sneakoscope 8.2.0 → 8.3.0

package/dist/core/codex-compat/codex-capability-matrix.js

@@ -1,5 +1,5 @@
 import { runProcess } from '../fsx.js';
-import { CURRENT_CODEX_RELEASE_MANIFEST, NARUTO_REQUIRED_CODEX_VERSION } from './codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT, NARUTO_REQUIRED_CODEX_VERSION } from './codex-runtime-contract.js';
 import { compareSemverLike, parseCodexVersionText } from './codex-version-policy.js';
 export const CODEX_CAPABILITY_MATRIX_SCHEMA = 'sks.codex-capability-matrix.v1';
 export const SKS_CODEX_CAPABILITY_IDS = [
@@ -13,10 +13,10 @@ export const SKS_CODEX_CAPABILITY_IDS = [
 ];
 const UPDATE_CTA = 'Update Codex CLI to the preferred latest: `sks codex update` or Menu Bar / SKS Center → Update Codex CLI Now.';
 export function preferredCodexCliVersion() {
-    return CURRENT_CODEX_RELEASE_MANIFEST.preferredCliVersion || CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion;
+    return CURRENT_CODEX_RUNTIME_CONTRACT.preferredCliVersion || CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion;
 }
 export function softMinimumCodexCliVersion() {
-    return CURRENT_CODEX_RELEASE_MANIFEST.minimumSupportedVersion;
+    return CURRENT_CODEX_RUNTIME_CONTRACT.minimumSupportedVersion;
 }
 export function narutoCodexFloorVersion() {
     return NARUTO_REQUIRED_CODEX_VERSION;
@@ -26,7 +26,7 @@ export function buildCodexCapabilityMatrix(input = {}) {
     const help = String(input.helpText || '');
     const config = String(input.configText || '');
     const schema = String(input.schemaText || '');
-    const policies = CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies;
+    const policies = CURRENT_CODEX_RUNTIME_CONTRACT.featurePolicies;
     const warnings = [];
     if (detected && compareSemverLike(detected, preferredCodexCliVersion()) < 0) {
         warnings.push(`detected Codex ${detected} is below preferred ${preferredCodexCliVersion()}; prefer latest via SKS update inducement`);
@@ -122,8 +122,8 @@ export async function probeNarutoCodexCapability(input) {
     return { matrix, naruto: assertNarutoMultiAgentV2Capability(matrix) };
 }
 function resolveMultiAgentV2(input) {
-    const policy = CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies.multiAgentV2
-        || CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies.multiAgentMode
+    const policy = CURRENT_CODEX_RUNTIME_CONTRACT.featurePolicies.multiAgentV2
+        || CURRENT_CODEX_RUNTIME_CONTRACT.featurePolicies.multiAgentMode
         || 'delegate';
     const evidence = [];
     const helpHit = /\bmulti_agent_v2\b/.test(input.help);
@@ -167,7 +167,7 @@ function resolveMultiAgentV2(input) {
     };
 }
 function resolveAgentsConcurrency(input) {
-    const policy = CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies.agentsMaxConcurrentThreads || 'delegate';
+    const policy = CURRENT_CODEX_RUNTIME_CONTRACT.featurePolicies.agentsMaxConcurrentThreads || 'delegate';
     const hit = /max_concurrent_threads_per_session/.test(input.help)
         || /max_concurrent_threads_per_session/.test(input.config);
     const available = hit || input.multiAgentV2;

