sneakoscope 8.0.0 → 8.0.2

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 8.0.0** — its own identity, read from `package.json` and verified by the release gate, not advice about what to install.
+This README documents package **SKS 8.0.2** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. SKS stays version-agnostic: older hosts keep working where capabilities allow, while Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is actually supported — feature availability is decided by capability probes, not by a version number printed in a document. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it. Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph with evidence paths rather than lexical guessing — see [docs/architecture/context-graph.md](docs/architecture/context-graph.md) and [docs/architecture/search-engine-target.md](docs/architecture/search-engine-target.md). See [CHANGELOG.md](CHANGELOG.md).
 
@@ -87,6 +87,15 @@ Orca's mobile companion and Remote Orca Servers are beta. Their desktop/server r
 
 Fresh SKS-owned project config enables Codex 0.145+ multi-agent V2 with `agents.max_concurrent_threads_per_session = 12`, `features.multi_agent_v2.max_concurrent_threads_per_session = 13`, `max_depth = 1`, and `interrupt_message = true`. Nested delegation remains forbidden. Explicit user limits are preserved, and larger requests run in waves.
 
+Naruto's automatic tiers are 4/6/8 children for ordinary work and 16 for
+mass cheap-model work, with automatic ceilings of 12 and 64 respectively.
+The absolute `--agents`/`--max-threads` frame ceiling is 256, and requests
+beyond current capacity reuse slots across waves. `SKS_NARUTO_REMOTE_API_PARALLEL_BUDGET`
+can lower the governor's remote API parallel-request budget. These are structural
+scheduling limits, not a recommended target or proof that 256 live agents were
+load-tested on the current host; CPU, memory, file descriptors, process/worktree
+capacity, ready work, and verifier capacity can select a much smaller active wave.
+
 Gates are task-profile aware: greetings and answer-only turns create no mission gate; tiny work gets minimal verification; parallel work gets scoped ownership and verification; high-risk work keeps the full safety gates. `SubagentStart`/`SubagentStop` prove lifecycle only. Completion also requires `subagent-parent-summary.json` with one trustworthy structured outcome per thread, correlated with `subagent-events.jsonl` and `subagent-evidence.json`.
 
 Every installed Codex hook runs one common Naruto decision gate. The gate records `none`, `generic_naruto`, or `route_owned`: Answer, DFix, Wiki, Computer Use, Goal, and simple Git/control turns stay lightweight; ordinary non-trivial work defaults to two independent official subagents; critical work spanning at least three risk domains may use three. Research, AutoResearch, and QA-Loop retain their own exact orchestration contracts instead of receiving a second generic fan-out. Explicit `--agents N` remains authoritative.
@@ -239,8 +248,10 @@ It shows the current quickstart flow: one-line install, `$sks-plan`, `sks review
 - macOS optional: menu bar integration and `/usr/bin/open`
   - The menubar icon shows and hides itself automatically as the Codex desktop app launches/quits; set `quit_with_codex: true` in `~/.codex/sks-menubar/config.json` to have the menubar fully quit with Codex instead of just hiding (default `false`).
   - Native input dialogs (API keys, codex-lb setup) pass secrets to `sks` via `--api-key-stdin` instead of a visible Terminal window or process arguments.
-  - Codex Desktop always keeps its real ChatGPT OAuth identity. codex-lb setup stores a separate gateway endpoint/key and never replaces `~/.codex/auth.json`.
+  - Codex Desktop always keeps its real ChatGPT OAuth identity. codex-lb setup stores a separate gateway endpoint/key in an owner-only `0600` env file and never replaces `~/.codex/auth.json`; Keychain requests fail closed until a dedicated signed helper is available.
+  - Explicit codex-lb setup/reconfiguration migrates the retired generic `sks-codex-lb` Keychain item only after the replacement owner-only store is verified, deletes only the exact legacy account, and proves absence by readback. If cleanup cannot be proved, the replacement store is retained and the provider key should be rotated.
   - Providers separates **Desktop Full Capability**, **CLI Provider**, and **Capability Matrix**. Desktop Full Capability keeps the built-in OpenAI provider and routes supported traffic through a loopback bridge; CLI Provider is selected only for the CLI process.
+  - The retired dual-auth compatibility mode is detected only for safe migration. It cannot be activated or reported ready because it would require a global GUI secret.
   - Authentication and routing modes do not toggle Codex App's native model picker, Fast, image, Browser Use, Computer Use, voice, plugins/apps, or other built-in surfaces. Capability status describes evidence for the codex-lb data path, not permission to use the native feature.
   - `sks update`, setup, repair, and routing changes preserve OAuth, user model/reasoning/Fast settings, unknown catalog fields, and unrelated provider configuration. Legacy shared-auth routing requires explicit `sks codex-lb migrate-legacy-desktop --restart-app`; without a real restart and post-restart identity check it cannot finalize a migration receipt.
   - The remote codex-lb service remains independently hosted and operated. SKS uses only the configured URL and gateway key; it does not deploy, restart, or change credentials on that host.

