sneakoscope 8.1.2 → 8.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (261) hide show
  1. package/README.md +96 -58
  2. package/crates/sks-core/Cargo.lock +1 -1
  3. package/crates/sks-core/Cargo.toml +1 -1
  4. package/dist/bin/fast-inline.js +5 -51
  5. package/dist/cli/command-manifest-lite.js +2 -1
  6. package/dist/cli/command-registry.js +2 -1
  7. package/dist/cli/global-mode-router.js +1 -1
  8. package/dist/cli/install-helpers-codex-lb-config.js +112 -914
  9. package/dist/cli/install-helpers-codex-lb-shared.js +3 -44
  10. package/dist/cli/install-helpers-install-support.js +4 -20
  11. package/dist/cli/install-helpers.js +36 -2716
  12. package/dist/cli/router.js +9 -9
  13. package/dist/commands/bridge-command-output.js +111 -0
  14. package/dist/commands/bridge.js +320 -0
  15. package/dist/commands/codex-app.js +39 -123
  16. package/dist/commands/doctor-helpers.js +380 -0
  17. package/dist/commands/doctor-profile.js +3 -0
  18. package/dist/commands/doctor.js +114 -873
  19. package/dist/commands/mad-sks.js +0 -4
  20. package/dist/config/skills-manifest.json +1 -1
  21. package/dist/core/agents/agent-effort-policy.js +11 -21
  22. package/dist/core/agents/agent-recursion-guard.js +26 -0
  23. package/dist/core/agents/agent-runner-codex-exec.js +7 -9
  24. package/dist/core/architecture-hardening/contracts/contracts.js +225 -161
  25. package/dist/core/architecture-hardening/state/state-service.js +49 -13
  26. package/dist/core/auto-review.js +15 -9
  27. package/dist/core/codex/codex-config-guard.js +8 -0
  28. package/dist/core/codex-adapter.js +8 -10
  29. package/dist/core/codex-app/codex-app-fast-ui-repair.js +7 -29
  30. package/dist/core/codex-app/codex-app-launcher.js +10 -12
  31. package/dist/core/codex-app/codex-app-restart.js +10 -12
  32. package/dist/core/codex-app/menubar/constants.js +2 -5
  33. package/dist/core/codex-app/menubar/global-install.js +3 -2
  34. package/dist/core/codex-app/menubar/installer/result.js +23 -0
  35. package/dist/core/codex-app/menubar/installer/runtime.js +28 -0
  36. package/dist/core/codex-app/menubar/installer.js +5 -96
  37. package/dist/core/codex-app/menubar/migration.js +1 -42
  38. package/dist/core/codex-app/openrouter-provider.js +0 -78
  39. package/dist/core/codex-app.js +97 -360
  40. package/dist/core/codex-control/codex-app-server-runtime-env.js +8 -28
  41. package/dist/core/codex-control/codex-current-image-path-real-probe.js +2 -3
  42. package/dist/core/codex-control/codex-current-web-search-probe.js +2 -3
  43. package/dist/core/codex-control/codex-sdk-adapter.js +5 -48
  44. package/dist/core/codex-control/codex-task-runner.js +16 -60
  45. package/dist/core/codex-control/desktop-bridge-launch-guard.js +227 -0
  46. package/dist/core/codex-exec-output-schema.js +11 -13
  47. package/dist/core/codex-lb/bridge-contracts.js +2 -0
  48. package/dist/core/codex-lb/bridge-runtime-validation/capability.js +104 -0
  49. package/dist/core/codex-lb/bridge-runtime-validation/catalog.js +52 -0
  50. package/dist/core/codex-lb/bridge-runtime-validation/shared.js +109 -0
  51. package/dist/core/codex-lb/bridge-runtime-validation/status.js +250 -0
  52. package/dist/core/codex-lb/bridge-runtime-validation.js +106 -0
  53. package/dist/core/codex-lb/capability-runner.js +505 -201