package/dist/core/codex-compat/codex-compat-report.js

@@ -2,21 +2,18 @@ import { projectRoot } from '../fsx.js';
 import { detectCodexCurrentCapability } from '../codex-control/codex-current-capability.js';
 import { codexVersionReport } from './codex-version.js';
 import { CODEX_COMPAT_SCHEMA, CODEX_HOOK_SCHEMA_BASELINE_TAG, CODEX_REQUIRED_BASELINE_TAG } from './codex-version-policy.js';
-import { codexReleaseManifestParity } from './codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from './codex-runtime-contract.js';
 import { codexSchemaSnapshotReport } from './codex-schema-snapshot.js';
 import { codexHookWarningCheck } from './codex-hook-warning-detector.js';
 export async function codexCompatibilityReport(opts = {}) {
     const root = opts.root || await projectRoot();
     const requiredBaseline = opts.requiredBaseline || opts.require || CODEX_REQUIRED_BASELINE_TAG;
     const version = await codexVersionReport({ ...opts, requiredBaseline });
-    const releaseManifest = await codexReleaseManifestParity(root).catch((err) => ({
-        ok: false,
-        mismatches: ['manifest_load_failed'],
-        manifest: null,
-        manifest_path: null,
-        manifest_sha256: null,
-        error: err?.message || String(err)
-    }));
+    const releaseContract = {
+        ok: true,
+        dependency_source: CURRENT_CODEX_RUNTIME_CONTRACT.dependencySource,
+        contract: CURRENT_CODEX_RUNTIME_CONTRACT
+    };
     const snapshot = await codexSchemaSnapshotReport();
     const hooks = await codexHookWarningCheck(root, { recordWrongness: false });
     const current = await detectCodexCurrentCapability({
@@ -24,11 +21,11 @@ export async function codexCompatibilityReport(opts = {}) {
         codexBin: opts.codexBin || null,
         requireReal: opts.requireReal === true
     });
-    const ok = Boolean(version.policy.ok && releaseManifest.ok && snapshot.ok && hooks.ok && current.ok);
+    const ok = Boolean(version.policy.ok && snapshot.ok && hooks.ok && current.ok);
     return {
         schema: CODEX_COMPAT_SCHEMA,
         required_baseline: requiredBaseline,
-        release_manifest: releaseManifest,
+        release_contract: releaseContract,
         detected: version.detected,
         current_capability: current,
         capabilities: current.feature_states,
@@ -58,7 +55,6 @@ export async function codexCompatibilityReport(opts = {}) {
         ],
         blockers: [
             ...(version.policy.ok ? [] : ['codex_version_policy_failed']),
-            ...(releaseManifest.ok ? [] : ['codex_release_manifest_mismatch']),
             ...(snapshot.ok ? [] : ['codex_hook_schema_snapshot_invalid']),
             ...(hooks.ok ? [] : ['codex_hook_semantic_warning']),
             ...current.blockers

package/dist/core/codex-compat/codex-runtime-contract.js

@@ -0,0 +1,62 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { packageRoot } from '../fsx.js';
+export const CODEX_RUNTIME_CONTRACT_SCHEMA = 'sks.codex-runtime-contract.v2';
+const sdkVersion = codexSdkDependencyVersion();
+export const CURRENT_CODEX_RUNTIME_CONTRACT = {
+    schema: CODEX_RUNTIME_CONTRACT_SCHEMA,
+    targetTag: `rust-v${sdkVersion}`,
+    requiredCliVersion: sdkVersion,
+    preferredCliVersion: sdkVersion,
+    sdkVersion,
+    minimumSupportedVersion: sdkVersion,
+    narutoCapabilityFloorVersion: sdkVersion,
+    protocolMode: 'app-server-v2',
+    dependencySource: 'package.json#dependencies.@openai/codex-sdk',
+    featurePolicies: {
+        multiAgentMode: 'delegate',
+        multiAgentV2: 'delegate',
+        agentsMaxConcurrentThreads: 'delegate',
+        indexedWebSearch: 'probe',
+        currentTimeRead: 'wrap',
+        threadListSearchRead: 'probe',
+        pluginCatalogRefresh: 'probe',
+        terminalSubagentErrorPropagation: 'probe',
+        execMcpTransientRecovery: 'probe',
+        remoteNativeEnvironment: 'probe',
+        rolloutTokenBudget: 'probe',
+        mcpStartupToolTimeouts: 'wrap',
+        gpt56TerraLunaSolRouting: 'delegate',
+        mcpPaginatedDiscovery: 'wrap',
+        portableAgentPlugins: 'delegate',
+        automaticApprovalReview: 'delegate'
+    },
+    requiredRealProbes: [
+        'runtime_identity',
+        'protocol_schema_generation',
+        'multi_agent_mode_schema',
+        'indexed_web_search_schema',
+        'current_time_read_schema',
+        'thread_list_search_schema',
+        'terminal_error_schema',
+        'rollout_budget_schema'
+    ],
+    supportedPlatforms: [
+        'darwin-arm64',
+        'darwin-x64',
+        'linux-arm64',
+        'linux-x64',
+        'win32-arm64',
+        'win32-x64'
+    ]
+};
+export const NARUTO_REQUIRED_CODEX_VERSION = CURRENT_CODEX_RUNTIME_CONTRACT.narutoCapabilityFloorVersion;
+export function codexSdkDependencyVersion(root = packageRoot()) {
+    const packagePath = path.join(root, 'package.json');
+    const pkg = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+    const value = String(pkg.dependencies?.['@openai/codex-sdk'] || '').trim();
+    if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value)) {
+        throw new Error(`@openai/codex-sdk must be an exact semver in ${packagePath}`);
+    }
+    return value;
+}