package/config/skills-hash-ledger.v1.json

@@ -0,0 +1,63 @@
+{
+  "schema": "sks.skills-hash-ledger.v1",
+  "skills": [
+    { "canonical_name": "sks", "trusted_sha256": ["6d90142f3617a8ae92d9af8cb2fc18ab58a7d0070868504e1fe89e0effc305a5", "5b17aeb1484e9e2b3791bff6dcb175f30857f47e71b36eb0340e575385e8e82b"] },
+    { "canonical_name": "sks-align", "trusted_sha256": ["e98e1b67e228bec5c37d00c0206a2e01d2da698a83c80b527105bf04a19c136a"] },
+    { "canonical_name": "sks-answer", "trusted_sha256": ["3056ac543fa074868c7023097fdcb042d7175ab557d8e18cb7d92ce872785452", "bc8e2fc157b6c9819d32bb0a41bdf7f599a07693df18b0d80aa0ba103594f6eb"] },
+    { "canonical_name": "sks-autoresearch", "trusted_sha256": ["0b0a626be3b2e4f80462b721787287350af08ccdf8e952b8eb563a294a8cb777", "42602109bc1bf36b28a9acd0c458ab6c3b87f412c2710052e1c65a1f7b0cfeb8"] },
+    { "canonical_name": "sks-autoresearch-loop", "trusted_sha256": ["16d02c8944e5a9ca6f91d3642af9280288f1513e70b66738089704ca6e5d0468", "2bca681fef9a8ca29619c0ee70bc9d272a3d4c575bba0d12f5739e585eb1c0a5"] },
+    { "canonical_name": "sks-commit", "trusted_sha256": ["aea41328993b11e26e26ae94df6ed44312d1570ed39448531428b53ade9d7461", "943c6dcf822df086b320140e74404d4c7bcfd531264e25ada6624b5009f26207"] },
+    { "canonical_name": "sks-commit-and-push", "trusted_sha256": ["8e4ff7a39440c82e6c67a67d5bb267c69f508cedb5d9d5a93261f4dcdf8e8a1a", "b005b4a7456b80b95768ad358fe5950bf517483c6de71aec14ee3d1c600cc074"] },
+    { "canonical_name": "sks-computer-use", "trusted_sha256": ["66e35e6b3f1a7e63f5a4b95f5cb5d8c3444fa41f12328aa0d97c18aa95b241a4"] },
+    { "canonical_name": "sks-computer-use-fast", "trusted_sha256": ["b270d82e4057934d7f92ed4241d4ae86e22d0a9a08bceba1aa179d7535bda042", "b8736b2621398dfc85f7a2ff35d7a2fc728db0dfc0e964de69aebff93b5ed897"] },
+    { "canonical_name": "sks-context7-docs", "trusted_sha256": ["694cdfab8ee25c86d906b0eab5064c067dd05d9be9a8c1beec67f843ab602a42", "f3618fa72800899ffbe1686bed6bc888997bfb007a14f0e17c9a26178d55262a"] },
+    { "canonical_name": "sks-cu", "trusted_sha256": ["fc6ed807d0299dd56441738d9388787b1dd857dab9bb4c31a11f7d9b90b424d0", "da480ba03208d4888df1e97bbec6d80d608dafad0e33c2b1c72266e1860476a8"] },
+    { "canonical_name": "sks-db", "trusted_sha256": ["65ecf818f21a5c36865619bcb1f542ead7ab2974c5c7c3488ac7b4037b9c85d6", "e3912adaf37f9be002b012c89c18ff987c9cd16ea2445600c834fa39a5bf865a"] },
+    { "canonical_name": "sks-db-safety-guard", "trusted_sha256": ["b027d34dde30a3a3ccf9dbb41b90a69d647085b1ce0bdba468809611f5847b7e", "7978ca93f51540c838ae46aab9c2d88fde4932892cc7d75fc94e2071e6878a01"] },
+    { "canonical_name": "sks-design-artifact-expert", "trusted_sha256": ["a09daba0a2e479a68ed81ec6fba8d70e54c8398ed86f3d1879f874b98480b97c", "4a28d166eaf0bc4477b566b056034f972a7034165e36d8186daa9947bf92e3cf"] },
