sneakoscope 8.2.0 → 8.3.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "8.2.0",
+  "version": "8.3.0",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -40,7 +40,8 @@
     "!dist/scripts/**",
     "dist/scripts/canonical-test-runner.js",
     "dist/scripts/desktop-bridge-transport-client.js",
-    "dist/scripts/{agent-guidance-dedup-check.js,agent-message-bus-reader-check.js,all-feature-deep-completion-check.js,appshots-thread-attachment-discovery-check.js,architecture-guard-check.js,certificate-sla-check.js,check-runtime-schemas.js,cli-output-consistency-check.js,codex-current-app-server-v2-check.js,codex-current-binary-identity-check.js,codex-current-capability-check.js,codex-current-core-real-probes-check.js,codex-current-manifest-check.js,codex-current-policy-check.js,codex-current-thread-store-check.js,codex-agent-role-rich-content-check.js,codex-agent-role-sync-check.js,codex-agent-type-routing-check.js,codex-app-execution-profile-check.js,codex-app-fast-ui-preservation-check.js,codex-app-handoff-check.js,codex-app-handoff-launch-check.js,codex-config-load-probe.js,context-graph-check.js,codex-control-all-pipelines-check.js,codex-control-event-stream-ledger-check.js,codex-control-tool-output-continuity-audit-check.js,desktop-bridge-transport-check.js,desktop-bridge-latency-check.js,desktop-bridge-capabilities-check.js,desktop-bridge-real-evidence-check.js,codex-native-agent-role-content-check.js,codex-native-feature-broker-blackbox.js,codex-native-feature-broker-check.js,codex-native-harness-compat-check.js,codex-native-hook-lifecycle-proof-check.js,codex-native-runtime-e2e-fixture.js,codex-plugin-app-template-policy-check.js,codex-sdk-all-pipelines-check.js,codex-sdk-backend-router-check.js,codex-sdk-capability-check.js,codex-sdk-event-stream-ledger-check.js,codex-sdk-real-smoke-check.js,concurrent-session-collision-check.js,context7-evidence-dedupe-check.js,core-skill-card-schema-check.js,core-skill-deployment-snapshot-check.js,core-skill-heldout-validation-check.js,core-skill-no-inference-optimizer-check.js,core-skill-patch-check.js,core-skill-route-runtime-integration-check.js,current-command-surface-check.js,current-surface-update-e2e-check.js,current-upgrade-matrix-check.js,desktop-bridge-unification-check.js,dfix-fixture-check.js,dfix-patch-handoff-check.js,dfix-verification-check.js,dfix-verification-recommendation-check.js,docs-truthfulness-check.js,doctor-codex-app-harness-check.js,doctor-fix-proves-codex-read-check.js,doctor-fixes-codex-app-fast-ui-check.js,evidence-flagship-coverage-check.js,fast-codex-service-tier-proof-check.js,fixtures/fake-codex-config-loader.js,gate-policy-audit-check.js,geo-claim-evidence-check.js,geo-cli-blackbox-check.js,geo-crawler-policy-check.js,git-worktree-checkpoint-check.js,git-worktree-cross-rebase-check.js,git-worktree-diff-envelope-check.js,git-worktree-dirty-lock-check.js,git-worktree-dirty-main-detection-check.js,git-worktree-integration-primary-check.js,git-worktree-manifest-append-check.js,git-worktree-untracked-diff-check.js,goal-artifact-compat-check.js,harness-benchmark-check.js,helper-dedup-check.js,hook-latency-budget-check.js,image-artifact-path-contract-check.js,imagegen-real-smoke-check.js,init-deep-backup-retention-check.js,installed-package-smoke-check.js,lib/codex-sdk-gate-lib.js,lib/ensure-dist-fresh.js,lib/git-worktree-fixture.js,lib/valid-png-fixture.js,local-collab-all-pipelines-final-gpt-check.js,loop-directive-check-lib.js,loop-integration-finalizer-check.js,loop-worker-fixture-child.js,mad-preflight-blocks-unreadable-config-check.js,mad-sks-app-ui-no-mutation-check.js}",
+    "dist/scripts/release-version-truth-check.js",
+    "dist/scripts/{agent-guidance-dedup-check.js,agent-message-bus-reader-check.js,all-feature-deep-completion-check.js,appshots-thread-attachment-discovery-check.js,architecture-guard-check.js,certificate-sla-check.js,check-runtime-schemas.js,cli-output-consistency-check.js,codex-current-app-server-v2-check.js,codex-current-binary-identity-check.js,codex-current-capability-check.js,codex-current-core-real-probes-check.js,codex-current-dependency-check.js,codex-current-policy-check.js,codex-current-thread-store-check.js,codex-agent-role-rich-content-check.js,codex-agent-role-sync-check.js,codex-agent-type-routing-check.js,codex-app-execution-profile-check.js,codex-app