  54. package/dist/core/codex-lb/codex-lb-env.js +179 -12
  55. package/dist/core/codex-lb/combined-catalog/builder.js +86 -0
  56. package/dist/core/codex-lb/combined-catalog/contracts.js +5 -0
  57. package/dist/core/codex-lb/combined-catalog/normalize.js +170 -0
  58. package/dist/core/codex-lb/combined-catalog/persistence.js +207 -0
  59. package/dist/core/codex-lb/combined-catalog/shared.js +12 -0
  60. package/dist/core/codex-lb/combined-catalog/storage.js +171 -0
  61. package/dist/core/codex-lb/combined-catalog.js +12 -0
  62. package/dist/core/codex-lb/desktop-bridge/client.js +4 -1
  63. package/dist/core/codex-lb/desktop-bridge/header-policy.js +48 -63
  64. package/dist/core/codex-lb/desktop-bridge/http-forward.js +115 -83
  65. package/dist/core/codex-lb/desktop-bridge/launchd.js +20 -13
  66. package/dist/core/codex-lb/desktop-bridge/location-rewrite.js +4 -1
  67. package/dist/core/codex-lb/desktop-bridge/security.js +381 -267
  68. package/dist/core/codex-lb/desktop-bridge/server.js +148 -19
  69. package/dist/core/codex-lb/desktop-bridge/state.js +56 -70
  70. package/dist/core/codex-lb/desktop-bridge/types.js +6 -1
  71. package/dist/core/codex-lb/desktop-bridge/websocket-forward.js +281 -106
  72. package/dist/core/codex-lb/desktop-bridge-migration/historical-config.js +245 -0
  73. package/dist/core/codex-lb/desktop-bridge-migration/historical-toml.js +56 -0
  74. package/dist/core/codex-lb/desktop-bridge-migration/metadata.js +73 -0
  75. package/dist/core/codex-lb/desktop-bridge-migration/receipt.js +52 -0
  76. package/dist/core/codex-lb/desktop-bridge-migration/retired-runtime-cleanup.js +106 -0
  77. package/dist/core/codex-lb/desktop-bridge-migration/types.js +1 -0
  78. package/dist/core/codex-lb/desktop-bridge-migration.js +238 -0
  79. package/dist/core/codex-lb/desktop-controller-v3/catalog.js +257 -0
  80. package/dist/core/codex-lb/desktop-controller-v3/diagnostics.js +62 -0
  81. package/dist/core/codex-lb/desktop-controller-v3/lifecycle-commands.js +203 -0
  82. package/dist/core/codex-lb/desktop-controller-v3/live-probes.js +293 -0
  83. package/dist/core/codex-lb/desktop-controller-v3/preflight-probes.js +144 -0
  84. package/dist/core/codex-lb/desktop-controller-v3/provider-commands.js +182 -0
  85. package/dist/core/codex-lb/desktop-controller-v3/shared.js +279 -0
  86. package/dist/core/codex-lb/desktop-controller-v3/status.js +269 -0
  87. package/dist/core/codex-lb/desktop-controller-v3/types.js +1 -0
  88. package/dist/core/codex-lb/desktop-controller-v3/verification.js +89 -0
  89. package/dist/core/codex-lb/desktop-controller-v3.js +67 -0
  90. package/dist/core/codex-lb/desktop-controller.js +2 -1730
  91. package/dist/core/codex-lb/desktop-service.js +462 -627
  92. package/dist/core/codex-lb/migration-receipt.js +560 -118
  93. package/dist/core/codex-lb/probes/auxiliary-surfaces-probe.js +37 -53
  94. package/dist/core/codex-lb/probes/bridge-probe.js +125 -64
  95. package/dist/core/codex-lb/probes/catalog-probe.js +36 -136
  96. package/dist/core/codex-lb/probes/computer-use-probe.js +63 -39
  97. package/dist/core/codex-lb/probes/image-generation-probe.js +98 -41
  98. package/dist/core/codex-lb/probes/probe-evidence.js +32 -33
  99. package/dist/core/codex-lb/probes/voice-realtime-probe.js +69 -43
