sneakoscope 7.1.0 → 7.3.0

package/dist/core/ppt.js

@@ -10,6 +10,7 @@ export { PPT_DESIGN_REFERENCE_PROFILES, buildPptStyleTokens, selectPptDesignRefe
 import { buildPptHtml } from './ppt/html.js';
 export { buildPptHtml } from './ppt/html.js';
 import { imageDimensions, sha256File } from './wiki-image/image-hash.js';
+import { imagegenEvidenceClassBlockers, isFullImagegenOutputSource } from './imagegen/imagegen-evidence.js';
 export const PPT_REQUIRED_GATE_FIELDS = Object.freeze([
     'clarification_contract_sealed',
     'audience_strategy_sealed',
@@ -409,9 +410,8 @@ function pptImageAssetEvidenceBlockers(asset = {}, evidence = {}) {
     const evidenceClass = String(asset.evidence_class || '');
     const outputSource = String(asset.output_source || '');
     const outputSha = String(asset.output_sha256 || '');
-    if (evidenceClass !== 'codex_app_imagegen')
-        blockers.push(evidenceClass ? `ppt_image_asset_evidence_class_not_codex_app:${evidenceClass}` : 'ppt_image_asset_evidence_class_missing');
-    if (!['manual_attach', 'auto_discovered_generated_images'].includes(outputSource))
+    blockers.push(...imagegenEvidenceClassBlockers('ppt_image_asset', evidenceClass));
+    if (!isFullImagegenOutputSource(outputSource))
         blockers.push(`ppt_image_asset_output_source_invalid:${outputSource || 'missing'}`);
     if (!outputSha)
         blockers.push('ppt_image_asset_output_sha256_missing');

package/dist/core/product-design-app-server.js

@@ -1,4 +1,5 @@
 import { spawn } from 'node:child_process';
+import { PACKAGE_VERSION } from './version.js';
 import { EMPTY_CODEX_INFO, getCodexInfo } from './codex-adapter.js';
 import { PRODUCT_DESIGN_PLUGIN, normalizeProductDesignPluginEvidence } from './product-design-plugin.js';
 export const PRODUCT_DESIGN_AUTO_INSTALL_ENV = 'SKS_PRODUCT_DESIGN_AUTO_INSTALL';
@@ -309,7 +310,7 @@ class CodexAppServerJsonRpcClient {
             clientInfo: {
                 name: 'sneakoscope-product-design',
                 title: 'Sneakoscope Product Design Installer',
-                version: '1.0.0'
+                version: PACKAGE_VERSION
             },
             capabilities: {
                 experimentalApi: true,

package/dist/core/proof/fake-real-proof-policy.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
 import { normalizeProofRoute } from './route-proof-policy.js';
 import { effectiveSubagentTarget, normalizeLegacySubagentCountFields, subagentCountContractBlockers } from '../subagents/wave-lifecycle.js';
+import { uniqueStrings } from '../text/strings.js';
 export const FAKE_REAL_PROOF_POLICY_SCHEMA = 'sks.fake-real-proof-policy.v3';
 export const OFFICIAL_SUBAGENT_EXECUTION_AUTHORITY = 'official_codex_subagent';
 export const OFFICIAL_SUBAGENT_EXECUTION_ARTIFACTS = [
@@ -286,6 +287,3 @@ function runScopedObservedStarts(plan, evidence) {
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
-function uniqueStrings(values) {
-    return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))];
-}

package/dist/core/proof/root-cause-policy.js

@@ -1,9 +1,7 @@
+import { asRecordOrEmpty as asRecord } from '../json/records.js';
 const PROBLEM_PATTERN = /\b(fallback|workaround|bypass|temporary|synthetic|stale|missing|failed|failure|error|blocked|not_ok|not ok|fixture_child_missing|native_agent_proof_false)\b/i;
 const COMPLETE_STATUSES = new Set(['complete', 'completed', 'corrected', 'resolved', 'fixed']);
 const BLOCKING_STATUSES = new Set(['blocked', 'failed', 'not_verified']);
-function asRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}
 function asList(value) {
     return Array.isArray(value) ? value : [];
 }