+    { "canonical_name": "sks-design-system-builder", "trusted_sha256": ["0a41e6ace960abaaf6abf5e7b1e53fd39f414e1e00b59fa725f2db9e3eb05b58", "c4f0007cad5774510bdc55e2815ce0911c220afa8d5dd4efc327ba1231c8f3da"] },
+    { "canonical_name": "sks-design-ui-editor", "trusted_sha256": ["83a806cc93a3c5342e0dccfc6a45983382d5bf74d1226c4e3288228db22b737a", "1b65f0028a6dcb2f7eeab0b0df411a75546bc3aefa8a76067e1818da000c2249"] },
+    { "canonical_name": "sks-dfix", "trusted_sha256": ["022785931a49f23e2efb6455962786c4b7dd7eab0f0ee55d8d3ffd2f858e01a5"] },
+    { "canonical_name": "sks-fast-mode", "trusted_sha256": ["0d42a799afc84d74bfe8c5855ab85adce0e945a10a10514b4d7e4b8c90eb16b6", "257daa08de3807d47c0941ac21ef1f89af2f7f670b0c34059d3234a5a8bfb36b"] },
+    { "canonical_name": "sks-fast-off", "trusted_sha256": ["bcb17b6d9a899dbb9c731e4cc95ba441af31fe4b5a7362dfc0154a39b798d8c5", "08b0b04df811d016d7f8018677dd9a25bd11de636daf1a11346e877d0466854e"] },
+    { "canonical_name": "sks-fast-on", "trusted_sha256": ["d136b65559bb87e22bb5818a065dfa7ec94ac21aa445f492a4fc70f92a364eff", "0355482a0baf32d8ac2131bdd88fb5fed5a3a9ea7ab82f12e26075bc8ea8c724"] },
+    { "canonical_name": "sks-from-chat-img", "trusted_sha256": ["be2f0ec42839c0c8ec09c4bfbb99e3c57d6ffe1b8253c2ebbf894200cf8dbf40", "583c41f46a7355d8c0c87472ea83573695d04341822eb9adcea822ed3311809f"] },
+    { "canonical_name": "sks-getdesign-reference", "trusted_sha256": ["ef1f04bb92da084e6217d213aba09a6df9b66dacdcf9aac2dd597c88207c7f0a", "688e10f29511c994ca24cdb16a160332bd79559bc03438cdcd43706420e34ad7"] },
+    { "canonical_name": "sks-goal", "trusted_sha256": ["867544877ac04df6e0232d6d425797e7fab2cceff9a7176a3c9e61f8c4a416d7", "0db0c58e72c0d58b24163371efe7a647c67d5d232020b2b4ed2557f19fe648d7"] },
+    { "canonical_name": "sks-gx", "trusted_sha256": ["53a9e538812e79549d0dfa7ae9da6b3d95672281d9b601ecd55f7d5ac64fcd44", "55b7d535a5978077462eb4c71226b9fdc772094f91ca336830315de10666e85e"] },
+    { "canonical_name": "sks-gx-visual-generate", "trusted_sha256": ["2041ab992d3a923f5d5c0f4548ceb89b408266c14f807d95c279a61c984d0c4f", "390d2647735657aa8c248a5ab48ed4fa7981e8d5534e74e8f207779a1716af65"] },
+    { "canonical_name": "sks-gx-visual-read", "trusted_sha256": ["8d287de65e0d4c298e1ff4e0e7e31e2f50a42ed8f708f98578ecd849c1cf13a4", "2175e76c4f4816d9c07f2f0ae02a0814d1489aaad78806a1ac27db1594282035"] },
+    { "canonical_name": "sks-gx-visual-validate", "trusted_sha256": ["ecd4f32fa298dc331e95793d756fcfba13ccdc0658a184452b6f45c637ad7c59", "f132066729e7f3e4a4287aa7be2146cd82df48730c38f51094f0174360c08d9d"] },
+    { "canonical_name": "sks-help", "trusted_sha256": ["8b6d7f0cffbd3b141f53a6937fb3d58ba363d495d6da561d8f463ee3b265d975", "0b67a2ed2eb1f3f80cf1645bee0c189ecc442d2ec84b1e0b218d800298487920"] },
