sneakoscope 7.3.0 → 7.5.0

package/dist/core/policy/latest-version-guidance.js

@@ -0,0 +1,113 @@
+export const LATEST_VERSION_GUIDANCE_SCHEMA = 'sks.latest-version-guidance.v1';
+const SEMVER_RE = /\b\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?\b/g;
+export const GUIDANCE_TRIGGERS = [
+    'current release',
+    'current version',
+    'currently',
+    'preferred',
+    'minimum',
+    'at least',
+    'requires',
+    'required',
+    'require',
+    'must be',
+    'must use',
+    'update to',
+    'upgrade to',
+    'recommend',
+    'recommended',
+    'or later',
+    'or newer',
+    'or above',
+    'supported version',
+    'baseline remains',
+    '이상',
+    '권장',
+    '최소',
+    '필요합니다',
+    '사용하세요'
+];
+export const HISTORICAL_MARKERS = [
+    'changelog',
+    'historical',
+    'history',
+    'previously',
+    'fixed in',
+    'regression',
+    'released in',
+    'shipped in',
+    'was released',
+    'compatibility matrix',
+    'compatibility snapshot',
+    'schema revision',
+    'fixture',
+    'reproduces',
+    'as of the',
+    'no longer'
+];
+const STRING_LITERAL_RE = /'(?:[^'\\\n]|\\.)*'|"(?:[^"\\\n]|\\.)*"|`(?:[^`\\]|\\.)*`/g;
+const WINDOW_CHARS = 90;
+function containsTrigger(haystack) {
+    const lower = haystack.toLowerCase();
+    for (const trigger of GUIDANCE_TRIGGERS) {
+        if (lower.includes(trigger.toLowerCase()))
+            return trigger;
+    }
+    return null;
+}
+function isHistorical(haystack) {
+    const lower = haystack.toLowerCase();
+    return HISTORICAL_MARKERS.some((marker) => lower.includes(marker));
+}
+function excerpt(line) {
+    const compact = line.trim().replace(/\s+/g, ' ');
+    return compact.length > 160 ? `${compact.slice(0, 157)}...` : compact;
+}
+export function scanLatestVersionGuidance(relativePath, text, options = {}) {
+    const findings = [];
+    const lines = text.split(/\r?\n/);
+    for (const [index, rawLine] of lines.entries()) {
+        const line = rawLine ?? '';
+        const candidates = [];
+        if (options.stringLiteralsOnly) {
+            STRING_LITERAL_RE.lastIndex = 0;
+            let match;
+            while ((match = STRING_LITERAL_RE.exec(line)))
+                candidates.push(match[0]);
+        }
+        else {
+            candidates.push(line);
+        }
+        if (!candidates.length)
+            continue;
+        let reported = false;
+        for (const candidate of candidates) {
+            if (reported)
+                break;
+            SEMVER_RE.lastIndex = 0;
+            let match;
+            while ((match = SEMVER_RE.exec(candidate))) {
+                const window = candidate.slice(Math.max(0, match.index - WINDOW_CHARS), match.index + match[0].length + WINDOW_CHARS);
+                if (isHistorical(window))
+                    continue;
+                const trigger = containsTrigger(window);
+                if (!trigger)
+                    continue;
+                findings.push({ path: relativePath, line: index + 1, version: match[0], trigger, excerpt: excerpt(line) });
+                reported = true;
+                break;
+            }
+        }
+    }
+    return findings;
+}
+export const LATEST_VERSION_GUIDANCE_TEXT = 'Use the official latest stable SKS and Codex CLI releases. Run `sks update-check` and read the capability report for the current state — feature support is decided by capability probes, not by a pinned version number.';
+export function latestVersionGuidanceReport(findings, scannedFiles, exemptions) {
+    return {
+        schema: LATEST_VERSION_GUIDANCE_SCHEMA,
+        ok: findings.length === 0,
+        scannedFiles,
+        findings: [...findings].sort((left, right) => left.path.localeCompare(right.path) || left.line - right.line),
+        exemptions: [...exemptions].sort()
+    };
+}

