sneakoscope 8.2.0 → 8.3.0

package/dist/core/context7-client.js

@@ -1,6 +1,7 @@
 import { Client } from '@modelcontextprotocol/client';
 import { StdioClientTransport } from '@modelcontextprotocol/client/stdio';
 import { PACKAGE_VERSION } from './version.js';
+import { collectMcpListPages } from './mcp/modern-protocol.js';
 const DEFAULT_CONTEXT7_COMMAND = 'npx';
 const DEFAULT_CONTEXT7_ARGS = ['-y', '@upstash/context7-mcp@latest'];
 export function defaultContext7ServerConfig() {
@@ -215,8 +216,10 @@ class LocalMcpClient {
     async listTools() {
         if (!this.client)
             throw new Error('Context7 MCP is not connected.');
-        const result = await this.client.listTools({}, { timeout: this.timeoutMs, cacheMode: 'refresh' });
-        return Array.isArray(result?.tools) ? result.tools : [];
+        return collectMcpListPages('tools', (params) => this.client.listTools(params, {
+            timeout: this.timeoutMs,
+            cacheMode: 'refresh'
+        }), { requireModernResult: false });
     }
     async callTool(name, args = {}) {
         if (!this.client)

package/dist/core/doctor/codex-current-core-probe-doctor.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 import { readJson } from '../fsx.js';
 export async function readCodexCurrentCoreDoctorRealProbeStatus(root) {
     const summary = await readJson(path.join(root, '.sneakoscope', 'codex-current-core-real-probe-summary.json'), null);
@@ -7,7 +7,7 @@ export async function readCodexCurrentCoreDoctorRealProbeStatus(root) {
     return {
         schema: 'sks.doctor-codex-current-core-real-probes.v1',
         codex_cli_version: result?.version_text || null,
-        capability_version_flag: result?.parsed_version === CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+        capability_version_flag: result?.parsed_version === CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion,
         real_probes_last_run_status: summary ? (summary.ok ? 'ok' : 'blocked') : 'not_run',
         skipped_probes: result?.skipped || [],
         strict_probe_command: 'node ./dist/scripts/codex-current-core-real-probes-check.js --require-real --allow-network',

package/dist/core/doctor/doctor-dirty-planner.js

@@ -121,7 +121,7 @@ function phaseInputFiles(id) {
         return ['src/core/codex-native', 'src/scripts/native-capability-postcheck-check.ts'];
     if (id.includes('secret'))
         return ['safety-mutation-allowlist.json', 'src/scripts/secret-preservation-check.ts'];
-    return ['package.json', 'config/codex-releases/rust-v0.146.0.json'];
+    return ['package.json', 'package-lock.json', 'src/core/codex-compat/codex-runtime-contract.ts'];
 }
 function packageIdentity() {
     const root = packageRoot();

package/dist/core/doctor/doctor-readiness-matrix.js

@@ -58,13 +58,6 @@ export function buildDoctorReadinessMatrix(input = {}) {
         warnings.add('codex_app_fast_selector_repaired_restart_app_if_needed');
     if (input.sks_menubar?.ok === false)
         warnings.add(`sks_menubar_${input.sks_menubar?.status || 'blocked'}`);
-    const telegramRemote = input.telegram_remote || null;
-    if (telegramRemote?.status === 'degraded') {
-        for (const blocker of normalizeList(telegramRemote.blockers))
-            warnings.add(`telegram_remote:${blocker}`);
-        if (!normalizeList(telegramRemote.blockers).length)
-            warnings.add('telegram_remote_degraded');
-    }
     const codexCurrentAppDoctor = input.codex_current_app_doctor || null;
     if (codexCurrentAppDoctor?.ok === false)
         for (const blocker of normalizeList(codexCurrentAppDoctor.blockers))

package/dist/core/feature-fixtures.js

@@ -36,10 +36,6 @@ const FIXTURES = Object.freeze({
         },
         reason: 'The read-only status command proves the installed Desktop Bridge JSON facade and fail-closed no-fallback routing contract without configuring a provider, starting a service, or reading a plaintext credential.'
     }),
-    'cli-telegram': fixture('execute', 'sks telegram --help', [], 'pass', {
-        quality: 'wiring_only',
-        reason: 'The non-mutating help path proves the installed Telegram command is wired without requiring a bot token, private-file state, resident poller, or network access; transport behavior is covered by focused Telegram tests.'
-    }),
     'cli-mcp': fixture('execute', 'sks mcp config list --scope project --trusted-project --json', [], 'pass', {
         reason: 'Project-scoped MCP inventory is a read-only, hermetic runtime probe when the trusted-project boundary is explicit; mutation, health, auth, and merge behavior remain covered by dedicated tests.'
     }),

