sneakoscope 8.1.2 → 8.2.0

package/dist/cli/router.js

@@ -23,7 +23,7 @@ export function prepareRouterExecutionIntent(argv, inheritance = {}) {
             observedChangedPaths: parent.observed_changed_paths,
             targetHashes: parent.target_hashes,
             policyVersion: parent.policy_version,
-            modeSnapshot: parent.mode_snapshot,
+            runtimeSnapshot: parent.runtime_snapshot,
             evidenceState: parent.evidence_state,
             retryBudget: parent.retry_budget,
             requestedRisk: parent.risk,
@@ -41,7 +41,7 @@ export function prepareRouterExecutionIntent(argv, inheritance = {}) {
         effect: inheritance.effect || classifyCliIntentEffect(effectiveArgv),
         targetHashes: [createHash('sha256').update(`${process.cwd()}\0${effectiveArgv[0] || 'doctor'}`).digest('hex')],
         policyVersion: 'sks-cli-router-v1',
-        modeSnapshot: inheritance.modeSnapshot || providerModeFromEnvironment(),
+        runtimeSnapshot: inheritance.runtimeSnapshot || 'desktop-bridge',
         evidenceState: inheritance.evidenceState || 'missing',
         retryBudget: inheritance.retryBudget ?? 0,
         force: effectiveArgv.includes('--force'),
@@ -104,12 +104,6 @@ export async function dispatch(args) {
         return result;
     }
 }
-function providerModeFromEnvironment() {
-    const mode = String(process.env.SKS_PROVIDER_MODE || '').trim();
-    return mode === 'codex-lb' || mode === 'openrouter' || mode === 'chatgpt-oauth'
-        ? mode
-        : 'chatgpt-oauth';
-}
 function classifyCliIntentEffect(argv) {
     const normalized = normalizeCommand(argv);
     const command = normalized.command;
@@ -133,7 +127,7 @@ function classifyCliIntentEffect(argv) {
 async function dispatchInner(argv) {
     const retiredGlm = findRetiredGlobalExecutionArgumentErrors(argv).filter((item) => item.includes('--glm'));
     if (retiredGlm.length && argv.some((arg) => arg === '--glm' || String(arg).startsWith('--glm='))) {
-        const hint = 'GLM MAD CLI was removed. Use SKS Center Providers or: sks codex-app use-openrouter --model <id>';
+        const hint = 'GLM MAD CLI was removed. Use sks bridge provider configure|validate|enable, sks bridge catalog sync, and sks bridge route set-default.';
         console.error(hint);
         process.exitCode = 1;
         const result = {
@@ -356,6 +350,12 @@ export function safeActiveRouteContinuation(command, args, state = {}) {
         return Boolean(state.mission_id)
             && (requestedMission === String(state.mission_id) || requestedMission === 'latest');
     }
+    if (command === 'align') {
+        if (activeRoute !== 'ALIGN' || !['run', 'proof'].includes(subcommand))
+            return false;
+        const requestedMission = String(args[1] || '').trim();
+        return Boolean(state.mission_id) && requestedMission === String(state.mission_id);
+    }
     const expectedRoutes = new Map([
         ['research', ['RESEARCH']],
         ['autoresearch', ['AUTORESEARCH', 'RESEARCH']],

package/dist/commands/bridge-command-output.js

@@ -0,0 +1,111 @@
+import { redactString, REDACTION_MARKER } from '../core/secret-redaction.js';
+import { validateDesktopCapabilityReportV3 } from '../core/codex-lb/bridge-runtime-validation.js';
+const COMMAND_SCHEMA = 'sks.bridge-command.v1';
+const ERROR_SCHEMA = 'sks.bridge-command-error.v1';
+export class BridgeCliError extends Error {
+    code;
+    recoveryAction;
+    constructor(code, recoveryAction = 'review_bridge_command_help') {
+        super(code);
+        this.code = code;
+        this.recoveryAction = recoveryAction;
+    }
+}
+export function verificationOutput(value, level, strict) {
+    const report = record(value);
+    const reportGenerated = validateDesktopCapabilityReportV3(value).ok;
+    if (!reportGenerated) {
+        return errorOutput('capability_schema_invalid', 'update_sks_and_rebuild_menubar');
+    }
+    const executionOk = record(report.execution).ok === true;
+    const summary = record(report.summary);
+    const levelSatisfied = summary.level_satisfied === true;
+    const fullFeatureVerified = summary.full_feature_verified === true;
+    return {
+        ...report,
+        ok: executionOk && (!strict || levelSatisfied),
+        execution_ok: executionOk,
+        report_generated: true,
+        requested_level: level,
+        level_satisfied: levelSatisfied,
+        full_feature_verified: fullFeatureVerified,
+        strict
+    };
+}
+export function ordinaryOutput(value, label) {
+    const result = record(value);
