sneakoscope 7.1.0 → 7.1.1

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current release: **SKS 7.1.0**, with the package preferred Codex channel at **CLI 0.145.0**. SKS stays version-agnostic: older hosts keep working where capabilities allow, while Menu Bar / Center induce updates to the preferred latest. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps current-version Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it. See [CHANGELOG.md](CHANGELOG.md).
+Current release: **SKS 7.1.1**, with the package preferred Codex channel at **CLI 0.145.0**. SKS stays version-agnostic: older hosts keep working where capabilities allow, while Menu Bar / Center induce updates to the preferred latest. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps current-version Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it. See [CHANGELOG.md](CHANGELOG.md).
 
 ## What 7.0.0 Ships
 
@@ -54,6 +54,12 @@ The SKS menu bar shows the installed Codex CLI version and latest known version.
 
 **Manage MCP Servers…** opens a native macOS manager for the global `~/.codex/config.toml`. It can add remote URL or local stdio servers, enable/disable existing entries, remove entries after confirmation, and refresh the current state. Mutations are lock-protected, backed up, TOML-validated, and written with mode `0600`; configured environment values and command arguments are never rendered in the list. Changes apply to new Codex sessions. The same plumbing is available through the canonical `sks mcp config list|get|add|edit|duplicate|enable|disable|remove|test|login|logout|backups|restore` surface for diagnostics and automation.
 
+### Telegram remote coding on this Mac
+
+Open **SKS Center → Remote & Telegram**, create a private bot with BotFather, send `/start` to that bot from the Telegram account you want to pair, then choose **Connect Bot & Register Coding Session…** and paste the token. SKS verifies the bot, stores the token only in macOS Keychain, pairs only that private chat/user, and registers one dedicated session bound to the current project. Choose **Start Hub**, then send ordinary text to the bot. On the first real message, the Hub creates the Codex thread and starts its first turn in the same App Server connection so the thread is durably resumable; later messages resume that exact thread and return the final response to Telegram.
+
+The Hub runs as a user LaunchAgent and uses `caffeinate -i` while the logged-in Mac is available. The Mac still needs to remain powered on, logged in, awake, and network-connected; closing the lid or logging out can stop access. Telegram input has no arbitrary shell path, runs with approvals disabled and network access disabled inside the Codex workspace sandbox, and cannot target an unpaired chat or another project.
+
 ## The Front Door
 
 | Command | What it does |

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "7.1.0"
+version = "7.1.1"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "7.1.0"
+version = "7.1.1"
 edition = "2021"
 
 [dependencies]

package/dist/cli/command-manifest-lite.js

@@ -36,7 +36,7 @@ export const COMMAND_MANIFEST_LITE = [
     { name: 'codex-lb', summary: 'Inspect codex-lb status and circuit health', maturity: 'beta' },
     { name: 'menubar', summary: 'Inspect/install/restart/uninstall SKS menu bar', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
     { name: 'remote', summary: 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', maturity: 'beta' },
-    { name: 'telegram', summary: 'Inspect and run the private proof-aware Telegram Hub', maturity: 'beta' },
+    { name: 'telegram', summary: 'Pair and run the private local Codex Telegram Hub', maturity: 'beta' },
     { name: 'hooks', summary: 'Explain and inspect Codex hooks', maturity: 'beta', skipMigrationGate: true },
     { name: 'zellij-lane', summary: 'Render a Zellij lane frame for SKS sessions', maturity: 'beta' },
     { name: 'zellij-slot-pane', summary: 'Render a compact Zellij worker slot pane', maturity: 'beta' },

