sneakoscope 7.1.0 → 7.3.0

package/dist/native/sks-menubar/Sources/RemoteTelegramViewController.swift

@@ -2,96 +2,212 @@ import Cocoa
 
 final class RemoteTelegramViewController: NSViewController, ControlCenterPage {
     private let processClient: ProcessClient
-    private let status = NativeView.detail("Remote readiness has not been checked.")
+    private let operations: OperationCoordinator
+    private let readinessStatus = NativeView.detail("Remote readiness has not been checked.")
+    private let setupStatus = NativeView.detail("Telegram setup has not been checked.")
+    private let hubStatus = NativeView.detail("Telegram Hub status has not been checked.")
     private var generation = 0
+    private var busy = false
+    private var setupReady = false
+    private var hubRunning = false
     private var checkButton: NSButton!
+    private var connectButton: NSButton!
+    private var startButton: NSButton!
+    private var stopButton: NSButton!
+    private var restartButton: NSButton!
 
-    init(processClient: ProcessClient) { self.processClient = processClient; super.init(nibName: nil, bundle: nil) }
+    init(processClient: ProcessClient, operations: OperationCoordinator) {
+        self.processClient = processClient
+        self.operations = operations
+        super.init(nibName: nil, bundle: nil)
+    }
     required init?(coder: NSCoder) { nil }
 
     override func loadView() {
-        checkButton = NativeView.button("Check Readiness", target: self, action: #selector(check))
-        view = NativeView.stack([
-            NativeView.title("Remote & Telegram"),
-            NativeView.detail("OpenAI Remote remains the high-fidelity coding surface. Telegram is limited to proof-aware fleet status and typed approvals; arbitrary remote shell is never enabled."),
-            status, checkButton
+        connectButton = NativeView.button("Connect Bot & Register Coding Session…", target: self, action: #selector(connectBot))
+        startButton = NativeView.button("Start Hub", target: self, action: #selector(startHub))
+        stopButton = NativeView.button("Stop Hub", target: self, action: #selector(stopHub))
+        restartButton = NativeView.button("Restart Hub", target: self, action: #selector(restartHub))
+        checkButton = NativeView.button("Refresh Status", target: self, action: #selector(check))
+
+        let setupCard = NativeView.card(
+            title: "1. Connect your private Telegram bot",
+            subtitle: "Create a bot with BotFather, open that bot in Telegram, send /start, then paste the bot token here. SKS verifies the bot, detects only that private chat/user, saves the token in macOS Keychain, and registers one dedicated coding session for this project.",
+            views: [setupStatus, NativeView.row([connectButton])]
+        )
+        let hubCard = NativeView.card(
+            title: "2. Keep remote coding available",
+            subtitle: "The LaunchAgent keeps the Hub running and prevents idle system sleep while this Mac user is logged in. Closing the lid or logging out can still stop access. It uses a local in-process worker on this Mac; SSH remains available only for explicitly configured remote machines.",
+            views: [hubStatus, NativeView.row([startButton, stopButton, restartButton])]
+        )
+        let usageCard = NativeView.card(
+            title: "3. Code from Telegram",
+            subtitle: "Send ordinary text in the paired private chat. The first message creates and persists the Codex thread with its first turn; later messages resume that exact thread, wait for completion, and return Codex’s final answer. /status, /diff, /proof, and /verify remain available. Arbitrary remote shell and unpaired chats stay blocked.",
+            views: []
+        )
+        let readinessCard = NativeView.card(
+            title: "Project readiness",
+            subtitle: "Codex app, CLI, and Git state for this project — checked together with every status refresh.",
+            views: [readinessStatus]
+        )
+        view = NativeView.page([
+            ControlKit.header("Remote & Telegram", "Telegram remote coding is isolated to this project, uses workspace-write with network disabled, and never exposes the bot token in config, arguments, or logs."),
+            NativeView.row([checkButton]),
+            setupCard, hubCard, usageCard, readinessCard
         ])
+        updateButtons()
         check()
     }
 