  100. package/dist/core/codex-lb/provider-credentials/configuration.js +127 -0
  101. package/dist/core/codex-lb/provider-credentials/locks.js +11 -0
  102. package/dist/core/codex-lb/provider-credentials/private-snapshot.js +28 -0
  103. package/dist/core/codex-lb/provider-credentials/removal.js +33 -0
  104. package/dist/core/codex-lb/provider-credentials/resolution.js +59 -0
  105. package/dist/core/codex-lb/provider-credentials/runtime.js +55 -0
  106. package/dist/core/codex-lb/provider-credentials/types.js +1 -0
  107. package/dist/core/codex-lb/provider-credentials/validation-store.js +137 -0
  108. package/dist/core/codex-lb/provider-credentials.js +5 -0
  109. package/dist/core/codex-lb/provider-registry.js +323 -0
  110. package/dist/core/codex-lb/provider-route-policy.js +118 -0
  111. package/dist/core/codex-lb/request-route-resolver.js +172 -0
  112. package/dist/core/codex-lb/route-index.js +148 -0
  113. package/dist/core/codex-lb/trusted-deep-evidence.js +158 -286
  114. package/dist/core/commands/basic-cli.js +1 -1
  115. package/dist/core/commands/check-command.js +3 -10
  116. package/dist/core/commands/gate-result-contract.js +10 -14
  117. package/dist/core/commands/intent-normalization/normalizer.js +1 -1
  118. package/dist/core/commands/mad-sks-command.js +2 -6
  119. package/dist/core/commands/release-command.js +11 -1
  120. package/dist/core/commands/telegram-command.js +46 -6
  121. package/dist/core/doctor/doctor-readiness-matrix.js +9 -7
  122. package/dist/core/doctor/skill-legacy-surface.js +5 -5
  123. package/dist/core/evidence/v2/evidence-key.js +30 -3
  124. package/dist/core/feature-fixtures.js +8 -1
  125. package/dist/core/feature-registry.js +3 -2
  126. package/dist/core/hooks-runtime/stop-finalization.js +11 -1
  127. package/dist/core/hooks-runtime/subagent-context.js +15 -1
  128. package/dist/core/hooks-runtime/subagent-skill-availability-contract.js +1 -1
  129. package/dist/core/hooks-runtime/tool-output-quarantine.js +1 -1
  130. package/dist/core/hooks-runtime.js +73 -87
  131. package/dist/core/image-ux-review/imagegen-adapter.js +108 -94
  132. package/dist/core/image-ux-review/real-callout-extractor.js +144 -14
  133. package/dist/core/imagegen/desktop-bridge-imagegen-target.js +77 -0
  134. package/dist/core/imagegen/imagegen-capability.js +43 -151
  135. package/dist/core/init/skills/filesystem.js +89 -0
  136. package/dist/core/init/skills/inventory.js +97 -0
  137. package/dist/core/init/skills/manifest.js +151 -0
  138. package/dist/core/init/skills.js +5 -325
  139. package/dist/core/init.js +0 -63
  140. package/dist/core/install/installed-package-smoke.js +1 -1
  141. package/dist/core/managed-assets/managed-assets-manifest.js +0 -1
  142. package/dist/core/policy/latest-version-guidance.js +15 -2
  143. package/dist/core/preflight/parallel-preflight-engine.js +27 -51
  144. package/dist/core/provider/provider-badge.js +9 -4
  145. package/dist/core/provider/provider-context.js +57 -107
  146. package/dist/core/providers/openrouter/openrouter-account.js +3 -1
  147. package/dist/core/providers/openrouter/openrouter-secret-store.js +91 -22
  148. package/dist/core/release/desktop-bridge-release-evidence.js +457 -0
  149. package/dist/core/release/gate-manifest.js +0 -1