package/dist/core/codex-compat/codex-version-policy.js

@@ -1,12 +1,12 @@
-import { CURRENT_CODEX_RELEASE_MANIFEST } from './codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from './codex-runtime-contract.js';
 export const CODEX_COMPAT_SCHEMA = 'sks.codex-compat.v2';
-export const CODEX_REQUIRED_BASELINE_TAG = CURRENT_CODEX_RELEASE_MANIFEST.targetTag;
-export const CODEX_REQUIRED_VERSION = CURRENT_CODEX_RELEASE_MANIFEST.preferredCliVersion
-    || CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion;
+export const CODEX_REQUIRED_BASELINE_TAG = CURRENT_CODEX_RUNTIME_CONTRACT.targetTag;
+export const CODEX_REQUIRED_VERSION = CURRENT_CODEX_RUNTIME_CONTRACT.preferredCliVersion
+    || CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion;
 export const CODEX_PREFERRED_VERSION = CODEX_REQUIRED_VERSION;
-export const CODEX_MINIMUM_SUPPORTED_VERSION = CURRENT_CODEX_RELEASE_MANIFEST.minimumSupportedVersion;
-export const CODEX_HOOK_SCHEMA_BASELINE_TAG = CURRENT_CODEX_RELEASE_MANIFEST.targetTag;
-export const CODEX_HOOK_SCHEMA_VERSION = CURRENT_CODEX_RELEASE_MANIFEST.targetTag;
+export const CODEX_MINIMUM_SUPPORTED_VERSION = CURRENT_CODEX_RUNTIME_CONTRACT.minimumSupportedVersion;
+export const CODEX_HOOK_SCHEMA_BASELINE_TAG = 'latest';
+export const CODEX_HOOK_SCHEMA_VERSION = 'latest';
 const UPDATE_CTA = 'prefer latest Codex CLI via `sks codex update` or Menu Bar / SKS Center → Update Codex CLI Now';
 export function compareSemverLike(a, b) {
     const pa = parseVersionParts(a);

package/dist/core/codex-control/codex-current-app-capability.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
 import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
 export async function detectCodexCurrentAppCapability(input = {}) {
     const fake = process.env.SKS_CODEX_CURRENT_APP_FAKE === '1';
@@ -9,10 +9,10 @@ export async function detectCodexCurrentAppCapability(input = {}) {
         ? input.codexBin || process.env.CODEX_BIN || 'codex'
         : input.codexBin || process.env.CODEX_BIN || await findCodexBinary();
     const versionText = fake
-        ? String(process.env.SKS_CODEX_VERSION_FAKE || `codex-cli ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion}`)
+        ? String(process.env.SKS_CODEX_VERSION_FAKE || `codex-cli ${CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion}`)
         : await readCodexVersionText(codexBin);
     const parsed = parseCodexVersion(versionText);
-    const currentRelease = Boolean(parsed && semverGte(parsed, CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion));
+    const currentRelease = Boolean(parsed && semverGte(parsed, CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion));
     const probeMode = process.env.SKS_CODEX_CURRENT_APP_PROBE === '1' ? 'feature-probe' : 'version-only';
     const featureProbeResults = probeMode === 'feature-probe'
         ? await probeCodexCurrentAppFeatures(codexBin, { fake })

