sneakoscope 8.0.2 → 8.0.3

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 8.0.2** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 8.0.3** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. SKS stays version-agnostic: older hosts keep working where capabilities allow, while Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is actually supported — feature availability is decided by capability probes, not by a version number printed in a document. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it. Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph with evidence paths rather than lexical guessing — see [docs/architecture/context-graph.md](docs/architecture/context-graph.md) and [docs/architecture/search-engine-target.md](docs/architecture/search-engine-target.md). See [CHANGELOG.md](CHANGELOG.md).
 
@@ -63,11 +63,25 @@ The SKS menu bar shows the installed Codex CLI version and latest known version.
 
 **Manage MCP Servers…** opens a native macOS manager for the global `~/.codex/config.toml`. It can add remote URL or local stdio servers, enable/disable existing entries, remove entries after confirmation, and refresh the current state. Mutations are lock-protected, backed up, TOML-validated, and written with mode `0600`; configured environment values and command arguments are never rendered in the list. Changes apply to new Codex sessions. The same plumbing is available through the canonical `sks mcp config list|get|add|edit|duplicate|enable|disable|remove|test|login|logout|backups|restore` surface for diagnostics and automation.
 
-### Remote coding: Orca (external option)
-
-SKS no longer provides a first-party Telegram coding bridge. If you want to monitor or steer coding work from another device, consider [Orca](https://github.com/stablyai/orca), an external MIT-licensed project that can launch Codex in a worktree. Orca is not bundled with SKS, supported by SKS, or required to use SKS; SKS adds no Orca dependency or configuration.
-
-Orca's mobile companion and Remote Orca Servers are beta. Their desktop/server runtime remains the source of truth and must keep running; remote access may require a private LAN or Tailscale path. See [the Orca migration and remote-coding guide](docs/orca-remote-coding.md) for scope, setup links, and former Telegram-user migration notes.
+### Remote coding: Telegram transport and Orca option
+
+SKS 8.0.3 restores a first-party Telegram Bot API transport for the existing
+typed remote-control contract. One bounded outbound `getUpdates` loop runs in
+the existing Menu Bar process, so it adds no daemon, inbound port, or tunnel.
+`sks telegram pair` enrolls an allowed chat through the existing secret store;
+unpaired chats receive no response, free-form shell input is never accepted,
+and destructive commands require actor-bound two-step confirmation and an audit
+receipt. Doctor readiness requires a real `getMe` round trip plus live-poller
+evidence. Release readiness additionally requires a real command/reply E2E from
+a cellular network; configuration, fixtures, and local-network tests do not
+satisfy that gate.
+
+[Orca](https://github.com/stablyai/orca) remains an external MIT-licensed
+option that can launch Codex in a worktree. It is not bundled with, supported
+by, or required by SKS, and SKS adds no Orca dependency or automatic migration.
+Orca's mobile companion and Remote Orca Servers are beta; the desktop/server
+runtime remains the source of truth and remote access may require a private LAN
+or Tailscale path. See [the Orca remote-coding guide](docs/orca-remote-coding.md).
 
 ## The Front Door
 
@@ -85,16 +99,25 @@ Orca's mobile companion and Remote Orca Servers are beta. Their desktop/server r
 
 `$sks-naruto` and `sks naruto run "task" --agents 8 --max-threads 12` use Codex official subagents. Standalone and Codex App tasks that request project-host database, spreadsheet, or render tools require the non-persistent `--trusted-project` flag after the operator reviews the checkout; an App session ID scopes evidence but does not grant trust. The parent is GPT-5.6 Sol Max. Tiny mechanical `worker` slices use Luna Max; ordinary UI, logic, backend, and native coding uses Sol High; review, testing, debugging, architecture, integration, security, database, research, release, and other judgment-sensitive work uses Sol Max; long-context scans and direct Computer Use, Browser/Chrome, or image-generation execution uses Terra Medium. Mixed execution/judgment work is split when possible, and unsplittable judgment defaults to Sol Max.
 