-fast-ui-preservation-check.js,codex-app-handoff-check.js,codex-app-handoff-launch-check.js,codex-config-load-probe.js,context-graph-check.js,codex-control-all-pipelines-check.js,codex-control-event-stream-ledger-check.js,codex-control-tool-output-continuity-audit-check.js,desktop-bridge-transport-check.js,desktop-bridge-latency-check.js,desktop-bridge-capabilities-check.js,desktop-bridge-real-evidence-check.js,codex-native-agent-role-content-check.js,codex-native-feature-broker-blackbox.js,codex-native-feature-broker-check.js,codex-native-harness-compat-check.js,codex-native-hook-lifecycle-proof-check.js,codex-native-runtime-e2e-fixture.js,codex-plugin-app-template-policy-check.js,codex-sdk-all-pipelines-check.js,codex-sdk-backend-router-check.js,codex-sdk-capability-check.js,codex-sdk-event-stream-ledger-check.js,codex-sdk-real-smoke-check.js,concurrent-session-collision-check.js,context7-evidence-dedupe-check.js,core-skill-card-schema-check.js,core-skill-deployment-snapshot-check.js,core-skill-heldout-validation-check.js,core-skill-no-inference-optimizer-check.js,core-skill-patch-check.js,core-skill-route-runtime-integration-check.js,current-command-surface-check.js,current-surface-update-e2e-check.js,current-upgrade-matrix-check.js,desktop-bridge-unification-check.js,dfix-fixture-check.js,dfix-patch-handoff-check.js,dfix-verification-check.js,dfix-verification-recommendation-check.js,docs-truthfulness-check.js,doctor-codex-app-harness-check.js,doctor-fix-proves-codex-read-check.js,doctor-fixes-codex-app-fast-ui-check.js,evidence-flagship-coverage-check.js,fast-codex-service-tier-proof-check.js,fixtures/fake-codex-config-loader.js,gate-policy-audit-check.js,geo-claim-evidence-check.js,geo-cli-blackbox-check.js,geo-crawler-policy-check.js,git-worktree-checkpoint-check.js,git-worktree-cross-rebase-check.js,git-worktree-diff-envelope-check.js,git-worktree-dirty-lock-check.js,git-worktree-dirty-main-detection-check.js,git-worktree-integration-primary-check.js,git-worktree-manifest-append-check.js,git-worktree-untracked-diff-check.js,goal-artifact-compat-check.js,harness-benchmark-check.js,helper-dedup-check.js,hook-latency-budget-check.js,image-artifact-path-contract-check.js,imagegen-real-smoke-check.js,init-deep-backup-retention-check.js,installed-package-smoke-check.js,lib/codex-sdk-gate-lib.js,lib/ensure-dist-fresh.js,lib/git-worktree-fixture.js,lib/valid-png-fixture.js,local-collab-all-pipelines-final-gpt-check.js,loop-directive-check-lib.js,loop-integration-finalizer-check.js,loop-worker-fixture-child.js,mad-preflight-blocks-unreadable-config-check.js,mad-sks-app-ui-no-mutation-check.js}",
     "dist/scripts/{latest-version-guidance-check.js,mad-sks-launch-sql-plane-boundary-check.js,mad-sks-sql-plane-capability-check.js,mad-sks-sql-plane-lifecycle-hook-decision-check.js,mad-sks-sql-plane-result-lifecycle-check.js,managed-config-merge-check.js,mcp-plugin-inventory-check.js,model-call-concurrency-check.js,mutation-callsite-analysis.js,mutation-callsite-coverage-check.js,naruto-ssot-gate-aliases-check.js,naruto-ssot-pipeline-default-check.js,naruto-ssot-route-normalization-check.js,naruto-ssot-routing-check.js,naruto-worktree-coding-blackbox.js,native-capability-repair-matrix-check.js,native-image-generation-repair-check.js,official-subagent-workflow-check.js,package-published-contract-check.js,packlist-performance-check.js,pipeline-codex-native-doctor-mad-routing-check.js,pipeline-codex-native-doctor-mad-routing-real-blackbox.js,pipeline-codex-native-image-routing-check.js,pipeline-codex-native-image-routing-real-blackbox.js,pipeline-codex-native-loop-routing-check.js,pipeline-codex-native-loop-routing-real-blackbox.js,pipeline-codex-native-qa-routing-check.js,pipeline-codex-native-qa-routing-real-blackbox.js,pipeline-codex-native-research-routing-check.js,pipeline-codex-native-research-routing-real-blackbox.js,ppt-full-e2e-blackbox-check.js,ppt-real-export-adapter-check.js,ppt-real-imagegen-smoke-check.js,ppt-real-imagegen-wiring-check.js,ppt-reexport-rereview-check.js,prepublish-fast-check.js,publish-preflight.js,prepublish-release-check-or-fast.js,probe-memoization-check.js,product-design-plugin-routing-check.js,prompt-placeholder-guard-check.js,proof-root-cause-policy-check.js,provider-badge-context-check.js,python-codex-sdk-all-pipelines-check.js,qa-loop-