package/dist/core/codex-control/codex-current-capability.js

@@ -1,9 +1,8 @@
 import fsp from 'node:fs/promises';
-import os from 'node:os';
 import path from 'node:path';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 import { compareSemverLike } from '../codex-compat/codex-version-policy.js';
-import { ensureDir, nowIso, packageRoot, readJson, runProcess, sha256, writeJsonAtomic } from '../fsx.js';
+import { nowIso, packageRoot, readJson, runProcess, sha256, withScratchDir, writeJsonAtomic } from '../fsx.js';
 import { resolveCodexRuntime } from '../codex-runtime/resolve-codex-runtime.js';
 export const CODEX_CURRENT_FEATURE_KEYS = [
     'runtime_identity',
@@ -30,11 +29,13 @@ export async function detectCodexCurrentCapability(input = {}) {
     if (!runtime.identity) {
         return blockedCapability('blocked', null, null, [...runtime.blockers]);
     }
-    const versionOk = compareSemverLike(runtime.identity.version, CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion) >= 0;
-    const schemaProbe = await schemaProbeForMode(root, runtime.identity.realpath, input.requireReal === true);
+    const versionOk = compareSemverLike(runtime.identity.version, CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion) >= 0;
+    const schemaProbe = await generateSchemaProbe(root, runtime.identity, {
+        allowCache: input.requireReal !== true
+    });
     const implementationRoot = packageRoot();
     const appServerClientText = await fsp.readFile(path.join(implementationRoot, 'src', 'core', 'codex-control', 'codex-app-server-v2-client.ts'), 'utf8').catch(() => '');
-    const states = featureStatesFromSchema(schemaProbe.text, schemaProbe.ok, appServerClientText);
+    const states = featureStatesFromSchema(schemaProbe.text, schemaProbe.ok, schemaProbe.mode, appServerClientText);
     const blockers = [
         ...(versionOk ? [] : ['codex_current_release_required']),
         ...(schemaProbe.ok ? [] : ['codex_current_schema_generation_failed']),
@@ -43,24 +44,21 @@ export async function detectCodexCurrentCapability(input = {}) {
     const realEnough = blockers.length === 0
         && schemaProbe.mode === 'real-schema'
         && schemaProbe.sha256 !== null
-        && CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256 !== 'pending-generated-schema'
-        && schemaProbe.sha256 === CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256
         && Object.values(states).every((state) => state.certainty === 'actual' || state.certainty === 'discovered');
     return {
         schema: 'sks.codex-current-capability.v1',
         generated_at: nowIso(),
         ok: blockers.length === 0,
         release_authorizing: realEnough,
-        target_tag: CURRENT_CODEX_RELEASE_MANIFEST.targetTag,
-        required_version: CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+        target_tag: CURRENT_CODEX_RUNTIME_CONTRACT.targetTag,
+        required_version: CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion,
         runtime_identity: runtime.identity,
         generated_schema_sha256: schemaProbe.sha256,
-        manifest_schema_sha256: CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256,
         probe_mode: schemaProbe.ok ? schemaProbe.mode : 'blocked',
         feature_states: states,
         blockers,
         warnings: [
-            ...(realEnough ? [] : ['codex_current_not_release_authorizing_until_schema_hash_and_all_required_real_probes_match']),
+            ...(realEnough ? [] : ['codex_current_not_release_authorizing_until_runtime_schema_and_required_probes_pass']),
             ...(input.requireReal && blockers.length ? ['required_real_probe_blocked'] : [])
         ]
     };
@@ -81,14 +79,15 @@ export async function writeCodexCurrentCapabilityArtifacts(root, input = {}) {
     }
     return { report, root_artifact: rootArtifact, mission_artifact: missionArtifact };
 }
-function featureStatesFromSchema(schemaText, schemaOk, appServerClientText = '') {
+function featureStatesFromSchema(schemaText, schemaOk, schemaMode, appServerClientText = '') {
     const lower = schemaText.toLowerCase();
+    const schemaCertainty = schemaMode === 'real-schema' ? 'actual' : 'discovered';
     const actual = (key, needles) => {
         const found = schemaOk && needles.every((needle) => lower.includes(needle.toLowerCase()));
         return {
             supported: found,
-            certainty: found ? 'actual' : schemaOk ? 'unverified' : 'failed',
-            evidence: found ? needles.map((needle) => `generated_schema_contains:${needle}`) : [],
+            certainty: found ? schemaCertainty : schemaOk ? 'unverified' : 'failed',
+            evidence: found ? needles.map((needle) => `${schemaMode}_contains:${needle}`) : [],
             blockers: found ? [] : [`codex_current_${key}_not_verified`]
         };
     };
@@ -101,14 +100,16 @@ function featureStatesFromSchema(schemaText, schemaOk, appServerClientText = '')
         },
         protocol_schema_generation: {
             supported: schemaOk,
-            certainty: schemaOk ? 'actual' : 'failed',
-            evidence: schemaOk ? ['codex_app_server_generate_json_schema'] : [],
+            certainty: schemaOk ? schemaCertainty : 'failed',
+            evidence: schemaOk
+                ? [schemaMode === 'real-schema' ? 'codex_app_server_generate_json_schema' : 'cached_schema_non_authorizing']
+                : [],
             blockers: schemaOk ? [] : ['codex_app_server_schema_generation_failed']
         },
         multi_agent_mode_schema: actual('multi_agent_mode_schema', ['MultiAgentMode']),
         rollout_budget_schema: actual('rollout_budget_schema', ['budgetLimited']),
         indexed_web_search_schema: actual('indexed_web_search_schema', ['indexed']),
-        current_time_read_schema: currentTimeState(lower, schemaOk, appServerClientText),
+        current_time_read_schema: currentTimeState(lower, schemaOk, schemaMode, appServerClientText),
         native_thread_list_search_schema: actual('native_thread_list_search_schema', ['thread/list', 'ThreadSearchResult', 'thread/read']),
         plugin_catalog_refresh_schema: actual('plugin_catalog_refresh_schema', ['plugin/list', 'plugin/install', 'AppListUpdatedNotification']),
         terminal_subagent_error_schema: actual('terminal_subagent_error_schema', ['subagentStart', 'subagentStop', 'error']),
@@ -117,13 +118,13 @@ function featureStatesFromSchema(schemaText, schemaOk, appServerClientText = '')
         app_server_overload_schema: actual('app_server_overload_schema', ['JSONRPCError'])
     };
 }
-function currentTimeState(schemaTextLower, schemaOk, appServerClientText) {
+function currentTimeState(schemaTextLower, schemaOk, schemaMode, appServerClientText) {
     const schemaHasCurrentTime = schemaOk && schemaTextLower.includes('currenttime') && schemaTextLower.includes('read');
     if (schemaHasCurrentTime) {
         return {
             supported: true,
-            certainty: 'actual',
-            evidence: ['generated_schema_contains:currentTime/read'],
+            certainty: schemaMode === 'real-schema' ? 'actual' : 'discovered',
+            evidence: [`${schemaMode}_contains:currentTime/read`],