-Fresh SKS-owned project config enables Codex 0.145+ multi-agent V2 with `agents.max_concurrent_threads_per_session = 12`, `features.multi_agent_v2.max_concurrent_threads_per_session = 13`, `max_depth = 1`, and `interrupt_message = true`. Nested delegation remains forbidden. Explicit user limits are preserved, and larger requests run in waves.
-
-Naruto's automatic tiers are 4/6/8 children for ordinary work and 16 for
-mass cheap-model work, with automatic ceilings of 12 and 64 respectively.
-The absolute `--agents`/`--max-threads` frame ceiling is 256, and requests
-beyond current capacity reuse slots across waves. `SKS_NARUTO_REMOTE_API_PARALLEL_BUDGET`
-can lower the governor's remote API parallel-request budget. These are structural
-scheduling limits, not a recommended target or proof that 256 live agents were
-load-tested on the current host; CPU, memory, file descriptors, process/worktree
-capacity, ready work, and verifier capacity can select a much smaller active wave.
+Fresh SKS-owned project config enables Codex 0.145+ multi-agent V2 with `agents.max_concurrent_threads_per_session = 256`, `features.multi_agent_v2.max_concurrent_threads_per_session = 257`, `max_depth = 1`, and `interrupt_message = true`. Nested delegation remains forbidden. Explicit user-owned limits are preserved, while legacy SKS-owned 12/13 defaults migrate to 256/257.
+
+Naruto's automatic starting tiers are 4/6/8 children for ordinary work and 16
+for mass cheap-model work. After decomposition, either lane may expand to the
+SKS-owned ceiling of 256 independent useful children. Explicit
+`--agents N` and `--max-threads N` values from 1 through 256 remain
+authoritative instead of being reduced to those automatic tiers. A first wave
+may reach 256 child slots only when independent ready work, disjoint ownership,
+verifier/tool capacity, and the external Codex/session host all permit it;
+otherwise Naruto records the exact active limiter and reuses returned capacity
+in later waves.
+
+`SKS_NARUTO_REMOTE_API_PARALLEL_BUDGET` declares a lower remote provider/API
+parallel-request budget for the governor. It cannot raise a lower external-host
+or session limit. The official Codex lane does not impose a local CPU/RAM or
+unmeasured API-default clamp; it follows an explicit provider budget and a
+measured host cap. The 256 ceiling is structural, not a recommendation or proof
+that 256 live agents were load-tested on the current host. The four GPT-5.6
+model profiles are routing lanes, not an agent-count limit.
 
 Gates are task-profile aware: greetings and answer-only turns create no mission gate; tiny work gets minimal verification; parallel work gets scoped ownership and verification; high-risk work keeps the full safety gates. `SubagentStart`/`SubagentStop` prove lifecycle only. Completion also requires `subagent-parent-summary.json` with one trustworthy structured outcome per thread, correlated with `subagent-events.jsonl` and `subagent-evidence.json`.
 