app-handoff-capability-check.js,qa-loop-app-handoff-check.js,qa-loop-app-handoff-cli-check.js,qa-loop-app-handoff-confirmation-check.js,qa-loop-app-handoff-gate-lifecycle-check.js,qa-loop-app-handoff-launch-check.js,qa-loop-app-handoff-status-lifecycle-check.js,qa-loop-budget-policy-check.js,qa-loop-effort-escalation-check.js,qa-loop-execution-profile-routing-check.js,qa-loop-image-path-exposure-check.js,qa-loop-image-path-prompt-injection-check.js,release-affected-selector-check.js,release-aggressive-resource-governor-check.js,release-cache-glob-hashing-check.js,release-cache-input-classifier-check.js,release-cache-neutralization-report-check.js,release-cache-version-neutral-fixture-check.js,release-check-stamp.js,release-dynamic-presets-check.js,release-full-parallelism-blackbox.js,release-gate-batch-runner-check.js,release-gate-budget-check.js,release-gate-dag-runner-check.js,release-gate-dag-runner.js,release-latency-slo-check.js,release-metadata-check.js,release-pack-receipt.js,release-parallel-speed-budget-check.js,release-physical-gates-check.js,release-proof-truth-check.js,release-provenance-check.js,release-real-check.js,release-runtime-truth-matrix-check.js,release-speed-summary.js,research-blueprint-densifier-check.js,research-claim-builder-check.js,research-complete-package-fixture-check.js,research-execution-profile-routing-check.js,research-final-reviewer-blackbox.js,responses-retry-policy-centralized-check.js,runtime-proof-summary-check.js,runtime-script-pack-closure-check.js,scheduler-batch-dispatch-check.js,scheduler-parallel-proof-consistency-check.js,scheduler-utilization-integral-check.js,search-visibility-gate-lib.js,secret-preservation-check.js,seo-audit-fixture-check.js,seo-cli-blackbox-check.js,seo-geo-geo-disambiguation-check.js,seo-geo-route-identity-check.js,seo-geo-skill-rich-content-check.js,seo-no-mutation-by-default-check.js,shared-memory-fixture-check.js,side-effect-runtime-report-check.js,skill-name-canonicalizer-check.js,skill-surface-modernization-check.js,skills-manifest-continuity-check.js,sks-cli-gate-lib.js}",
     "dist/scripts/{real-execution-check-lib.js,gate-lib.js,runtime-domain-gate-lib.js,typed-routing-gate-lib.js,codex-native-gate-lib.js,skill-fixture-check-lib.js,sks-uninstall-regression-check.js,sksd-daemon-check.js,super-search-provider-interface-check.js,triwiki-cache-key-check.js,triwiki-proof-bank-blackbox.js,triwiki-proof-bank-check.js,triwiki-proof-card-check.js,trust-fixture-check.js,type-surface-codex-app-check.js,ultra-router-auto-router-check.js,uninstall-inventory-check.js,install-surface-ssot-check.js,ux-review-extract-wires-real-extractor-check.js,ux-review-imagegen-blackbox-check.js,ux-review-patch-diff-recheck-check.js,ux-review-real-imagegen-smoke-check.js,ux-review-run-wires-imagegen-check.js,wrongness-fixture-check.js}",
     "dist/scripts/check-publish-tag.js",
@@ -54,8 +55,6 @@
     "!dist/core/proof/route-finalizer-fixtures.js",
     "!dist/core/release/npm-stage-tarball-verifier.js",
     "!dist/core/release/npm-stage-tarball-verifier-support.js",
-    "!dist/vendor/openai-codex/rust-v0.131.0",
-    "config/codex-releases/rust-v0.146.0.json",
     "config/installed-public-surface-closure.v1.json",
     "config/competitor-scorecard-baseline.json",
     "config/architecture-budgets.v1.json",
@@ -65,8 +64,6 @@
     "infra-harness-gates.json",
     "runtime-required-scripts.json",
     "schemas",
-    "!schemas/codex/app-server-*/**",
-    "schemas/codex/app-server-0.146/codex_app_server_protocol.v2.schemas.json",
     "crates/sks-core/Cargo.lock",
     "crates/sks-core/Cargo.toml",
     "crates/sks-core/src",
@@ -202,7 +199,7 @@
   "dependencies": {
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
-    "@openai/codex-sdk": "0.146.0",
+    "@openai/codex-sdk": "0.147.0",
     "smol-toml": "^1.7.0",
     "typescript": "^5.9.3"
   },

package/release-gates.v2.json

@@ -703,6 +703,43 @@
       ],
       "output_contract": "sks.gate-result.v2"
     },
+    {
+      "id": "release:version-truth",
+      "command": "node ./dist/scripts/release-version-truth-check.js",
+      "deps": [],
+      "resource": [
+        "cpu-light",
+        "fs-read"
+      ],
+      "side_effect": "hermetic",
+      "timeout_ms": 60000,
+      "cache": {
+        "enabled": false,
+        "inputs": [
+          "package.json",