             blockers: []
         };
     }
@@ -135,76 +136,50 @@ function currentTimeState(schemaTextLower, schemaOk, appServerClientText) {
         blockers: clientHandlesCurrentTime ? [] : ['codex_current_current_time_read_handler_not_verified']
     };
 }
-async function schemaProbeForMode(root, codexBin, requireReal) {
-    if (!requireReal && process.env.SKS_CODEX_CURRENT_REFRESH !== '1') {
-        const shipped = await shippedSchemaProbe();
-        if (shipped.ok)
-            return shipped;
+async function generateSchemaProbe(root, runtime, options) {
+    const cachePath = codexCurrentSchemaCachePath(root, runtime);
+    if (options.allowCache) {
+        const cached = await readJson(cachePath, null).catch(() => null);
+        if (cached?.ok === true && typeof cached.text === 'string' && cached.sha256) {
+            return { ok: true, text: cached.text, sha256: cached.sha256, mode: 'cached-schema' };
+        }
     }
-    return generateSchemaProbe(root, codexBin);
-}
-async function shippedSchemaProbe() {
-    const schemaRoot = path.join(packageRoot(), 'schemas', 'codex', 'app-server-0.146');
-    const files = await listFiles(schemaRoot).catch(() => []);
-    if (!files.length)
-        return { ok: false, text: 'shipped schema cache missing', sha256: null, mode: 'shipped-manifest-cache' };
-    const rows = await Promise.all(files.map(async (file) => {
-        const text = await fsp.readFile(file, 'utf8');
-        return {
-            relative: path.relative(schemaRoot, file),
-            text,
-            canonicalText: canonicalSchemaContent(file, text)
-        };
-    }));
-    const joined = rows.map((row) => `${row.relative}\n${row.text}`).join('\n');
-    const canonicalJoined = rows.map((row) => `${row.relative}\n${row.canonicalText}`).join('\n');
-    return { ok: true, text: joined, sha256: sha256(canonicalJoined), mode: 'shipped-manifest-cache' };
-}
-async function generateSchemaProbe(root, codexBin) {
-    const cachePath = await schemaCachePath(root, codexBin);
-    const cached = await readJson(cachePath, null).catch(() => null);
-    if (cached?.ok === true && typeof cached.text === 'string' && cached.sha256) {
-        return { ok: true, text: cached.text, sha256: cached.sha256, mode: 'real-schema' };
-    }
-    const out = path.join(os.tmpdir(), `sks-codex-current-schema-${process.pid}-${Date.now()}`);
-    await ensureDir(out);
-    const result = await runProcess(codexBin, ['app-server', 'generate-json-schema', '--out', out], {
-        cwd: root,
-        timeoutMs: 60_000,
-        maxOutputBytes: 256 * 1024
-    }).catch((err) => ({
-        code: 1,
-        stdout: '',
-        stderr: err instanceof Error ? err.message : String(err),
-        stdoutBytes: 0,
-        stderrBytes: 0,
-        truncated: false,
-        timedOut: false
-    }));
-    if (result.code !== 0)
-        return { ok: false, text: `${result.stdout}\n${result.stderr}`, sha256: null, mode: 'real-schema' };
-    const files = await listFiles(out);
-    const rows = await Promise.all(files.map(async (file) => {
-        const text = await fsp.readFile(file, 'utf8');
-        return {
-            relative: path.relative(out, file),
-            text,
-            canonicalText: canonicalSchemaContent(file, text)
-        };
-    }));
-    const joined = rows.map((row) => `${row.relative}\n${row.text}`).join('\n');
-    const canonicalJoined = rows.map((row) => `${row.relative}\n${row.canonicalText}`).join('\n');
-    await fsp.rm(out, { recursive: true, force: true }).catch(() => { });
-    const probe = { ok: true, text: joined, sha256: sha256(canonicalJoined), mode: 'real-schema' };
-    await writeJsonAtomic(cachePath, probe).catch(() => undefined);
-    return probe;
+    return withScratchDir('codex-current-schema-', async (out) => {
+        const result = await runProcess(runtime.realpath, ['app-server', 'generate-json-schema', '--out', out], {
+            cwd: root,
+            timeoutMs: 60_000,
+            maxOutputBytes: 256 * 1024
+        }).catch((err) => ({
+            code: 1,
+            stdout: '',
+            stderr: err instanceof Error ? err.message : String(err),
+            stdoutBytes: 0,
+            stderrBytes: 0,
+            truncated: false,
+            timedOut: false
+        }));
+        if (result.code !== 0)
+            return { ok: false, text: `${result.stdout}\n${result.stderr}`, sha256: null, mode: 'real-schema' };
+        const files = await listFiles(out);
+        const rows = await Promise.all(files.map(async (file) => {
+            const text = await fsp.readFile(file, 'utf8');
+            return {
+                relative: path.relative(out, file),
+                text,
+                canonicalText: canonicalSchemaContent(file, text)
+            };
+        }));
+        const joined = rows.map((row) => `${row.relative}\n${row.text}`).join('\n');
+        const canonicalJoined = rows.map((row) => `${row.relative}\n${row.canonicalText}`).join('\n');
+        const probe = { ok: true, text: joined, sha256: sha256(canonicalJoined), mode: 'real-schema' };
+        await writeJsonAtomic(cachePath, probe).catch(() => undefined);
+        return probe;
+    });
 }
-async function schemaCachePath(root, codexBin) {
-    const realpath = await fsp.realpath(codexBin).catch(() => codexBin);
+export function codexCurrentSchemaCachePath(root, runtime) {
     const key = sha256(JSON.stringify({
-        realpath,
-        target: CURRENT_CODEX_RELEASE_MANIFEST.targetTag,
-        manifest_schema_sha256: CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256,
+        realpath: runtime.realpath,
+        binary_sha256: runtime.sha256,
         platform: process.platform,
         arch: process.arch
     }));
@@ -251,11 +226,10 @@ function blockedCapability(probeMode, runtime, schemaSha, blockers) {
         generated_at: nowIso(),
         ok: false,
         release_authorizing: false,
-        target_tag: CURRENT_CODEX_RELEASE_MANIFEST.targetTag,
-        required_version: CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+        target_tag: CURRENT_CODEX_RUNTIME_CONTRACT.targetTag,
+        required_version: CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion,
         runtime_identity: runtime,
         generated_schema_sha256: schemaSha,
-        manifest_schema_sha256: CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256,
         probe_mode: probeMode,
         feature_states: state,
         blockers,
@@ -274,11 +248,10 @@ function fakeCapability() {
         generated_at: nowIso(),
         ok: true,
         release_authorizing: false,
-        target_tag: CURRENT_CODEX_RELEASE_MANIFEST.targetTag,
-        required_version: CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+        target_tag: CURRENT_CODEX_RUNTIME_CONTRACT.targetTag,
+        required_version: CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion,
         runtime_identity: null,
         generated_schema_sha256: 'fixture',
-        manifest_schema_sha256: CURRENT_CODEX_RELEASE_MANIFEST.generatedSchemaSha256,
         probe_mode: 'hermetic-fixture',
         feature_states: state,
         blockers: [],