+    { "canonical_name": "sks-honest-mode", "trusted_sha256": ["d1216afadecd4d9c85a2fb54bd31ee77ba45f8071f43bb0e21305c5fcd870095", "4543d942cac510b1a23e2e842f944d033087bbc761f6abc4a27d0a015bf22235"] },
+    { "canonical_name": "sks-hproof-claim-ledger", "trusted_sha256": ["2d40b940a022ecf5aeb9b4db77a21cef6f2808e884135bd28fe636c6ddd2c58f", "dc04c5e6100c940a84e1dc52af5c84158e03f1d24935c3b4f814ce7f1f5f0f60"] },
+    { "canonical_name": "sks-hproof-evidence-bind", "trusted_sha256": ["9629257ef1b78b13b503ad1033f500ea8ef898fb74ba50d78a2a72143b7ead4f", "fa20989183324964b5527742c0b1f593eacfcd3090b1707fb7c52258cdf62637"] },
+    { "canonical_name": "sks-image-ux-review", "trusted_sha256": ["9293346873b5fb25a9d93b630064a2c8ceede2bfdfa4c6ffe7fbb7f64da6595c"] },
+    { "canonical_name": "sks-imagegen", "trusted_sha256": ["a7f466ba1829a757f38432fbe8c3a672e22e91948537dafe8f8ce09561d2256e", "7a1f9372b03975886233a623031f41e06fd782b1e7a3409517bb428d9c6b76dd"] },
+    { "canonical_name": "sks-imagegen-source-scout", "trusted_sha256": ["95e71d4431a4c1f6911f0f76eaa1c2b475c52fd22d35c0a6c241e21e090507ad", "d648b571c674ed3be862bc0e8b2110f88c2bee54292bb009df0b0b2dbd6d400b"] },
+    { "canonical_name": "sks-init-deep", "trusted_sha256": ["a679fa4ba36e070de5753994f58595c4352302cc98d868ba70ff98305d15f451"] },
+    { "canonical_name": "sks-loop", "trusted_sha256": ["e56f9c4d0f7227961779daf6806943f1926bb588ce21a965a813e8ad91cfd5c8"] },
+    { "canonical_name": "sks-mad-sks", "trusted_sha256": ["03fb5063d19c3d48d004cd8e6e39bfe244016d7edacfe99e5dab087cbbfa6db9", "a3d0110ca97576130893311b3267621acb02c16ca9aea4b2da3e5300eea58158"] },
+    { "canonical_name": "sks-naruto", "trusted_sha256": ["f8e808622e222b4ad7dcb2907e5f06a890db83139ae443ec6c8c33781dfa3e37", "49b5e3dcc1b537b49c2cf09e5b875cb16acb05c622b22798e265e64dacd8ac90"] },
+    { "canonical_name": "sks-performance-evaluator", "trusted_sha256": ["5b8c6cea19ffda8e434700297ed060fde3cfcfc9c98635402599e84756466db4", "c0bfd5a2e6c74813cb5dac9dadd4c7543ee768a48cf3e36b86b3d9306c2712c6"] },
+    { "canonical_name": "sks-pipeline-runner", "trusted_sha256": ["020ba4da2f96bcda23cee4596b1e790816780178f1917dee748ff4b289cba0e5", "ffcbe0ea4b585e3d2886f1d9fa7a3b88706aaf42182fb177b2371b76beb0ddcd"] },
+    { "canonical_name": "sks-plan", "trusted_sha256": ["7795867b38a5f169924125850f137c31995cf28000f74284839530a68ace156a", "b6f3b09230e9809acf4e13df2de6af3c75a8534e8890d6560664ebfc2e4072f8"] },
+    { "canonical_name": "sks-ppt", "trusted_sha256": ["02e8a0758ec6d056ce9851a5a4505b1d32e302e730be3eb169a41392a5d6b2e2", "329fc6ee24bb04478b18fb6ccd3691cd7cbb50e1b77ca7b6136383d00b3b0bb4"] },
+    { "canonical_name": "sks-prompt-pipeline", "trusted_sha256": ["480c8afffafa9d52c483a963b4b8fafdffc0a47cd6d2efd3fb6d7924c11832c5", "5dc8524de9bad66cef133ea5ff2a8052331bd12a7ec85695f727d0d2c8523145"] },
