }
+    const unselect = await unselectCodexLbProvider({
+        home,
+        configPath,
+        allowActiveSharedAuthTransition: true
+    }).catch((err) => ({ ok: false, status: 'failed', provider_error: err?.message || String(err) }));
+    const current = await readText(configPath, '');
+    let next = upsertTopLevelTomlString(current, 'model_provider', OPENROUTER_PROVIDER_ID);
+    next = upsertTopLevelTomlString(next, 'model', model);
+    next = ensureTrailingNewline(next);
+    const write = await safeWriteCodexConfigToml(configPath, current, next, 'openrouter-use');
+    if (!write.ok) {
+        return {
+            schema: 'sks.codex-app-use-openrouter.v1',
+            generated_at: nowIso(),
+            ok: false,
+            status: 'blocked',
+            mode: 'openrouter',
+            model,
+            write,
+            unselect,
+            blockers: [String(write.status || 'openrouter_config_write_blocked')],
+            warnings: []
+        };
+    }
+    const restart = await restartCodexApp({ enabled: Boolean(input.restartApp) });
+    const status = await openRouterStatus({ home, configPath, env });
+    const ok = Boolean(status.selected && status.key_present && status.provider_present && status.model === model && restart.ok);
+    return {
+        schema: 'sks.codex-app-use-openrouter.v1',
+        generated_at: nowIso(),
+        ok,
+        status: ok ? 'active' : 'activation_incomplete',
+        mode: 'openrouter',
+        model,
+        profile,
+        unselect,
+        write,
+        restart_app: restart,
+        openrouter: status,
+        readiness: {
+            selected: status.selected,
+            key_present: status.key_present,
+            provider_present: status.provider_present,
+            model: status.model,
+            ok
+        },
+        blockers: [
+            ...(status.selected ? [] : ['openrouter_not_selected']),
+            ...(status.model === model ? [] : ['openrouter_model_not_applied']),
+            ...(restart.ok ? [] : (restart.blockers || ['openrouter_restart_blocked']))
+        ],
+        warnings: [
+            ...(unselect?.ok === false ? [`codex_lb_unselect:${unselect.provider_error || unselect.status}`] : []),
+            ...(profile.warnings || [])
+        ]
+    };
+}
+export async function ensureOpenRouterProviderInstalled(opts = {}) {
+    return ensureGlobalCodexAppGlmProfile(opts);
+}