package/dist/core/codex-control/codex-current-core-capability.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
 import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
 export async function detectCodexCurrentCoreCapability(input = {}) {
     const fake = process.env.SKS_CODEX_CURRENT_CORE_FAKE === '1';
@@ -9,10 +9,10 @@ export async function detectCodexCurrentCoreCapability(input = {}) {
         ? input.codexBin || process.env.CODEX_BIN || 'codex'
         : input.codexBin || process.env.CODEX_BIN || await findCodexBinary();
     const versionText = fake
-        ? String(process.env.SKS_CODEX_VERSION_FAKE || `codex-cli ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion}`)
+        ? String(process.env.SKS_CODEX_VERSION_FAKE || `codex-cli ${CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion}`)
         : await readCodexVersionText(codexBin);
     const parsed = parseCodexVersionText(versionText);
-    const currentRelease = Boolean(parsed && compareSemverLike(parsed, CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion) >= 0);
+    const currentRelease = Boolean(parsed && compareSemverLike(parsed, CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion) >= 0);
     const probeMode = process.env.SKS_CODEX_CURRENT_CORE_PROBE === '1' ? 'feature-probe' : 'version-only';
     const probeTimeoutMs = Math.max(1, Number(process.env.SKS_CODEX_CURRENT_CORE_PROBE_TIMEOUT_MS || 3000) || 3000);
     const featureProbeResults = probeMode === 'feature-probe'