  150. package/dist/core/release/main-push-guard.js +13 -0
  151. package/dist/core/release/main-push-receipt.js +11 -0
  152. package/dist/core/release/physical-release-gates.js +664 -61
  153. package/dist/core/release/publish-preflight.js +3 -3
  154. package/dist/core/release/release-gate-batch-runner.js +19 -6
  155. package/dist/core/release/release-gate-dag.js +33 -6
  156. package/dist/core/release/release-gate-node.js +1 -3
  157. package/dist/core/release/release-gate-output-contract.js +55 -0
  158. package/dist/core/release/release-pack-contract.js +1 -1
  159. package/dist/core/release/release-pack-receipt.js +209 -8
  160. package/dist/core/release/release-real-contract.js +1 -1
  161. package/dist/core/release/stage-publish.js +106 -28
  162. package/dist/core/retention/temp-lease.js +204 -0
  163. package/dist/core/retention.js +18 -195
  164. package/dist/core/routes.js +1 -2
  165. package/dist/core/safety/intent-contract/intent-contract.js +3 -3
  166. package/dist/core/subagents/naruto-host-credentials.js +6 -1
  167. package/dist/core/subagents/official-subagent-config.js +27 -9
  168. package/dist/core/subagents/official-subagent-runner.js +14 -31
  169. package/dist/core/subagents/wave-lifecycle.js +36 -8
  170. package/dist/core/subagents/wave-parent-guidance.js +2 -1
  171. package/dist/core/telegram/doctor.js +2 -2
  172. package/dist/core/telegram/liveness.js +10 -4
  173. package/dist/core/triwiki/context-graph/compiler/index.js +18 -18
  174. package/dist/core/update/update-migration-state/fast-mode-config.js +172 -0
  175. package/dist/core/update/update-migration-state/session-state-split.js +247 -0
  176. package/dist/core/update/update-migration-state/simple-stages.js +46 -0
  177. package/dist/core/update/update-migration-state.js +4 -481
  178. package/dist/core/version.js +1 -1
  179. package/dist/native/sks-menubar/Sources/OperationCoordinator.swift +28 -4
  180. package/dist/native/sks-menubar/Sources/OperationModels.swift +112 -2
  181. package/dist/native/sks-menubar/Sources/ProviderRouteExplanation.swift +21 -0
  182. package/dist/native/sks-menubar/Sources/ProvidersBridgeCatalog.swift +140 -0
  183. package/dist/native/sks-menubar/Sources/ProvidersOpenRouter.swift +107 -470
  184. package/dist/native/sks-menubar/Sources/ProvidersReliability.swift +27 -197
  185. package/dist/native/sks-menubar/Sources/ProvidersRoutingTruth.swift +335 -269
  186. package/dist/native/sks-menubar/Sources/ProvidersViewController.swift +233 -437
  187. package/dist/native/sks-menubar/Sources/RemoteCodingViewController.swift +16 -7
  188. package/dist/native/sks-menubar/Sources/SecureProcessEnvelope.swift +39 -9
  189. package/dist/native/sks-menubar/Sources/TelegramSupport.swift +56 -0
  190. package/dist/scripts/canonical-test-runner.js +7 -1
  191. package/dist/scripts/check-runtime-schemas.js +7 -2
  192. package/dist/scripts/codex-sdk-real-smoke-check.js +3 -1
  193. package/dist/scripts/desktop-bridge-capabilities-check.js +123 -0
  194. package/dist/scripts/{codex-lb-desktop-bridge-latency-check.js → desktop-bridge-latency-check.js} +61 -16
  195. package/dist/scripts/desktop-bridge-real-evidence-check.js +64 -0
  196. package/dist/scripts/{codex-lb-desktop-bridge-check.js → desktop-bridge-transport-check.js} +92 -155