package/dist/core/codex-app/openrouter-provider.js

@@ -0,0 +1,82 @@
+export const OPENROUTER_PROVIDER_ID = 'openrouter';
+export const OPENROUTER_DEFAULT_MODEL = 'z-ai/glm-5.2';
+export const OPENROUTER_DEFAULT_PROFILE_ID = 'sks-openrouter-default';
+export const OPENROUTER_DEFAULT_PROFILE_LABEL = 'OpenRouter (SKS)';
+export const GLM_52_OPENROUTER_MODEL = OPENROUTER_DEFAULT_MODEL;
+export const GLM_CODEX_CONFIG_PROVIDER_ID = OPENROUTER_PROVIDER_ID;
+export const GLM_CODEX_CONFIG_PROFILE_ID = 'sks-glm-52-mad';
+export const GLM_CODEX_APP_PROFILE_ID = 'sks/glm-5.2-mad';
+export const GLM_CODEX_APP_PROFILE_LABEL = 'GLM 5.2 (OpenRouter)';
+export const RETIRED_GLM_DESKTOP_CONFIG_PROFILE_IDS = [
+    'sks-glm-52-mad',
+    'sks-glm-52-minimal',
+    'sks-glm-52-low',
+    'sks-glm-52-medium',
+    'sks-glm-52-high',
+    'sks-glm-52-xhigh'
+];
+export const OPENROUTER_SELECTABLE_REASONING_EFFORTS = [
+    'none',
+    'minimal',
+    'low',
+    'medium',
+    'high',
+    'xhigh',
+];
+export const GLM_CODEX_SELECTABLE_REASONING_EFFORTS = OPENROUTER_SELECTABLE_REASONING_EFFORTS;
+export const OPENROUTER_CODEX_REASONING_PROFILES = [];
+export const GLM_CODEX_CONFIG_REASONING_PROFILES = OPENROUTER_CODEX_REASONING_PROFILES;
+export function buildGlmCodexAppModelProfile() {
+    return {
+        schema: 'sks.codex-app-model-profile.v1',
+        id: OPENROUTER_DEFAULT_PROFILE_ID,
+        label: OPENROUTER_DEFAULT_PROFILE_LABEL,
+        provider: 'openrouter',
+        model: OPENROUTER_DEFAULT_MODEL,
+        codexConfigProvider: OPENROUTER_PROVIDER_ID,
+        codexConfigProfile: OPENROUTER_DEFAULT_PROFILE_ID,
+        supportedReasoningEfforts: OPENROUTER_SELECTABLE_REASONING_EFFORTS,
+        reasoningProfiles: OPENROUTER_CODEX_REASONING_PROFILES,
+        mode: 'openrouter-desktop',
+        strictModelLock: false,
+        gptFallbackAllowed: false,
+        requiresSecret: 'openrouter-api-key',
+        defaultProfile: 'speed',
+        defaultSettings: {
+            temperature: 0.2,
+            top_p: 0.85,
+            reasoning_effort: null,
+            tool_choice: 'none',
+            parallel_tool_calls: false,
+            max_tokens: 4096,
+            provider_sort: 'throughput',
+            provider_allow_fallbacks: false,
+            provider_require_parameters: false,
+        },
+        codexCompatibility: {
+            target: 'rust-v0.145.0',
+            selectedExecutorPluginMcp: 'defer-to-codex-native',
+            duplicateAppMcpDeclarations: 'dedupe-by-codex',
+            cwdShellPathSemantics: 'preserve-codex-native',
+        },
+    };
+}
+export function normalizeOpenRouterModelId(value) {
+    const model = String(value || '').trim();
+    if (!model)
+        return null;
+    if (model.length > 200)
+        return null;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:/-]*$/.test(model))
+        return null;
+    return model;
+}
+export function retiredGlmDesktopProfileBody(effort) {
+    return [
+        'model_provider = "openrouter"',
+        `model = "${OPENROUTER_DEFAULT_MODEL}"`,
+        `model_reasoning_effort = "${effort}"`,
+        'service_tier = "default"',
+        'approval_policy = "on-request"'
+    ].join('\n');
+}

package/dist/core/codex-app/sks-menubar.js

@@ -1,2 +1 @@
-/** Compatibility facade retained for the 6.3 release. */
 export * from './menubar/index.js';