package/dist/core/ppt.js

@@ -478,7 +478,7 @@ export async function buildPptImageAssetLedger(dir, contract = {}, storyboard =
         created_at: nowIso(),
         contract_hash: contract.sealed_hash || null,
         required,
-        policy: 'Required PPT image resources must be generated through Codex App $imagegen/gpt-image-2 and recorded as real output files; direct API fallback, fabricated files, and placeholder ledgers do not satisfy this gate.',
+        policy: 'Required PPT image resources must be generated with gpt-image-2 through the selected Codex provider and recorded as real output files; unrelated API fallback, partial preview frames, fabricated files, and placeholder ledgers do not satisfy this gate.',
         codex_app_imagegen_doc: CODEX_APP_IMAGE_GENERATION_DOC_URL,
         imagegen_execution: {
             required_skill: 'imagegen',
@@ -511,9 +511,9 @@ export async function buildPptImageAssetLedger(dir, contract = {}, storyboard =
         passed,
         notes: [
             required
-                ? 'The sealed PPT contract requires generated image assets; missing Codex App $imagegen/gpt-image-2 output blocks the PPT gate.'
+                ? 'The sealed PPT contract requires generated image assets; missing completed gpt-image-2 output from the selected Codex provider blocks the PPT gate.'
                 : 'No generated image asset requirement was detected; assets remain optional and are not generated to avoid unrequested API cost.',
-            'Invoke the loaded imagegen skill with Codex App $imagegen/gpt-image-2 for each blocked asset, place the generated raster under assets/, then rerun the PPT build so existing generated files are verified.'
+            'Generate each blocked asset with gpt-image-2 through Codex App $imagegen or the selected codex-lb provider, place the completed raster under assets/, then rerun the PPT build so existing generated files are verified.'
         ]
     };
 }
@@ -598,7 +598,7 @@ export function buildPptReviewLedger({ contract = {}, storyboard, styleTokens, f
                 : 'Optional generated image assets were planned but not generated.',
             source: 'ppt_image_asset_ledger',
             action: imageAssetLedger?.required
-                ? 'Generate the required assets with Codex App $imagegen/gpt-image-2, place the real raster files under assets/, then rerun sks ppt build.'
+                ? 'Generate the required assets with gpt-image-2 through the selected Codex provider, place the completed raster files under assets/, then rerun sks ppt build.'
                 : 'Generate only if the sealed PPT contract needs image resources.'
         }));
     }
@@ -638,9 +638,9 @@ export function buildPptReviewLedger({ contract = {}, storyboard, styleTokens, f
             id: 'codex-app-imagegen-review-missing',
             severity: 'P1',
             title: 'Required gpt-image-2 visual review evidence missing',
-            detail: 'The sealed PPT contract explicitly requested image/gpt-image-2 visual critique, but no Codex App imagegen review evidence was supplied.',
+            detail: 'The sealed PPT contract explicitly requested image/gpt-image-2 visual critique, but no completed selected-provider imagegen review evidence was supplied.',
             source: 'codex_app_imagegen_gate',
-            action: 'Invoke the loaded imagegen skill through Codex App $imagegen/gpt-image-2, run the bounded slide review loop, and record evidence paths before final output.'
+            action: 'Invoke gpt-image-2 through Codex App $imagegen or the selected codex-lb provider, run the bounded slide review loop, and record evidence paths before final output.'
         }));
     }
     const blocking = issues.filter((issue) => ['P0', 'P1'].includes(issue.severity));
@@ -673,7 +673,7 @@ export function buildPptReviewLedger({ contract = {}, storyboard, styleTokens, f
         passed: blocking.length === 0 && overallScore >= 0.88,
         notes: [
             'This ledger is an executable deterministic QA pass, not a fake gpt-image-2 result.',
-            'When image review is required, missing Codex App imagegen evidence blocks the gate instead of being simulated.'
+            'When image review is required, missing completed selected-provider imagegen evidence blocks the gate instead of being simulated.'
         ]
     };
 }
@@ -1040,7 +1040,7 @@ export function defaultPptGate(contract = {}) {
             'Do not pass this gate until the HTML/PDF artifact work is actually complete or the PDF export is explicitly deferred with evidence.',
             'Audience strategy must stay linked to STP, target pain points, proof, and three or more aha moments.',
             'Fact ledger must keep user input separate from verified web evidence and block unsupported critical external claims.',
-            'Image asset ledger must require real Codex App $imagegen/gpt-image-2 output for required resources, or block with evidence instead of faking files.',
+            'Image asset ledger must require completed gpt-image-2 output from the selected Codex provider for required resources, or block with evidence instead of faking files.',
             'Review loop must be bounded by score thresholds, P0/P1 issue count, max passes, and explicit imagegen evidence requirements when requested.',
             'Preserve the editable HTML source under source-html/ and remove PPT-only temporary build files before completion.',
             'Record independent PPT build phases in ppt-parallel-report.json so research/design/render work can stay parallel-friendly.'