+          "package-lock.json",
+          "plugins/sks/.codex-plugin/plugin.json",
+          "src/core/version.ts",
+          "src/core/fsx.ts",
+          "src/bin/sks.ts",
+          "crates/sks-core/Cargo.toml",
+          "crates/sks-core/Cargo.lock",
+          "dist/build-manifest.json",
+          "CHANGELOG.md",
+          "README.md",
+          "src/scripts/release-version-truth-check.ts"
+        ]
+      },
+      "isolation": {
+        "home": "temp",
+        "codex_home": "temp",
+        "report_dir": "per-gate"
+      },
+      "preset": [
+        "release"
+      ],
+      "output_contract": "sks.gate-result.v2"
+    },
     {
       "id": "install-surface:ssot",
       "command": "node ./dist/scripts/install-surface-ssot-check.js",
@@ -714,7 +751,7 @@
       "side_effect": "hermetic",
       "timeout_ms": 60000,
       "cache": {
-        "enabled": true,
+        "enabled": false,
         "inputs": [
           "package.json",
           "plugins/sks/.codex-plugin/plugin.json",
@@ -727,7 +764,7 @@
         "report_dir": "per-gate"
       },
       "preset": [
-        "confidence"
+        "release"
       ],
       "output_contract": "sks.gate-result.v2"
     },
@@ -1800,9 +1837,7 @@
           "src/core/codex-compat/**",
           "src/core/codex-runtime/**",
           "src/core/codex-app-server/**",
-          "config/codex-releases/**",
-          "schemas/codex-*.json",
-          "schemas/codex/**"
+          "schemas/codex-*.json"
         ]
       },
       "isolation": {
@@ -3768,8 +3803,8 @@
       "output_contract": "sks.gate-result.v2"
     },
     {
-      "id": "codex:current:manifest",
-      "command": "node ./dist/scripts/codex-current-manifest-check.js",
+      "id": "codex:current:dependency-graph",
+      "command": "node ./dist/scripts/codex-current-dependency-check.js",
       "deps": [],
       "resource": [
         "cpu-light",
@@ -3785,9 +3820,7 @@
           "release-gates.v2.json",
           "src/core/codex-control/**",
           "src/core/codex-compat/**",
-          "src/core/codex-runtime/**",
-          "config/codex-releases/**",
-          "schemas/codex/**"
+          "src/core/codex-runtime/**"
         ]
       },
       "isolation": {
@@ -3804,7 +3837,7 @@
       "id": "codex:current:binary-identity",
       "command": "node ./dist/scripts/codex-current-binary-identity-check.js",
       "deps": [
-        "codex:current:manifest"
+        "codex:current:dependency-graph"
       ],
       "resource": [
         "cpu-light",
@@ -3837,7 +3870,7 @@
       "id": "codex:current:policy",
       "command": "node ./dist/scripts/codex-current-policy-check.js",
       "deps": [
-        "codex:current:manifest"
+        "codex:current:dependency-graph"
       ],
       "resource": [
         "cpu-light",
@@ -3868,7 +3901,7 @@
       "id": "codex:current:app-server-v2",
       "command": "node ./dist/scripts/codex-current-app-server-v2-check.js",
       "deps": [
-        "codex:current:manifest"
+        "codex:current:dependency-graph"
       ],
       "resource": [
         "cpu-light",
@@ -3883,7 +3916,6 @@
           "release-gates.v2.json",
           "src/core/codex-control/**",
           "src/core/codex-compat/**",
-          "schemas/codex/app-server-0.146/**",
           "src/scripts/codex-current-app-server-v2-check.ts"
         ]
       },
@@ -3901,7 +3933,7 @@
       "id": "codex:current:thread-store",
       "command": "node ./dist/scripts/codex-current-thread-store-check.js",
       "deps": [
-        "codex:current:manifest"
+        "codex:current:dependency-graph"
       ],
       "resource": [
         "cpu-light",
@@ -3932,7 +3964,7 @@
       "id": "codex:current:capability",
       "command": "node ./dist/scripts/codex-current-capability-check.js",
       "deps": [
-        "codex:current:manifest",
+        "codex:current:dependency-graph",
         "codex:current:binary-identity",
         "codex:current:app-server-v2"
       ],
@@ -3950,9 +3982,7 @@
           "release-gates.v2.json",
           "src/core/codex-control/**",
           "src/core/codex-compat/**",
-          "src/core/codex-runtime/**",
-          "config/codex-releases/**",
-          "schemas/codex/app-server-0.146/**"
+          "src/core/codex-runtime/**"
         ]
       },
       "isolation": {