package/dist/core/codex-app.js

@@ -6,8 +6,7 @@ import { EMPTY_CODEX_INFO, getCodexInfo } from './codex-adapter.js';
 import { CODEX_CHROME_EXTENSION_DOC_URL, DEFAULT_CODEX_APP_PLUGINS as DEFAULT_CODEX_APP_PLUGIN_TUPLES, RESERVED_CODEX_PLUGIN_SKILL_NAMES } from './routes.js';
 import { PRODUCT_DESIGN_PLUGIN, normalizeProductDesignPluginEvidence } from './product-design-plugin.js';
 import { PRODUCT_DESIGN_AUTO_INSTALL_ENV, ensureProductDesignPluginInstalled, productDesignAutoInstallRequested } from './product-design-app-server.js';
-import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } from './codex-app/glm-model-profile.js';
-import { GLM_52_OPENROUTER_MODEL } from './providers/glm/glm-52-settings.js';
+import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_52_OPENROUTER_MODEL, RETIRED_GLM_DESKTOP_CONFIG_PROFILE_IDS } from './codex-app/openrouter-provider.js';
 import { resolveOpenRouterApiKey } from './providers/openrouter/openrouter-secret-store.js';
 import { codexLbEnvPath, loadCodexLbEnv, parseShellEnvValue, readCodexLbModelCatalog } from './codex-lb/codex-lb-env.js';
 import { codexLbToolCatalogPath, inspectCodexLbToolCatalog } from './codex-lb/codex-lb-tool-catalog.js';
@@ -543,14 +542,14 @@ export function codexAppGuidance({ appInstalled, codex, mcpList, featureList, re
         lines.push('Run: sks doctor --fix');
     }
     if (providerModelUi?.glm?.exposed && providerModelUi.glm.openrouter_key_present) {
-        lines.push(`GLM model selector profile is exposed: ${providerModelUi.glm.model} via profiles ${providerModelUi.glm.profiles_present.join(', ')}.`);
+        lines.push(`OpenRouter provider is ready: ${providerModelUi.glm.model} (activate with ${providerModelUi.glm.install_command}).`);
     }
     else if (providerModelUi?.glm?.exposed) {
-        lines.push(`GLM model selector profile is exposed for ${providerModelUi.glm.model}, but the OpenRouter key is missing.`);
+        lines.push(`OpenRouter provider is present for ${providerModelUi.glm.model}, but the OpenRouter key is missing.`);
         lines.push(`Run: ${providerModelUi.glm.key_command}; restart Codex App if the model picker was already open.`);
     }
     else if (providerModelUi?.glm) {
-        lines.push(`GLM model selector profile is not exposed yet: ${providerModelUi.glm.blockers.join(', ') || 'profile setup required'}.`);
+        lines.push(`OpenRouter provider is not ready yet: ${providerModelUi.glm.blockers.join(', ') || 'provider setup required'}.`);
         lines.push(`Run: ${providerModelUi.glm.key_command}; then ${providerModelUi.glm.install_command}; restart Codex App if the model picker was already open.`);
     }
     if (providerModelUi?.codex_lb?.key_entry_visible && providerModelUi.codex_lb.key_present && providerModelUi.codex_lb.provider_present && providerModelUi.codex_lb.provider_contract_ok && providerModelUi.codex_lb.base_url_present) {
@@ -874,7 +873,6 @@ async function codexFastModeConfigStatus(opts = {}) {
             const line = lines[index] || '';
             if (!/^\s*model_reasoning_effort\s*=/.test(line))
                 continue;
-            // Preserve unmarked user reasoning choices. Only SKS-provenanced locks hide Fast UI.
             if (config.scope === 'global' ? isSksOwnedGlobalUiLock(lines, index) : true) {
                 blockers.push(`${config.scope}:top_level_model_reasoning_effort`);
             }
@@ -882,9 +880,6 @@ async function codexFastModeConfigStatus(opts = {}) {
         if (/(^|\n)\s*fast_default_opt_out\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(tomlTable(config.text, 'notice')))
             blockers.push(`${config.scope}:fast_default_opt_out`);
     }
-    // 2026-07 renewal: [user.fast_mode] left the config schema. Its PRESENCE is now
-    // the defect (a stale legacy stamp), not its absence — the old visible/enabled
-    // "missing" blockers inverted into a single legacy-residue blocker.
     const merged = configs.map((config) => config.text).join('\n');
     if (tomlTable(merged, 'user.fast_mode').trim())
         blockers.push('user.fast_mode.legacy_table_present');
@@ -933,20 +928,12 @@ export async function codexProviderModelUiStatus(opts = {}) {
     const profilesPresent = [];
     const profilesMissing = [];
     const glmProfileBlockers = [];
-    for (const profile of GLM_CODEX_CONFIG_REASONING_PROFILES) {
-        const body = tomlTableAny(configText, [`profiles.${profile.id}`, `profiles."${profile.id}"`]);
-        if (!body) {