@@ -234,9 +257,9 @@ It shows the current quickstart flow: one-line install, `$sks-plan`, `sks review
 - Project memory: `sks memory build`
 - Codebase index/pack for LLM context: `sks wiki refresh --code`, `sks wiki validate --json` (code-pack freshness)
 - Native capability repair: `sks doctor --fix` (imagegen/Computer Use/Browser Use), `.sneakoscope/reports/native-capability-readiness.json`
-- codex-lb continuity: `sks codex-lb status --json` verifies the selected proxy's unauthenticated `/health` `X-App-Version`. Tool-heavy continuation requires a codex-lb deployment that reports the capability; use the official latest stable release. Older or unverified deployments block setup, doctor, and launch instead of silently falling back.
+- codex-lb continuity: `sks codex-lb status --json` verifies the selected proxy's unauthenticated `/health` `X-App-Version`. Tool-heavy continuation requires a codex-lb deployment that reports the capability; use the official latest stable release. Older or unverified deployments block setup, doctor, and launch instead of silently falling back. A selected route is green only after one measured request records the destination host, gateway-key authentication class, measurement time, and latency; config presence alone is not routing proof.
 - Agent bridge for any agent system: `sks mcp-server`, `sks agent-bridge setup`, `SKS_AGENT_MODE=1` — see [docs/AGENT-BRIDGE.md](docs/AGENT-BRIDGE.md)
-- Release gates: `npm run release:check:affected` for ordinary change-aware verification and `npm run release:check:confidence` for the final local confidence pass.
+- Release gates: `npm run release:check:affected` for ordinary change-aware verification and `npm run release:check:confidence` for the final local confidence pass. Evidence for the 8.0.3 physical checklist includes a successful 5,001-directory update scan, exactly one running Menu Bar process at the current package version, one measured real codex-lb request to the selected remote host, and one Telegram command/reply E2E over cellular.
 - Release preparation: typecheck, one clean build, focused tests, affected/confidence gates, then `npm publish --dry-run --json --registry https://registry.npmjs.org/ --tag latest --access public`. The dry-run does not publish; authorization remains a separate maintainer workflow.
 - Release readiness notes: [docs/release-readiness.md](docs/release-readiness.md) and [CHANGELOG.md](CHANGELOG.md)
 - Image generation review routes require Codex App `$imagegen`/`gpt-image-2` evidence with recorded output hashes; direct API fallback and mock fixtures do not satisfy full route gates.
@@ -248,15 +271,16 @@ It shows the current quickstart flow: one-line install, `$sks-plan`, `sks review
 - macOS optional: menu bar integration and `/usr/bin/open`
   - The menubar icon shows and hides itself automatically as the Codex desktop app launches/quits; set `quit_with_codex: true` in `~/.codex/sks-menubar/config.json` to have the menubar fully quit with Codex instead of just hiding (default `false`).
   - Native input dialogs (API keys, codex-lb setup) pass secrets to `sks` via `--api-key-stdin` instead of a visible Terminal window or process arguments.
-  - Codex Desktop always keeps its real ChatGPT OAuth identity. codex-lb setup stores a separate gateway endpoint/key in an owner-only `0600` env file and never replaces `~/.codex/auth.json`; Keychain requests fail closed until a dedicated signed helper is available.
+  - Codex Desktop keeps `~/.codex/auth.json` byte-preserved. **Use codex-lb** atomically stores the provider definition and active top-level selection and resolves its separate gateway key from the owner-only `0600` env file; while selected, requests must not consume the stored ChatGPT OAuth identity. Turning codex-lb off returns to the official OAuth path. Keychain requests fail closed until a dedicated signed helper is available.
   - Explicit codex-lb setup/reconfiguration migrates the retired generic `sks-codex-lb` Keychain item only after the replacement owner-only store is verified, deletes only the exact legacy account, and proves absence by readback. If cleanup cannot be proved, the replacement store is retained and the provider key should be rotated.
-  - Providers separates **Desktop Full Capability**, **CLI Provider**, and **Capability Matrix**. Desktop Full Capability keeps the built-in OpenAI provider and routes supported traffic through a loopback bridge; CLI Provider is selected only for the CLI process.
+  - Providers exposes atomic **Use codex-lb** / **Use ChatGPT OAuth** selection plus shared RoutingTruth. A green codex-lb state requires one measured request to the configured remote base URL; the Menu Bar and Doctor render the same host, authentication class, measurement time, and latency.
   - The retired dual-auth compatibility mode is detected only for safe migration. It cannot be activated or reported ready because it would require a global GUI secret.
-  - Authentication and routing modes do not toggle Codex App's native model picker, Fast, image, Browser Use, Computer Use, voice, plugins/apps, or other built-in surfaces. Capability status describes evidence for the codex-lb data path, not permission to use the native feature.
+  - Authentication and routing modes do not toggle Codex App's native model picker, Fast, image, Browser Use, Computer Use, voice, plugins/apps, or other built-in surfaces. Capability status describes measured evidence for the codex-lb data path, not permission to use a native feature.
   - `sks update`, setup, repair, and routing changes preserve OAuth, user model/reasoning/Fast settings, unknown catalog fields, and unrelated provider configuration. Legacy shared-auth routing requires explicit `sks codex-lb migrate-legacy-desktop --restart-app`; without a real restart and post-restart identity check it cannot finalize a migration receipt.
   - The remote codex-lb service remains independently hosted and operated. SKS uses only the configured URL and gateway key; it does not deploy, restart, or change credentials on that host.
-  - Full release proof blocks with `real_required_missing` until fresh trust-anchored evidence covers the real Desktop feature/lifecycle matrix and the separately hosted other-Mac runtime; fixtures and configuration cannot satisfy that boundary.
-  - Update installs always rebuild the companion with the newly installed SKS package, preventing a previous-version updater from restoring a stale menu binary.
+  - Full release proof blocks with `real_required_missing` until fresh trust-anchored evidence covers the real Desktop feature/lifecycle matrix, one measured gateway-key request to the selected separately hosted codex-lb instance, and the other-Mac runtime; fixtures and configuration cannot satisfy that boundary.
+  - Update installs stop and verify every prior Menu Bar process before replacement, rebuild the companion from the newly installed SKS package, bootstrap it, and require exactly one running process whose version probe equals the current package version.
+  - Telegram remote control uses one bounded long-poller inside that same Menu Bar process. Release evidence must include a real cellular command/reply round trip; `getMe`, a local fixture, or a configured token alone cannot satisfy the E2E gate.
   - The menubar dropdown's `View Last Log` item opens the most recent background action's log file, so you don't need to keep a Terminal window open to see command output.
   - `Manage MCP Servers…` provides a resizable native table and add/remove/enable/disable controls for global Codex MCP configuration. Secret environment values and command arguments are accepted through native dialogs/stdin but omitted from list output and logs.
   - `sks menubar status --json` reports a `codex_sync` object with `bundle_id`, `codex_running`, and `icon_visible_expected` to show Codex-lifecycle detection state.