package/dist/core/feature-registry.js

@@ -941,7 +941,6 @@ function isExternalPromptCommandMention(mention) {
         '$SKS_CODEX_APP_IMAGEGEN_OUTPUT',
         '$SKS_CODEX_APP_IMAGEGEN_OUTPUT_ID',
         '$SKS_CODEX_APP_IMAGEGEN_CREATED_AT',
-        '$SKS_TELEGRAM_TOKEN',
         '$SKS_WORKTREE_ROOT',
         '$XDG_CACHE_HOME',
         '$IMAGEGEN'

package/dist/core/image-ux-review.js

@@ -5,7 +5,7 @@ import fsp from 'node:fs/promises';
 import { nowIso, sha256, writeJsonAtomic } from './fsx.js';
 import { imageDimensions, sha256File } from './wiki-image/image-hash.js';
 import { CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_CHROME_EXTENSION_DOC_URL, CODEX_IMAGEGEN_REQUIRED_POLICY, CODEX_WEB_VERIFICATION_POLICY } from './routes.js';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from './codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from './codex-compat/codex-runtime-contract.js';
 import { detectCodexExecResumeOutputSchema } from './codex-exec-output-schema.js';
 import { buildCalloutPrompt, imagegenCapabilityBlocker } from './image-ux-review/imagegen-adapter.js';
 import { buildIssueLedgerFromGeneratedCallouts } from './image-ux-review/callout-extraction.js';
@@ -132,8 +132,8 @@ export function buildImageUxReviewPolicy(contract = {}) {
         max_screen_retries: 2,
         codex_compatibility: {
             schema: 'sks.codex-current-image-ux-contract.v1',
-            target_tag: CURRENT_CODEX_RELEASE_MANIFEST.targetTag,
-            required_version: CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion,
+            target_tag: CURRENT_CODEX_RUNTIME_CONTRACT.targetTag,
+            required_version: CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion,
             output_schema_preferred: true
         },
         output_schema: outputSchema,

package/dist/core/install/installed-package-smoke.js

@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { runProcess, writeJsonAtomic } from '../fsx.js';
 import { LEGACY_DOLLAR_COMMAND_NAMES, LEGACY_DOLLAR_SKILL_NAMES } from '../routes.js';
-export const INSTALLED_REQUIRED_COMMANDS = ['naruto', 'mcp', 'update', 'menubar', 'config', 'telegram'];
+export const INSTALLED_REQUIRED_COMMANDS = ['naruto', 'mcp', 'update', 'menubar', 'config'];
 export const INSTALLED_REQUIRED_DOLLAR_COMMANDS = ['$sks-naruto', '$sks-work'];
 export const INSTALLED_REMOVED_COMMANDS = ['team', 'mad-db', 'tmux', 'xai', 'swarm', 'agent', 'ralph', 'ui'];
 export const INSTALLED_REMOVED_DOLLAR_COMMANDS = Array.from(new Set([
@@ -192,7 +192,6 @@ export async function runInstalledPackageSmoke(root, options = {}) {
         { name: 'mcp', argv: [bin, 'mcp', 'config', 'list', '--scope', 'effective', '--trusted-project', '--json'], diagnostic: true },
         { name: 'update', argv: [bin, 'update', 'status', '--json'], diagnostic: true },
         { name: 'config', argv: [bin, 'config', '--help'], diagnostic: true },
-        { name: 'telegram', argv: [bin, 'telegram', '--help'], diagnostic: true },
         ...(process.platform === 'darwin'
             ? [{ name: 'menubar-install', argv: [bin, 'menubar', 'install', '--no-launch', '--json'] }]
             : []),
@@ -543,7 +542,7 @@ function installedDiagnosticBlockers(name, result, platform) {
     if (name === 'naruto')
         return result.exit_code === 0 && /\$sks-naruto/.test(result.stdout)
             ? [] : ['installed_diagnostic_failed:naruto'];
-    if (name === 'config' || name === 'telegram') {
+    if (name === 'config') {
         return result.exit_code === 0 && new RegExp(`Usage: sks ${name}`).test(result.stdout)
             ? [] : [`installed_diagnostic_failed:${name}`];
     }