-            profilesMissing.push(profile.id);
-            glmProfileBlockers.push(`glm_profile_missing:${profile.id}`);
+    for (const profileId of RETIRED_GLM_DESKTOP_CONFIG_PROFILE_IDS) {
+        const body = tomlTableAny(configText, [`profiles.${profileId}`, `profiles."${profileId}"`]);
+        if (!body)
             continue;
-        }
-        profilesPresent.push(profile.id);
-        if (!hasTomlString(body, 'model_provider', GLM_CODEX_CONFIG_PROVIDER_ID))
-            glmProfileBlockers.push(`glm_profile_provider_invalid:${profile.id}`);
-        if (!hasTomlString(body, 'model', GLM_52_OPENROUTER_MODEL))
-            glmProfileBlockers.push(`glm_profile_model_invalid:${profile.id}`);
-        if (!hasTomlString(body, 'model_reasoning_effort', profile.reasoning_effort))
-            glmProfileBlockers.push(`glm_profile_reasoning_invalid:${profile.id}`);
+        profilesPresent.push(profileId);
+        glmProfileBlockers.push(`retired_glm_desktop_profile_present:${profileId}`);
     }
     const codexLbProvider = tomlTableAny(configText, ['model_providers.codex-lb', 'model_providers."codex-lb"']);
     const codexLbProviderPresent = Boolean(codexLbProvider);
@@ -970,8 +957,6 @@ export async function codexProviderModelUiStatus(opts = {}) {
         const loadedEnv = await loadCodexLbEnv({ home, envPath: codexLbEnvFilePath }).catch(() => null);
         liveCatalog = loadedEnv ? await readCodexLbModelCatalog({ loadedEnv }).catch(() => null) : null;
     }
-    // Prefer the persisted Codex-owned catalog that Desktop actually loads. Live
-    // /models remains freshness telemetry and a fallback when no managed file exists.
     const codexLbModelCatalog = opts.codexLbModelCatalog || (persistedCatalog?.ok
         ? {
             ok: true,
@@ -1015,14 +1000,11 @@ export async function codexProviderModelUiStatus(opts = {}) {
         ? glmBlockers
         : [...glmBlockers, ...codexLbBlockers];
     const keyCommand = 'sks codex-app set-openrouter-key --api-key-stdin';
-    const installCommand = 'sks codex-app glm-profile install';
+    const installCommand = 'sks codex-app use-openrouter --model z-ai/glm-5.2';
     const setupCommand = 'sks codex-lb setup --host <domain> --api-key-stdin --yes';
     const setKeyCommand = 'sks codex-lb set-key --api-key-stdin';
     return {
         schema: 'sks.codex-app-provider-model-ui.v1',
-        // The top-level readiness contract is intentionally scoped to the active
-        // provider. Optional GLM/OpenRouter and codex-lb setup diagnostics remain
-        // visible below without making an unrelated provider selection fail.
         ok: selectedProviderBlockers.length === 0,
         selected_provider_ok: selectedProviderBlockers.length === 0,
         selected_provider: codexLbSelectedDefault ? 'codex-lb' : 'oauth',
@@ -1039,7 +1021,7 @@ export async function codexProviderModelUiStatus(opts = {}) {
             codex_lb_env: codexLbEnvFilePath
         },
         glm: {
-            exposed: glmProviderPresent && profilesMissing.length === 0 && glmProfileBlockers.length === 0,
+            exposed: glmProviderPresent && glmProfileBlockers.length === 0,
             provider_present: glmProviderPresent,
             provider: GLM_CODEX_CONFIG_PROVIDER_ID,
             model: GLM_52_OPENROUTER_MODEL,
@@ -1050,7 +1032,7 @@ export async function codexProviderModelUiStatus(opts = {}) {
             openrouter_key_preview: openRouterKey.key_preview || null,
             key_command: keyCommand,
             install_command: installCommand,
-            doctor_command: 'sks codex-app glm-profile doctor',
+            doctor_command: 'sks codex-app openrouter-status',
             blockers: glmBlockers
         },
         codex_lb: {
@@ -1170,9 +1152,9 @@ function glmModelUiSummary(status = {}) {
         return 'not checked';
     if (status.exposed) {
         const key = status.openrouter_key_present ? `key ${status.openrouter_key_source || 'present'}` : 'key missing';
-        return `ok ${status.model} (${status.profiles_present?.length || 0} profiles, ${key})`;
+        return `ok ${status.model} (${key})`;
     }
-    return `setup ${(status.blockers || []).join(', ') || 'profile missing'}; run ${status.key_command || 'sks codex-app set-openrouter-key --api-key-stdin'}`;
+    return `setup ${(status.blockers || []).join(', ') || 'provider missing'}; run ${status.key_command || 'sks codex-app set-openrouter-key --api-key-stdin'}`;
 }
 function codexLbKeyUiSummary(status = {}) {
     if (!status)