     func refreshOnAppear() { check() }
 
+    @objc private func connectBot() {
+        guard let window = view.window else { return }
+        AlertFactory.textSheet(
+            window: window,
+            title: "Telegram Bot Token",
+            message: "First send /start to your bot from the private Telegram account you want to pair. Paste the BotFather token below. It is sent through stdin, stored in macOS Keychain, and never logged.",
+            secure: true,
+            placeholder: "123456789:ABC…"
+        ) { [weak self] token in
+            guard let self = self, let token = token else { return }
+            self.runMutation(
+                args: ["telegram", "setup", "--bot-token-stdin", "--project-root", AppRuntime.projectRoot, "--json"],
+                stdin: token + "\n",
+                kind: "telegram-setup",
+                summary: "Connect Telegram bot and register dedicated Codex session"
+            )
+        }
+    }
+
+    @objc private func startHub() {
+        runMutation(
+            args: ["telegram", "hub", "start", "--project-root", AppRuntime.projectRoot, "--json"],
+            kind: "telegram-hub-start",
+            summary: "Start Telegram Hub"
+        )
+    }
+
+    @objc private func stopHub() {
+        runMutation(
+            args: ["telegram", "hub", "stop", "--project-root", AppRuntime.projectRoot, "--json"],
+            kind: "telegram-hub-stop",
+            summary: "Stop Telegram Hub"
+        )
+    }
+
+    @objc private func restartHub() {
+        runMutation(
+            args: ["telegram", "hub", "restart", "--project-root", AppRuntime.projectRoot, "--json"],
+            kind: "telegram-hub-restart",
+            summary: "Restart Telegram Hub"
+        )
+    }
+
     @objc private func check() {
+        guard !busy else { return }
         generation += 1
         let requestGeneration = generation
         checkButton?.isEnabled = false
-        status.stringValue = "Checking official Remote compatibility and Telegram Hub state…"
+        readinessStatus.stringValue = "Checking project readiness…"
+        setupStatus.stringValue = "Checking Keychain, pairing, and dedicated Codex session…"
+        hubStatus.stringValue = "Checking LaunchAgent state…"
         var remote: [String: Any]?
         var telegram: [String: Any]?
-        var remoteFailed = false
-        var telegramFailed = false
         let group = DispatchGroup()
         group.enter()
         processClient.run(["remote", "readiness", "--project-root", AppRuntime.projectRoot, "--json"], timeout: NativeView.statusTimeout) { [weak self] result in
             remote = self?.json(result.output)
-            remoteFailed = result.code != 0 || remote == nil
             group.leave()
         }
         group.enter()
         processClient.run(["telegram", "status", "--project-root", AppRuntime.projectRoot, "--json"], timeout: NativeView.statusTimeout) { [weak self] result in
-            telegram = result.code == 0 ? self?.json(result.output) : nil
-            telegramFailed = result.code != 0 || telegram == nil
+            telegram = self?.json(result.output)
             group.leave()
         }
         group.notify(queue: .main) { [weak self] in
             guard let self = self, self.generation == requestGeneration else { return }
-            self.checkButton?.isEnabled = true
-            self.status.stringValue = self.summary(remote: remote, telegram: telegram, remoteFailed: remoteFailed, telegramFailed: telegramFailed)
+            self.render(remote: remote, telegram: telegram)
+            self.updateButtons()
         }
     }
 