package/dist/core/mad-sks/sql-plane/mcp-executor.js

@@ -2,6 +2,7 @@ import { performance } from 'node:perf_hooks';
 import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
 import { nowIso, sha256 } from '../../fsx.js';
 import { PACKAGE_VERSION } from '../../version.js';
+import { collectMcpListPages } from '../../mcp/modern-protocol.js';
 export class MadSksSqlPlaneMcpExecutor {
     profile;
     opts;
@@ -42,11 +43,11 @@ export class MadSksSqlPlaneMcpExecutor {
         const started = performance.now();
         try {
             await this.connect();
-            const result = await this.client.listTools({}, {
+            const tools = await collectMcpListPages('tools', (params) => this.client.listTools(params, {
                 timeout: this.opts.timeoutMs || 10_000,
                 cacheMode: 'refresh'
-            });
-            const names = (result.tools || []).map((tool) => String(tool?.name || '')).filter(Boolean).sort();
+            }), { requireModernResult: false });
+            const names = tools.map((tool) => String(tool?.name || '')).filter(Boolean).sort();
             const inventory = {
                 schema: 'sks.mad-sks-sql-plane-tool-inventory.v1',
                 checked_at: nowIso(),

package/dist/core/mcp/modern-protocol.js

@@ -3,6 +3,37 @@ export const MCP_PROTOCOL_VERSION_META_KEY = 'io.modelcontextprotocol/protocolVe
 export const MCP_CLIENT_INFO_META_KEY = 'io.modelcontextprotocol/clientInfo';
 export const MCP_CLIENT_CAPABILITIES_META_KEY = 'io.modelcontextprotocol/clientCapabilities';
 export const MCP_SERVER_INFO_META_KEY = 'io.modelcontextprotocol/serverInfo';
+export const MCP_LIST_PAGE_LIMIT = 100;
+export const MCP_LIST_ITEM_LIMIT = 10_000;
+export async function collectMcpListPages(itemKey, requestPage, options = {}) {
+    const maxPages = options.maxPages ?? MCP_LIST_PAGE_LIMIT;
+    const maxItems = options.maxItems ?? MCP_LIST_ITEM_LIMIT;
+    const seenCursors = new Set();
+    const items = [];
+    let cursor = null;
+    for (let pageIndex = 0; pageIndex < maxPages; pageIndex += 1) {
+        const raw = await requestPage(cursor === null ? {} : { cursor }, pageIndex);
+        const result = options.requireModernResult === false
+            ? requireRecordResult(raw)
+            : requireModernCompleteResult(raw);
+        const pageItems = result[itemKey];
+        if (!Array.isArray(pageItems))
+            throw new Error('mcp_list_items_invalid');
+        items.push(...pageItems);
+        if (items.length > maxItems)
+            throw new Error('mcp_pagination_item_limit_exceeded');
+        const nextCursor = result.nextCursor;
+        if (nextCursor === undefined || nextCursor === null)
+            return items;
+        if (typeof nextCursor !== 'string')
+            throw new Error('mcp_pagination_cursor_invalid');
+        if (seenCursors.has(nextCursor))
+            throw new Error('mcp_pagination_cursor_repeated');
+        seenCursors.add(nextCursor);
+        cursor = nextCursor;
+    }
+    throw new Error('mcp_pagination_page_limit_exceeded');
+}
 export function modernMcpParams(params, options) {
     const authoredMeta = isRecord(params._meta) ? params._meta : {};
     return {
@@ -40,6 +71,11 @@ export function requireModernCompleteResult(value) {
     }
     return value;
 }
+function requireRecordResult(value) {
+    if (!isRecord(value))
+        throw new Error('mcp_result_invalid');
+    return value;
+}
 export function modernServerInfo(value) {
     if (!isRecord(value) || !isRecord(value._meta))
         return null;