package/dist/core/proof/validation.js

@@ -1,8 +1,6 @@
 import { containsPlaintextSecret } from '../secret-redaction.js';
 import { COMPLETION_PROOF_SCHEMA, COMPLETION_PROOF_STATUSES } from './proof-schema.js';
-function asRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}
+import { asRecordOrEmpty as asRecord } from '../json/records.js';
 export function validateCompletionProof(proof = {}) {
     const issues = [];
     const record = asRecord(proof);

package/dist/core/provider/model-router.js

@@ -66,6 +66,10 @@ export function normalizeNarutoGpt56Model(value) {
     const model = String(value || '').trim().toLowerCase();
     return NARUTO_MODELS.includes(model) ? model : null;
 }
+export function childInheritsActiveMainModel(value) {
+    const model = String(value || '').trim();
+    return Boolean(model) && !isNarutoGpt56Model(model);
+}
 export function categoryForWorkerRole(role, taskText = '') {
     const text = `${String(role || '')} ${String(taskText || '')}`.toLowerCase();
     if (/(refactor|re-?architect|리팩터|아키텍처)/i.test(text))

package/dist/core/provider/provider-context.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { exists, nowIso, readJson, readText, writeJsonAtomic } from '../fsx.js';
+import { escapeRegExp } from '../text/regex.js';
 export const PROVIDER_CONTEXT_SCHEMA = 'sks.provider-context.v1';
 export async function resolveProviderContext(input = {}) {
     const env = input.env || process.env;
@@ -139,6 +140,3 @@ function codexLbProviderBody(text) {
     }
     return inTable ? out.join('\n') : null;
 }
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}

package/dist/core/providers/openrouter/openrouter-account.js

@@ -2,6 +2,7 @@ import { nowIso } from '../../fsx.js';
 import { normalizeOpenRouterModelId } from '../../codex-app/openrouter-provider.js';
 import { resolveOpenRouterApiKey } from './openrouter-secret-store.js';
 import { invalidOpenRouterResponseIssue, normalizeOpenRouterError } from './openrouter-error.js';
+import { isRecord } from '../../json/records.js';
 export const OPENROUTER_KEY_URL = 'https://openrouter.ai/api/v1/key';
 export const OPENROUTER_MODELS_URL = 'https://openrouter.ai/api/v1/models';
 export const OPENROUTER_MODEL_ROW_LIMIT = 1_000;
@@ -287,9 +288,6 @@ function finiteInteger(value) {
     const number = Number(value);
     return Number.isFinite(number) && number >= 0 ? Math.floor(number) : null;
 }
-function isRecord(value) {
-    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-}
 function emptyModelsResult(blocker, warnings) {
     return {
         schema: 'sks.openrouter-models.v1',

package/dist/core/recallpulse.js

@@ -371,7 +371,7 @@ export async function buildRecallPulseGovernanceReport(root, opts = {}) {
                 existing_research_artifacts: 'Research gates require agent display_name/persona/persona_boundary fields and the research_reviewer GPT-5.6 Sol Max binding; old ledgers must be migrated before claiming pass.',
                 generated_skills: 'Do not edit generated installed skills directly; rerun init/bootstrap from engine source when generated text needs refreshing.'
             },
-            release_gate: '0.8.0 remains report-only unless packcheck, selftest, sizecheck, registry metadata check, TriWiki validate, and RecallPulse fixture eval pass.'
+            release_gate: 'RecallPulse remains report-only unless packcheck, selftest, sizecheck, registry metadata check, TriWiki validate, and RecallPulse fixture eval pass.'
         }
     };
     if (missionId)