-    private func summary(remote: [String: Any]?, telegram: [String: Any]?, remoteFailed: Bool, telegramFailed: Bool) -> String {
-        if remoteFailed && telegramFailed {
-            return "Remote readiness and Telegram status are unavailable. Retry Check Readiness, or open Diagnostics for the redacted log."
+    private func runMutation(args: [String], stdin: String? = nil, kind: String, summary: String) {
+        guard !busy else {
+            hubStatus.stringValue = "Another Telegram operation is already running."
+            return
         }
-        var lines: [String] = []
-        if remoteFailed || remote == nil {
-            lines.append("Official Remote compatibility: unavailable — probe failed or returned no readable JSON.")
-        } else if let remote = remote {
+        guard let operation = operations.begin(kind: kind, mutationGroup: "telegram", summary: summary) else {
+            hubStatus.stringValue = "Another guarded mutation is already running. Wait or open Diagnostics."
+            return
+        }
+        setBusy(true)
+        _ = operations.update(operation, state: .running, stage: "running", progress: nil, summary: summary)
+        hubStatus.stringValue = "\(summary)…"
+        processClient.run(args, stdin: stdin, timeout: NativeView.mutationTimeout) { [weak self] result in
+            guard let self = self else { return }
+            let ok = result.code == 0
+            _ = self.operations.update(
+                operation,
+                state: ok ? .succeeded : .failed,
+                stage: "complete",
+                progress: 1,
+                summary: ok ? "\(summary) completed" : "\(summary) failed"
+            )
+            self.setBusy(false)
+            if !ok {
+                // Route setup failures to the setup card so the guidance sits
+                // next to the Connect button instead of the Hub status line.
+                if kind == "telegram-setup" {
+                    self.setupStatus.stringValue = "Setup failed. Confirm you sent /start to this bot, then retry. The token was not written to logs."
+                } else {
+                    self.hubStatus.stringValue = "\(summary) failed · \(NativeView.redactPreview(result.output))"
+                }
+            }
+            self.check()
+        }
+    }
+
+    private func setBusy(_ value: Bool) {
+        busy = value
+        updateButtons()
+    }
+
+    private func updateButtons() {
+        connectButton?.isEnabled = !busy
+        startButton?.isEnabled = !busy && setupReady && !hubRunning
+        stopButton?.isEnabled = !busy && hubRunning
+        restartButton?.isEnabled = !busy && setupReady && hubRunning
+        checkButton?.isEnabled = !busy
+    }
+
+    private func render(remote: [String: Any]?, telegram: [String: Any]?) {
+        if let remote = remote {
             let host = remote["host"] as? [String: Any]
             let project = remote["project"] as? [String: Any]
-            let mcp = remote["mcp"] as? [String: Any]
-            let sks = remote["sks"] as? [String: Any]
-            let remoteBlockers = remote["blockers"] as? [String] ?? []
-            let remoteWarnings = remote["warnings"] as? [String] ?? []
-            lines.append("Official Remote compatibility: \(remote["ok"] as? Bool == true ? "Ready" : "Needs attention") · Codex app \(host?["codex_app_found"] as? Bool == true ? "found" : "missing") · CLI \(host?["codex_cli_found"] as? Bool == true ? "found" : "missing")")
-            lines.append("Project: Git \(project?["git_repo"] as? Bool == true ? "ready" : "missing") · worktree \(project?["worktree"] as? Bool == true ? "yes" : "no") · dirty \(project?["dirty"] as? Bool == true ? "yes" : "no") · allowlist \(project?["allowed"] as? Bool == true ? "ready" : "blocked")")
-            lines.append("MCP: \(mcp?["effective_count"] as? Int ?? 0) effective · \(mcp?["failed_count"] as? Int ?? 0) failed · SKS proof \(sks?["proof_surfaces_ready"] as? Bool == true ? "ready" : "missing")")
-            if !remoteBlockers.isEmpty {
-                lines.append("Remote blockers: \(remoteBlockers.prefix(3).joined(separator: "; "))\(remoteBlockers.count > 3 ? "…" : "")")
-            } else if !remoteWarnings.isEmpty {
-                lines.append("Remote warnings: \(remoteWarnings.prefix(3).joined(separator: "; "))\(remoteWarnings.count > 3 ? "…" : "")")
-            } else {
-                lines.append("Remote blockers 0 · warnings 0")
-            }
+            let blockers = remote["blockers"] as? [String] ?? []
+            readinessStatus.stringValue = "Project readiness: \(remote["ok"] as? Bool == true ? "Ready" : "Needs attention") · Codex app \(host?["codex_app_found"] as? Bool == true ? "found" : "missing") · CLI \(host?["codex_cli_found"] as? Bool == true ? "found" : "missing") · Git \(project?["git_repo"] as? Bool == true ? "ready" : "missing")" + (blockers.isEmpty ? "" : " · \(blockers.prefix(2).joined(separator: "; "))")
+        } else {
+            readinessStatus.stringValue = "Project readiness is unavailable. Open Diagnostics for the redacted log."
         }
 