package/dist/core/mcp-config/health-check.js

@@ -8,7 +8,7 @@ import { normalizeMcpServerName } from './secret-policy.js';
 import { resolveMcpScope } from './scope.js';
 import { MCP_HEALTH_SCHEMA } from './types.js';
 import { PACKAGE_VERSION } from '../version.js';
-import { MCP_PROTOCOL_VERSION, isRecognizedModernError, modernHttpHeaders, modernMcpRequest, modernServerInfo, requireModernCompleteResult } from '../mcp/modern-protocol.js';
+import { MCP_PROTOCOL_VERSION, collectMcpListPages, isRecognizedModernError, modernHttpHeaders, modernMcpRequest, modernServerInfo, requireModernCompleteResult } from '../mcp/modern-protocol.js';
 const LEGACY_PROTOCOL_VERSION = '2024-11-05';
 const HEALTH_CLIENT_INFO = { name: 'sks-mcp-health', version: PACKAGE_VERSION };
 const OUTPUT_CAP = 64 * 1024;
@@ -102,12 +102,14 @@ async function probeStdio(name, scope, raw, options) {
             return result(name, scope, 'protocol_error', null, null, null, null, 'mcp_protocol_version_unsupported', options);
         }
         const instructions = typeof discoverResult.instructions === 'string';
-        channel.send(modernMcpRequest(2, 'tools/list', {}, { clientInfo: HEALTH_CLIENT_INFO }));
-        const tools = await channel.wait(2, timeoutMs(raw.tool_timeout_sec, 30));
-        const toolsResult = isRecord(tools) && isRecord(tools.result) ? requireModernCompleteResult(tools.result) : null;
-        const list = toolsResult && Array.isArray(toolsResult.tools) ? toolsResult.tools : null;
-        if (!list)
-            return result(name, scope, 'protocol_error', MCP_PROTOCOL_VERSION, null, instructions, null, 'mcp_tools_list_invalid', options);
+        const list = await collectMcpListPages('tools', async (params, pageIndex) => {
+            const id = 2 + pageIndex;
+            channel.send(modernMcpRequest(id, 'tools/list', params, { clientInfo: HEALTH_CLIENT_INFO }));
+            const response = await channel.wait(id, timeoutMs(raw.tool_timeout_sec, 30));
+            if (!isRecord(response) || !isRecord(response.result))
+                throw new Error('mcp_tools_list_invalid');
+            return response.result;
+        });
         return result(name, scope, 'healthy', MCP_PROTOCOL_VERSION, list.length, instructions, null, null, options, toolNames(list));
     }
     catch (error) {
@@ -160,11 +162,14 @@ async function probeLegacyStdio(name, scope, raw, options, channel) {
     const protocol = typeof init.result.protocolVersion === 'string' ? init.result.protocolVersion : null;
     const instructions = typeof init.result.instructions === 'string';
     channel.send({ jsonrpc: '2.0', method: 'notifications/initialized', params: {} });
-    channel.send({ jsonrpc: '2.0', id: 3, method: 'tools/list', params: {} });
-    const tools = await channel.wait(3, timeoutMs(raw.tool_timeout_sec, 30));
-    const list = isRecord(tools) && isRecord(tools.result) && Array.isArray(tools.result.tools) ? tools.result.tools : null;
-    if (!list)
-        return result(name, scope, 'protocol_error', protocol, null, instructions, null, 'mcp_tools_list_invalid', options);
+    const list = await collectMcpListPages('tools', async (params, pageIndex) => {
+        const id = 3 + pageIndex;
+        channel.send({ jsonrpc: '2.0', id, method: 'tools/list', params });
+        const response = await channel.wait(id, timeoutMs(raw.tool_timeout_sec, 30));
+        if (!isRecord(response) || !isRecord(response.result))
+            throw new Error('mcp_tools_list_invalid');
+        return response.result;
+    }, { requireModernResult: false });
     return result(name, scope, 'healthy', protocol, list.length, instructions, null, null, options, toolNames(list));
 }
 async function probeHttp(name, scope, raw, options) {
@@ -202,22 +207,30 @@ async function probeHttp(name, scope, raw, options) {
             return result(name, scope, 'protocol_error', null, null, null, null, 'mcp_protocol_version_unsupported', options);
         }
         const instructions = typeof discoverResult.instructions === 'string';
-        const toolsMessage = modernMcpRequest(2, 'tools/list', {}, { clientInfo: HEALTH_CLIENT_INFO });