package/config/codex-releases/rust-v0.146.0.json

@@ -1,45 +0,0 @@
-{
-  "schema": "sks.codex-release-manifest.v1",
-  "targetTag": "rust-v0.146.0",
-  "requiredCliVersion": "0.146.0",
-  "preferredCliVersion": "0.146.0",
-  "sdkVersion": "0.146.0",
-  "minimumSupportedVersion": "0.146.0",
-  "narutoCapabilityFloorVersion": "0.146.0",
-  "protocolMode": "app-server-v2",
-  "generatedSchemaSha256": "2be4fd32103409b5b4864daaf429f6b61a5e55eb98ca5f63cd43569556b009c8",
-  "upstreamCommit": "rust-v0.146.0",
-  "featurePolicies": {
-    "multiAgentMode": "delegate",
-    "multiAgentV2": "delegate",
-    "agentsMaxConcurrentThreads": "delegate",
-    "indexedWebSearch": "probe",
-    "currentTimeRead": "wrap",
-    "threadListSearchRead": "probe",
-    "pluginCatalogRefresh": "probe",
-    "terminalSubagentErrorPropagation": "probe",
-    "execMcpTransientRecovery": "probe",
-    "remoteNativeEnvironment": "probe",
-    "rolloutTokenBudget": "probe",
-    "mcpStartupToolTimeouts": "wrap",
-    "gpt56TerraLunaSolRouting": "delegate"
-  },
-  "requiredRealProbes": [
-    "runtime_identity",
-    "protocol_schema_generation",
-    "multi_agent_mode_schema",
-    "indexed_web_search_schema",
-    "current_time_read_schema",
-    "thread_list_search_schema",
-    "terminal_error_schema",
-    "rollout_budget_schema"
-  ],
-  "supportedPlatforms": [
-    "darwin-arm64",
-    "darwin-x64",
-    "linux-arm64",
-    "linux-x64",
-    "win32-arm64",
-    "win32-x64"
-  ]
-}

package/dist/core/agents/agent-runner-codex-exec.js

@@ -1,177 +0,0 @@
-import path from 'node:path';
-import { packageRoot, readJson, runProcess, writeJsonAtomic } from '../fsx.js';
-import { managedProxyEnvForChild } from '../codex/managed-proxy-env.js';
-import { agentWorkerEnv, validateAgentWorkerResult } from './agent-worker-pipeline.js';
-import { fastModeEnv, resolveFastModePolicy } from './fast-mode-policy.js';
-import { buildCodexExecArgs } from '../codex/codex-cli-syntax-builder.js';
-import { desktopBridgeLaunchBlockedProcessResult, withDesktopBridgeCliLaunchGuard } from '../codex-control/desktop-bridge-launch-guard.js';
-import { prepareCodexAppServerRuntimeEnv } from '../codex-control/codex-app-server-runtime-env.js';
-export function buildCodexExecAgentArgs(agent, prompt, opts = {}) {
-    const resultFile = opts.resultFile || defaultCodexResultFile(agent, opts);
-    const sandbox = opts.workspaceWrite ? 'workspace-write' : 'read-only';
-    const noMcp = workerNoMcpDefault(agent, opts, sandbox);
-    const args = buildCodexExecArgs({
-        json: true,
-        outputSchema: opts.schemaFile || path.join(packageRoot(), 'schemas/codex/agent-result.schema.json'),
-        outputLastMessage: resultFile,
-        ephemeral: true,
-        skipGitRepoCheck: opts.skipGitRepoCheck !== false,
-        profile: opts.profile ? String(opts.profile) : null,
-        ignoreUserConfig: !opts.profile,
-        noMcp,
-        ignoreRules: true,
-        sandbox,
-        serviceTier: opts.serviceTier || (opts.fastMode === false ? 'standard' : 'fast'),
-        prompt
-    });
-    return {
-        resultFile,
-        args
-    };
-}
-function codexArgsIncludeServiceTier(args, serviceTier) {
-    return args.includes('-c') && args.includes(`service_tier=${serviceTier}`);
-}
-function defaultCodexResultFile(agent, opts = {}) {
-    const root = opts.agentRoot || opts.cwd || process.cwd();
-    const artifactDir = agent.session_artifact_dir || path.join('sessions', agent.id || agent.session_id || 'agent');
-    return path.join(root, artifactDir, 'agent-result.json');
-}
-export async function runCodexExecAgent(agent, slice, opts = {}) {
-    const fastPolicy = resolveFastModePolicy({ fastMode: opts.fastMode ?? agent.fast_mode, serviceTier: opts.serviceTier ?? agent.service_tier });
-    if (opts.outputSchemaSupported === false) {
-        return validateAgentWorkerResult({ mission_id: opts.missionId || opts.mission_id || '', agent_id: agent.id, session_id: agent.session_id, persona_id: agent.persona_id || agent.id, task_slice_id: slice?.id || '', status: 'blocked', backend: 'codex-exec', summary: 'Codex exec output schema support was not verified.', artifacts: [], blockers: ['codex_exec_output_schema_unsupported'], unverified: [], writes: [], source_intelligence_refs: agent.source_intelligence_refs || null, goal_mode_ref: agent.goal_mode_ref || null });