-        if telegramFailed || telegram == nil {
-            lines.append("Telegram Hub: unavailable — status probe failed.")
-            lines.append("Remote fleet: unavailable until Telegram status succeeds.")
-        } else if let telegram = telegram {
-            let owner = telegram["owner"] as? [String: Any]
-            let configured = telegram["configured"] as? Bool
-            let hubState = owner != nil ? "Running" : configured == true ? "Stopped" : configured == false ? "Not configured" : "Unknown"
-            let telegramIssues = (telegram["config_issues"] as? [String] ?? []) + (telegram["remote_config_issues"] as? [String] ?? [])
-            lines.append("Telegram Hub: \(hubState) · \(telegram["topic_count"] as? Int ?? 0) topics · \(telegram["machine_count"] as? Int ?? 0) machines · \(telegram["target_count"] as? Int ?? 0) targets")
-            if telegramIssues.isEmpty {
-                lines.append("Telegram issues 0")
-            } else {
-                lines.append("Telegram issues \(telegramIssues.count): \(telegramIssues.prefix(2).joined(separator: "; "))\(telegramIssues.count > 2 ? "…" : "")")
-            }
+        guard let telegram = telegram else {
+            setupReady = false
+            hubRunning = false
+            setupStatus.stringValue = "Telegram setup status is unavailable."
+            hubStatus.stringValue = "Telegram Hub status is unavailable."
+            return
         }
-        return lines.joined(separator: "\n")
+        let token = telegram["token_configured"] as? Bool == true
+        let pairing = telegram["pairing_valid"] as? Bool == true
+        let sessions = telegram["registered_session_count"] as? Int ?? 0
+        setupReady = token && pairing && sessions > 0
+        hubRunning = telegram["hub_running"] as? Bool == true
+        setupStatus.stringValue = "Keychain token \(token ? "ready" : "missing") · private pairing \(pairing ? "ready" : "missing") · dedicated Codex sessions \(sessions)" + (setupReady ? " · ready to start" : " · connect the bot to continue")
+        let service = telegram["service"] as? [String: Any]
+        let installed = service?["installed"] as? Bool == true
+        let state = service?["state"] as? String
+        hubStatus.stringValue = "Hub \(hubRunning ? "Running" : installed ? "Stopped" : "Not installed")" + (state.map { " · launchd \($0)" } ?? "") + (hubRunning ? " · send a Telegram message to code" : setupReady ? " · click Start Hub" : "")
     }
 
     private func json(_ text: String) -> [String: Any]? {

package/dist/native/sks-menubar/Sources/SettingsViewController.swift

@@ -2,7 +2,7 @@ import Cocoa
 
 final class SettingsViewController: NSViewController, ControlCenterPage {
     private let notifications: NotificationCoordinator
-    private let quitWithCodex = NSButton(checkboxWithTitle: "Quit SKS Menu when Codex quits (otherwise keep icon, hide only after a Codex session ends)", target: nil, action: nil)
+    private let quitWithCodex = NSButton(checkboxWithTitle: "Quit SKS Menu when Codex quits", target: nil, action: nil)
     private let status = NativeView.detail("Settings use the native app configuration file.")
     init(notifications: NotificationCoordinator) { self.notifications = notifications; super.init(nibName: nil, bundle: nil) }
     required init?(coder: NSCoder) { nil }
@@ -12,10 +12,19 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
         quitWithCodex.state = readConfig()["quit_with_codex"] as? Bool == true ? .on : .off
         quitWithCodex.setAccessibilityLabel("Quit SKS Menu when Codex quits")
         let authorize = NativeView.button("Enable Notifications", target: self, action: #selector(enableNotifications))
-        view = NativeView.stack([
-            NativeView.title("Settings"),
-            NativeView.detail("These options stay on this Mac. Notification permission and Codex lifecycle behavior never leave the machine."),
-            quitWithCodex, authorize, status
+        let lifecycleCard = NativeView.card(
+            title: "Codex lifecycle",
+            subtitle: "Off keeps the menu icon available on cold start and hides it only after a Codex session ends.",
+            views: [quitWithCodex]
+        )
+        let notificationsCard = NativeView.card(
+            title: "Notifications",
+            subtitle: "Operation results always stay available in Control Center, even when notifications are denied.",
+            views: [NativeView.row([authorize]), status]
+        )
+        view = NativeView.page([
+            ControlKit.header("Settings", "These options stay on this Mac. Notification permission and Codex lifecycle behavior never leave the machine."),
+            lifecycleCard, notificationsCard
         ])
         refreshOnAppear()
     }