package/dist/core/release/file-ownership.js

@@ -1,7 +1,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { escapeRegExp } from '../text/regex.js';
 export const RELEASE_FILE_OWNERSHIP_REPORT_SCHEMA = 'sks.release-file-ownership-report.v1';
+export function sharedFileRequestDir(release) {
+    return `.sneakoscope/release/${release}/shared-file-requests`;
+}
 export function readReleaseFileOwnershipManifest(file) {
     const value = JSON.parse(fs.readFileSync(file, 'utf8'));
     if (value?.schema !== 'sks.release-file-ownership.v1')
@@ -14,16 +18,16 @@ export function readReleaseFileOwnershipManifest(file) {
     return value;
 }
 export function inspectReleaseFileOwnership(input) {
+    const release = (input.release || input.manifest.release || '').trim();
     const canonicalBase = gitCommit(input.root, input.base);
     const canonicalHead = gitCommit(input.root, input.head);
     const changedFiles = canonicalBase && canonicalHead ? gitChangedFiles(input.root, canonicalBase, canonicalHead) : [];
-    const workstream = input.workstream || inferWorkstream(input.manifest, changedFiles);
+    const workstream = input.workstream || inferWorkstream(input.manifest, changedFiles, release);
     const allowedPatterns = workstream ? input.manifest.workstreams[workstream] || [] : [];
     const sharedPatterns = input.manifest.shared_files || [];
-    const requestPrefix = workstream ? `.sneakoscope/release/6.3.0/shared-file-requests/${workstream}` : '';
     const sharedFileChanges = changedFiles.filter((file) => matchesAny(file, sharedPatterns));
     const outOfScopeChanges = changedFiles.filter((file) => {
-        if (requestPrefix && isWorkstreamRequest(file, workstream || ''))
+        if (release && workstream && isWorkstreamRequest(file, workstream, release))
             return false;
         return !matchesAny(file, allowedPatterns);
     });
@@ -34,6 +38,8 @@ export function inspectReleaseFileOwnership(input) {
         return owners.length > 1 ? [{ file, owners }] : [];
     });
     const blockers = [];
+    if (!release)
+        blockers.push('release_unresolved');
     if (!workstream)
         blockers.push('workstream_unresolved');
     else if (!input.manifest.workstreams[workstream])
@@ -61,6 +67,7 @@ export function inspectReleaseFileOwnership(input) {
         ok: blockers.length === 0,
         base: canonicalBase || input.base,
         head: canonicalHead || input.head,
+        release: release || null,
         workstream,
         changed_files: changedFiles,
         allowed_patterns: allowedPatterns,
@@ -71,16 +78,19 @@ export function inspectReleaseFileOwnership(input) {
         checked_at: new Date().toISOString()
     };
 }
-function inferWorkstream(manifest, changedFiles) {
-    const requestOwners = [...new Set(changedFiles.flatMap((file) => {
-            const match = file.match(/^\.sneakoscope\/release\/6\.3\.0\/shared-file-requests\/(W\d+)(?:-[^/]+)?\.json$/);
-            return match?.[1] ? [match[1]] : [];
-        }))];
-    const requestOwner = requestOwners[0];
-    if (requestOwners.length === 1 && requestOwner && manifest.workstreams[requestOwner])
-        return requestOwner;
+function inferWorkstream(manifest, changedFiles, release) {
+    if (release) {
+        const requestPattern = new RegExp(`^${escapeRegExp(sharedFileRequestDir(release))}/(W\\d+)(?:-[^/]+)?\\.json$`);
+        const requestOwners = [...new Set(changedFiles.flatMap((file) => {
+                const match = file.match(requestPattern);
+                return match?.[1] ? [match[1]] : [];
+            }))];
+        const requestOwner = requestOwners[0];
+        if (requestOwners.length === 1 && requestOwner && manifest.workstreams[requestOwner])
+            return requestOwner;
+    }
     const candidates = Object.entries(manifest.workstreams)
-        .filter(([owner, patterns]) => changedFiles.every((file) => isWorkstreamRequest(file, owner) || matchesAny(file, patterns)))
+        .filter(([owner, patterns]) => changedFiles.every((file) => (release && isWorkstreamRequest(file, owner, release)) || matchesAny(file, patterns)))
         .map(([owner]) => owner);
     return candidates.length === 1 ? candidates[0] || null : null;
 }
@@ -120,11 +130,10 @@ function gitOk(root, args) {
 function matchesAny(file, patterns) {
     return patterns.some((pattern) => globToRegExp(normalize(pattern)).test(normalize(file)));
 }
-function isWorkstreamRequest(file, owner) {
-    return new RegExp(`^\\.sneakoscope/release/6\\.3\\.0/shared-file-requests/${escapeRegExp(owner)}(?:-[^/]+)?\\.json$`).test(file);
-}
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+function isWorkstreamRequest(file, owner, release) {
+    if (!release)
+        return false;
+    return new RegExp(`^${escapeRegExp(sharedFileRequestDir(release))}/${escapeRegExp(owner)}(?:-[^/]+)?\\.json$`).test(file);
 }
 function globToRegExp(pattern) {
     let source = '^';