package/dist/core/release/gate-manifest.js

@@ -103,7 +103,19 @@ export function affectedGlobsFor(id) {
         case 'publish':
             return ['package.json', '.npmignore', 'src/scripts/packlist-performance-check.ts', 'src/scripts/npm-publish-performance-check.ts', 'dist/**'];
         case 'postinstall':
-            return ['src/cli/install-helpers.ts', 'src/core/init.ts', 'src/scripts/postinstall-safe-side-effects-check.ts'];
+            return [
+                'src/cli/install-helpers.ts',
+                'src/cli/install-helpers-codex-lb-selftest.ts',
+                'src/cli/install-helpers-install-support.ts',
+                'src/core/init.ts',
+                'src/core/install/installed-package-smoke.ts',
+                'src/core/routes/design-policy.ts',
+                'src/scripts/installed-package-smoke-check.ts',
+                'src/scripts/postinstall-safe-side-effects-check.ts',
+                'test/blackbox/postinstall-safe-side-effects-packed.test.mjs',
+                'test/unit/postinstall-command.test.mjs',
+                'test/unit/publish-workflow-safety.test.mjs'
+            ];
         case 'runtime':
             return ['src/**', 'src/scripts/runtime-*.ts', 'src/scripts/build-dist.ts', 'src/scripts/clean-dist.ts', 'package.json'];
         case 'agent':
@@ -131,6 +143,25 @@ export function affectedGlobsFor(id) {
                 'src/core/codex-lb-circuit.ts',
                 `src/scripts/${prefix}-*.ts`
             ];
+        case 'context-graph':
+            return [
+                'src/core/triwiki/context-graph/**',
+                'src/core/search/context.ts',
+                'src/core/search/context-graph-seeds.ts',
+                'src/core/subagents/triwiki-attention.ts',
+                'src/core/triwiki/code-pack.ts',
+                'src/core/naruto/context-graph-advisor.ts',
+                'src/core/naruto/context-graph-advisor-scope.ts',
+                'src/core/verification/context-graph-affected.ts',
+                'src/core/commands/wiki-command.ts',
+                'src/core/commands/triwiki-graph-command.ts',
+                'config/context-graph-benchmark.json',
+                'schemas/triwiki/context-graph.schema.json',
+                'src/scripts/context-graph-check.ts',
+                'package.json'
+            ];
+        case 'latest-version':
+            return ['README.md', 'docs/**', 'src/**', 'native/**', 'src/scripts/latest-version-guidance-check.ts', 'package.json'];
         case 'release':
             return ['src/core/release/**', 'src/scripts/release-parallel-check.ts', 'src/scripts/release-*.ts', 'package.json'];
         default:

package/dist/core/release/npm-stage-contract.js

@@ -0,0 +1,21 @@
+export const REQUIRED_NPM_STAGE_CLI_VERSION = '11.15.0';
+export function exactNpmStageCliInvocation(platform = process.platform) {
+    return {
+        command: platform === 'win32' ? 'npx.cmd' : 'npx',
+        args: ['--yes', `npm@${REQUIRED_NPM_STAGE_CLI_VERSION}`]
+    };
+}
+export function localNpmStageReviewEnvironmentBlocker(env) {
+    const oidcKeys = [
+        'ACTIONS_ID_TOKEN_REQUEST_TOKEN',
+        'ACTIONS_ID_TOKEN_REQUEST_URL',
+        'NPM_ID_TOKEN',
+        'SIGSTORE_ID_TOKEN'
+    ];
+    if (env.GITHUB_ACTIONS === 'true' || oidcKeys.some((key) => Boolean(String(env[key] || '').trim()))) {
+        return 'oidc_environment_not_allowed';
+    }
+    if (env.CI === 'true' || env.CI === '1')
+        return 'ci_environment_not_allowed';
+    return null;
+}

package/dist/core/release/package-size-budget.js

@@ -1,2 +1,2 @@
-export const DEFAULT_MAX_PACK_BYTES = 2510 * 1024;
-export const DEFAULT_MAX_UNPACKED_BYTES = 11_425_000;
+export const DEFAULT_MAX_PACK_BYTES = 2650 * 1024;
+export const DEFAULT_MAX_UNPACKED_BYTES = 11_950_000;

package/dist/core/release/release-gate-contract.js

@@ -33,6 +33,10 @@ export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
     'codex:app-handoff-comprehensive',
     'codex:product-design-plugin-routing',
     'config:managed-merge',
+    'context-graph:contract',
+    'context-graph:legacy-closure',
+    'context-graph:performance',
+    'context-graph:quality',
     'context7:evidence-dedupe',
     'core-skill:card-schema-deployment-snapshot',
     'core-skill:heldout-validation',
@@ -62,6 +66,7 @@ export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
     'hooks:concurrent-session-collision',
     'image:artifact-path-contract',
     'init-deep:backup-retention',
+    'latest-version:guidance',
     'legacy:gate-inventory',
     'legacy:gate-purge',
     'legacy:strong-inventory',