package/dist/native/sks-menubar/Sources/SidebarItem.swift

@@ -1,11 +1,25 @@
 import Foundation
 
+// Ordered by expected use frequency: provider/model work first, then updates,
+// then integrations, then maintenance.
 enum SidebarItem: String, CaseIterable {
     case overview = "Overview"
+    case providers = "Providers"
     case updates = "Updates"
     case mcpServers = "MCP Servers"
-    case providers = "Providers"
     case remoteTelegram = "Remote & Telegram"
     case diagnostics = "Diagnostics"
     case settings = "Settings"
+
+    var symbolName: String {
+        switch self {
+        case .overview: return "gauge"
+        case .providers: return "cpu"
+        case .updates: return "arrow.down.circle"
+        case .mcpServers: return "server.rack"
+        case .remoteTelegram: return "paperplane"
+        case .diagnostics: return "stethoscope"
+        case .settings: return "gearshape"
+        }
+    }
 }

package/dist/native/sks-menubar/Sources/StatusItemController.swift

@@ -124,7 +124,7 @@ final class StatusItemController: NSObject, NSMenuDelegate {
         else if operationFailed { icon = .warning; summary = "Needs attention — last operation failed" }
         else if actionRequired || notificationAuthorizationDenied || pendingCount > 0 {
             icon = .attention
-            summary = notificationAuthorizationDenied ? "Notifications require attention" : pendingCount > 0 ? "Input or approval required" : "Input or approval required"
+            summary = pendingCount > 0 ? "Input or approval required" : notificationAuthorizationDenied ? "Notifications require attention" : "Input or approval required"
         }
         else if sksUpdate || codexUpdate {
             icon = .updateAvailable
@@ -231,7 +231,7 @@ final class StatusItemController: NSObject, NSMenuDelegate {
         if update["source"] as? String == "disabled" { return false }
         guard update["schema"] as? String == "sks.update-status.v3",
               let expiresAt = update["expires_at"] as? String,
-              let expiry = ISO8601DateFormatter().date(from: expiresAt) else { return true }
+              let expiry = SKSTimestamp.date(from: expiresAt) else { return true }
         return expiry <= now
     }
 