package/dist/cli/command-registry.js

@@ -155,7 +155,7 @@ const COMMAND_DEFINITIONS = {
     'codex-lb': entry('beta', 'Inspect codex-lb status and circuit health', 'dist/commands/codex-lb.js', directCommand(() => import('../commands/codex-lb.js'), 'dist/commands/codex-lb.js')),
     menubar: activeRouteDiagnostic(entry('beta', 'Inspect/install/restart/uninstall SKS menu bar', 'dist/core/commands/menubar-command.js', subcommand(() => import('../core/commands/menubar-command.js'), 'menubarCommand', 'dist/core/commands/menubar-command.js', 'status'))),
     remote: entry('beta', 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', 'dist/core/commands/remote-command.js', argsCommand(() => import('../core/commands/remote-command.js'), 'remoteCommand', 'dist/core/commands/remote-command.js')),
-    telegram: entry('beta', 'Inspect and run the private proof-aware Telegram Hub', 'dist/core/commands/telegram-command.js', argsCommand(() => import('../core/commands/telegram-command.js'), 'telegramCommand', 'dist/core/commands/telegram-command.js')),
+    telegram: entry('beta', 'Pair and run the private local Codex Telegram Hub', 'dist/core/commands/telegram-command.js', argsCommand(() => import('../core/commands/telegram-command.js'), 'telegramCommand', 'dist/core/commands/telegram-command.js')),
     hooks: skipMigrationGate(entry('beta', 'Explain and inspect Codex hooks', 'dist/commands/hooks.js', directCommand(() => import('../commands/hooks.js'), 'dist/commands/hooks.js'))),
     'zellij-lane': entry('beta', 'Render a Zellij lane frame for SKS sessions', 'dist/commands/zellij-lane.js', directCommand(() => import('../commands/zellij-lane.js'), 'dist/commands/zellij-lane.js')),
     'zellij-slot-pane': entry('beta', 'Render a compact Zellij worker slot pane', 'dist/commands/zellij-slot-pane.js', directCommand(() => import('../commands/zellij-slot-pane.js'), 'dist/commands/zellij-slot-pane.js')),

package/dist/commands/codex-app.js

@@ -16,6 +16,7 @@ import { OPENROUTER_DEFAULT_MODEL } from '../core/codex-app/openrouter-provider.
 import { promptForOpenRouterKeyHidden, writeStoredOpenRouterKey } from '../core/providers/openrouter/openrouter-secret-store.js';
 import { compactOpenRouterModelsResult, listOpenRouterModels, testOpenRouterConnection } from '../core/providers/openrouter/openrouter-account.js';
 import { restartCodexApp } from '../core/codex-app/codex-app-restart.js';
+import { MULTI_PROVIDER_ROUTER_DEFAULT_BASE_URL, multiProviderRouterStatus, testMultiProviderRouter, useMultiProviderRouter } from '../core/codex-app/multi-provider-router.js';
 import { resetRoleModelPreference, roleModelPreferencesStatus, setRoleModelPreference } from '../core/subagents/role-model-preferences.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'check';
@@ -93,12 +94,38 @@ export async function run(_command, args = []) {
         const result = await testOpenRouterConnection({ model: readOption(args, '--model', '') });
         return printCodexAppResult(args, result);
     }
+    if (action === 'router-status' || action === 'multi-provider-status' || action === 'opencodex-status') {
+        const result = await multiProviderRouterStatus({
+            baseUrl: readOption(args, '--base-url', ''),
+            catalogPath: readOption(args, '--catalog', '')
+        });
+        return printCodexAppResult(args, result);
+    }
+    if (action === 'router-test' || action === 'multi-provider-test' || action === 'opencodex-test') {
+        const result = await testMultiProviderRouter({
+            baseUrl: readOption(args, '--base-url', MULTI_PROVIDER_ROUTER_DEFAULT_BASE_URL),
+            catalogPath: readOption(args, '--catalog', ''),
+            model: readOption(args, '--model', '')
+        });
+        return printCodexAppResult(args, result);
+    }
+    if (action === 'use-router' || action === 'use-multi-provider' || action === 'use-opencodex') {
+        const result = await useMultiProviderRouter({
+            model: readOption(args, '--model', ''),
+            baseUrl: readOption(args, '--base-url', MULTI_PROVIDER_ROUTER_DEFAULT_BASE_URL),
+            catalogPath: readOption(args, '--catalog', ''),
+            replaceCatalog: flag(args, '--replace-catalog'),
+            restartApp: flag(args, '--restart-app') || flag(args, '--restart') || !flag(args, '--no-restart-app')
+        });
+        return printCodexAppResult(args, result);
+    }
     if (action === 'role-models') {
         return printCodexAppResult(args, await roleModelPreferencesStatus());
     }
     if (action === 'set-role-model') {
         const result = await setRoleModelPreference({
             role: readOption(args, '--role', ''),
+            provider: readOption(args, '--provider', ''),
             model: readOption(args, '--model', ''),
             reasoning: readOption(args, '--reasoning', '')
         });
@@ -168,7 +195,7 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|set-openrouter-key [--api-key-stdin]|use-openrouter --model <id>|openrouter-status|openrouter-models [--ids-only]|openrouter-test [--model <id>]|role-models|set-role-model --role <name> --model <id> --reasoning <effort>|reset-role-model --role <name>|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
+    console.error('Usage: sks codex-app check|status|harness-matrix|skill-sync|agent-role-sync|init-deep|hook-lifecycle|execution-profile|set-openrouter-key [--api-key-stdin]|use-openrouter --model <id>|openrouter-status|openrouter-models [--ids-only]|openrouter-test [--model <id>]|router-status [--base-url <loopback-url>] [--catalog <path>]|router-test --model <provider/model> [--base-url <loopback-url>] [--catalog <path>]|use-router --model <provider/model> [--base-url <loopback-url>] [--catalog <path>] [--replace-catalog]|role-models|set-role-model --role <name> [--provider <id>] --model <catalog-slug> --reasoning <effort>|reset-role-model --role <name>|product-design [--check-only]|ensure-product-design|chrome-extension|pat status|remote-control [--json]');
     console.error('Note: glm-profile is retired (strips leftover Desktop GLM profiles); use set-openrouter-key / use-openrouter.');
     process.exitCode = 1;
 }