package/dist/core/codex-compat/codex-capability-matrix.js

@@ -0,0 +1,208 @@
+import { runProcess } from '../fsx.js';
+import { CURRENT_CODEX_RELEASE_MANIFEST, NARUTO_REQUIRED_CODEX_VERSION } from './codex-release-manifest.js';
+import { compareSemverLike, parseCodexVersionText } from './codex-version-policy.js';
+export const CODEX_CAPABILITY_MATRIX_SCHEMA = 'sks.codex-capability-matrix.v1';
+export const SKS_CODEX_CAPABILITY_IDS = [
+    'multi_agent_v2',
+    'agents_max_concurrent_threads_per_session',
+    'thread_list_search_read',
+    'mcp_startup_tool_timeouts',
+    'gpt56_terra_luna_sol_routing',
+    'exec_mcp_transient_recovery',
+    'rollout_token_budget'
+];
+const UPDATE_CTA = 'Update Codex CLI to the preferred latest: `sks codex update` or Menu Bar / SKS Center → Update Codex CLI Now.';
+export function preferredCodexCliVersion() {
+    return CURRENT_CODEX_RELEASE_MANIFEST.preferredCliVersion || CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion;
+}
+export function softMinimumCodexCliVersion() {
+    return CURRENT_CODEX_RELEASE_MANIFEST.minimumSupportedVersion;
+}
+export function narutoCodexFloorVersion() {
+    return NARUTO_REQUIRED_CODEX_VERSION;
+}
+export function buildCodexCapabilityMatrix(input = {}) {
+    const detected = parseCodexVersionText(input.version) || null;
+    const help = String(input.helpText || '');
+    const config = String(input.configText || '');
+    const schema = String(input.schemaText || '');
+    const policies = CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies;
+    const warnings = [];
+    if (detected && compareSemverLike(detected, preferredCodexCliVersion()) < 0) {
+        warnings.push(`detected Codex ${detected} is below preferred ${preferredCodexCliVersion()}; prefer latest via SKS update inducement`);
+    }
+    const multiAgentV2 = resolveMultiAgentV2({ detected, help, config, schema });
+    const agentsConcurrency = resolveAgentsConcurrency({ help, config, multiAgentV2: multiAgentV2.available });
+    const threadList = resolveBooleanCapability({
+        id: 'thread_list_search_read',
+        policy: policies.threadListSearchRead || 'probe',
+        markers: [/thread\/list/, /searchTerm/, /ThreadSearchResult/],
+        sources: [schema, help]
+    });
+    const mcpTimeouts = resolveBooleanCapability({
+        id: 'mcp_startup_tool_timeouts',
+        policy: policies.mcpStartupToolTimeouts || 'wrap',
+        markers: [/startup_timeout_sec/, /tool_timeout_sec/],
+        sources: [help, config],
+        forceAvailable: true
+    });
+    const gpt56 = resolveBooleanCapability({
+        id: 'gpt56_terra_luna_sol_routing',
+        policy: policies.gpt56TerraLunaSolRouting || 'delegate',
+        markers: [/gpt-5\.6-(?:luna|terra|sol)/],
+        sources: [help, config],
+        forceAvailable: Boolean(detected)
+    });
+    const execMcp = resolveBooleanCapability({
+        id: 'exec_mcp_transient_recovery',
+        policy: policies.execMcpTransientRecovery || 'probe',
+        markers: [/mcp.*reconnect|transient|exec_mcp/i],
+        sources: [help, schema]
+    });
+    const rollout = resolveBooleanCapability({
+        id: 'rollout_token_budget',
+        policy: policies.rolloutTokenBudget || 'probe',
+        markers: [/token.?budget|rollout/i],
+        sources: [help, schema]
+    });
+    return {
+        schema: CODEX_CAPABILITY_MATRIX_SCHEMA,
+        preferred_cli_version: preferredCodexCliVersion(),
+        minimum_supported_version: softMinimumCodexCliVersion(),
+        detected_version: detected,
+        capabilities: {
+            multi_agent_v2: multiAgentV2,
+            agents_max_concurrent_threads_per_session: agentsConcurrency,
+            thread_list_search_read: threadList,
+            mcp_startup_tool_timeouts: mcpTimeouts,
+            gpt56_terra_luna_sol_routing: gpt56,
+            exec_mcp_transient_recovery: execMcp,
+            rollout_token_budget: rollout
+        },
+        warnings
+    };
+}
+export function assertNarutoMultiAgentV2Capability(matrix) {
+    const state = matrix.capabilities.multi_agent_v2;
+    if (state.available) {
+        return { ok: true, blockers: [], guidance: [] };
+    }
+    return {
+        ok: false,
+        blockers: [
+            'naruto_requires_multi_agent_v2',