-    }
-    if (opts.dryRun !== false) {
-        const command = buildCodexExecAgentArgs(agent, opts.prompt || slice?.description || '', opts);
-        const proxyEnv = managedProxyEnvForChild({ ...process.env, ...(opts.env || {}) });
-        const report = await writeCodexProcessReport(opts.agentRoot || opts.cwd || process.cwd(), agent, {
-            project_hash: opts.projectHash || agent.project_hash || agent.root_hash || null,
-            command: [opts.codexBin || 'codex', ...command.args],
-            profile: opts.profile || null,
-            result_file: command.resultFile,
-            service_tier: fastPolicy.service_tier,
-            fast_mode: fastPolicy.fast_mode,
-            service_tier_passed_to_codex: codexArgsIncludeServiceTier(command.args, fastPolicy.service_tier),
-            service_tier_cli_override_present: codexArgsIncludeServiceTier(command.args, fastPolicy.service_tier),
-            no_mcp: command.args.includes('--no-mcp'),
-            output_schema_used: command.args.includes('--output-schema'),
-            output_last_message_path: command.resultFile,
-            agent_worker_env_injected: false,
-            recursion_guard_env: false,
-            managed_proxy_env_keys: Object.keys(proxyEnv).sort(),
-            pid: null,
-            exit_code: null,
-            stdout_log: null,
-            stderr_log: null,
-            dry_run: true
-        });
-        return validateAgentWorkerResult({ mission_id: opts.missionId || opts.mission_id || '', agent_id: agent.id, session_id: agent.session_id, persona_id: agent.persona_id || agent.id, task_slice_id: slice?.id || '', status: 'done', backend: 'codex-exec', summary: 'Codex exec command prepared for ' + agent.id + '.', findings: ['codex exec command prepared'], proposed_changes: [], changed_files: [], lease_compliance: { ok: true, violations: [] }, artifacts: [command.resultFile, report], blockers: [], confidence: 'verified_partial', handoff_notes: 'Dry-run did not launch Codex exec.', unverified: ['codex-exec dry-run command was not launched'], writes: [], source_intelligence_refs: agent.source_intelligence_refs || null, goal_mode_ref: agent.goal_mode_ref || null, verification: { status: 'dry_run', checks: ['codex-exec-args-built'] } });
-    }
-    const command = buildCodexExecAgentArgs(agent, opts.prompt || slice?.description || '', opts);
-    const logRoot = path.join(opts.agentRoot || opts.cwd || process.cwd(), agent.session_artifact_dir || path.join('sessions', agent.id));
-    const stdoutFile = path.join(logRoot, 'codex-exec.stdout.log');
-    const stderrFile = path.join(logRoot, 'codex-exec.stderr.log');
-    const allowedCommandsFile = path.join(opts.agentRoot || opts.cwd || process.cwd(), 'agent-allowed-commands.json');
-    const workerEnv = agentWorkerEnv(agent, allowedCommandsFile);
-    const effectiveEnv = { ...process.env, ...(opts.env || {}) };
-    const runtimeEnv = await prepareCodexAppServerRuntimeEnv({ env: effectiveEnv });
-    const proxyEnv = managedProxyEnvForChild(runtimeEnv);
-    const execute = opts.runProcessImpl || runProcess;
-    const guarded = await withDesktopBridgeCliLaunchGuard({
-        root: opts.cwd || process.cwd(),
-        env: runtimeEnv,
-        cliArgs: command.args.slice(0, -1)
-    }, (sanitizedEnv) => execute(opts.codexBin || 'codex', command.args, { cwd: opts.cwd || process.cwd(), env: { ...sanitizedEnv, ...proxyEnv, ...fastModeEnv(fastPolicy), ...workerEnv }, timeoutMs: opts.timeoutMs || 30 * 60 * 1000, maxOutputBytes: 256 * 1024, stdoutFile, stderrFile }));
-    const result = guarded.launched
-        ? guarded.value
-        : desktopBridgeLaunchBlockedProcessResult(guarded.desktopBridgeLaunchGuard);
-    const report = await writeCodexProcessReport(opts.agentRoot || opts.cwd || process.cwd(), agent, {
-        project_hash: opts.projectHash || agent.project_hash || agent.root_hash || null,
-        command: [opts.codexBin || 'codex', ...command.args],
-        profile: opts.profile || null,
-        result_file: command.resultFile,
-        service_tier: fastPolicy.service_tier,
-        fast_mode: fastPolicy.fast_mode,
-        service_tier_passed_to_codex: codexArgsIncludeServiceTier(command.args, fastPolicy.service_tier),