package/dist/core/codex-control/codex-current-core-probe-runner.js

@@ -2,7 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
 import { parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 import { runProcess } from '../fsx.js';
 import { runCodexCurrentCoreDoctorEnvRealProbe } from './codex-current-doctor-real-probe.js';
 import { runCodexCurrentCoreImageReferencedPathRealProbe } from './codex-current-image-path-real-probe.js';
@@ -18,7 +18,7 @@ export async function runCodexCurrentCoreRealProbes(input) {
     const codexBin = input.codexBin || await findCurrentCodexRealProbeBinary();
     const versionText = await readCodexVersionText(codexBin, timeoutMs);
     const parsedVersion = parseCodexVersionText(versionText);
-    const currentVersion = parsedVersion === CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion;
+    const currentVersion = parsedVersion === CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion;
     const requestedRaw = input.probes?.length ? input.probes : CODEX_CURRENT_CORE_REAL_PROBE_NAMES;
     const unknownProbeNames = requestedRaw.filter((name) => !CODEX_CURRENT_CORE_REAL_PROBE_NAMES.includes(name));
     const requested = [...new Set(requestedRaw.filter((name) => CODEX_CURRENT_CORE_REAL_PROBE_NAMES.includes(name)))];
@@ -27,7 +27,7 @@ export async function runCodexCurrentCoreRealProbes(input) {
     if (!codexBin)
         extraBlockers.push('codex_cli_missing');
     if (!currentVersion)
-        extraBlockers.push(`codex_${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion.replaceAll('.', '_')}_required`);
+        extraBlockers.push(`codex_${CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion.replaceAll('.', '_')}_required`);
     if (!codexBin || !currentVersion) {
         for (const name of requested) {
             probes[name] = skippedCodexCurrentCoreProbe(!codexBin ? 'codex_cli_missing' : 'codex_current_release_required', { parsed_version: parsedVersion });
@@ -119,7 +119,7 @@ export async function findCurrentCodexRealProbeBinary() {
             firstExisting = candidate;
         const versionText = await readCodexVersionText(candidate, 30000);
         const parsed = parseCodexVersionText(versionText);
-        if (parsed === CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion)
+        if (parsed === CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion)
             return candidate;
     }
     return firstExisting || await findCodexBinary();

package/dist/core/codex-control/codex-current-core-real-probes.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 export const CODEX_CURRENT_CORE_REAL_PROBE_NAMES = [
     'code_mode_web_search',
@@ -63,7 +63,7 @@ export function buildCodexCurrentCoreRealProbeResult(input) {
     const overallOk = input.requireReal ? blockers.length === 0 && failed.length === 0 && skipped.length === 0 : failed.length === 0;
     return {
         schema: 'sks.codex-current-core-real-probe-result.v1',
-        target_version: CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+        target_version: CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion,
         compatibility_origin: 'codex-current-core-real-probe-result-v1',
         compatibility_authority: 'deprecated_non_authoritative_lineage_only',
         generated_at: nowIso(),