-        const tools = await postRpc(fetchImpl, url, toolsMessage, timeoutMs(raw.tool_timeout_sec, 30), bearer, {
-            modern: true, method: 'tools/list', params: {}
+        const list = await collectMcpListPages('tools', async (params, pageIndex) => {
+            const toolsMessage = modernMcpRequest(2 + pageIndex, 'tools/list', params, { clientInfo: HEALTH_CLIENT_INFO });
+            const tools = await postRpc(fetchImpl, url, toolsMessage, timeoutMs(raw.tool_timeout_sec, 30), bearer, {
+                modern: true, method: 'tools/list', params
+            });
+            if (tools.status === 401 || tools.status === 403)
+                throw new Error('mcp_oauth_required');
+            if (!tools.ok || !isRecord(tools.json) || !isRecord(tools.json.result)) {
+                throw new Error(`mcp_http_tools_${tools.status}`);
+            }
+            return tools.json.result;
         });
-        if (tools.status === 401 || tools.status === 403)
-            return result(name, scope, 'oauth_required', MCP_PROTOCOL_VERSION, null, instructions, null, null, options);
-        const toolsResult = tools.ok && isRecord(tools.json) && isRecord(tools.json.result)
-            ? requireModernCompleteResult(tools.json.result) : null;
-        const list = toolsResult && Array.isArray(toolsResult.tools) ? toolsResult.tools : null;
-        if (!list)
-            return result(name, scope, 'protocol_error', MCP_PROTOCOL_VERSION, null, instructions, null, `mcp_http_tools_${tools.status}`, options);
         return result(name, scope, 'healthy', MCP_PROTOCOL_VERSION, list.length, instructions, null, null, options, toolNames(list));
     }
     catch (error) {
         const message = redactMcpError(error);
-        return result(name, scope, message.includes('AbortError') || message.includes('timeout') ? 'timeout' : 'startup_failed', null, null, null, null, message, options);
+        if (message === 'mcp_oauth_required')
+            return result(name, scope, 'oauth_required', MCP_PROTOCOL_VERSION, null, null, null, null, options);
+        const status = message.includes('AbortError') || message.includes('timeout')
+            ? 'timeout'
+            : message.includes('pagination') || message.includes('mcp_result') || message.includes('mcp_list') || message.includes('mcp_http_tools')
+                ? 'protocol_error'
+                : 'startup_failed';
+        return result(name, scope, status, null, null, null, null, message, options);
     }
 }
 async function probeLegacyHttp(name, scope, raw, options, fetchImpl, url, bearer) {
@@ -230,13 +243,15 @@ async function probeLegacyHttp(name, scope, raw, options, fetchImpl, url, bearer
     await postRpc(fetchImpl, url, { jsonrpc: '2.0', method: 'notifications/initialized', params: {} }, timeoutMs(raw.tool_timeout_sec, 30), bearer, {
         modern: false, sessionId: init.sessionId, legacyProtocolVersion: protocol
     });
-    const tools = await postRpc(fetchImpl, url, { jsonrpc: '2.0', id: 3, method: 'tools/list', params: {} }, timeoutMs(raw.tool_timeout_sec, 30), bearer, {
-        modern: false, sessionId: init.sessionId, legacyProtocolVersion: protocol
-    });
-    const list = tools.ok && isRecord(tools.json) && isRecord(tools.json.result) && Array.isArray(tools.json.result.tools)
-        ? tools.json.result.tools : null;
-    if (!list)
-        return result(name, scope, 'protocol_error', protocol, null, instructions, null, `mcp_http_tools_${tools.status}`, options);
+    const list = await collectMcpListPages('tools', async (params, pageIndex) => {
+        const tools = await postRpc(fetchImpl, url, { jsonrpc: '2.0', id: 3 + pageIndex, method: 'tools/list', params }, timeoutMs(raw.tool_timeout_sec, 30), bearer, {
+            modern: false, sessionId: init.sessionId, legacyProtocolVersion: protocol
+        });
+        if (!tools.ok || !isRecord(tools.json) || !isRecord(tools.json.result)) {
+            throw new Error(`mcp_http_tools_${tools.status}`);
+        }
+        return tools.json.result;
+    }, { requireModernResult: false });
     return result(name, scope, 'healthy', protocol, list.length, instructions, null, null, options, toolNames(list));
 }
 class JsonLineChannel {