package/config/skills-hash-ledger.v1.json

@@ -38,7 +38,7 @@
     { "canonical_name": "sks-init-deep", "trusted_sha256": ["a679fa4ba36e070de5753994f58595c4352302cc98d868ba70ff98305d15f451"] },
     { "canonical_name": "sks-loop", "trusted_sha256": ["e56f9c4d0f7227961779daf6806943f1926bb588ce21a965a813e8ad91cfd5c8"] },
     { "canonical_name": "sks-mad-sks", "trusted_sha256": ["03fb5063d19c3d48d004cd8e6e39bfe244016d7edacfe99e5dab087cbbfa6db9", "a3d0110ca97576130893311b3267621acb02c16ca9aea4b2da3e5300eea58158"] },
-    { "canonical_name": "sks-naruto", "trusted_sha256": ["f8e808622e222b4ad7dcb2907e5f06a890db83139ae443ec6c8c33781dfa3e37", "49b5e3dcc1b537b49c2cf09e5b875cb16acb05c622b22798e265e64dacd8ac90"] },
+    { "canonical_name": "sks-naruto", "trusted_sha256": ["34222c72e4e1ead3584907f4d905444b7de820283ee7348018f110d5e6b04461", "f8e808622e222b4ad7dcb2907e5f06a890db83139ae443ec6c8c33781dfa3e37", "49b5e3dcc1b537b49c2cf09e5b875cb16acb05c622b22798e265e64dacd8ac90"] },
     { "canonical_name": "sks-performance-evaluator", "trusted_sha256": ["5b8c6cea19ffda8e434700297ed060fde3cfcfc9c98635402599e84756466db4", "c0bfd5a2e6c74813cb5dac9dadd4c7543ee768a48cf3e36b86b3d9306c2712c6"] },
     { "canonical_name": "sks-pipeline-runner", "trusted_sha256": ["020ba4da2f96bcda23cee4596b1e790816780178f1917dee748ff4b289cba0e5", "ffcbe0ea4b585e3d2886f1d9fa7a3b88706aaf42182fb177b2371b76beb0ddcd"] },
     { "canonical_name": "sks-plan", "trusted_sha256": ["7795867b38a5f169924125850f137c31995cf28000f74284839530a68ace156a", "b6f3b09230e9809acf4e13df2de6af3c75a8534e8890d6560664ebfc2e4072f8"] },

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "8.0.2"
+version = "8.0.3"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "8.0.2"
+version = "8.0.3"
 edition = "2021"
 
 [dependencies]