+    if (Object.keys(result).length === 0 || typeof result.schema !== 'string') {
+        return errorOutput('bridge_controller_response_invalid', 'update_sks_and_rebuild_bridge_controller');
+    }
+    const executionOk = result.execution_ok === false
+        ? false
+        : result.ok === false
+            ? false
+            : record(result.execution).ok === false
+                ? false
+                : true;
+    return {
+        ...result,
+        schema: typeof result.schema === 'string' ? result.schema : COMMAND_SCHEMA,
+        ok: executionOk,
+        execution_ok: executionOk,
+        command_summary: label
+    };
+}
+export function errorOutput(blocker, recoveryAction, error) {
+    return {
+        schema: ERROR_SCHEMA,
+        ok: false,
+        execution_ok: false,
+        status: 'failed',
+        blockers: [blocker],
+        recovery_action: recoveryAction,
+        ...(error instanceof BridgeCliError
+            ? {}
+            : error instanceof Error
+                ? { error: redactString(error.message) }
+                : {})
+    };
+}
+export function sanitizeBridgeValue(value, secrets) {
+    if (typeof value === 'string') {
+        let text = redactString(value);
+        for (const secret of secrets)
+            text = text.split(secret).join(REDACTION_MARKER);
+        return text;
+    }
+    if (Array.isArray(value))
+        return value.map((entry) => sanitizeBridgeValue(entry, secrets));
+    if (!value || typeof value !== 'object')
+        return value;
+    const output = {};
+    for (const [key, entry] of Object.entries(value)) {
+        output[key] = isSecretValueKey(key)
+            ? REDACTION_MARKER
+            : sanitizeBridgeValue(entry, secrets);
+    }
+    return output;
+}
+function isSecretValueKey(key) {
+    return /^(?:api_key|secret|token|password|authorization|bearer|cookie|set_cookie)$/i.test(key)
+        || /(?:^|_)(?:api_key|secret|token|password|authorization)$/i.test(key)
+        || /^(?:headers?|env)$/i.test(key);
+}
+export function mergeMetadata(output, metadata) {
+    return metadata ? { ...output, ...metadata } : output;
+}
+export function textSummary(output) {
+    const status = output.ok === false ? 'failed' : 'completed';
+    const summary = typeof output.command_summary === 'string'
+        ? output.command_summary
+        : 'Desktop Bridge command';
+    const blockers = Array.isArray(output.blockers)
+        ? output.blockers.map(String).filter(Boolean).join(', ')
+        : '';
+    return blockers ? `${summary}: ${status} (${blockers})` : `${summary}: ${status}`;
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}

package/dist/commands/bridge.js

@@ -0,0 +1,320 @@
+import path from 'node:path';
+import { readStdin } from '../core/fsx.js';
+import { serveDesktopBridge } from '../core/codex-lb/desktop-service.js';
+import { BridgeCliError, errorOutput, mergeMetadata, ordinaryOutput, sanitizeBridgeValue, textSummary, verificationOutput } from './bridge-command-output.js';
+const CONTROLLER_FACADE_EXPORT = 'executeDesktopBridgeCommand';
+const MAX_STDIN_SECRET_BYTES = 64 * 1024;
+const DEFAULT_IO = {
+    readStdin,
+    stdout: (text) => process.stdout.write(text),
+    stderr: (text) => process.stderr.write(text),
+    setExitCode: (code) => {
+        process.exitCode = code;
+    }
+};
+export function usage(command = 'bridge') {
+    return [
+        `Usage: sks ${command} status [--json]`,
+        `       sks ${command} ensure|repair [--json]`,
+        `       sks ${command} verify --level shallow|transport|deep [--strict|--require-ready] [--json]`,
+        `       sks ${command} provider list [--json]`,
+        `       sks ${command} provider configure codex-lb --host <host> --api-key-stdin [--json]`,
+        `       sks ${command} provider configure openrouter --api-key-stdin [--json]`,
+        `       sks ${command} provider validate|enable|disable <codex-lb|openrouter> [--json]`,
+        `       sks ${command} provider remove-credential <codex-lb|openrouter> --confirm [--json]`,
+        `       sks ${command} catalog sync|status [--json]`,
+        `       sks ${command} route list [--json]`,
+        `       sks ${command} route set-default <codex-lb|openrouter> [--json]`,
+        `       sks ${command} route explain <model> [--json]`,
+        `       sks ${command} unmanage --confirm [--json]`,
+        `       sks ${command} rollback <receipt-id> --confirm [--json]`,
+        '',
+        'Provider secrets are accepted only through --api-key-stdin. Readiness changes the exit code only with --strict or --require-ready.'