+    { "canonical_name": "sks-qa-loop", "trusted_sha256": ["366ec49e5d25a6f25ba72308e46044291fe4d26f9d294a90638b42cc5565bb94"] },
+    { "canonical_name": "sks-reasoning-router", "trusted_sha256": ["a7d879d157c6d5b6b81a67dba7b5b731ac18ea986841fe1ab2cafbd6623481c3", "dc0b8c6a4093269c2c36b58432b25409704d06fea8ca558f43b598625ca0d9de"] },
+    { "canonical_name": "sks-reflection", "trusted_sha256": ["5013cefe58746a23e998bd83dedf2c4de9270010297be6fc0c0f0ae2aae73fb8", "4ba8b2778d1d37c25c89f1a97ce3ce5602c39138425e1f4af4a91e840a961670"] },
+    { "canonical_name": "sks-release-review", "trusted_sha256": ["bb6ef28431fd6c390041c9a2855b906fd01a1f6da02111f094258914cf826bb9", "7cf879a2efd61822d3dccd4eb69fb704bfbab4b114b820b6dfa0d13b5f20e9fa"] },
+    { "canonical_name": "sks-research", "trusted_sha256": ["2e96f95315d99b645d4171ba4648d9f9218ec3e98dcd6d363b5de522d2e1bfe3"] },
+    { "canonical_name": "sks-review", "trusted_sha256": ["d08e9aada80a2fe87edee602e57517ec814b87e0f3dfc40928e8571fc1efafd5", "42ba1dbdc6b476d1c4a6e42467fdc86fda58bab3207c054550591ab5f6e94c37"] },
+    { "canonical_name": "sks-search-visibility-core", "trusted_sha256": ["79bc8e1220a6a48acc74c70f9d5715bf80b910fef44e9c57550ea06046f204e0"] },
+    { "canonical_name": "sks-seo-geo-optimizer", "trusted_sha256": ["3db4ae3a41093df1a2e9bc35b5ad9b3458eef6eb76d6899b8e4099c42e0227e6"] },
+    { "canonical_name": "sks-solution-scout", "trusted_sha256": ["c2fe96cea325ad44a1e871f1e14c18ec369846c5deaa28d77be234994cae734c", "a563554da2d69e69a4afebf914a7a2d3b7b0f25dcb5eb7f9248f3fc7576bc4c9"] },
+    { "canonical_name": "sks-super-search", "trusted_sha256": ["1f50b70eb7d30544d5cdf8f0712ae01442737025a152a53648ebdd956326d83e", "a0da7ec655bab7f40831de21b52691ac75b56fbc2fbfd1f053e1c5f2dd5ddb52"] },
+    { "canonical_name": "sks-turbo-context-pack", "trusted_sha256": ["c02745666f6d9485c538876e77509209ecf5f481d1d7bed36e312eea60688f06", "d94bb85ea836e55c5b2b0df237821cf97b3d2ec6bfe697c97525f3fa5807b200"] },
+    { "canonical_name": "sks-wiki", "trusted_sha256": ["b49e0bbe6163e8673b9d2d34a43f8ec130ac7032cacabe17e6fece6182f96be0", "16b2b813d202ca51d2ea4fe0da918eddf9494db7ab1356352d4188a5da3496b1"] },
+    { "canonical_name": "sks-with-local-llm-off", "trusted_sha256": ["4609c43a671c649b2574aebf035e0e8200b29bb893d176567e92f14d2f3aa92c", "86d3a860b438c91c2a5b4cc8ac9c8e7477008f9b689602ddcf14a9e3b759923d"] },
+    { "canonical_name": "sks-with-local-llm-on", "trusted_sha256": ["11da3f94d77b0f9fe76dee2e99d058cf1495fdc4eaf3e2fb6e43dae66f7d2cd3", "27e1ff08b95428d6b623d06358d5d114ff02673a5c97d8f180dd75859682cd6c"] },
+    { "canonical_name": "sks-work", "trusted_sha256": ["9619bcbe29fe84853500dbcac169d81915388144cbe677ef4f5831220e3a02d3", "7b4893af053caba27eab1b1d73ff375856522e433fb85dfabde50ea844c75639"] }
+  ]
+}