  197. package/dist/scripts/desktop-bridge-transport-client.js +116 -0
  198. package/dist/scripts/desktop-bridge-unification-check.js +276 -0
  199. package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js +12 -8
  200. package/dist/scripts/gate-policy-audit-check.js +52 -2
  201. package/dist/scripts/provider-badge-context-check.js +55 -12
  202. package/dist/scripts/publish-preflight.js +1 -2
  203. package/dist/scripts/release-affected-selector-check.js +1 -2
  204. package/dist/scripts/release-aggressive-resource-governor-check.js +1 -1
  205. package/dist/scripts/release-cache-glob-hashing-check.js +1 -0
  206. package/dist/scripts/release-cache-version-neutral-fixture-check.js +1 -0
  207. package/dist/scripts/release-full-parallelism-blackbox.js +1 -1
  208. package/dist/scripts/release-gate-batch-runner-check.js +9 -0
  209. package/dist/scripts/release-gate-dag-runner-check.js +6 -0
  210. package/dist/scripts/release-gate-dag-runner.js +4 -2
  211. package/dist/scripts/release-metadata-check.js +16 -3
  212. package/dist/scripts/release-pack-receipt.js +29 -6
  213. package/dist/scripts/release-physical-gates-check.js +39 -0
  214. package/dist/scripts/release-real-check.js +7 -5
  215. package/package.json +6 -8
  216. package/release-gates.v2.json +156 -157
  217. package/runtime-required-scripts.json +11 -11
  218. package/schemas/codex/desktop-bridge-status-v3.schema.json +286 -0
  219. package/schemas/codex/desktop-capabilities-v3.schema.json +198 -0
  220. package/schemas/release/release-gate-node.schema.json +2 -3
  221. package/dist/cli/codex-lb-setup-warning-output.js +0 -17
  222. package/dist/cli/install-helpers-codex-lb-chain.js +0 -529
  223. package/dist/commands/codex-lb.js +0 -1232
  224. package/dist/core/architecture-hardening/migration/migration.js +0 -111
  225. package/dist/core/codex-app/auxiliary-oauth-policy.js +0 -36
  226. package/dist/core/codex-app/catalog-compat/catalog-service.js +0 -104
  227. package/dist/core/codex-app/child-policy/child-policy.js +0 -35
  228. package/dist/core/codex-app/desktop-routing-snapshot.js +0 -233
  229. package/dist/core/codex-app/glm-model-profile.js +0 -1
  230. package/dist/core/codex-app/glm-profile-installer.js +0 -191
  231. package/dist/core/codex-app/glm-profile-schema.js +0 -42
  232. package/dist/core/codex-app/multi-provider-router.js +0 -391
  233. package/dist/core/codex-app/openrouter-activate.js +0 -405
  234. package/dist/core/codex-app/openrouter-model-catalog.js +0 -217
  235. package/dist/core/codex-app/provider-child-policy.js +0 -64
  236. package/dist/core/codex-app/provider-mode.js +0 -91
  237. package/dist/core/codex-app/provider-session-policy.js +0 -85
  238. package/dist/core/codex-app/session-policy/session-pinning.js +0 -68
  239. package/dist/core/codex-control/codex-lb-launch-recovery.js +0 -319
  240. package/dist/core/codex-lb/codex-lb-setup.js +0 -293
  241. package/dist/core/codex-lb/codex-lb-tool-catalog.js +0 -456
  242. package/dist/core/codex-lb/codex-lb-tool-output-recovery.js +0 -290
  243. package/dist/core/codex-lb/desktop-center-credentials.js +0 -1083
  244. package/dist/core/codex-lb/desktop-mode.js +0 -32
  245. package/dist/core/codex-lb/desktop-real-evidence.js +0 -168
  246. package/dist/core/codex-lb/legacy-migration.js +0 -576