+    ].join('\n');
+}
+export async function run(_command, args = []) {
+    return runBridgeCommand(args);
+}
+export async function runBridgeCommand(args = [], options = {}) {
+    const io = options.io || DEFAULT_IO;
+    const execution = await executeBridgeCommand(args, options);
+    if (execution.json) {
+        io.stdout(`${JSON.stringify(execution.output, null, 2)}\n`);
+    }
+    else if (execution.exit_code === 0) {
+        io.stdout(`${textSummary(execution.output)}\n`);
+    }
+    else {
+        io.stderr(`${textSummary(execution.output)}\n`);
+    }
+    if (execution.exit_code !== 0)
+        io.setExitCode(execution.exit_code);
+    return execution.output;
+}
+export async function executeBridgeCommand(args = [], options = {}) {
+    const io = options.io || DEFAULT_IO;
+    let parsed;
+    try {
+        parsed = await parseInvocation(args, io);
+    }
+    catch (error) {
+        const bridgeError = error instanceof BridgeCliError
+            ? error
+            : new BridgeCliError('bridge_command_parse_failed');
+        const output = errorOutput(bridgeError.code, bridgeError.recoveryAction, error);
+        return {
+            output: mergeMetadata(output, options.metadata),
+            json: args.includes('--json'),
+            exit_code: 1
+        };
+    }
+    try {
+        const raw = parsed.request.operation === 'serve'
+            ? await (options.serve || serveDesktopBridge)({ settingsPath: parsed.request.settings_path })
+            : await (options.facade || await loadBridgeCommandFacade()).execute(parsed.request);
+        const output = parsed.request.operation === 'verify'
+            ? verificationOutput(raw, parsed.request.level, parsed.strict)
+            : ordinaryOutput(raw, parsed.label);
+        const sanitized = sanitizeBridgeValue(output, parsed.secrets);
+        const decorated = mergeMetadata(sanitized, options.metadata);
+        return {
+            output: decorated,
+            json: parsed.json,
+            exit_code: decorated.ok === false ? 1 : 0
+        };
+    }
+    catch (error) {
+        const output = sanitizeBridgeValue(errorOutput(error instanceof BridgeCliError ? error.code : 'bridge_command_internal_error', error instanceof BridgeCliError ? error.recoveryAction : 'retry_or_run_bridge_status', error), parsed.secrets);
+        return {
+            output: mergeMetadata(output, options.metadata),
+            json: parsed.json,
+            exit_code: 1
+        };
+    }
+}
+export async function loadBridgeCommandFacade() {
+    const controller = await import('../core/codex-lb/desktop-controller.js');
+    const execute = controller[CONTROLLER_FACADE_EXPORT];
+    if (typeof execute !== 'function') {
+        throw new BridgeCliError(`bridge_controller_facade_unavailable:${CONTROLLER_FACADE_EXPORT}`, 'update_sks_and_rebuild_bridge_controller');
+    }
+    return {
+        execute: (request) => Promise.resolve(execute(request))
+    };
+}
+async function parseInvocation(args, io) {
+    rejectSecretArgv(args);
+    const parsed = parseArgs(args);
+    const [area = 'status', action, target, extra] = parsed.positionals;
+    const json = parsed.flags.has('--json');
+    const strict = parsed.flags.has('--strict') || parsed.flags.has('--require-ready');
+    const base = { json, strict, secrets: [] };
+    if (area === 'status' && action === undefined) {
+        allowOnly(parsed, ['--json'], []);
+        return { ...base, request: { operation: 'status' }, label: 'Desktop Bridge status' };
+    }
+    if (area === 'serve' && action === undefined) {
+        allowOnly(parsed, ['--json'], ['--settings']);
+        const settingsPath = parsed.values.get('--settings') || '';
+        if (!path.isAbsolute(settingsPath)) {
+            throw new BridgeCliError('desktop_bridge_settings_path_must_be_absolute');
+        }
+        if (path.basename(settingsPath) !== 'desktop-bridge-settings.json') {
+            throw new BridgeCliError('desktop_bridge_settings_path_invalid');
+        }
+        return {
+            ...base,
+            request: { operation: 'serve', settings_path: settingsPath },