package/dist/core/release/stage-publish.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import fs from 'node:fs';
 import { RELEASE_ORIGIN_IDENTITY, releaseOriginIdentity } from './release-origin.js';
+import { exactNpmStageCliInvocation, localNpmStageReviewEnvironmentBlocker, REQUIRED_NPM_STAGE_CLI_VERSION } from './npm-stage-contract.js';
 export const STAGE_PUBLISH_SCHEMA = 'sks.release-stage-publish.v1';
 export const STAGE_WORKFLOW_FILE = 'publish-npm.yml';
 export const RELEASE_BRANCH = 'main';
@@ -100,6 +101,26 @@ function runPreflight(opts, version) {
     const origin = releaseOriginIdentity(opts.root);
     const originOk = origin.identity === RELEASE_ORIGIN_IDENTITY;
     steps.push(step('origin', originOk, origin.identity || null, originOk ? null : 'stage_origin_identity_mismatch'));
+    const stampVerifier = path.join(opts.root, 'dist', 'scripts', 'release-check-stamp.js');
+    const stamp = opts.run(process.execPath, [stampVerifier, 'verify']);
+    const stampOk = stamp.status === 0;
+    steps.push(step('release_stamp', stampOk, stampOk ? 'current source-bound full release stamp verified' : compactProcessOutput(stamp), stampOk ? null : 'stage_release_stamp_invalid'));
+    const verifier = path.join(opts.root, 'dist', 'scripts', 'npm-stage-tarball-verifier.js');
+    const verifierReady = fs.existsSync(verifier);
+    steps.push(step('local_review_verifier', verifierReady, verifierReady ? verifier : null, verifierReady ? null : 'stage_verifier_unavailable_outside_checkout'));
+    const reviewEnvironmentBlocker = localNpmStageReviewEnvironmentBlocker(opts.env || process.env);
+    steps.push(step('local_review_environment', reviewEnvironmentBlocker === null, reviewEnvironmentBlocker === null ? 'maintainer-local' : reviewEnvironmentBlocker, reviewEnvironmentBlocker === null ? null : `stage_${reviewEnvironmentBlocker}`));
+    const npmInvocation = exactNpmStageCliInvocation();
+    const npmStageCli = opts.run(npmInvocation.command, [...npmInvocation.args, '--version']);
+    const npmStageCliVersion = text(npmStageCli);
+    const npmStageCliReady = npmStageCli.status === 0 && npmStageCliVersion === REQUIRED_NPM_STAGE_CLI_VERSION;
+    steps.push(step('npm_stage_cli', npmStageCliReady, npmStageCliReady
+        ? `${npmStageCliVersion} via ${[npmInvocation.command, ...npmInvocation.args].join(' ')}`
+        : compactProcessOutput(npmStageCli) || npmStageCliVersion || null, npmStageCliReady
+        ? null
+        : npmStageCli.status === 0
+            ? 'stage_npm_cli_version_mismatch'
+            : 'stage_npm_cli_unavailable'));
     const gh = opts.run('gh', ['auth', 'status']);
     steps.push(step('gh_auth', gh.status === 0, gh.status === 0 ? 'authenticated' : null, gh.status === 0 ? null : 'stage_gh_not_authenticated'));
     const commit = text(opts.run('git', ['rev-parse', 'HEAD'])) || null;
@@ -186,6 +207,12 @@ function safeJsonArray(value) {
 function text(result) {
     return String(result.stdout || '').trim();
 }
+function compactProcessOutput(result) {
+    return String(result.stderr || result.stdout || '')
+        .trim()
+        .replace(/\s+/g, ' ')
+        .slice(0, 240) || null;
+}
 function step(id, ok, detail = null, blocker = null) {
     return { id, ok, attempted: true, detail, blocker };
 }