-        service_tier_cli_override_present: codexArgsIncludeServiceTier(command.args, fastPolicy.service_tier),
-        no_mcp: command.args.includes('--no-mcp'),
-        output_schema_used: command.args.includes('--output-schema'),
-        output_last_message_path: command.resultFile,
-        agent_worker_env_injected: Object.keys(workerEnv).length > 0,
-        recursion_guard_env: Boolean(workerEnv.SKS_AGENT_SESSION_ID),
-        managed_proxy_env_keys: Object.keys(proxyEnv).sort(),
-        pid: result.pid || null,
-        exit_code: result.code,
-        stdout_log: path.relative(opts.agentRoot || opts.cwd || process.cwd(), stdoutFile),
-        stderr_log: path.relative(opts.agentRoot || opts.cwd || process.cwd(), stderrFile),
-        stdout_tail: result.stdout,
-        stderr_tail: result.stderr,
-        stdout_bytes: result.stdoutBytes,
-        stderr_bytes: result.stderrBytes,
-        truncated: result.truncated,
-        timed_out: result.timedOut,
-        desktop_bridge_launch_guard: guarded.desktopBridgeLaunchGuard,
-        dry_run: false
-    });
-    if (result.code === 0) {
-        const parsed = await readJson(command.resultFile, null).catch(() => null);
-        if (parsed) {
-            const validated = validateAgentWorkerResult({
-                ...parsed,
-                mission_id: parsed.mission_id || opts.missionId || opts.mission_id || '',
-                agent_id: parsed.agent_id || agent.id,
-                session_id: parsed.session_id || agent.session_id,
-                persona_id: parsed.persona_id || agent.persona_id || agent.id,
-                task_slice_id: parsed.task_slice_id || slice?.id || '',
-                backend: 'codex-exec',
-                patch_envelopes: normalizeCodexRuntimePatchEnvelopes(parsed.patch_envelopes, { childPid: Number.isFinite(Number(result.pid)) ? Number(result.pid) : null, workerPid: process.pid, fastPolicy }),
-                source_intelligence_refs: parsed.source_intelligence_refs || agent.source_intelligence_refs || null,
-                goal_mode_ref: parsed.goal_mode_ref || agent.goal_mode_ref || null,
-                artifacts: [...(Array.isArray(parsed.artifacts) ? parsed.artifacts : []), command.resultFile, report],
-                verification: { status: parsed.verification?.status || 'passed', checks: [...(Array.isArray(parsed.verification?.checks) ? parsed.verification.checks : []), 'codex-exec-output-last-message', 'agent-result-schema'] }
-            });
-            if (!validated.blockers.some((blocker) => blocker.startsWith('schema_invalid:')))
-                return validated;
-            return { ...validated, status: 'blocked', blockers: [...validated.blockers, 'codex_exec_result_schema_invalid'] };
-        }
-    }
-    return validateAgentWorkerResult({ mission_id: opts.missionId || opts.mission_id || '', agent_id: agent.id, session_id: agent.session_id, persona_id: agent.persona_id || agent.id, task_slice_id: slice?.id || '', status: result.code === 0 ? 'done' : 'failed', backend: 'codex-exec', summary: result.stdout.slice(-1000) || result.stderr.slice(-1000), artifacts: [command.resultFile, report], blockers: result.code === 0 ? ['codex_exec_output_last_message_missing_or_invalid'] : [...(guarded.launched ? [] : guarded.desktopBridgeLaunchGuard.blockers), 'codex_exec_exit_' + result.code], confidence: 'verified_partial', unverified: result.code === 0 ? ['codex-exec stdout fallback; resultFile JSON missing or invalid'] : [], writes: [], source_intelligence_refs: agent.source_intelligence_refs || null, goal_mode_ref: agent.goal_mode_ref || null, codex_child_report: { desktop_bridge_launch_guard: guarded.desktopBridgeLaunchGuard }, verification: { status: result.code === 0 ? 'partial' : 'failed', checks: ['codex-exec-exit-code', 'codex-exec-process-report', 'codex-exec-output-last-message'] } });
-}
-function workerNoMcpDefault(agent, opts = {}, sandbox = 'read-only') {
-    if (opts.noMcp !== undefined)
-        return opts.noMcp !== false;
-    if (sandbox === 'read-only')
-        return true;
-    const roleText = [
-        agent?.role,
-        agent?.persona_id,
-        agent?.required_role,
-        agent?.kind,
-        opts.role,
-        opts.kind
-    ].map((value) => String(value || '')).join(' ');
-    if (/\b(?:verify|verifier|verification|review|reviewer|qa|audit|read[-_ ]?only)\b/i.test(roleText))