package/dist/native/sks-menubar/Sources/UpdatesViewController.swift

@@ -1,7 +1,10 @@
 import Cocoa
 
 final class UpdatesViewController: NSViewController, ControlCenterPage {
-    private static let controlCenterUpdateEnvironment = ["SKS_UPDATE_DEFER_MENUBAR_RESTART": "1"]
+    private static let controlCenterUpdateEnvironment = [
+        "SKS_UPDATE_DEFER_MENUBAR_RESTART": "1",
+        "SKS_SKIP_SKS_MENUBAR_LAUNCH": "1"
+    ]
     private let processClient: ProcessClient
     private let operations: OperationCoordinator
     private let notifications: NotificationCoordinator
@@ -31,15 +34,17 @@ final class UpdatesViewController: NSViewController, ControlCenterPage {
         checkButton = NativeView.button("Check Now", target: self, action: #selector(checkNow))
         codexUpdateButton = NativeView.button("Update Codex CLI", target: self, action: #selector(updateCodexCLI))
         codexUpdateButton.setAccessibilityHelp("Update the operator Codex CLI using its verified installation method.")
-        reviewButton = NativeView.button("Review and Update", target: self, action: #selector(reviewAndUpdate))
+        reviewButton = ControlKit.primaryButton("Review and Update", target: self, action: #selector(reviewAndUpdate))
+        reviewButton.setAccessibilityHelp("Review the staged update first, then confirm before anything is installed.")
         codexUpdateStatus.setAccessibilityLabel("Codex CLI update result")
         let buttons = NSStackView(views: [checkButton, codexUpdateButton, reviewButton, progress])
         buttons.orientation = .horizontal; buttons.spacing = 8
-        view = NativeView.stack([
-            NativeView.title("Updates"),
-            NativeView.detail("SKS, Codex CLI, and Menu Bar status share one local snapshot. Prefer the latest Codex CLI; SKS stays version-agnostic and capability-gates features. Network refresh only runs on demand or after expiry."),
-            status, codexUpdateStatus, stageStatus, remediation, buttons,
-            NativeView.detail("Rollback guidance and the previous Menu Bar app remain available if final verification fails. The update receipt records the exact recovery command and stage state.")
+        view = NativeView.page([
+            ControlKit.header("Updates", "SKS, Codex CLI, and Menu Bar status share one local snapshot. Prefer the latest Codex CLI; SKS stays version-agnostic and capability-gates features. Network refresh only runs on demand or after expiry."),
+            buttons,
+            NativeView.card(title: "Status", subtitle: "Versions from the shared local snapshot.", views: [status, codexUpdateStatus]),
+            NativeView.card(title: "Progress", subtitle: "Authoritative stage checklist from the update receipt.", views: [stageStatus]),
+            NativeView.card(title: "Recovery", subtitle: "Rollback guidance and the previous Menu Bar app remain available if final verification fails. The update receipt records the exact recovery command and stage state.", views: [remediation])
         ])
         loadCached()
     }
@@ -295,7 +300,7 @@ final class UpdatesViewController: NSViewController, ControlCenterPage {
         let menu = json["menubar"] as? [String: Any]
         let generatedAt = json["generated_at"] as? String ?? "unknown"
         let expiresAt = json["expires_at"] as? String ?? "unknown"
-        let expired = ISO8601DateFormatter().date(from: expiresAt).map { $0 <= Date() } ?? true
+        let expired = SKSTimestamp.date(from: expiresAt).map { $0 <= Date() } ?? true
         status.stringValue = [
             "SKS \(sks?["current"] as? String ?? "unknown") → \(sks?["latest"] as? String ?? "unknown") · Codex CLI \(codex?["current"] as? String ?? "unknown") → \(codex?["latest"] as? String ?? "unknown")",
             "Menu Bar expected \(menu?["expected_version"] as? String ?? AppRuntime.packageVersion) · installed \(menu?["installed_version"] as? String ?? "unknown") · rebuild \(menu?["rebuild_required"] as? Bool == true ? "required" : "not required")",
@@ -334,8 +339,7 @@ final class UpdatesViewController: NSViewController, ControlCenterPage {
 
     private func receipt(_ receipt: UpdateOperationReceiptSnapshot, belongsTo operation: OperationSnapshot) -> Bool {
         guard receipt.kind == "update" || receipt.kind == "rollback" else { return false }
-        let parser = ISO8601DateFormatter()
-        guard let receiptDate = parser.date(from: receipt.startedAt), let operationDate = parser.date(from: operation.startedAt) else { return receipt.startedAt >= operation.startedAt }
+        guard let receiptDate = SKSTimestamp.date(from: receipt.startedAt), let operationDate = SKSTimestamp.date(from: operation.startedAt) else { return receipt.startedAt >= operation.startedAt }
         return receiptDate >= operationDate.addingTimeInterval(-1)
     }
 
@@ -362,11 +366,11 @@ final class UpdatesViewController: NSViewController, ControlCenterPage {
             if id == current { return "● \(id) — running" }
             return "○ \(id)"
         }
-        return "Update stages (14):\n" + rows.joined(separator: "\n")
+        return "Update stages (\(OperationCoordinator.updateStageOrder.count)):\n" + rows.joined(separator: "\n")
     }
 
     private func formatTimestamp(_ value: String) -> String {
-        guard let date = ISO8601DateFormatter().date(from: value) else { return value }
+        guard let date = SKSTimestamp.date(from: value) else { return value }
         let formatter = DateFormatter()
         formatter.dateStyle = .medium
         formatter.timeStyle = .medium