+            label: 'Desktop Bridge service'
+        };
+    }
+    if ((area === 'ensure' || area === 'repair') && action === undefined) {
+        allowOnly(parsed, ['--json'], []);
+        return { ...base, request: { operation: area }, label: `Desktop Bridge ${area}` };
+    }
+    if (area === 'verify' && action === undefined) {
+        allowOnly(parsed, ['--json', '--strict', '--require-ready'], ['--level']);
+        const level = capabilityLevel(parsed.values.get('--level') || 'shallow');
+        return {
+            ...base,
+            request: { operation: 'verify', level },
+            label: `Desktop Bridge ${level} verification`
+        };
+    }
+    if (area === 'provider') {
+        if (action === 'list' && target === undefined) {
+            allowOnly(parsed, ['--json'], []);
+            return { ...base, request: { operation: 'provider.list' }, label: 'Bridge provider list' };
+        }
+        if (action === 'configure' && target !== undefined && extra === undefined) {
+            allowOnly(parsed, ['--json', '--api-key-stdin'], ['--host']);
+            const providerId = provider(target);
+            if (!parsed.flags.has('--api-key-stdin')) {
+                throw new BridgeCliError('bridge_provider_api_key_stdin_required', 'retry_with_api_key_stdin');
+            }
+            const host = parsed.values.get('--host');
+            if (providerId === 'codex-lb' && !host) {
+                throw new BridgeCliError('codex_lb_host_required', 'retry_with_codex_lb_host');
+            }
+            const apiKey = (await io.readStdin()).trim();
+            if (!apiKey)
+                throw new BridgeCliError('bridge_provider_api_key_stdin_empty', 'retry_with_api_key_stdin');
+            if (Buffer.byteLength(apiKey, 'utf8') > MAX_STDIN_SECRET_BYTES) {
+                throw new BridgeCliError('bridge_provider_api_key_stdin_too_large', 'retry_with_valid_api_key');
+            }
+            return {
+                ...base,
+                secrets: [apiKey],
+                request: {
+                    operation: 'provider.configure',
+                    provider_id: providerId,
+                    api_key: apiKey,
+                    ...(host ? { host } : {})
+                },
+                label: `${providerId} credential configuration`
+            };
+        }
+        if ((action === 'validate' || action === 'enable' || action === 'disable')
+            && target !== undefined
+            && extra === undefined) {
+            allowOnly(parsed, ['--json'], []);
+            const providerId = provider(target);
+            return {
+                ...base,
+                request: { operation: `provider.${action}`, provider_id: providerId },
+                label: `${providerId} ${action}`
+            };
+        }
+        if (action === 'remove-credential' && target !== undefined && extra === undefined) {
+            allowOnly(parsed, ['--json', '--confirm'], []);
+            requireConfirmation(parsed);
+            const providerId = provider(target);
+            return {
+                ...base,
+                request: { operation: 'provider.remove-credential', provider_id: providerId, confirmed: true },
+                label: `${providerId} credential removal`
+            };
+        }
+    }
+    if (area === 'catalog' && (action === 'sync' || action === 'status') && target === undefined) {
+        allowOnly(parsed, ['--json'], []);
+        return {
+            ...base,
+            request: { operation: `catalog.${action}` },
+            label: `Combined catalog ${action}`
+        };
+    }
+    if (area === 'route') {
+        if (action === 'list' && target === undefined) {
+            allowOnly(parsed, ['--json'], []);
+            return { ...base, request: { operation: 'route.list' }, label: 'Bridge route list' };
+        }
+        if (action === 'set-default' && target !== undefined && extra === undefined) {
+            allowOnly(parsed, ['--json'], []);
+            const providerId = provider(target);
+            return {
+                ...base,
+                request: { operation: 'route.set-default', provider_id: providerId },