package/dist/core/responses-stream.js

@@ -37,21 +37,29 @@ export function findStreamedImageOutput(events) {
     for (const event of events) {
         const type = String(event?.type || '');
         const item = event?.item;
-        if (item && String(item.type || '') === 'image_generation_call') {
+        const partialEvent = type === 'response.image_generation_call.partial_image'
+            || type.endsWith('.image_generation_call.partial_image');
+        if (partialEvent) {
+            const partialB64 = b64Of(event?.partial_image_b64)
+                || b64Of(event?.b64_json)
+                || b64Of(event?.result)
+                || b64Of(item?.partial_image_b64)
+                || b64Of(item?.b64_json)
+                || b64Of(item?.result);
+            if (partialB64)
+                partial = { id: event?.item_id || item?.id || null, b64: partialB64, partial: true };
+            continue;
+        }
+        if (type === 'response.output_item.done' && item && String(item.type || '') === 'image_generation_call') {
             const b64 = b64Of(item.result) || b64Of(item.b64_json);
             if (b64)
                 final = { id: item.id || event?.item_id || null, b64, partial: false };
             continue;
         }
-        if (/image_generation_call/.test(type)) {
+        if (type === 'response.image_generation_call.completed' || type === 'response.image_generation_call.done') {
             const b64 = b64Of(event?.result) || b64Of(event?.b64_json);
-            if (b64) {
+            if (b64)
                 final = { id: event?.item_id || event?.id || null, b64, partial: false };
-                continue;
-            }
-            const partialB64 = b64Of(event?.partial_image_b64);
-            if (partialB64)
-                partial = { id: event?.item_id || null, b64: partialB64, partial: true };
         }
     }
     return final || partial;
@@ -86,22 +94,46 @@ export function parseResponsesSsePayload(text) {
         if (output.length) {
             if (hasImageGenerationResult(completed.response) || !streamedImage)
                 return completed.response;
+            if (streamedImage.partial) {
+                return {
+                    ...completed.response,
+                    image_output_partial_frame: true,
+                    partial_image_output_present: true
+                };
+            }
             return {
                 ...completed.response,
                 output: [...output, streamedImageItem(streamedImage)],
                 image_output_recovered_from_stream: true,
-                image_output_partial_frame: streamedImage.partial
+                image_output_partial_frame: false,
+                image_output_provenance: 'response.output_item.done'
+            };
+        }
+        if (!recovered.length) {
+            if (!streamedImage?.partial)
+                return completed.response;
+            return {
+                ...completed.response,
+                image_output_partial_frame: true,
+                partial_image_output_present: true
             };
         }
-        if (!recovered.length)
-            return completed.response;
         return {
             ...completed.response,
             output: recovered,
             output_recovered_from_stream: true,
-            ...(streamedImage
-                ? { image_output_recovered_from_stream: true, image_output_partial_frame: streamedImage.partial }
-                : {})
+            ...(streamedImage?.partial
+                ? {
+                    image_output_partial_frame: true,
+                    partial_image_output_present: true
+                }
+                : streamedImage
+                    ? {
+                        image_output_recovered_from_stream: true,
+                        image_output_partial_frame: false,
+                        image_output_provenance: 'response.output_item.done'
+                    }
+                    : {})
         };
     }
     if (recovered.length) {
@@ -110,13 +142,27 @@ export function parseResponsesSsePayload(text) {
             status: 'completed',
             output: recovered,
             output_recovered_from_stream: true,
-            ...(streamedImage
-                ? { image_output_recovered_from_stream: true, image_output_partial_frame: streamedImage.partial }
-                : {}),
+            ...(streamedImage?.partial
+                ? {
+                    image_output_partial_frame: true,
+                    partial_image_output_present: true
+                }
+                : streamedImage
+                    ? {
+                        image_output_recovered_from_stream: true,
+                        image_output_partial_frame: false,
+                        image_output_provenance: 'response.output_item.done'
+                    }
+                    : {}),
             events: eventTypes
         };
     }
-    return { object: 'response.sse', status: 'unknown', events: eventTypes };
+    return {
+        object: 'response.sse',
+        status: 'unknown',
+        ...(streamedImage?.partial ? { image_output_partial_frame: true, partial_image_output_present: true } : {}),
+        events: eventTypes
+    };
 }
 export function responsesOutputText(payload) {
     const direct = typeof payload?.output_text === 'string' ? payload.output_text : '';
@@ -134,7 +180,7 @@ export function responsesOutputText(payload) {
 function recoveredOutput(items, streamedImage) {
     const output = [...items];
     const hasImage = output.some((item) => String(item?.type || '') === 'image_generation_call' && b64Of(item?.result));
-    if (streamedImage && !hasImage)
+    if (streamedImage && !streamedImage.partial && !hasImage)
         output.push(streamedImageItem(streamedImage));
     return output;
 }

package/dist/core/routes/design-policy.js

@@ -1,14 +1,19 @@
 import { PRODUCT_DESIGN_PLUGIN, PRODUCT_DESIGN_REQUIRED_SKILLS, productDesignPluginPolicyText } from '../product-design-plugin.js';
 import { CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_COMPUTER_USE_ONLY_POLICY, CODEX_IMAGEGEN_REQUIRED_POLICY, CODEX_WEB_VERIFICATION_POLICY } from './evidence.js';
 export { productDesignPluginPolicyText };
+const GETDESIGN_CODEX_SKILL_REPOSITORY = 'MohtashamMurshid/getdesign';
+const GETDESIGN_CODEX_SKILL_REF = '83e9840d4a5744b5f10117ec00b855059e5abc25';
 export const GETDESIGN_REFERENCE = {
     id: 'getdesign',
     url: 'https://getdesign.md/',
     docs_url: 'https://docs.getdesign.app/',
     official_urls_url: 'https://docs.getdesign.app/resources/official-urls/',
     codex_guide_url: 'https://docs.getdesign.app/guides/use-with-codex/',
-    codex_skill: 'MohtashamMurshid/getdesign',
-    codex_skill_install: 'skills add MohtashamMurshid/getdesign',
+    codex_skill_repository: GETDESIGN_CODEX_SKILL_REPOSITORY,
+    codex_skill_ref: GETDESIGN_CODEX_SKILL_REF,
+    codex_skill: GETDESIGN_CODEX_SKILL_REPOSITORY,
+    codex_skill_install: `skills add ${GETDESIGN_CODEX_SKILL_REPOSITORY} -g -a codex -y`,
+    codex_skill_install_mode: 'manual_only',
     npm_cli: '@getdesign/cli',
     npm_sdk: '@getdesign/sdk',
     official_mcp_available: false,