package/dist/core/release/macos-menubar-proof.js

@@ -2,7 +2,8 @@ import fs from 'node:fs';
 import crypto from 'node:crypto';
 import path from 'node:path';
 import { releaseProofDir, writeReleaseJson } from './release-pack-receipt.js';
-export const MACOS_MENUBAR_PROOF_SCHEMA = 'sks.macos-menubar-proof.v1';
+import { RELEASE_UPGRADE_BASELINE_VERSION } from './release-upgrade-baseline.js';
+export const MACOS_MENUBAR_PROOF_SCHEMA = 'sks.macos-menubar-proof.v2';
 export const MACOS_MENUBAR_REQUIRED_CHECKS = Object.freeze([
     'swift_parse',
     'swift_compile',
@@ -75,6 +76,25 @@ export function validateMacosMenubarProof(value, expected = {}) {
         blockers.push('install_report_path_invalid');
     if (!/^[a-f0-9]{64}$/i.test(String(proof?.install_report_sha256 || '')))
         blockers.push('install_report_hash_missing');
+    if (!proof?.upgrade_report_path || path.isAbsolute(proof.upgrade_report_path) || !proof.upgrade_report_path.startsWith('.sneakoscope/reports/release/'))
+        blockers.push('upgrade_report_path_invalid');
+    if (!/^[a-f0-9]{64}$/i.test(String(proof?.upgrade_report_sha256 || '')))
+        blockers.push('upgrade_report_hash_missing');
+    if (proof?.upgrade_report?.schema !== 'sks.release-upgrade-smoke.v2')
+        blockers.push('upgrade_report_schema_invalid');
+    if (proof?.upgrade_report?.baseline_version !== RELEASE_UPGRADE_BASELINE_VERSION)
+        blockers.push('upgrade_report_baseline_version_invalid');
+    if (proof?.upgrade_report?.target_version !== proof?.version
+        || proof?.upgrade_report?.target_package_version !== proof?.version)
+        blockers.push('upgrade_report_target_version_mismatch');
+    if (proof?.upgrade_report?.source_commit !== proof?.source_commit)
+        blockers.push('upgrade_report_source_commit_mismatch');
+    if (!/^[a-f0-9]{64}$/i.test(String(proof?.upgrade_report?.target_tarball_sha256 || '')))
+        blockers.push('upgrade_report_target_tarball_sha256_invalid');
+    if (!/^[a-f0-9]{64}$/i.test(String(proof?.upgrade_report?.target_receipt_sha256 || '')))
+        blockers.push('upgrade_report_target_receipt_sha256_invalid');
+    if (!/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(String(proof?.upgrade_report?.target_tarball_sha512_integrity || '')))
+        blockers.push('upgrade_report_target_integrity_invalid');
     if (proof?.install_report?.schema !== 'sks.sks-menubar-install-check.v2')
         blockers.push('install_report_schema_invalid');
     if (!proof?.install_report?.checks || Object.keys(proof.install_report.checks).length === 0)
@@ -105,6 +125,12 @@ export function validateMacosMenubarProof(value, expected = {}) {
         blockers.push('macos_proof_version_mismatch');
     if (expected.sourceCommit && proof?.source_commit !== expected.sourceCommit)
         blockers.push('macos_proof_source_commit_mismatch');
+    if (expected.upgradeReportPath && proof?.upgrade_report_path !== expected.upgradeReportPath)