+                label: `Default bridge provider set to ${providerId}`
+            };
+        }
+        if (action === 'explain' && target !== undefined && extra === undefined) {
+            allowOnly(parsed, ['--json'], []);
+            return {
+                ...base,
+                request: { operation: 'route.explain', model: target },
+                label: `Bridge route explanation for ${target}`
+            };
+        }
+    }
+    if (area === 'unmanage' && action === undefined) {
+        allowOnly(parsed, ['--json', '--confirm'], []);
+        requireConfirmation(parsed);
+        return {
+            ...base,
+            request: { operation: 'unmanage', confirmed: true },
+            label: 'Desktop Bridge unmanage'
+        };
+    }
+    if (area === 'rollback' && action !== undefined && target === undefined) {
+        allowOnly(parsed, ['--json', '--confirm'], []);
+        requireConfirmation(parsed);
+        return {
+            ...base,
+            request: { operation: 'rollback', receipt_id: action, confirmed: true },
+            label: `Desktop Bridge rollback ${action}`
+        };
+    }
+    throw new BridgeCliError('bridge_command_invalid', 'review_bridge_command_help');
+}
+function parseArgs(args) {
+    const positionals = [];
+    const flags = new Set();
+    const values = new Map();
+    const booleanOptions = new Set([
+        '--json', '--strict', '--require-ready', '--api-key-stdin', '--confirm'
+    ]);
+    const valueOptions = new Set(['--level', '--host', '--settings']);
+    for (let index = 0; index < args.length; index += 1) {
+        const value = String(args[index] || '');
+        if (!value.startsWith('--')) {
+            positionals.push(value);
+            continue;
+        }
+        if (value.includes('='))
+            throw new BridgeCliError('bridge_command_option_equals_syntax_unsupported');
+        if (booleanOptions.has(value)) {
+            if (flags.has(value))
+                throw new BridgeCliError('bridge_command_duplicate_option');
+            flags.add(value);
+            continue;
+        }
+        if (valueOptions.has(value)) {
+            if (values.has(value))
+                throw new BridgeCliError('bridge_command_duplicate_option');
+            const next = args[index + 1];
+            if (!next || String(next).startsWith('--'))
+                throw new BridgeCliError('bridge_command_option_value_missing');
+            values.set(value, String(next));
+            index += 1;
+            continue;
+        }
+        throw new BridgeCliError('bridge_command_unknown_option');
+    }
+    return { positionals, flags, values };
+}
+function rejectSecretArgv(args) {
+    for (const arg of args) {
+        const option = String(arg).split('=', 1)[0]?.toLowerCase() || '';
+        if (option === '--api-key-stdin')
+            continue;
+        if (/^--(?:api[-_]?key|secret|token|authorization|bearer|password)(?:$|-)/.test(option)) {
+            throw new BridgeCliError('bridge_secret_argv_forbidden', 'retry_with_api_key_stdin');
+        }
+    }
+}
+function allowOnly(parsed, allowedFlags, allowedValues) {
+    const flags = new Set(allowedFlags);
+    const values = new Set(allowedValues);
+    if ([...parsed.flags].some((entry) => !flags.has(entry))) {
+        throw new BridgeCliError('bridge_command_option_not_allowed');
+    }
+    if ([...parsed.values.keys()].some((entry) => !values.has(entry))) {
+        throw new BridgeCliError('bridge_command_option_not_allowed');
+    }
+}
+function requireConfirmation(parsed) {
+    if (!parsed.flags.has('--confirm')) {
+        throw new BridgeCliError('bridge_explicit_confirmation_required', 'retry_with_confirm');
+    }
+}
+function capabilityLevel(value) {
+    if (value === 'shallow' || value === 'transport' || value === 'deep')
+        return value;
+    throw new BridgeCliError('capability_level_must_be_shallow_transport_or_deep');
+}
+function provider(value) {
+    if (value === 'codex-lb' || value === 'openrouter')
+        return value;
+    throw new BridgeCliError('bridge_provider_must_be_codex_lb_or_openrouter');
+}