  247. package/dist/core/codex-lb/native-openai-transport/transport.js +0 -68
  248. package/dist/core/codex-lb/provider-routing/provider-router.js +0 -58
  249. package/dist/core/codex-lb/routing-truth.js +0 -327
  250. package/dist/core/imagegen/codex-lb-imagegen-target.js +0 -92
  251. package/dist/native/sks-menubar/Sources/ProvidersConnectTest.swift +0 -118
  252. package/dist/native/sks-menubar/Sources/ProvidersFastMode.swift +0 -17
  253. package/dist/native/sks-menubar/Sources/ProvidersMultiProvider.swift +0 -331
  254. package/dist/native/sks-menubar/Sources/ProvidersRoleModels.swift +0 -260
  255. package/dist/scripts/codex-lb-catalog-passthrough-check.js +0 -120
  256. package/dist/scripts/codex-lb-desktop-auth-invariant-check.js +0 -169
  257. package/dist/scripts/codex-lb-desktop-capabilities-check.js +0 -287
  258. package/dist/scripts/codex-lb-desktop-real-evidence-check.js +0 -123
  259. package/dist/scripts/codex-lb-fast-mode-truth-check.js +0 -114
  260. package/dist/scripts/codex-lb-fast-ui-preservation-check.js +0 -152
  261. package/dist/scripts/codex-lb-gpt56-fast-profile-check.js +0 -231
@@ -1,32 +0,0 @@
1
- export const CODEX_LB_DESKTOP_MODES = [
2
- 'desktop-native-bridge',
3
- 'desktop-dual-auth-compat',
4
- 'cli-provider',
5
- 'disabled'
6
- ];
7
- export const CODEX_LB_GATEWAY_AUTH_TRANSPORTS = [
8
- 'x-codex-lb-api-key',
9
- 'authorization-bearer-compat'
10
- ];
11
- export const DEFAULT_CODEX_LB_DESKTOP_MODE = 'desktop-native-bridge';
12
- export const DEFAULT_CODEX_LB_GATEWAY_AUTH_TRANSPORT = 'authorization-bearer-compat';
13
- export function parseCodexLbDesktopMode(value) {
14
- const normalized = String(value ?? '').trim();
15
- if (CODEX_LB_DESKTOP_MODES.includes(normalized)) {
16
- return normalized;
17
- }
18
- throw new Error(`unsupported_codex_lb_desktop_mode:${normalized || 'empty'}`);
19
- }
20
- export function parseCodexLbGatewayAuthTransport(value) {
21
- const normalized = String(value ?? '').trim();
22
- if (CODEX_LB_GATEWAY_AUTH_TRANSPORTS.includes(normalized)) {
23
- return normalized;
24
- }
25
- throw new Error(`unsupported_codex_lb_gateway_auth_transport:${normalized || 'empty'}`);
26
- }
27
- export function modeRequiresChatGptOAuth(mode) {
28
- return mode === 'desktop-native-bridge' || mode === 'desktop-dual-auth-compat';
29
- }
30
- export function modeMayMutateSharedAuth(_mode) {
31
- return false;
32
- }
@@ -1,168 +0,0 @@
1
- import { isComputerCallEvent } from './probes/computer-use-probe.js';
2
- import { isImageOutputEvent } from './probes/image-generation-probe.js';
3
- import { validateCodexLbDesktopDeepEvidence } from './trusted-deep-evidence.js';
4
- import { uniqueValues as unique } from '../text/strings.js';
5
- export const CODEX_LB_DESKTOP_REAL_EVIDENCE_CHECK_SCHEMA = 'sks.codex-lb-desktop-real-evidence-check.v1';
6
- export const CODEX_LB_DESKTOP_REAL_EVIDENCE_REQUIRED_TRUE_FIELDS = Object.freeze([
7
- 'provider_identity_verified',
8
- 'picker_control_visible',
9
- 'bridge_websocket_round_trip',
10
- 'image_request_tools_present',
11
- 'image_artifact_materialized',
12
- 'computer_executor_completed',
13
- 'computer_output_submitted',
14
- 'computer_follow_up_completed',
15
- 'computer_session_affinity_preserved',
16
- 'browser_use_verified',
17