package/dist/commands/doctor-profile.js

@@ -0,0 +1,78 @@
+import { flag } from '../cli/args.js';
+import { sksMenuBarRestartDeferred } from '../core/codex-app/sks-menubar.js';
+export function doctorProfileFromArgs(args = [], doctorFix = false) {
+    const explicit = readOption(args, '--profile');
+    if (isDoctorProfile(explicit))
+        return explicit;
+    if (flag(args, '--full'))
+        return 'full';
+    if (flag(args, '--capabilities'))
+        return 'capabilities';
+    return doctorFix ? 'fix' : 'fast';
+}
+export function doctorArgWarnings(args = []) {
+    const warnings = [];
+    const explicit = readOption(args, '--profile');
+    if (explicit && !isDoctorProfile(explicit)) {
+        warnings.push(`unknown_profile:${explicit}; supported profiles: migration, full, capabilities, fast, fix`);
+    }
+    for (const value of unknownDoctorFlags(args))
+        warnings.push(`unknown_flag:${value}`);
+    return warnings;
+}
+export function doctorMenuBarInstallPolicy(args = [], doctorFix = false, env = process.env) {
+    const profile = doctorProfileFromArgs(args, doctorFix);
+    const phaseEnabled = doctorPhaseIdsForProfile(profile).includes('sks_menubar');
+    const apply = doctorFix && phaseEnabled;
+    return {
+        profile,
+        phase_enabled: phaseEnabled,
+        apply,
+        launch: apply && !sksMenuBarRestartDeferred(env)
+    };
+}
+export function doctorPhaseIdsForProfile(profile) {
+    const required = [
+        'codex_startup_repair',
+        'startup_config_repair',
+        'context7_repair',
+        'context7_mcp_repair',
+        'hook_trust_repair',
+        'command_alias_cleanup'
+    ];
+    if (profile === 'migration')
+        return required;
+    const optional = ['supabase_mcp_repair', 'native_capability_repair', 'sks_menubar'];
+    if (profile === 'full' || profile === 'capabilities')
+        return ['setup', ...required, ...optional];
+    return [...required, ...optional];
+}
+function unknownDoctorFlags(args) {
+    const knownBoolean = new Set([
+        '--fix', '--yes', '-y', '--machine-only', '--actual-codex', '--require-actual-codex',
+        '--full', '--capabilities', '--repair-codex-app-ui', '--repair-zellij', '--install-homebrew',
+        '--repair-native-capabilities', '--repair-codex-native', '--local-only', '--global-only', '--project', '--global',
+        '--dry-run', '--json'
+    ]);
+    const knownValue = new Set(['--profile', '--report-file', '--codex-bin', '--install-scope']);
+    const unknown = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = String(args[index] || '');
+        if (!arg.startsWith('-'))
+            continue;
+        if (knownValue.has(arg)) {
+            index += 1;
+            continue;
+        }
+        if (!knownBoolean.has(arg))
+            unknown.push(arg);
+    }
+    return unknown;
+}
+function isDoctorProfile(value) {
+    return ['migration', 'full', 'capabilities', 'fast', 'fix'].includes(String(value || ''));
+}
+function readOption(args, name) {
+    const index = args.indexOf(name);
+    return index >= 0 && args[index + 1] ? String(args[index + 1]) : null;
+}