+            ...(state.blockers.length ? state.blockers : ['multi_agent_v2_unavailable']),
+            'update_codex_cli'
+        ],
+        guidance: [
+            UPDATE_CTA,
+            `Naruto needs Codex multi-agent V2 (preferred ${preferredCodexCliVersion()}+; capability floor ${narutoCodexFloorVersion()}+ when present).`
+        ]
+    };
+}
+export async function probeCodexHelpText(input) {
+    const result = await runProcess(input.codexBin, ['--help'], {
+        ...(input.env ? { env: input.env } : {}),
+        timeoutMs: input.timeoutMs ?? 5_000,
+        maxOutputBytes: 256 * 1024
+    }).catch(() => null);
+    if (!result || result.code !== 0)
+        return '';
+    return `${result.stdout || ''}${result.stderr || ''}`;
+}
+export async function probeNarutoCodexCapability(input) {
+    const helpText = await probeCodexHelpText({
+        codexBin: input.codexBin,
+        ...(input.env ? { env: input.env } : {})
+    });
+    const matrix = buildCodexCapabilityMatrix({
+        ...(input.version !== undefined ? { version: input.version } : {}),
+        helpText
+    });
+    return { matrix, naruto: assertNarutoMultiAgentV2Capability(matrix) };
+}
+function resolveMultiAgentV2(input) {
+    const policy = CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies.multiAgentV2
+        || CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies.multiAgentMode
+        || 'delegate';
+    const evidence = [];
+    const helpHit = /\bmulti_agent_v2\b/.test(input.help);
+    const configHit = /\[features\.multi_agent_v2\]|features\.multi_agent_v2\b/.test(input.config);
+    const schemaHit = /\bMultiAgentMode\b|\bmulti_agent_v2\b/.test(input.schema);
+    if (helpHit)
+        evidence.push('help_mentions_multi_agent_v2');
+    if (configHit)
+        evidence.push('config_mentions_multi_agent_v2');
+    if (schemaHit)
+        evidence.push('schema_mentions_multi_agent_v2');
+    if (helpHit || configHit || schemaHit) {
+        return {
+            id: 'multi_agent_v2',
+            available: true,
+            policy,
+            evidence,
+            blockers: [],
+            update_cta: null
+        };
+    }
+    if (input.detected && compareSemverLike(input.detected, narutoCodexFloorVersion()) >= 0) {
+        return {
+            id: 'multi_agent_v2',
+            available: true,
+            policy,
+            evidence: [`version_meets_naruto_floor:${input.detected}`],
+            blockers: [],
+            update_cta: null
+        };
+    }
+    return {
+        id: 'multi_agent_v2',
+        available: false,
+        policy,
+        evidence,
+        blockers: input.detected
+            ? [`multi_agent_v2_missing_on_codex_${input.detected}`]
+            : ['multi_agent_v2_probe_empty'],
+        update_cta: UPDATE_CTA
+    };
+}
+function resolveAgentsConcurrency(input) {
+    const policy = CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies.agentsMaxConcurrentThreads || 'delegate';
+    const hit = /max_concurrent_threads_per_session/.test(input.help)
+        || /max_concurrent_threads_per_session/.test(input.config);
+    const available = hit || input.multiAgentV2;
+    return {
+        id: 'agents_max_concurrent_threads_per_session',
+        available,
+        policy,
+        evidence: hit
+            ? ['mentions_max_concurrent_threads_per_session']
+            : input.multiAgentV2
+                ? ['inferred_from_multi_agent_v2']
+                : [],
+        blockers: available ? [] : ['agents_max_concurrent_threads_unavailable'],
+        update_cta: available ? null : UPDATE_CTA
+    };
+}
+function resolveBooleanCapability(input) {
+    if (input.forceAvailable) {
+        return {
+            id: input.id,
+            available: true,
+            policy: input.policy,
+            evidence: ['sks_owned_surface'],
+            blockers: [],
+            update_cta: null
+        };
+    }
+    const joined = input.sources.join('\n');
+    const hit = input.markers.some((marker) => marker.test(joined));
+    return {
+        id: input.id,
+        available: hit,
+        policy: input.policy,
+        evidence: hit ? [`marker_hit:${input.id}`] : [],
+        blockers: hit ? [] : [`${input.id}_unavailable`],
+        update_cta: hit || input.policy === 'disable' ? null : UPDATE_CTA
+    };
+}