- 'voice_create_verified',
18
- 'voice_location_received',
19
- 'voice_location_rewritten',
20
- 'voice_websocket_upgraded',
21
- 'voice_server_event_seen',
22
- 'voice_clean_close',
23
- 'voice_owner_binding_verified',
24
- 'plugins_verified',
25
- 'auxiliary_request_body_hash_preserved',
26
- 'auxiliary_owner_affinity_verified',
27
- 'desktop_adoption_verified',
28
- 'oauth_bytes_unchanged_before_restart',
29
- 'oauth_semantic_identity_verified_after_restart',
30
- 'built_in_openai_provider_retained',
31
- 'fast_selector_visible',
32
- 'fast_effective_verified',
33
- 'text_response_verified',
34
- 'code_mcp_search_verified',
35
- 'files_transcribe_verified',
36
- 'memory_thread_goal_routes_verified',
37
- 'existing_thread_resumed',
38
- 'new_thread_created',
39
- 'disable_routing_verified',
40
- 'rollback_byte_exact_verified',
41
- 'app_restart_recovery_verified',
42
- 'mac_reboot_recovery_verified',
43
- 'remote_other_mac_runtime_verified',
44
- 'auth_mode_independence_verified'
45
- ]);
46
- const REQUIRED_NONEMPTY_STRING_FIELDS = Object.freeze([
47
- 'picker_selected_model',
48
- 'configured_service_tier',
49
- 'request_service_tier',
50
- 'response_actual_service_tier',
51
- 'source_surface',
52
- 'desktop_build',
53
- 'codex_core_version',
54
- 'protocol_fixture_schema_hash',
55
- 'app_origin_observed'
56
- ]);
57
- const REQUIRED_NONEMPTY_ARRAY_FIELDS = Object.freeze([
58
- 'image_events',
59
- 'computer_events',
60
- 'auxiliary_routes_observed',
61
- 'auxiliary_events',
62
- 'auxiliary_output_events'
63
- ]);
64
- const DEFAULT_RELEASE_PRODUCERS = Object.freeze([
65
- 'sks.codex-lb-desktop-blackbox'
66
- ]);
67
- export function validateCodexLbDesktopRealEvidence(raw, options) {
68
- const validation = validateCodexLbDesktopDeepEvidence(raw, {
69
- expectedMode: options.expectedMode,
70
- expectedEndpoint: options.expectedEndpoint,
71
- trustAnchors: options.trustAnchors,
72
- ...(options.now !== undefined ? { now: options.now } : {}),
73
- ...(options.maxAgeMs !== undefined ? { maxAgeMs: options.maxAgeMs } : {}),
74
- ...(options.maxFutureSkewMs !== undefined ? { maxFutureSkewMs: options.maxFutureSkewMs } : {})
75
- });
76
- const blockers = [...validation.blockers];
77
- const verifiedFields = [];
78
- const payload = validation.evidence;
79
- const allowedProducerIds = new Set(options.allowedProducerIds || DEFAULT_RELEASE_PRODUCERS);
80
- if (validation.state !== 'verified' || !payload) {
81
- blockers.push('codex_lb_desktop_real_evidence_unverified');
82
- }
83
- else {
84
- if (!validation.producer_id || !allowedProducerIds.has(validation.producer_id)) {
85
- blockers.push('codex_lb_desktop_real_evidence_producer_not_allowed');
86
- }
87
- for (const field of CODEX_LB_DESKTOP_REAL_EVIDENCE_REQUIRED_TRUE_FIELDS) {
88
- if (payload[field] === true)
89
- verifiedFields.push(field);
90
- else
91
- blockers.push(`codex_lb_desktop_real_evidence_required_true:${field}`);
92
- }
93
- for (const field of REQUIRED_NONEMPTY_STRING_FIELDS) {
94
- if (typeof payload[field] === 'string' && payload[field].trim())
95
- verifiedFields.push(field);
96
- else
97
- blockers.push(`codex_lb_desktop_real_evidence_required_string:${field}`);
98
- }
99
- for (const field of REQUIRED_NONEMPTY_ARRAY_FIELDS) {
100
- if (Array.isArray(payload[field]) && payload[field].length > 0)