package/dist/scripts/agent-guidance-dedup-check.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { analyzeAgentGuidance } from '../core/agent-guidance/directive-registry.js';
+import { renderInitDeepAgentGuidance } from '../core/codex-app/codex-init-deep.js';
+import { writeJsonAtomic } from '../core/fsx.js';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const files = renderInitDeepAgentGuidance([
+    { score: 1, dir: '.', file_count: 120, languages: ['ts'], guidance: 'Use local source conventions and keep changes owner-scoped.' },
+    { score: 1, dir: 'src/core', file_count: 79, languages: ['ts'], guidance: 'Use local source conventions and keep changes owner-scoped.' },
+    { score: 1, dir: 'src/core/release', file_count: 47, languages: ['ts'], guidance: 'High-risk SKS runtime area; hydrate TriWiki/current source before edits.' },
+    { score: 1, dir: 'src/cli', file_count: 27, languages: ['ts'], guidance: 'Use local source conventions and keep changes owner-scoped.' },
+    { score: 1, dir: 'docs', file_count: 40, languages: ['md'], guidance: 'Use local source conventions and keep changes owner-scoped.' }
+]);
+const report = analyzeAgentGuidance(files, { sharedScopePath: 'ROOT' });
+const output = path.join(root, '.sneakoscope', 'reports', 'agent-guidance-dedup.json');
+await writeJsonAtomic(output, report);
+console.log(JSON.stringify(report, null, 2));
+if (!report.ok) {
+    console.error('Agent guidance carries directives that say nothing new.');
+    console.error('State a directive once, at the broadest scope that covers its readers, and prefer the canonical principle over its restatements.');
+    process.exitCode = 1;
+}

package/dist/scripts/agent-message-bus-reader-check.js

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { appendAgentMessage, readAgentMessageBus } from '../core/agents/agent-message-bus.js';
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate } from './gate-lib.js';
 const missionId = 'M-agent-message-reader';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-agent-message-'));
 const agents = path.join(root, '.sneakoscope', 'missions', missionId, 'agents');

package/dist/scripts/all-feature-deep-completion-check.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
 import path from 'node:path';
-import { assertGate, emitGate, requireContains, root, runSksJson } from './sks-1-12-real-execution-check-lib.js';
+import { assertGate, emitGate, requireContains, root, runSksJson } from './real-execution-check-lib.js';
 const requiredGates = [
     'ux-review:run-wires-imagegen',
     'ux-review:extract-wires-real-extractor',

package/dist/scripts/appshots-thread-attachment-discovery-check.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
 import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist, root } from './gate-lib.js';
 const detector = await importDist('core/codex/appshots-detector.js');
 const evidenceMod = await importDist('core/source-intelligence/appshots-evidence.js');
 const fixture = writeAppshotFixture();

package/dist/scripts/architecture-guard-check.js

@@ -33,7 +33,6 @@ if (architectureBudgets.schema !== 'sks.architecture-budgets.v1')
 if (architectureBudgets.waiver_policy?.mode !== 'shrink-only')
     issues.push('architecture waivers must be shrink-only');
 for (const [id, maxLines] of [
-    ['menubar-facade', 80],
     ['menubar-typescript', 450],
     ['menubar-swift', 500],
     ['menubar-app-delegate', 250],
@@ -52,7 +51,7 @@ assertIncludes('src/scripts/check-architecture.ts', "args.includes('--strict-all
 assertIncludes('src/scripts/check-architecture.ts', "'config', 'architecture-budgets.v1.json'", 'architecture check must load the budget SSOT');
 assertIncludes('src/scripts/check-architecture.ts', 'shrink-only ceiling', 'architecture check must enforce shrink-only waivers');
 assertIncludes('docs/architecture.md', '`config/architecture-budgets.v1.json`', 'architecture docs must name the budget SSOT');
-for (const token of ['`80`', '`250`', '`450`', '`500`', '`900`', '`1200`', '`1800`', '`3000`', '`--strict-all`', 'shrink-only']) {
+for (const token of ['`250`', '`450`', '`500`', '`900`', '`1200`', '`1800`', '`3000`', '`--strict-all`', 'shrink-only']) {
     assertIncludes('docs/architecture.md', token, `architecture docs missing ${token}`);
 }
 assertIncludes('src/core/pipeline-internals/runtime-core.ts', "'ssot_guard'");