package/dist/bin/fast-inline.js

@@ -13,11 +13,7 @@ function rootJsonFastInline(fs, cwd = process.cwd()) {
 }
 async function doctorJsonFastInline(input = {}) {
     const startedAt = Date.now();
-    const { inspectOAuthCallbackPortConflict, oauthCallbackDoctorGuidance } = await import('../core/codex/oauth-callback-port-diagnostic.js');
-    const oauthCallbackPortDiagnostic = await inspectOAuthCallbackPortConflict({
-        ...(input.run ? { run: input.run } : {})
-    });
-    const oauthCallbackOperatorActions = oauthCallbackDoctorGuidance(oauthCallbackPortDiagnostic);
+    const secretResolution = await inspectCodexLbSecretResolutionFastInline(input);
     const write = input.write || ((text) => process.stdout.write(text));
     write(`${JSON.stringify({
         schema: 'sks.doctor-status.v3',
@@ -59,12 +55,10 @@ async function doctorJsonFastInline(input = {}) {
         },
         doctor_fix_transaction: null,
         blockers: [],
-        warnings: [
-            'fast_readonly_doctor_skipped_optional_deep_diagnostics',
-            ...oauthCallbackPortDiagnostic.warnings
-        ],
-        operator_actions: oauthCallbackOperatorActions,
-        oauth_callback_port_diagnostic: oauthCallbackPortDiagnostic
+        warnings: ['fast_readonly_doctor_skipped_optional_deep_diagnostics'],
+        codex_lb: {
+            secret_resolution: secretResolution
+        }
     }, null, 2)}\n`);
 }
 async function narutoHelpJsonFastInline() {
@@ -125,12 +119,60 @@ function findProjectRootSync(fs, start) {
         dir = parent;
     }
 }
+async function inspectCodexLbSecretResolutionFastInline(input) {
+    const processEnv = input.processEnv || process.env;
+    const home = input.home || processEnv.HOME || processEnv.USERPROFILE || process.cwd();
+    const codexHome = joinPath(home, '.codex');
+    const envPath = joinPath(codexHome, 'sks-codex-lb.env');
+    const metadataPath = joinPath(codexHome, 'sks-codex-lb.json');
+    const [{ inspectConfinedPath }, { readPrivateCredentialFile }] = await Promise.all([
+        import('../core/managed-path-safety.js'),
+        import('../core/security/private-credential-file.js')
+    ]);
+    let envFilePresent = false;
+    let envFilePrivate = false;
+    try {
+        const inspected = await inspectConfinedPath(codexHome, envPath);
+        envFilePresent = inspected.exists;
+        const expectedUid = typeof process.getuid === 'function' ? process.getuid() : null;
+        envFilePrivate = inspected.exists
+            && !inspected.leafSymlink
+            && inspected.stat?.isFile() === true
+            && (inspected.stat.mode & 0o777) === 0o600
+            && (expectedUid === null || inspected.stat.uid === expectedUid);
+    }
+    catch {
+        envFilePresent = false;
+    }
+    let metadataValid = false;
+    if (envFilePrivate) {
+        try {
+            const snapshot = await readPrivateCredentialFile(codexHome, metadataPath, 'codex_lb_metadata', { maxBytes: 64 * 1024 });
+            const metadata = JSON.parse(snapshot.bytes.toString('utf8'));
+            metadataValid = metadata?.schema === 'sks.codex-lb-metadata.v1'
+                && /^[a-f0-9]{64}$/.test(String(metadata?.api_key?.sha256 || '').trim().toLowerCase())
+                && Boolean(String(metadata?.base_url || '').trim());
+        }
+        catch {
+            metadataValid = false;
+        }
+    }
+    const processKeyPresent = Boolean(String(processEnv.CODEX_LB_API_KEY || '').trim());
+    const source = envFilePrivate && metadataValid ? 'env-file' : processKeyPresent ? 'process.env' : 'missing';
+    return {
+        source,
+        path: source === 'env-file' || envFilePresent ? envPath : null,
+        prompt_risk: (input.platform || process.platform) === 'darwin'
+            ? 'unknown_keychain_not_probed'
+            : 'none'
+    };
+}
 function fsInline() {
     return process.getBuiltinModule?.('node:fs') || require('node:fs');
 }
-function readJsonSyncInline(file) {
+function readJsonSyncInline(file, fs = fsInline()) {
     try {
-        return JSON.parse(fsInline().readFileSync(file, 'utf8'));
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
     }
     catch {
         return null;

package/dist/bin/sks-dispatch.js

@@ -13,7 +13,7 @@ async function runSks(args) {
         const { rootJsonFastInline } = await import('./fast-inline.js');
         rootJsonFastInline(fs);
     }
-    else if (args[0] === 'doctor' && args.includes('--json') && !args.includes('--report-file') && !args.includes('--fix') && !args.includes('--full') && !args.includes('--capabilities') && !args.includes('--search')) {
+    else if (args[0] === 'doctor' && args.includes('--json') && !args.includes('--report-file') && !args.includes('--fix') && !args.includes('--full') && !args.includes('--capabilities') && !args.includes('--profile') && !args.includes('--search')) {
         const { doctorJsonFastInline } = await import('./fast-inline.js');
         await doctorJsonFastInline();
     }