package/dist/core/perf/release-latency-slo.js

@@ -211,8 +211,7 @@ let firstStart = DispatchTime.now().uptimeNanoseconds
 status.start()
 let firstMs = Double(DispatchTime.now().uptimeNanoseconds - firstStart) / 1_000_000
 status.stop()
-let telegramService = TelegramRuntimeFactory.make(processClient: processClient, canonicalProjectRoot: AppRuntime.canonicalProjectRoot)
-let control = ControlCenterWindowController(processClient: processClient, operations: operations, notifications: notifications, telegramService: telegramService)
+let control = ControlCenterWindowController(processClient: processClient, operations: operations, notifications: notifications)
 let controlStart = DispatchTime.now().uptimeNanoseconds
 control.show(section: SidebarItem.overview)
 let controlMs = Double(DispatchTime.now().uptimeNanoseconds - controlStart) / 1_000_000

package/dist/core/proof/runtime-truth-matrix.js

@@ -77,7 +77,7 @@ export async function buildRuntimeTruthMatrix(input) {
         row('goal_mode', goalMode?.ok === true ? 'proven' : 'integration_optional', ['goal-mode-applied.json'], false, goalMode, 'record official goal mode evidence'),
         row('route_blackbox', fakeReal?.subsystem_levels?.route_blackbox || (official.proof_level === 'proven' ? 'proven' : 'integration_optional'), ['subagent-evidence.json', 'naruto-gate.json', 'fake-real-proof-policy.json'], false, fakeReal, official.next_action),
         row('dynamic_scheduler', schedulerRuntime.proof_level, ['agent-scheduler-state.json'], false, schedulerRuntime.report, 'record scheduler drain evidence'),
-        row('codex_current', levelFromOk(codexCurrent, 'integration_optional'), ['codex-current-capability.json', 'config/codex-releases/rust-v0.146.0.json'], false, codexCurrent, 'run the current Codex capability release gate'),
+        row('codex_current', levelFromOk(codexCurrent, 'integration_optional'), ['codex-current-capability.json', 'package.json'], false, codexCurrent, 'run the current Codex capability release gate'),
         row('mcp_current', levelFromOk(mcpCurrent, 'integration_optional'), ['mcp-readonly-runtime-scheduler.json'], false, mcpCurrent, 'run the current MCP runtime scheduler release gate'),
         row('adhd_orchestration', levelFromOk(adhdOrchestration, 'integration_optional'), ['strategy-gate.json', 'adhd-orchestrating-gate.json'], false, adhdOrchestration, 'run `npm run strategy:adhd-orchestrating-gate`'),
         row('appshots', levelFromAppshots(appshots), ['appshots-evidence.json'], false, appshots, 'run `npm run appshots:evidence`'),

package/dist/core/release/canonical-test-proof.js

@@ -6,10 +6,9 @@ import { releaseAuthorizationSnapshot, sameReleaseAuthorizationSnapshot } from '
 export const CANONICAL_TEST_PROOF_SCHEMA = 'sks.canonical-test-proof.v1';
 const CURRENT_COMPILED_TESTS = new Set([
     'dist/core/__tests__/codex-capability-matrix.test.js',
-    'dist/core/__tests__/codex-release-manifest-current.test.js',
+    'dist/core/__tests__/codex-runtime-contract-current.test.js',
     'dist/core/__tests__/release-gate-hermetic-env.test.js',
     'dist/core/__tests__/update-menubar-package-local.test.js',
-    'dist/core/__tests__/update-simulated-upgrade.test.js',
     'dist/core/__tests__/version-manager-current-docs.test.js',
     'dist/core/install/__tests__/installed-package-smoke.test.js',
     'dist/core/perf/__tests__/release-latency-slo.test.js'

package/dist/core/release/gate-manifest.js

@@ -11,6 +11,8 @@ export const FORBIDDEN_RECURSIVE_GATES = new Set([
 ]);
 export const ALWAYS_ON_GATES = new Set([
     'release:metadata-current',
+    'release:version-truth',
+    'install-surface:ssot',
     'architecture:guard',
     'safety:mutation-callsite-coverage',
     'side-effect:runtime-report',
@@ -25,13 +27,15 @@ export const ALWAYS_ON_GATES = new Set([
 ]);
 export const REQUIRED_FOR_PUBLISH = new Set([
     'release:metadata-current',
+    'release:version-truth',
+    'install-surface:ssot',
     'architecture:guard',
     'safety:mutation-callsite-coverage',
     'side-effect:runtime-report',
     'release:proof-truth',
     'release:latency-slo',
     'release:provenance',
-    'codex:current:manifest',
+    'codex:current:dependency-graph',
     'codex:current:binary-identity',
     'codex:current:policy',
     'codex:current:app-server-v2',
@@ -105,7 +109,6 @@ export function affectedGlobsFor(id) {
                 'src/core/codex-policy/**',
                 'src/commands/codex.ts',
                 'src/cli/install-helpers.ts',
-                'config/codex-releases/**',
                 'schemas/codex-*.json',
                 'package.json',
                 'package-lock.json',