package/dist/core/routes/dollar-manifest-lite.js

@@ -18,7 +18,6 @@ const DOLLAR_COMMANDS_LITE_BASE = [
     { command: '$QA-LOOP', route: 'QA loop', description: 'Dogfood UI/API as human proxy with safety gates, Codex Chrome Extension-first web UI evidence, safe fixes, rechecks, Honest Mode.' },
     { command: '$PPT', route: 'HTML/PDF presentation pipeline', description: 'Create restrained, information-first HTML/PDF presentation artifacts after delivery context, audience profile, STP, decision context, pain-point, research, design-system, and verification questions are sealed.' },
     { command: '$Image-UX-Review', route: 'image-generation UI/UX review loop', description: 'Review UI/UX through the imagegen/gpt-image-2 visual critique loop: source screenshots become generated annotated review images, those images become issue ledgers, then fixes are rechecked.' },
-    { command: '$UX-Review', route: 'image-generation UI/UX review loop', description: 'Review UI/UX through the imagegen/gpt-image-2 visual critique loop: source screenshots become generated annotated review images, those images become issue ledgers, then fixes are rechecked.' },
     { command: '$Computer-Use', route: 'native Computer Use fast lane', description: COMPUTER_USE_DESCRIPTION },
     { command: '$CU', route: 'native Computer Use fast lane', description: COMPUTER_USE_DESCRIPTION },
     { command: '$Goal', route: 'Codex native /goal control', description: 'Use Codex native Goal directly with detailed completion criteria; SKS creates no Goal mission, artifact, loop, or fallback state.' },
@@ -52,9 +51,6 @@ const DOLLAR_COMMAND_ALIASES_LITE_BASE = [
     { canonical: '$QA-LOOP', app_skill: '$qa-loop' },
     { canonical: '$PPT', app_skill: '$ppt' },
     { canonical: '$Image-UX-Review', app_skill: '$image-ux-review' },
-    { canonical: '$Image-UX-Review', app_skill: '$ux-review' },
-    { canonical: '$Image-UX-Review', app_skill: '$visual-review' },
-    { canonical: '$Image-UX-Review', app_skill: '$ui-ux-review' },
     { canonical: '$Computer-Use', app_skill: '$computer-use-fast' },
     { canonical: '$Computer-Use', app_skill: '$cu' },
     { canonical: '$Goal', app_skill: '$goal' },

package/dist/core/routes/evidence.js

@@ -24,7 +24,7 @@ export const CODEX_QA_SURFACE_ROUTING_POLICY = `Codex QA surface routing follows
 export const CODEX_WEB_VERIFICATION_POLICY = CODEX_QA_SURFACE_ROUTING_POLICY;
 export const CODEX_COMPUTER_USE_ONLY_POLICY = `Codex Computer Use is a live GUI surface for supported macOS and Windows environments, invoked with @Computer or @AppName for native apps, OS settings, browser contexts that truly require GUI-level operation, and cross-app workflows. Do not replace @Browser localhost/public-page checks or @Chrome signed-in checks with Computer Use unless the surface router records a specific GUI-only/cross-app reason. If live Computer Use tools, permissions, or app access are unavailable, mark the affected native/GUI evidence blocked or unverified instead of fabricating screenshots or actions. Codex App readiness/config checks are capability evidence only, not target interaction proof.`;
 export const IMAGEGEN_SOCIAL_SOURCE_POLICY = 'Use public X/social/community reports only as prompt-quality and workflow-sentiment hints after official OpenAI/Codex docs. Social posts are not capability specs, evidence of tool availability, or proof that a generated asset was created.';
-export const CODEX_IMAGEGEN_REQUIRED_POLICY = 'Pipeline image generation, raster asset creation/editing, and generated image-review evidence must use real Codex App imagegen/$imagegen with gpt-image-2 when that evidence is required for full verification. For newest-model image requests, prompt explicitly for "ChatGPT Images 2.0 / GPT Image 2.0 with gpt-image-2" instead of relying on generic image-generation wording. Do not substitute placeholder SVG/HTML/CSS, prose-only critique, stock-like stand-ins, manually fabricated files, or missing-output ledgers for requested/generated raster assets or required generated review images. If imagegen/gpt-image-2 is unavailable or generated annotated images cannot be created/linked, record the blocker and cap any closeout at verified_partial/reference-only instead of claiming generated-image evidence or full route verification; that partial closeout requires source screenshots plus hashes, docs evidence, source Image Voxel anchors, and Honest Mode evidence. In Codex App prompts, invoke $imagegen when live image generation is needed; SKS hooks and skills can require the policy but cannot attach missing host image-generation tools to an already-started turn. Official OpenAI/Codex docs are authoritative for capabilities, surfaces, limits, and evidence rules; X/social/community reports may inform prompt style only.';
+export const CODEX_IMAGEGEN_REQUIRED_POLICY = 'Pipeline image generation, raster asset creation/editing, and generated image-review evidence must use gpt-image-2 through the user-selected Codex provider when that evidence is required for full verification: Codex App imagegen/$imagegen, or the selected and ready codex-lb Responses provider. Only completed response output or a final response.output_item.done image result qualifies; streamed partial preview frames never count as generated-image evidence. For newest-model image requests, prompt explicitly for "ChatGPT Images 2.0 / GPT Image 2.0 with gpt-image-2" instead of relying on generic image-generation wording. Do not substitute placeholder SVG/HTML/CSS, prose-only critique, stock-like stand-ins, manually fabricated files, or missing-output ledgers for requested/generated raster assets or required generated review images. If imagegen/gpt-image-2 is unavailable or generated annotated images cannot be created/linked, record the blocker and cap any closeout at verified_partial/reference-only instead of claiming generated-image evidence or full route verification; that partial closeout requires source screenshots plus hashes, docs evidence, source Image Voxel anchors, and Honest Mode evidence. In Codex App prompts, invoke $imagegen when live image generation is needed; SKS hooks and skills can require the policy but cannot attach missing host image-generation tools to an already-started turn. Official OpenAI/Codex docs are authoritative for capabilities, surfaces, limits, and evidence rules; X/social/community reports may inform prompt style only.';
 export const DEFAULT_CODEX_APP_PLUGINS = Object.freeze([
     ['browser', 'openai-bundled'],
     ['chrome', 'openai-bundled'],