-        return true;
-    const safeList = Array.isArray(opts.workerSafeMcpServers)
-        ? opts.workerSafeMcpServers
-        : String(process.env.SKS_WORKER_SAFE_MCP_SERVERS || '').split(',').map((item) => item.trim()).filter(Boolean);
-    return !(opts.allowWorkerMcp === true && safeList.length > 0);
-}
-async function writeCodexProcessReport(root, agent, report) {
-    const rel = path.join(agent.session_artifact_dir || path.join('sessions', agent.id), 'agent-process-report.json');
-    await writeJsonAtomic(path.join(root, rel), { schema: 'sks.agent-process-report.v1', backend: 'codex-exec', agent_id: agent.id, session_id: agent.session_id, service_tier: report.service_tier || agent.service_tier || 'fast', fast_mode: report.fast_mode !== false, ...report });
-    return rel;
-}
-function normalizeCodexRuntimePatchEnvelopes(envelopes, input) {
-    if (!Array.isArray(envelopes))
-        return envelopes;
-    return envelopes.map((envelope) => ({
-        ...envelope,
-        source: 'model_authored',
-        ...(Number.isFinite(Number(input.childPid)) ? { backend_child_process_id: Number(input.childPid) } : {}),
-        ...(Number.isFinite(Number(input.workerPid)) ? { worker_process_id: Number(input.workerPid), native_cli_process_id: Number(input.workerPid) } : {}),
-        fast_mode: input.fastPolicy.fast_mode,
-        service_tier: input.fastPolicy.service_tier
-    }));
-}

package/dist/core/codex-compat/codex-release-manifest.js

@@ -1,72 +0,0 @@
-import path from 'node:path';
-import { packageRoot, readJson, readText, sha256 } from '../fsx.js';
-export const CODEX_RELEASE_MANIFEST_SCHEMA = 'sks.codex-release-manifest.v1';
-export const CURRENT_CODEX_RELEASE_MANIFEST = {
-    schema: CODEX_RELEASE_MANIFEST_SCHEMA,
-    targetTag: 'rust-v0.146.0',
-    requiredCliVersion: '0.146.0',
-    preferredCliVersion: '0.146.0',
-    sdkVersion: '0.146.0',
-    minimumSupportedVersion: '0.146.0',
-    narutoCapabilityFloorVersion: '0.146.0',
-    protocolMode: 'app-server-v2',
-    generatedSchemaSha256: '2be4fd32103409b5b4864daaf429f6b61a5e55eb98ca5f63cd43569556b009c8',
-    upstreamCommit: 'rust-v0.146.0',
-    featurePolicies: {
-        multiAgentMode: 'delegate',
-        multiAgentV2: 'delegate',
-        agentsMaxConcurrentThreads: 'delegate',
-        indexedWebSearch: 'probe',
-        currentTimeRead: 'wrap',
-        threadListSearchRead: 'probe',
-        pluginCatalogRefresh: 'probe',
-        terminalSubagentErrorPropagation: 'probe',
-        execMcpTransientRecovery: 'probe',
-        remoteNativeEnvironment: 'probe',
-        rolloutTokenBudget: 'probe',
-        mcpStartupToolTimeouts: 'wrap',
-        gpt56TerraLunaSolRouting: 'delegate'
-    },
-    requiredRealProbes: [
-        'runtime_identity',
-        'protocol_schema_generation',
-        'multi_agent_mode_schema',
-        'indexed_web_search_schema',
-        'current_time_read_schema',
-        'thread_list_search_schema',
-        'terminal_error_schema',
-        'rollout_budget_schema'
-    ],
-    supportedPlatforms: [
-        'darwin-arm64',
-        'darwin-x64',
-        'linux-arm64',
-        'linux-x64',
-        'win32-arm64',
-        'win32-x64'
-    ]
-};
-export const NARUTO_REQUIRED_CODEX_VERSION = CURRENT_CODEX_RELEASE_MANIFEST.narutoCapabilityFloorVersion;
-export function currentCodexReleaseManifestPath(root = packageRoot()) {
-    return path.join(root, 'config', 'codex-releases', `${CURRENT_CODEX_RELEASE_MANIFEST.targetTag}.json`);
-}
-export async function loadCurrentCodexReleaseManifest(root = packageRoot()) {
-    return await readJson(currentCodexReleaseManifestPath(root));
-}
-export async function codexReleaseManifestParity(root = packageRoot()) {
-    const file = await loadCurrentCodexReleaseManifest(root);
-    const mismatches = [];
-    for (const key of Object.keys(CURRENT_CODEX_RELEASE_MANIFEST)) {
-        if (JSON.stringify(file[key]) !== JSON.stringify(CURRENT_CODEX_RELEASE_MANIFEST[key])) {
-            mismatches.push(String(key));
-        }
-    }
-    const text = await readText(currentCodexReleaseManifestPath(root));
-    return {
-        ok: mismatches.length === 0,
-        mismatches,
-        manifest: file,
-        manifest_path: currentCodexReleaseManifestPath(root),
-        manifest_sha256: sha256(text)
-    };
-}