package/dist/core/release/physical-release-gates.js

@@ -19,7 +19,6 @@ export const PHYSICAL_RELEASE_GATE_IDS = [
     'update_5001_directory',
     'single_menubar_process',
     'codex_lb_measured_request',
-    'telegram_cellular_e2e',
     'desktop_bridge_live_evidence'
 ];
 export function inspectPhysicalReleaseGates(opts) {
@@ -588,7 +587,6 @@ function genericGateCommandId(id) {
         update_5001_directory: 'sks.update.physical',
         single_menubar_process: 'sks.menubar.process-readback',
         codex_lb_measured_request: 'sks.codex-lb.measured-request',
-        telegram_cellular_e2e: 'sks.telegram.cellular-roundtrip',
         desktop_bridge_live_evidence: 'sks.desktop-bridge.live-evidence'
     }[id];
 }
@@ -630,20 +628,6 @@ function deriveGenericGateObservations(id, measurement) {
             latency_ms: measurement.latency_ms
         };
     }
-    if (id === 'telegram_cellular_e2e') {
-        if (!CAPTURE_ID_PATTERN.test(String(measurement?.pairing_id || ''))
-            || !SHA256_PATTERN.test(String(measurement?.outbound_message_sha256 || ''))
-            || !SHA256_PATTERN.test(String(measurement?.inbound_reply_sha256 || '')))
-            return null;
-        return {
-            network: measurement.network_interface_kind,
-            paired: measurement.pairing_verified === true,
-            allowlisted: measurement.allowlist_match === true,
-            typed_command: measurement.outbound_typed === true,
-            reply_received: measurement.inbound_reply_received === true,
-            bot_token_recorded: measurement.bot_token_captured === true
-        };
-    }
     return null;
 }
 function validateArtifactReference(artifactPath, artifactSha256, id, evidenceRoot, scope, blockers) {
@@ -707,16 +691,6 @@ function validateObservations(observations, id, version, sourceCommit, evidenceR
         if (!Number.isFinite(observations.latency_ms) || observations.latency_ms < 0)
             blockers.push(`physical_receipt_observation_invalid:${id}:latency`);
     }
-    else if (id === 'telegram_cellular_e2e') {
-        if (observations.network !== 'cellular')
-            blockers.push(`physical_receipt_observation_invalid:${id}:network`);
-        if (observations.paired !== true || observations.allowlisted !== true)
-            blockers.push(`physical_receipt_observation_invalid:${id}:authorization`);
-        if (observations.typed_command !== true || observations.reply_received !== true)
-            blockers.push(`physical_receipt_observation_invalid:${id}:roundtrip`);
-        if (observations.bot_token_recorded !== false)
-            blockers.push(`physical_receipt_observation_invalid:${id}:secret`);
-    }
     else if (id === 'desktop_bridge_live_evidence') {
         if (observations.release_authorizing !== true
             || observations.capture_platform !== 'darwin'

package/dist/core/release/release-gate-affected-selector.js

@@ -1,6 +1,8 @@
 import { spawnSync } from 'node:child_process';
 const ALWAYS_KEEP = new Set([
     'release:proof-truth',
+    'release:version-truth',
+    'install-surface:ssot',
     'typecheck',
     'schema:check'
 ]);
@@ -94,7 +96,6 @@ function isCodexCurrentFile(file) {
         || file.startsWith('src/core/codex-policy/')
         || file === 'src/commands/codex.ts'
         || file === 'src/cli/install-helpers.ts'
-        || file.startsWith('config/codex-releases/')
         || file.startsWith('schemas/codex-');
 }
 function selectionResult(all, selected, changedFiles, mode, reasons, skipped) {

package/dist/core/release/release-gate-contract.js

@@ -5,12 +5,13 @@ export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
     'codex:current:app-server-v2',
     'codex:current:binary-identity',
     'codex:current:capability',
-    'codex:current:manifest',
+    'codex:current:dependency-graph',
     'codex:current:policy',
     'codex:current:thread-store',
     'commands:current-surface-only',
     'config:managed-merge',
     'docs:truthfulness',
+    'install-surface:ssot',
     'latest-version:guidance',
     'migration:current-surface-e2e',
     'migration:upgrade-safety',
@@ -24,6 +25,7 @@ export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
     'release:metadata-current',
     'release:proof-truth',
     'release:provenance',
+    'release:version-truth',
     'runtime:installed-smoke',
     'safety:mutation-callsite-coverage',
     'schema:check',

package/dist/core/release/release-pack-receipt.js

@@ -405,7 +405,6 @@ const RETIRED_SURFACE_PATTERNS = [
     { kind: 'retired_team_lane_label', regex: /\b(?:Balanced Team Lane|Full Team Honest Path|full Team\/Honest proof path)\b/gi }
 ];
 const RETIRED_PACKAGED_FILE_PATTERNS = [
-    /^package\/dist\/core\/telegram\/controller\.js$/,
     /^package\/dist\/core\/commands\/ui-command\.js$/,
     /^package\/dist\/core\/ui\/dashboard-html\.js$/,
     new RegExp(`^package/.*${RETIRED_MULTIPLEXER_TOKEN}`, 'i')