package/dist/core/routes.js

@@ -258,7 +258,7 @@ export const ROUTES = [
         reasoningPolicy: 'high',
         stopGate: 'naruto-gate.json',
         coverage_required: true,
-        cliEntrypoint: 'sks naruto run "task" [--agents N] [--max-threads N] [--trusted-project] | sks naruto status|subagents|proof',
+        cliEntrypoint: 'sks naruto run "task" [--agents N] [--max-threads N] [--trusted-project] | sks naruto status|subagents|proof | sks naruto parent-summary --mission M-... --stdin',
         examples: ['$Naruto run review twelve independent packages with --agents 12', '$Work']
     },
     {
@@ -310,8 +310,7 @@ export const ROUTES = [
         route: 'image-generation UI/UX review loop',
         description: 'Review UI/UX through the imagegen/gpt-image-2 visual critique loop: source screenshots become generated annotated review images, those images become issue ledgers, then fixes are rechecked.',
         requiredSkills: ['image-ux-review', 'imagegen', 'cu', 'pipeline-runner', REFLECTION_SKILL_NAME, 'honest-mode'],
-        dollarAliases: ['$UX-Review'],
-        appSkillAliases: ['ux-review', 'visual-review', 'ui-ux-review'],
+        hiddenDollarAliases: ['$UX-Review', '$Visual-Review', '$UI-UX-Review'],
         lifecycle: ['target_and_capture_inventory', 'source_screenshots', 'gpt_image_2_annotated_review_image', 'generated_image_text_extraction', 'issue_ledger', 'optional_safe_fixes', 'changed_screen_recheck', 'post_route_reflection', 'honest_mode'],
         context7Policy: 'if_external_docs',
         reasoningPolicy: 'high',
@@ -632,7 +631,7 @@ export const COMMAND_CATALOG = [
     { name: 'uninstall', usage: 'sks uninstall [--dry-run] [--yes] [--keep-config] [--keep-data] [--purge-projects] [--json]', description: 'Remove SKS global skills, hooks, menu bar, state, temp files, and optional project residue while preserving user-owned content by default.' },
     { name: 'deps', usage: 'sks deps check [--json] [--yes]', description: 'Check Node/npm, Codex CLI, and Zellij readiness; pass --yes to repair missing Codex CLI/Zellij tooling when supported.' },
     { name: 'codex', usage: 'sks codex compatibility|version|update-status [--refresh]|update|doctor|schema|0.144 [--json]', description: 'Check Codex CLI compatibility/version/update status, run the official `codex update`, and inspect current manifest, capability, and hook-schema evidence.' },
-    { name: 'codex-app', usage: 'sks codex-app [check|set-openrouter-key --api-key-stdin|use-openrouter --model <id>|openrouter-status|product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App install, OpenRouter provider activation, codex-lb key-entry guidance, Product Design plugin readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, and Codex CLI 0.130.0+ remote-control availability.' },
+    { name: 'codex-app', usage: 'sks codex-app [check|set-openrouter-key --api-key-stdin|use-openrouter --model <id>|openrouter-status|product-design|chrome-extension|pat status|remote-control]', description: 'Check Codex App install, OpenRouter provider activation, codex-lb key-entry guidance, Product Design plugin readiness, Codex Chrome Extension web verification readiness, PAT-safe status, first-party MCP/plugin readiness, and Codex CLI remote-control availability.' },
     { name: 'codex-native', usage: 'sks codex-native status|feature-broker|invocation-plan|init-deep [--json]', description: 'Inspect Codex Native feature broker readiness, invocation routing, pattern evidence, and managed memory setup.' },
     { name: 'hooks', usage: 'sks hooks explain|status|trust-report|replay|codex-validate|warning-check ... [--json]', description: 'Explain Codex hook events, validate vendored latest 10-event output schemas, replay fixtures, and enforce warning-zero SKS hook policies under the 0.134 compatibility matrix.' },
     { name: 'codex-lb', usage: 'sks codex-lb status|health|metrics|doctor|circuit|repair|setup ...', description: 'Configure, health-check, repair, and record circuit evidence for codex-lb provider auth without confusing ChatGPT OAuth and proxy keys.' },
@@ -688,7 +687,7 @@ export const COMMAND_CATALOG = [