package/dist/cli/command-manifest-lite.js

@@ -17,6 +17,7 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'update', summary: 'Inspect, review, apply, or roll back the global SKS update', maturity: 'stable' },
     { name: 'uninstall', summary: 'Uninstall SKS global skills, hooks, config, menu bar, and optional project residue', maturity: 'stable', allowedDuringActiveRoute: true },
     { name: 'update-check', summary: 'Show the shared SKS, Codex CLI, and Menu Bar update status', maturity: 'stable', readonly: true, skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
+    { name: 'config', summary: 'Adopt project Codex config into SKS management', maturity: 'stable', skipMigrationGate: true },
     { name: 'mcp', summary: 'Manage scoped Codex MCP configuration', maturity: 'beta', skipMigrationGate: true },
     { name: 'wizard', summary: 'Open setup wizard help', maturity: 'stable' },
     { name: 'usage', summary: 'Show focused usage topic', maturity: 'stable', readonly: true, allowedDuringActiveRoute: true, diagnostic: true },
@@ -37,6 +38,7 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'codex-lb', summary: 'Inspect codex-lb status and circuit health', maturity: 'beta', skipMigrationGate: true },
     { name: 'menubar', summary: 'Inspect/install/restart/uninstall SKS menu bar', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
     { name: 'remote', summary: 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', maturity: 'beta' },
+    { name: 'telegram', summary: 'Pair and inspect the Telegram remote-control transport', maturity: 'beta', skipMigrationGate: true },
     { name: 'hooks', summary: 'Explain and inspect Codex hooks', maturity: 'beta', skipMigrationGate: true },
     { name: 'zellij-lane', summary: 'Render a Zellij lane frame for SKS sessions', maturity: 'beta' },
     { name: 'zellij-slot-pane', summary: 'Render a compact Zellij worker slot pane', maturity: 'beta' },
@@ -116,6 +118,7 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
     check: { risk: 'R1', latency: 'long' },
     'commit-and-push': { risk: 'R3' },
     'computer-use': { latency: 'long' },
+    config: { risk: 'R2', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     dfix: { latency: 'long' },
     'dollar-commands': { risk: 'R2', latency: 'normal' },
     eval: { latency: 'long' },
@@ -165,6 +168,7 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
         requiredCapabilities: ['proof.stop-gate']
     },
     task: { risk: 'R1', latency: 'long' },
+    telegram: { risk: 'R2', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     trust: {
         risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'trust', requiredCapabilities: ['proof.trust']
     },

package/dist/cli/command-registry.js

@@ -165,6 +165,7 @@ const COMMAND_DEFINITIONS = {
         activeRoutePolicy: 'always'
     }),
     'update-check': readOnly(entry('stable', 'Show the shared SKS, Codex CLI, and Menu Bar update status', 'dist/core/commands/basic-cli.js', basicArgs('updateCheckCommand'))),
+    config: skipMigrationGate(entry('stable', 'Adopt project Codex config into SKS management', 'dist/core/config-adopt/index.js', subcommand(() => import('../core/config-adopt/index.js'), 'configCommand', 'dist/core/config-adopt/index.js', 'adopt'))),
     mcp: skipMigrationGate(entry('beta', 'Manage scoped Codex MCP configuration', 'dist/core/commands/mcp-config-command.js', argsCommand(() => import('../core/commands/mcp-config-command.js'), 'mcpConfigCommand', 'dist/core/commands/mcp-config-command.js'))),
     wizard: entry('stable', 'Open setup wizard help', 'dist/core/commands/basic-cli.js', basicNoArgs('quickstartCommand')),
     usage: readOnly(entry('stable', 'Show focused usage topic', 'dist/core/commands/basic-cli.js', basicArgs('usageCommand'))),
@@ -185,6 +186,7 @@ const COMMAND_DEFINITIONS = {
     'codex-lb': skipMigrationGate(entry('beta', 'Inspect codex-lb status and circuit health', 'dist/commands/codex-lb.js', directCommand(() => import('../commands/codex-lb.js'), 'dist/commands/codex-lb.js'))),
     menubar: activeRouteDiagnostic(entry('beta', 'Inspect/install/restart/uninstall SKS menu bar', 'dist/core/commands/menubar-command.js', subcommand(() => import('../core/commands/menubar-command.js'), 'menubarCommand', 'dist/core/commands/menubar-command.js', 'status'))),
     remote: entry('beta', 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', 'dist/core/commands/remote-command.js', argsCommand(() => import('../core/commands/remote-command.js'), 'remoteCommand', 'dist/core/commands/remote-command.js')),
+    telegram: skipMigrationGate(entry('beta', 'Pair and inspect the Telegram remote-control transport', 'dist/core/commands/telegram-command.js', argsCommand(() => import('../core/commands/telegram-command.js'), 'telegramCommand', 'dist/core/commands/telegram-command.js'))),
     hooks: skipMigrationGate(entry('beta', 'Explain and inspect Codex hooks', 'dist/commands/hooks.js', directCommand(() => import('../commands/hooks.js'), 'dist/commands/hooks.js'))),
     'zellij-lane': entry('beta', 'Render a Zellij lane frame for SKS sessions', 'dist/commands/zellij-lane.js', directCommand(() => import('../commands/zellij-lane.js'), 'dist/commands/zellij-lane.js')),
     'zellij-slot-pane': entry('beta', 'Render a compact Zellij worker slot pane', 'dist/commands/zellij-slot-pane.js', directCommand(() => import('../commands/zellij-slot-pane.js'), 'dist/commands/zellij-slot-pane.js')),
@@ -260,6 +262,7 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
     check: { risk: 'R1', latency: 'long' },
     'commit-and-push': { risk: 'R3' },
     'computer-use': { latency: 'long' },
+    config: { risk: 'R2', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     dfix: { latency: 'long' },
     eval: { latency: 'long' },
     gates: {
@@ -307,6 +310,7 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
         requiredCapabilities: ['proof.stop-gate']
     },
     task: { risk: 'R1', latency: 'long' },
+    telegram: { risk: 'R2', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     trust: {
         risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'trust', requiredCapabilities: ['proof.trust']
     },