package/dist/commands/doctor.js

@@ -25,11 +25,13 @@ import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native
 import { withSecretPreservationGuard } from '../core/config/config-migration-journal.js';
 import { reconcileDoctorSkills } from '../core/doctor/doctor-skill-reconcile.js';
 import { isUpdateMigrationReceiptCurrent, projectUpdateMigrationReceiptPath, writeProjectUpdateMigrationReceipt } from '../core/update/update-migration-state.js';
-import { inspectSksMenuBarStatus, installSksMenuBar } from '../core/codex-app/sks-menubar.js';
+import { inspectSksMenuBarStatus, installSksMenuBar, sksMenuBarRestartDeferred } from '../core/codex-app/sks-menubar.js';
 import { sweepSksTempDirs } from '../core/retention.js';
 import { detectImagegenCapability } from '../core/imagegen/imagegen-capability.js';
 import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
 import { formatHarnessConflictReport, scanHarnessConflicts } from '../core/harness-conflicts.js';
+import { doctorArgWarnings, doctorMenuBarInstallPolicy, doctorPhaseIdsForProfile, doctorProfileFromArgs } from './doctor-profile.js';
+export { doctorArgWarnings, doctorMenuBarInstallPolicy, doctorProfileFromArgs } from './doctor-profile.js';
 export async function run(_command, args = [], deps = {}) {
     const root = await projectRoot();
     const doctorFix = flag(args, '--fix');
@@ -88,6 +90,9 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         || (await import('../cli/install-helpers.js')).ensureStoredOpenRouterProviderDuringInstall;
     const installMenuBarImpl = deps.installSksMenuBarImpl || installSksMenuBar;
     const codexLbStatusImpl = deps.codexLbStatusImpl || codexLbStatus;
+    const doctorEnv = deps.env || (deps.home
+        ? { ...process.env, HOME: home }
+        : process.env);
     const providerStatus = await codexLbStatusImpl({
         probeToolOutputRecovery: true,
         allowUnverifiedToolOutputRecovery: codexLbToolOutputRecoveryOverrideAcknowledged({ args })
@@ -128,9 +133,11 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         status: 'failed',
         error: err?.message || String(err)
     }));
-    const openRouterEnv = deps.env || (deps.home
-        ? { ...process.env, HOME: home, SKS_HOME: path.join(home, '.sneakoscope') }
-        : { ...process.env, HOME: home });
+    const openRouterEnv = {
+        ...doctorEnv,
+        HOME: home,
+        SKS_HOME: path.join(home, '.sneakoscope')
+    };
     const openRouterProvider = await ensureStoredOpenRouterProviderImpl({ home, env: openRouterEnv }).catch((err) => ({
         schema: 'sks.openrouter-provider-upgrade-repair.v1',
         ok: false,
@@ -142,7 +149,8 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         home,
         root: home,
         apply: true,
-        launch: true,
+        launch: !sksMenuBarRestartDeferred(doctorEnv),
+        env: doctorEnv,
         quiet: flag(args, '--json') || flag(args, '--machine-only')
     }).catch((err) => ({
         schema: 'sks.codex-app-sks-menubar.v1',
@@ -674,15 +682,18 @@ async function runDoctor(args = [], root, doctorFix) {
             blockers: [err?.message || String(err)]
         }))
         : codexAppUiPlan;
+    const menuBarPolicy = doctorMenuBarInstallPolicy(args, doctorFix, process.env);
+    const menuBarLaunchRequested = menuBarPolicy.launch;
     const sksMenuBar = await installSksMenuBar({
         root,
-        apply: doctorFix,
-        launch: doctorFix,
+        apply: menuBarPolicy.apply,
+        launch: menuBarLaunchRequested,
+        env: process.env,