package/dist/core/codex-compat/codex-hook-output-builders.js

@@ -1,6 +1,14 @@
 import {} from './codex-schema-snapshot.js';
 export function buildPreToolUseContinue(options = {}) {
-    return withOptionalSystemMessage({ continue: true }, options.systemMessage);
+    const output = { continue: true };
+    const additionalContext = optionalText(options.additionalContext);
+    if (additionalContext) {
+        output.hookSpecificOutput = {
+            hookEventName: 'PreToolUse',
+            additionalContext
+        };
+    }
+    return withOptionalSystemMessage(output, options.systemMessage);
 }
 export function buildPreToolUseDeny(reason, options = {}) {
     const trimmed = requiredReason(reason, 'PreToolUse deny requires a non-empty reason');

package/dist/core/codex-compat/codex-hook-output-normalizer.js

@@ -25,7 +25,7 @@ export function normalizeCodexHookOutput(name, result = {}) {
         }
         if (decision === 'allow' && out.updatedInput !== undefined)
             return buildPreToolUseAllowRewrite(out.updatedInput, { systemMessage });
-        return buildPreToolUseContinue({ systemMessage });
+        return buildPreToolUseContinue({ additionalContext: out.additionalContext, systemMessage });
     }
     if (eventName === 'PermissionRequest') {
         if (out.decision === 'deny' || out.permissionDecision === 'deny') {

package/dist/core/codex-compat/codex-hook-semantic-validator.js

@@ -98,8 +98,9 @@ function validatePreToolUse(output, issues) {
     const specific = asRecord(output.hookSpecificOutput);
     if (!specific)
         return;
-    if (specific.additionalContext !== undefined)
-        pushStrictSubset(issues, 'pretooluse_additional_context', 'PreToolUse additionalContext is schema-compatible but disallowed by the SKS zero-warning strict subset.', '$.hookSpecificOutput.additionalContext');
+    if (specific.additionalContext !== undefined && typeof specific.additionalContext !== 'string') {
+        pushIssue(issues, 'schema_violation', 'pretooluse_additional_context_type', 'PreToolUse additionalContext must be a string.', '$.hookSpecificOutput.additionalContext', { upstream_supported: false });
+    }
     const decision = specific.permissionDecision;
     const hasUpdatedInput = Object.prototype.hasOwnProperty.call(specific, 'updatedInput');
     const hasReason = Object.prototype.hasOwnProperty.call(specific, 'permissionDecisionReason');