package/dist/core/codex-control/codex-current-feature-capability.js

@@ -1,15 +1,15 @@
 import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
 import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
 import { CODEX_CURRENT_FEATURE_FEATURE_KEYS, probeCodexCurrentFeatureFeatureDetails, probeCodexCurrentFeatureFeatures } from './codex-current-feature-probes.js';
 export async function detectCodexCurrentFeatureCapability(input = {}) {
     const fake = process.env.SKS_CODEX_CURRENT_FEATURE_FAKE === '1';
     const codexBin = fake ? input.codexBin || process.env.CODEX_BIN || 'codex' : input.codexBin || process.env.CODEX_BIN || await findCodexBinary();
-    const versionText = fake ? String(process.env.SKS_CODEX_VERSION_FAKE || `codex-cli ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion}`) : await readCodexVersionText(codexBin);
+    const versionText = fake ? String(process.env.SKS_CODEX_VERSION_FAKE || `codex-cli ${CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion}`) : await readCodexVersionText(codexBin);
     const parsed = parseCodexVersionText(versionText);
-    const supportsCurrentContract = Boolean(parsed && compareSemverLike(parsed, CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion) >= 0);
+    const supportsCurrentContract = Boolean(parsed && compareSemverLike(parsed, CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion) >= 0);
     const probeMode = process.env.SKS_CODEX_CURRENT_FEATURE_PROBE === '1' ? 'feature-probe' : 'version-only';
     const probeTimeoutMs = Number(process.env.SKS_CODEX_CURRENT_FEATURE_PROBE_TIMEOUT_MS || 3000);
     const probeDetails = probeMode === 'feature-probe'
@@ -77,7 +77,7 @@ function featureStateFor(key, supportsCurrentContract, probeMode, probeDetails)
         return {
             supported: true,
             certainty: 'assumed_by_version',
-            evidence: [`codex_version>=${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion}`],
+            evidence: [`codex_version>=${CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion}`],
             blockers: []
         };
     }

package/dist/core/codex-control/codex-current-image-path-real-probe.js

@@ -49,7 +49,7 @@ export async function runCodexCurrentCoreImageReferencedPathRealProbe(input) {
     }
     const outputFile = path.join(tempDir, 'last-message.txt');
     const prompt = [
-        'This is a Current Codex 0.146.0 image path routing probe.',
+        'This is a current Codex image path routing probe.',
         `Only the image file named ${path.basename(inputB)} is intentionally referenced.`,
         `Return compact JSON {"referenced_path":"${inputB.replace(/\\/g, '\\\\')}","saw_image":true}.`,
         'Do not edit files and do not reference any other image path.'

package/dist/core/codex-control/codex-current-web-search-probe.js

@@ -15,7 +15,7 @@ export async function runCodexCurrentCoreWebSearchRealProbe(input) {
         return skippedCodexCurrentCoreProbe('codex_cli_missing');
     const tempDir = path.join(input.root, '.sneakoscope', 'tmp', 'codex-current-core-real-probes', `web-search-${Date.now()}`);
     await ensureDir(tempDir);
-    await writeTextAtomic(path.join(tempDir, 'README.md'), 'Temporary Current Codex 0.146.0 web-search real probe workspace.\n');
+    await writeTextAtomic(path.join(tempDir, 'README.md'), 'Temporary current Codex web-search real probe workspace.\n');
     const outputFile = path.join(tempDir, 'last-message.txt');
     const prompt = 'In code mode, use standalone web search to find the title of https://example.com. Return JSON {"used_web_search":true,"answer":"...","sources":[...]}.';
     const args = buildCodexExecArgs({ root: tempDir, prompt, outputFile, json: true, extraArgs: ['-c', 'mcp_servers={}'] });

package/dist/core/codex-control/codex-sdk-capability.js

@@ -2,7 +2,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 export async function detectCodexSdkCapability(input = {}) {
     let dynamicImportOk = false;
     let version = null;
@@ -38,7 +38,7 @@ export async function detectCodexSdkCapability(input = {}) {
         node_compatible: nodeCompatible,
         dynamic_import_ok: dynamicImportOk,
         structured_output_fake_smoke: structuredFake,
-        setup_action: blockers.includes('codex_sdk_unavailable') ? `npm install @openai/codex-sdk@${CURRENT_CODEX_RELEASE_MANIFEST.sdkVersion}` : null,
+        setup_action: blockers.includes('codex_sdk_unavailable') ? `npm install @openai/codex-sdk@${CURRENT_CODEX_RUNTIME_CONTRACT.sdkVersion}` : null,
         blockers
     };
 }

package/dist/core/commands/remote-command.js

@@ -105,8 +105,8 @@ Usage:
   sks remote worker --stdio
 
 This command manages SKS remote readiness, registered machines, and the JSONL worker transport.
-It does not install a messaging bridge or create remote sessions. For the supported mobile-first
-integration, create a bot with BotFather and run sks telegram --help.
+It does not install a messaging bridge or create remote sessions. For mobile-first workflows,
+use a separately installed independent companion such as Paseo.
 `);
 }
 function fail(error, supported, json) {