         quiet: machineOnly || flag(args, '--json')
     }).catch((err) => ({
         schema: 'sks.codex-app-sks-menubar.v1',
         ok: false,
-        apply: doctorFix,
+        apply: menuBarPolicy.apply,
         status: 'blocked',
         platform: process.platform,
         app_path: null,
@@ -693,7 +704,7 @@ async function runDoctor(args = [], root, doctorFix) {
         report_path: `${root}/.sneakoscope/reports/sks-menubar.json`,
         menu_items: [],
         actions: [],
-        launch: { requested: doctorFix, method: 'none', ok: false, error: err?.message || String(err) },
+        launch: { requested: menuBarLaunchRequested, method: 'none', ok: false, error: err?.message || String(err) },
         tcc_automation_status: 'unknown',
         next_actions: [
             'Run: sks menubar status',
@@ -1708,65 +1719,6 @@ function fallbackCodexNativeFeatureMatrix(codex, blockers = [], warnings = []) {
         warnings
     };
 }
-export function doctorProfileFromArgs(args = [], doctorFix = false) {
-    const explicit = readOption(args, '--profile', null);
-    if (explicit === 'migration' || explicit === 'full' || explicit === 'capabilities' || explicit === 'fast' || explicit === 'fix')
-        return explicit;
-    if (flag(args, '--full'))
-        return 'full';
-    if (flag(args, '--capabilities'))
-        return 'capabilities';
-    return doctorFix ? 'fix' : 'fast';
-}
-export function doctorArgWarnings(args = []) {
-    const warnings = [];
-    const explicit = readOption(args, '--profile', null);
-    if (explicit && !['migration', 'full', 'capabilities', 'fast', 'fix'].includes(String(explicit))) {
-        warnings.push(`unknown_profile:${explicit}; supported profiles: migration, full, capabilities, fast, fix`);
-    }
-    for (const flag of unknownDoctorFlags(args))
-        warnings.push(`unknown_flag:${flag}`);
-    return warnings;
-}
-function unknownDoctorFlags(args = []) {
-    const knownBoolean = new Set([
-        '--fix', '--yes', '-y', '--machine-only', '--actual-codex', '--require-actual-codex',
-        '--full', '--capabilities', '--repair-codex-app-ui', '--repair-zellij', '--install-homebrew',
-        '--repair-native-capabilities', '--repair-codex-native', '--local-only', '--global-only', '--project', '--global',
-        '--dry-run', '--json'
-    ]);
-    const knownValue = new Set(['--profile', '--report-file', '--codex-bin', '--install-scope']);
-    const unknown = [];
-    for (let index = 0; index < args.length; index += 1) {
-        const arg = String(args[index] || '');
-        if (!arg.startsWith('-'))
-            continue;
-        if (knownValue.has(arg)) {
-            index += 1;
-            continue;
-        }
-        if (knownBoolean.has(arg))
-            continue;
-        unknown.push(arg);
-    }
-    return unknown;
-}
-function doctorPhaseIdsForProfile(profile) {
-    const required = [
-        'codex_startup_repair',
-        'startup_config_repair',
-        'context7_repair',
-        'context7_mcp_repair',
-        'hook_trust_repair',
-        'command_alias_cleanup'
-    ];
-    if (profile === 'migration')
-        return required;
-    const optional = ['supabase_mcp_repair', 'native_capability_repair', 'sks_menubar'];
-    if (profile === 'full' || profile === 'capabilities')
-        return ['setup', ...required, ...optional];
-    return [...required, ...optional];
-}
 async function writeJsonReportFile(file, value) {
     const fsp = await import('node:fs/promises');
     const path = await import('node:path');