+        blockers.push('macos_upgrade_report_path_mismatch');
+    if (expected.upgradeReportSha256 && proof?.upgrade_report_sha256 !== expected.upgradeReportSha256)
+        blockers.push('macos_upgrade_report_hash_mismatch');
+    if (expected.targetTarballSha256 && proof?.upgrade_report?.target_tarball_sha256 !== expected.targetTarballSha256)
+        blockers.push('macos_upgrade_target_tarball_mismatch');
     for (const key of MACOS_MENUBAR_REQUIRED_CHECKS) {
         if (proof?.checks?.[key] !== true)
             blockers.push(`macos_check_failed:${key}`);
@@ -150,6 +176,38 @@ export function validateMacosMenubarProofArtifacts(root, value, expected = {}) {
             blockers.push('install_report_artifact_json_invalid');
         }
     }
+    const upgradeFile = proof?.upgrade_report_path ? path.resolve(root, proof.upgrade_report_path) : '';
+    const upgradeRelative = upgradeFile ? path.relative(reportRoot, upgradeFile) : '..';
+    if (!upgradeFile || upgradeRelative.startsWith('..') || path.isAbsolute(upgradeRelative) || !fs.existsSync(upgradeFile)) {
+        blockers.push('upgrade_report_artifact_missing_or_unsafe');
+    }
+    else {
+        const bytes = fs.readFileSync(upgradeFile);
+        if (crypto.createHash('sha256').update(bytes).digest('hex') !== proof?.upgrade_report_sha256)
+            blockers.push('upgrade_report_artifact_hash_mismatch');
+        try {
+            const report = JSON.parse(bytes.toString('utf8'));
+            if (report?.schema !== proof?.upgrade_report?.schema)
+                blockers.push('upgrade_report_artifact_schema_mismatch');
+            if (report?.ok !== true || !Array.isArray(report?.blockers) || report.blockers.length > 0)
+                blockers.push('upgrade_report_artifact_not_ok');
+            if (report?.platform !== 'darwin'
+                || report?.baseline_version !== proof?.upgrade_report?.baseline_version
+                || report?.target_version !== proof?.upgrade_report?.target_version)
+                blockers.push('upgrade_report_artifact_version_mismatch');
+            if (report?.source_tree?.head !== proof?.upgrade_report?.source_commit)
+                blockers.push('upgrade_report_artifact_source_commit_mismatch');
+            if (report?.target?.tarball_sha256 !== proof?.upgrade_report?.target_tarball_sha256
+                || report?.target?.receipt_sha256 !== proof?.upgrade_report?.target_receipt_sha256
+                || report?.target?.tarball_sha512_integrity !== proof?.upgrade_report?.target_tarball_sha512_integrity
+                || report?.target?.package_version !== proof?.upgrade_report?.target_package_version) {
+                blockers.push('upgrade_report_artifact_target_binding_mismatch');
+            }
+        }
+        catch {
+            blockers.push('upgrade_report_artifact_json_invalid');
+        }
+    }
     return { ok: blockers.length === 0, proof, blockers: [...new Set(blockers)] };
 }
 export function writeMacosMenubarProof(root, proof) {