     { name: 'wiki', usage: 'sks wiki coords|pack|refresh|publish|rebuild-index|validate|validate-shared|wrongness ...', description: 'Build, refresh, publish shared shards, rebuild ignored indexes, validate, and attach wrongness-memory context to RGBA/trig LLM Wiki packs with attention.use_first and attention.hydrate_first for compact recall plus source hydration.' },
     { name: 'memory', usage: 'sks memory build [--json] | sks memory gc [--dry-run]', description: 'Project TriWiki context-pack memory into managed AGENTS.md blocks or run bounded memory cleanup.' },
     { name: 'hproof', usage: 'sks hproof check [mission-id|latest]', description: 'Evaluate the H-Proof done gate for a mission.' },
-    { name: 'naruto', usage: 'sks naruto run \"task\" [--agents N] [--max-threads N] [--trusted-project] [--json] | sks naruto status|subagents|proof [latest|M-...] [--json]', description: 'Run or inspect the Codex official subagent workflow with a Sol Max parent and fixed Luna Max mechanical, Sol High implementation, Sol Max judgment, and Terra Medium long-context/tool profiles, max_depth=1, and structured parent-thread completion evidence.' },
+    { name: 'naruto', usage: 'sks naruto run \"task\" [--agents N] [--max-threads N] [--trusted-project] [--json] | sks naruto status|subagents|proof [latest|M-...] [--json] | sks naruto parent-summary --mission M-... --stdin [--json]', description: 'Run or inspect the Codex official subagent workflow with a Sol Max parent and fixed Luna Max mechanical, Sol High implementation, Sol Max judgment, and Terra Medium long-context/tool profiles, max_depth=1, and structured parent-thread completion evidence.' },
     { name: 'reasoning', usage: 'sks reasoning ["prompt"] [--json]', description: 'Show SKS temporary reasoning-effort routing: medium for simple tasks, high for logic, xhigh for research.' },
     { name: 'gx', usage: 'sks gx init|render|validate|drift|snapshot [name]', description: 'Create and verify deterministic SVG/HTML visual context cartridges.' },
     { name: 'profile', usage: 'sks profile show|set <model>', description: 'Inspect or set the current SKS model profile metadata.' },
@@ -743,10 +742,15 @@ export function explicitManagedSkillNames(prompt = '') {
         const skillName = sksPrefixedSkillName(match.name);
         if (!skillName || skillName.length > 100)
             continue;
-        if (routeByDollarCommand(match.name)) {
-            if (!MANAGED_ROUTE_SKILL_NAME_SET.has(skillName) || selected.includes(skillName))
+        const matchedRoute = routeByDollarCommand(match.name);
+        if (matchedRoute) {
+            const canonicalRouteSkillName = sksPrefixedSkillName(dollarSkillName(matchedRoute.command));
+            const selectedSkillName = MANAGED_ROUTE_SKILL_NAME_SET.has(skillName)
+                ? skillName
+                : canonicalRouteSkillName;
+            if (!MANAGED_ROUTE_SKILL_NAME_SET.has(selectedSkillName) || selected.includes(selectedSkillName))
                 continue;
-            selected.push(skillName);
+            selected.push(selectedSkillName);
             continue;
         }
         if (!rawName.startsWith('sks-'))

package/dist/core/safety/command-contract/contracts.js

@@ -17,6 +17,7 @@ const ARGUMENT_PROFILES = {
             mission: boundedString(1, 160),
             agents: { type: 'integer', minimum: 1 },
             max_threads: { type: 'integer', minimum: 1 },
+            stdin: { type: 'boolean' },
             readonly: { type: 'boolean' },
             trusted_project: { type: 'boolean' },
             json: { type: 'boolean' }
@@ -34,6 +35,7 @@ const ARGUMENT_PROFILES = {
                 ...valueFlag(input, 'mission', '--mission'),
                 ...numberFlag(input, 'agents', '--agents'),
                 ...numberFlag(input, 'max_threads', '--max-threads'),
+                ...booleanFlag(input, 'stdin', '--stdin'),
                 ...booleanFlag(input, 'readonly', '--readonly'),
                 ...booleanFlag(input, 'trusted_project', '--trusted-project'),
                 ...jsonFlag(input)

package/dist/core/safety/command-contract/types.js

@@ -1 +1 @@
-export const NARUTO_ACTIONS = ['run', 'status', 'subagents', 'proof', 'help'];
+export const NARUTO_ACTIONS = ['run', 'status', 'subagents', 'proof', 'parent-summary', 'help'];