package/dist/scripts/certificate-sla-check.js

@@ -1,4 +1,4 @@
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist, root } from './gate-lib.js';
 const graphMod = await importDist('core/triwiki/triwiki-affected-graph.js');
 const certMod = await importDist('core/triwiki/triwiki-sla-certificate.js');
 const graph = graphMod.computeTriWikiAffectedGraph({ root, changedFiles: ['src/core/triwiki/triwiki-proof-bank.ts'], tier: 'affected' });

package/dist/scripts/cli-output-consistency-check.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
 import { spawnSync } from 'node:child_process';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, root } from './gate-lib.js';
 import { PACKAGE_VERSION } from '../core/version.js';
 const executed = [
     ['review'],

package/dist/scripts/codex-0-134-runner-truth-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist, root } from './gate-lib.js';
 const runner = await importDist('core/agents/agent-runner-codex-exec.js');
 const compat = await importDist('core/codex/codex-0-134-compat.js');
 const history = await importDist('core/source-intelligence/codex-history-search.js');

package/dist/scripts/codex-0138-capability-artifact-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 process.env.SKS_CODEX_0138_FAKE = '1';
 const mod = await importDist('core/codex-control/codex-0138-capability.js');
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-0138-cap-'));

package/dist/scripts/codex-0138-capability-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 process.env.SKS_CODEX_0138_FAKE = '1';
 process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.138.0';
 const mod = await importDist('core/codex-control/codex-0138-capability.js');

package/dist/scripts/codex-0138-doctor-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 import { writeTextAtomic } from '../core/fsx.js';
 process.env.SKS_CODEX_0138_FAKE = '1';
 const mod = await importDist('core/doctor/codex-0138-doctor.js');

package/dist/scripts/codex-0138-feature-probes-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 process.env.SKS_CODEX_0138_FAKE = '1';
 process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.138.0';
 process.env.SKS_CODEX_0138_PROBE = '1';

package/dist/scripts/codex-0144-app-server-v2-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, readText } from './gate-lib.js';
 import { createCodexAppServerV2Client, currentTimeResponse } from '../core/codex-control/codex-app-server-v2-client.js';
 import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
 const requireReal = process.argv.includes('--require-real') || process.env.SKS_REQUIRE_CODEX_0144_APP_SERVER === '1';

package/dist/scripts/codex-0144-binary-identity-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate } from './gate-lib.js';
 import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
 import { compareSemverLike } from '../core/codex-compat/codex-version-policy.js';
 import { resolveOfficialCodexPackageRuntime } from '../core/codex-runtime/resolve-codex-runtime.js';

package/dist/scripts/codex-0144-capability-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate } from './gate-lib.js';
 import { CODEX_0144_FEATURE_KEYS, detectCodex0144Capability, writeCodex0144CapabilityArtifacts } from '../core/codex-control/codex-0144-capability.js';
 const requireReal = process.argv.includes('--require-real') || process.env.SKS_REQUIRE_CODEX_0144 === '1';
 if (!requireReal)

package/dist/scripts/codex-0144-core-real-probes-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+import { emitGate, importDist, root } from './gate-lib.js';
 const args = process.argv.slice(2);
 const requireReal = args.includes('--require-real');
 const allowNetwork = args.includes('--allow-network');

package/dist/scripts/codex-0144-manifest-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { assertGate, emitGate, readJson, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, readJson, root } from './gate-lib.js';
 import { codexReleaseManifestParity } from '../core/codex-compat/codex-release-manifest.js';
 import { detectCodex0144Capability } from '../core/codex-control/codex-0144-capability.js';
 const parity = await codexReleaseManifestParity(root);

package/dist/scripts/codex-0144-policy-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate } from './gate-lib.js';
 import { buildCodexExecutionPolicy } from '../core/codex-control/codex-sdk-config-policy.js';
 import { buildCodexSdkEnv } from '../core/codex-control/codex-sdk-env-policy.js';
 process.env.AWS_SECRET_ACCESS_KEY = 'fixture-secret-aws';

package/dist/scripts/codex-0144-thread-store-check.js

@@ -2,7 +2,7 @@
 import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate } from './gate-lib.js';
 import { readCodexThreadRegistry, recordCodexThread } from '../core/codex-control/codex-thread-registry.js';
 const tmp = await fsp.mkdtemp(path.join(os.tmpdir(), 'sks-codex-0144-thread-store-'));
 try {