package/dist/cli/install-helpers-codex-lb-chain.js

@@ -204,6 +204,193 @@ async function fetchCodexLbResponse(fetchImpl, endpoint, apiKey, body, timeoutMs
         clearTimeout(timer);
     }
 }
+const CODEX_LB_CONNECT_TEST_MAX_OUTPUT_TOKENS = 32;
+const CODEX_LB_CONNECT_TEST_MAX_RESULT_CHARS = 256;
+const CODEX_LB_CONNECT_TEST_MAX_ERROR_CHARS = 512;
+const CODEX_LB_CONNECT_TEST_TIMEOUT_MS = 15_000;
+function boundedText(value, maxChars) {
+    const text = String(value || '').trim();
+    return text.length <= maxChars ? text : text.slice(0, maxChars);
+}
+function codexLbCompletedResponse(json, events = []) {
+    if (json?.response && typeof json.response === 'object')
+        return json.response;
+    if (json?.data?.response && typeof json.data.response === 'object')
+        return json.data.response;
+    if (json?.data && typeof json.data === 'object')
+        return json.data;
+    if (json && typeof json === 'object')
+        return json;
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event?.type === 'response.completed' && event?.response && typeof event.response === 'object') {
+            return event.response;
+        }
+    }
+    return null;
+}
+function codexLbOutputText(response, events = []) {
+    const parts = [];
+    for (const output of Array.isArray(response?.output) ? response.output : []) {
+        for (const content of Array.isArray(output?.content) ? output.content : []) {
+            if (content?.type === 'output_text' && typeof content.text === 'string' && content.text.trim()) {
+                parts.push(content.text.trim());
+            }
+        }
+    }
+    if (parts.length === 0) {
+        for (const event of events) {
+            if (event?.type === 'response.output_text.done' && typeof event.text === 'string' && event.text.trim()) {
+                parts.push(event.text.trim());
+            }
+        }
+    }
+    return parts.join('\n').trim();
+}
+function boundedCodexLbUsage(usage) {
+    const tokenCount = (value) => Number.isSafeInteger(value) && value >= 0 ? value : null;
+    return {
+        input_tokens: tokenCount(usage?.input_tokens),
+        output_tokens: tokenCount(usage?.output_tokens),
+        total_tokens: tokenCount(usage?.total_tokens),
+        reasoning_tokens: tokenCount(usage?.output_tokens_details?.reasoning_tokens)
+    };
+}
+function codexLbConnectTestFailure(status, extra = {}) {
+    return {
+        schema: 'sks.codex-lb-connect-test.v1',
+        ok: false,
+        status,
+        response_id: null,
+        model: extra.model || null,
+        latency_ms: extra.latency_ms ?? null,
+        usage: extra.usage || null,
+        result: null,
+        result_truncated: false,
+        http_status: extra.http_status ?? null,
+        blockers: Array.isArray(extra.blockers) ? extra.blockers : [status],
+        ...(extra.error ? { error: extra.error } : {})
+    };
+}
+export async function testCodexLbConnection(status = {}, opts = {}) {
+    const providerSelected = status?.selected === true || status?.provider?.selected === true;
+    if (opts.requireSelected === true && !providerSelected) {
+        return codexLbConnectTestFailure('provider_unselected', {
+            blockers: ['codex_lb_provider_not_selected']
+        });
+    }
+    const credentialBindingBlockers = Array.isArray(opts.credentialBindingBlockers)
+        ? opts.credentialBindingBlockers.map((value) => boundedText(value, 128)).filter(Boolean)
+        : [];
+    if (credentialBindingBlockers.length > 0) {
+        return codexLbConnectTestFailure('credential_binding_drift', { blockers: credentialBindingBlockers });
+    }
+    if (status.provider_base_url_matches_credential !== true) {
+        return codexLbConnectTestFailure('provider_base_url_mismatch', {
+            blockers: ['codex_lb_provider_base_url_mismatch']
+        });
+    }
+    if (status.provider_contract_ok !== true) {
+        return codexLbConnectTestFailure('provider_contract_drift', {
+            blockers: ['codex_lb_provider_contract_drift']
+        });
+    }
+    const baseUrl = opts.baseUrl || status.base_url;
+    const endpoint = codexLbResponsesEndpoint(baseUrl);
+    if (!endpoint)