101
- verifiedFields.push(field);
102
- else
103
- blockers.push(`codex_lb_desktop_real_evidence_required_array:${field}`);
104
- }
105
- if (payload.desktop_adoption_source !== 'codex_desktop_runtime') {
106
- blockers.push('codex_lb_desktop_real_evidence_adoption_source_invalid');
107
- }
108
- if (payload.source_surface !== 'codex_desktop_runtime') {
109
- blockers.push('codex_lb_desktop_real_evidence_source_surface_invalid');
110
- }
111
- if (!/^[a-f0-9]{64}$/i.test(String(payload.protocol_fixture_schema_hash || ''))) {
112
- blockers.push('codex_lb_desktop_real_evidence_protocol_fixture_hash_invalid');
113
- }
114
- if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(String(payload.app_origin_observed || ''))) {
115
- blockers.push('codex_lb_desktop_real_evidence_app_origin_invalid');
116
- }
117
- const requestTier = normalizeFastTier(payload.request_service_tier);
118
- const responseTier = normalizeFastTier(payload.response_actual_service_tier);
119
- if (requestTier !== 'priority')
120
- blockers.push('codex_lb_desktop_real_evidence_fast_request_invalid');
121
- if (responseTier !== 'priority')
122
- blockers.push('codex_lb_desktop_real_evidence_fast_response_invalid');
123
- if (!['fast', 'priority'].includes(String(payload.configured_service_tier || '').toLowerCase())) {
124
- blockers.push('codex_lb_desktop_real_evidence_fast_configuration_invalid');
125
- }
126
- if (!['responses_tool', 'images_api'].includes(String(payload.image_route || ''))) {
127
- blockers.push('codex_lb_desktop_real_evidence_image_route_invalid');
128
- }
129
- if (!(Array.isArray(payload.image_events) && payload.image_events.some(isImageOutputEvent))) {
130
- blockers.push('codex_lb_desktop_real_evidence_image_output_event_missing');
131
- }
132
- if (!(Array.isArray(payload.computer_events) && payload.computer_events.some(isComputerCallEvent))) {
133
- blockers.push('codex_lb_desktop_real_evidence_computer_call_event_missing');
134
- }
135
- if (Array.isArray(payload.auxiliary_events)
136
- && Array.isArray(payload.auxiliary_output_events)
137
- && stableJson(payload.auxiliary_events) !== stableJson(payload.auxiliary_output_events)) {
138
- blockers.push('codex_lb_desktop_real_evidence_auxiliary_events_changed');
139
- }
140
- }
141
- const uniqueBlockers = unique(blockers);
142
- const ok = uniqueBlockers.length === 0;
143
- return {
144
- schema: CODEX_LB_DESKTOP_REAL_EVIDENCE_CHECK_SCHEMA,
145
- ok,
146
- status: ok ? 'passed' : 'real_required_missing',
147
- release_authorizing: ok,
148
- mode: options.expectedMode,
149
- endpoint: options.expectedEndpoint,
150
- producer_id: validation.producer_id,
151
- deep_evidence_validation: validation,
152
- required_true_fields: CODEX_LB_DESKTOP_REAL_EVIDENCE_REQUIRED_TRUE_FIELDS,
153
- required_string_fields: REQUIRED_NONEMPTY_STRING_FIELDS,
154
- required_array_fields: REQUIRED_NONEMPTY_ARRAY_FIELDS,
155
- verified_fields: unique(verifiedFields),
156
- blockers: uniqueBlockers,
157
- warnings: validation.warnings
158
- };
159
- }
160
- function normalizeFastTier(value) {
161
- const tier = String(value || '').trim().toLowerCase();
162
- if (tier === 'fast')
163
- return 'priority';
164
- return tier || null;
165
- }
166
- function stableJson(value) {
167
- return JSON.stringify(value);
168
- }