package/dist/core/release/stage-publish.js

@@ -175,7 +175,7 @@ function runPreflight(opts, packageName, version) {
         && physicalReport?.release_authorizing === true
         && physicalReport?.inspector_platform === 'darwin';
     steps.push(step('physical_release_gates', physicalReady, physicalReady
-        ? 'all five source-bound physical release receipts and live Desktop Bridge artifacts verified on macOS'
+        ? 'all four source-bound physical release receipts and live Desktop Bridge artifacts verified on macOS'
         : compactPhysicalGateFailure(physical, physicalReport), physicalReady ? null : 'stage_physical_release_gates_invalid'));
     const reviewEnvironmentBlocker = localNpmStageReviewEnvironmentBlocker(opts.env || process.env);
     steps.push(step('local_review_environment', reviewEnvironmentBlocker === null, reviewEnvironmentBlocker === null ? 'maintainer-local' : reviewEnvironmentBlocker, reviewEnvironmentBlocker === null ? null : `stage_${reviewEnvironmentBlocker}`));

package/dist/core/version-manager.js

@@ -323,6 +323,10 @@ async function syncSourcePackageVersion(root, version) {
             rel: 'src/core/version.ts',
             replace: (text) => text.replace(/export const PACKAGE_VERSION = ['"][^'"]+['"];/, `export const PACKAGE_VERSION = '${version}';`)
         },
+        {
+            rel: 'plugins/sks/.codex-plugin/plugin.json',
+            replace: (text) => text.replace(/("version"\s*:\s*")[^"]+("(?=\s*[,}]))/, `$1${version}$2`)
+        },
         {
             rel: 'crates/sks-core/Cargo.toml',
             replace: (text) => text.replace(/^version\s*=\s*"[^"]+"/m, `version = "${version}"`)

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '8.2.0';
+export const PACKAGE_VERSION = '8.3.0';

package/dist/native/sks-menubar/Sources/AppDelegate.swift

@@ -7,7 +7,6 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
     private var notifications: NotificationCoordinator!
     private var controlCenter: ControlCenterWindowController!
     private var statusItemController: StatusItemController!
-    private var telegramService: TelegramMenuBarService?
 
     init(singletonGuard: SingletonInstanceGuard) {
         self.singletonGuard = singletonGuard
@@ -21,19 +20,12 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
         // never reaches NSTextField/NSTextView responders without an explicit menu.
         AppIdentity.installStandardEditMenu()
         processClient = ProcessClient(actionScript: AppRuntime.actionScript, logPath: AppRuntime.lastActionLogPath, projectRoot: AppRuntime.projectRoot)
-        let residentTelegramService = TelegramRuntimeFactory.make(
-            processClient: processClient,
-            canonicalProjectRoot: AppRuntime.canonicalProjectRoot
-        )
-        telegramService = residentTelegramService
-        _ = residentTelegramService.start()
         operations = OperationCoordinator(directory: AppRuntime.operationDirectory)
         notifications = NotificationCoordinator()
         controlCenter = ControlCenterWindowController(
             processClient: processClient,
             operations: operations,
-            notifications: notifications,
-            telegramService: residentTelegramService
+            notifications: notifications
         )
         statusItemController = StatusItemController(
             processClient: processClient,
@@ -53,9 +45,6 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
     }
 
     func applicationWillTerminate(_ notification: Notification) {
-        if telegramService?.stopAndWait(timeout: 2) == false {
-            fputs("SKS Telegram bounded stop timed out; liveness will become stale.\n", stderr)
-        }
         statusItemController?.stop()
         processClient?.terminateAll()
         singletonGuard.releaseRuntimeStateIfOwned()

package/dist/native/sks-menubar/Sources/ControlCenterWindowController.swift

@@ -11,8 +11,7 @@ final class ControlCenterWindowController: NSWindowController, NSTableViewDataSo
     init(
         processClient: ProcessClient,
         operations: OperationCoordinator,
-        notifications: NotificationCoordinator,
-        telegramService: TelegramMenuBarService
+        notifications: NotificationCoordinator
     ) {
         let overview = OverviewViewController(processClient: processClient, operations: operations)
         overviewController = overview
@@ -29,10 +28,7 @@ final class ControlCenterWindowController: NSWindowController, NSTableViewDataSo
             .updates: UpdatesViewController(processClient: processClient, operations: operations, notifications: notifications),
             .mcpServers: MCPServersViewController(processClient: processClient, operations: operations, notifications: notifications),
             .providers: ProvidersViewController(processClient: processClient, operations: operations),
-            .remoteCoding: RemoteCodingViewController(
-                processClient: processClient,
-                telegramService: telegramService
-            ),
+            .remoteCoding: RemoteCodingViewController(),
             .diagnostics: DiagnosticsViewController(processClient: processClient, operations: operations),
             .settings: SettingsViewController(notifications: notifications)
         ]