+        return codexLbConnectTestFailure('missing_base_url');
+    const transportBlocker = codexLbBaseUrlSecurityBlocker(baseUrl);
+    if (transportBlocker)
+        return codexLbConnectTestFailure('transport_blocked', { blockers: [transportBlocker] });
+    const env = opts.env || process.env;
+    const home = opts.home || env.HOME || os.homedir();
+    const apiKey = opts.apiKey || parseCodexLbEnvKey(await readText(opts.envPath || status.env_path || codexLbEnvPath(home), ''));
+    if (!apiKey)
+        return codexLbConnectTestFailure('missing_env_key');
+    const model = String(opts.model || env.SKS_CODEX_MODEL || env.CODEX_MODEL || '').trim();
+    if (!model)
+        return codexLbConnectTestFailure('model_unselected');
+    if (model.length > 128)
+        return codexLbConnectTestFailure('model_invalid');
+    const fetchImpl = opts.fetch || globalThis.fetch;
+    if (typeof fetchImpl !== 'function')
+        return codexLbConnectTestFailure('fetch_unavailable', { model });
+    const timeoutMs = Number(opts.timeoutMs || env.SKS_CODEX_LB_CONNECT_TEST_TIMEOUT_MS || CODEX_LB_CONNECT_TEST_TIMEOUT_MS);
+    const body = {
+        model,
+        input: 'Reply OK.',
+        store: false,
+        reasoning: { effort: 'low' },
+        max_output_tokens: CODEX_LB_CONNECT_TEST_MAX_OUTPUT_TOKENS
+    };
+    const nowMs = typeof opts.nowMs === 'function' ? opts.nowMs : Date.now;
+    const startedAt = nowMs();
+    const fetched = await fetchCodexLbResponse(fetchImpl, endpoint, apiKey, body, timeoutMs);
+    const latencyMs = Math.max(0, Math.round(nowMs() - startedAt));
+    if (!fetched.ok) {
+        const error = redactSecretText(fetched.error_payload?.error?.message
+            || fetched.error_payload?.response?.error?.message
+            || fetched.text
+            || 'codex-lb Responses request failed', [apiKey]);
+        return codexLbConnectTestFailure('request_failed', {
+            model,
+            latency_ms: latencyMs,
+            http_status: fetched.status,
+            error: boundedText(error, CODEX_LB_CONNECT_TEST_MAX_ERROR_CHARS)
+        });
+    }
+    const response = codexLbCompletedResponse(fetched.json, fetched.events);
+    const responseId = boundedText(codexLbResponseId(response), 128);
+    const responseModel = boundedText(response?.model || model, 128);
+    const usage = boundedCodexLbUsage(response?.usage);
+    if (!responseId) {
+        return codexLbConnectTestFailure('missing_response_id', {
+            model: responseModel,
+            latency_ms: latencyMs,
+            http_status: fetched.status,
+            usage
+        });
+    }
+    if (response?.error) {
+        return codexLbConnectTestFailure('response_error', {
+            model: responseModel,
+            latency_ms: latencyMs,
+            http_status: fetched.status,
+            usage,
+            error: boundedText(redactSecretText(response.error?.message || response.error, [apiKey]), CODEX_LB_CONNECT_TEST_MAX_ERROR_CHARS)
+        });
+    }
+    if (response?.status !== 'completed') {
+        return codexLbConnectTestFailure('response_not_completed', {
+            model: responseModel,
+            latency_ms: latencyMs,
+            http_status: fetched.status,
+            usage
+        });
+    }
+    const outputText = codexLbOutputText(response, fetched.events);
+    if (!outputText) {
+        return codexLbConnectTestFailure('empty_result', {
+            model: responseModel,
+            latency_ms: latencyMs,
+            http_status: fetched.status,
+            usage
+        });
+    }
+    return {
+        schema: 'sks.codex-lb-connect-test.v1',
+        ok: true,
+        status: 'connected',
+        response_id: responseId,
+        model: responseModel,
+        latency_ms: latencyMs,
+        usage,
+        result: boundedText(outputText, CODEX_LB_CONNECT_TEST_MAX_RESULT_CHARS),
+        result_truncated: outputText.length > CODEX_LB_CONNECT_TEST_MAX_RESULT_CHARS,
+        http_status: fetched.status,
+        blockers: []
+    };
+}
 export async function checkCodexLbResponseChain(status = {}, opts = {}) {
     const env = opts.env || process.env;
     if (!codexLbChainCheckEnabled(env) && !opts.force)