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "8.0.0"
+version = "8.0.2"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "8.0.0"
+version = "8.0.2"
 edition = "2021"
 
 [dependencies]

package/dist/bin/fast-inline.js

@@ -11,9 +11,15 @@ function rootJsonFastInline(fs, cwd = process.cwd()) {
         using_global_root: !project
     })}\n`);
 }
-function doctorJsonFastInline() {
+async function doctorJsonFastInline(input = {}) {
     const startedAt = Date.now();
-    process.stdout.write(`${JSON.stringify({
+    const { inspectOAuthCallbackPortConflict, oauthCallbackDoctorGuidance } = await import('../core/codex/oauth-callback-port-diagnostic.js');
+    const oauthCallbackPortDiagnostic = await inspectOAuthCallbackPortConflict({
+        ...(input.run ? { run: input.run } : {})
+    });
+    const oauthCallbackOperatorActions = oauthCallbackDoctorGuidance(oauthCallbackPortDiagnostic);
+    const write = input.write || ((text) => process.stdout.write(text));
+    write(`${JSON.stringify({
         schema: 'sks.doctor-status.v3',
         elapsed_ms: Math.max(0, Date.now() - startedAt),
         ok: true,
@@ -53,7 +59,12 @@ function doctorJsonFastInline() {
         },
         doctor_fix_transaction: null,
         blockers: [],
-        warnings: ['fast_readonly_doctor_skipped_optional_deep_diagnostics']
+        warnings: [
+            'fast_readonly_doctor_skipped_optional_deep_diagnostics',
+            ...oauthCallbackPortDiagnostic.warnings
+        ],
+        operator_actions: oauthCallbackOperatorActions,
+        oauth_callback_port_diagnostic: oauthCallbackPortDiagnostic
     }, null, 2)}\n`);
 }
 async function narutoHelpJsonFastInline() {

package/dist/bin/sks-dispatch.js

@@ -15,7 +15,7 @@ async function runSks(args) {
     }
     else if (args[0] === 'doctor' && args.includes('--json') && !args.includes('--report-file') && !args.includes('--fix') && !args.includes('--full') && !args.includes('--capabilities') && !args.includes('--search')) {
         const { doctorJsonFastInline } = await import('./fast-inline.js');
-        doctorJsonFastInline();
+        await doctorJsonFastInline();
     }
     else if (args[0] === 'super-search' && args[1] === 'doctor') {
         const superSearchDoctorModule = '../core/super-search/doctor.js';

package/dist/cli/codex-lb-setup-warning-output.js

@@ -0,0 +1,17 @@
+const CODEX_LB_SETUP_WARNING_MESSAGES = {
+    legacy_keychain_removed_rotate_provider_key_if_not_already_rotated: 'The retired macOS Keychain item was removed. Rotate the provider API key if it has not already been rotated.',
+    legacy_keychain_cleanup_indeterminate_rotate_provider_key: 'Legacy macOS Keychain cleanup could not be proved. Rotate the provider API key before continuing to use it.'
+};
+export function formatCodexLbSetupWarnings(result) {
+    const warningCodes = [
+        ...(Array.isArray(result?.warnings) ? result.warnings : []),
+        result?.persistence?.warning
+    ]
+        .map((value) => String(value || '').trim())
+        .filter(Boolean);
+    return [...new Set(warningCodes)].map((warning) => `warning: ${CODEX_LB_SETUP_WARNING_MESSAGES[warning] || warning}`);
+}
+export function printCodexLbSetupWarnings(result, write = console.error) {
+    for (const warning of formatCodexLbSetupWarnings(result))
+        write(warning);
+}

package/dist/cli/command-manifest-lite.js

@@ -1,4 +1,4 @@
-import { NARUTO_ACTIONS } from '../core/safety/command-contract/types.js';
+import { narutoCommandInputSchema } from '../core/subagents/naruto-command-input-contract.js';
 const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'help', summary: 'Show SKS help', maturity: 'stable', readonly: true, skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
     { name: 'version', summary: 'Show SKS version', maturity: 'stable', readonly: true, skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
@@ -189,18 +189,7 @@ export function commandInputSchema(profile) {
     if (profile === 'json-only')
         return objectSchema({ json: { type: 'boolean' } });
     if (profile === 'naruto') {
-        return objectSchema({
-            action: { type: 'string', enum: [...NARUTO_ACTIONS] },
-            task: boundedString(1, 32_768),
-            prompt: boundedString(1, 32_768),
-            mission: boundedString(1, 160),
-            agents: { type: 'integer', minimum: 1 },
-            max_threads: { type: 'integer', minimum: 1 },
-            stdin: { type: 'boolean' },
-            readonly: { type: 'boolean' },
-            trusted_project: { type: 'boolean' },
-            json: { type: 'boolean' }
-        });
+        return narutoCommandInputSchema();
     }
     if (profile === 'paths') {
         return objectSchema({