sneakoscope 8.2.1 → 8.3.0

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 8.2.1** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 8.3.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 
@@ -30,7 +30,6 @@ Use the official latest stable SKS and Codex CLI releases. The Codex compatibili
 
 | Problem | 8.2.0 behavior |
 | --- | --- |
-| SKS Center could reject a valid token for a user-selected BotFather bot with only a generic verification message | Setup accepts any bot the user owns, binds the exact `getMe` identity, returns actionable verification failures, and keeps native/CLI liveness receipts schema-compatible. |
 | Overview mixed Menu Bar, installed SKS, and cached registry versions | Each value is labeled by authority, stale or unavailable probes remain explicit, and Refresh forces a bounded update-status refresh. |
 | Naruto stopped creating children after its first wave | The root parent records settled waves, recovers open-thread capacity, rescans the ready DAG, and can launch later direct-child waves under the same workflow run. |
 | Most delegated work drifted to Sol Max | Read-heavy discovery uses Terra Max, ordinary implementation uses Sol High, and Sol Max is reserved for focused high-risk or final judgment slices. |
@@ -72,111 +71,49 @@ The SKS menu bar shows the installed Codex CLI version and latest known version.
 
 **Manage MCP Servers…** opens a native macOS manager for the global `~/.codex/config.toml`. It can add remote URL or local stdio servers, enable/disable existing entries, remove entries after confirmation, and refresh the current state. Mutations are lock-protected, backed up, TOML-validated, and written with mode `0600`; configured environment values and command arguments are never rendered in the list. Changes apply to new Codex sessions. The same plumbing is available through the canonical `sks mcp config list|get|add|edit|duplicate|enable|disable|remove|test|login|logout|backups|restore` surface for diagnostics and automation.
 
-### Remote control: Telegram BotFather integration
-
-SKS provides a first-party Telegram Bot API transport for the existing
-typed remote-control contract. A bounded outbound `getUpdates` loop runs only
-inside the resident Menu Bar process: it opens no inbound port, tunnel, daemon,
-or public webhook.
-
-#### BotFather setup
-
-1. In Telegram, open **@BotFather** and create a bot with `/newbot`, or select
-   any existing bot that you own. Copy that bot's token. SKS does not assume a
-   fixed bot name or username: it verifies the token with `getMe` and binds the
-   returned bot identity. Treat the token like a password. Do not place it in
-   a shell command, config file, commit, issue, or screenshot.
-2. On the Mac that runs SKS, open **SKS Center → Remote Coding**, choose
-   **Enter Bot Token…**, and paste the token into the native secure-input
-   sheet. SKS verifies `getMe` and the bot's webhook state before it stores
-   anything. If a webhook is active, the token is not retained and Center asks
-   for explicit consent before removing that webhook without dropping pending
-   updates.
-
-   For a terminal-only setup, use a no-echo `zsh` prompt and pipe the token on
-   standard input; direct interactive TTY input is intentionally rejected:
-
-   ```sh
-   IFS= read -r -s "sks_telegram_token?BotFather token: "
-   printf '\n'
-   printf '%s\n' "$sks_telegram_token" | sks telegram setup --token-stdin
-   unset sks_telegram_token
-   ```
-
-   If that command reports an existing webhook, review the delivery change and
-   repeat the same no-echo flow with `--remove-webhook`. This is explicit
-   consent to stop the old webhook endpoint; SKS always requests
-   `drop_pending_updates=false`. The token travels only on standard input, is
-   verified with Telegram before storage, is never printed, and is stored in
-   the owner-only user secret file. A token supplied by `TELEGRAM_BOT_TOKEN` or
-   `SKS_TELEGRAM_BOT_TOKEN` is also supported for an operator-managed runtime,
-   but environment values can be exposed to other local processes and are not
-   the recommended setup path. SKS Center restarts its resident poller after a
-   successful save; if that restart reports a blocker, resolve it before
-   generating or sending a pairing code.
-3. For terminal-only setup, restart the resident Menu Bar process immediately
-   after setup (and after any webhook removal or token rotation). The poller
-   must be running before it can consume and confirm `/start`:
-
-   ```sh
-   sks menubar restart
-   ```
-
-   There is deliberately no `sks telegram start` or `sks telegram stop`:
-   Telegram is not a separate daemon. SKS Center exposes **Start**, **Stop**,
-   and **Restart** for the poller owned by the current resident Menu Bar
-   process. **Stop** preserves the token and pairings and lasts only until that
-   companion is relaunched. To keep Telegram stopped across relaunches, stop or
-   uninstall the entire Menu Bar companion; that also disables its other
-   resident features.
-4. Issue a short-lived pairing code with `sks telegram pair`:
-
-   ```sh
-   sks telegram pair --json
-   ```
-
-   From the one intended **private** chat, send the returned
-   `/start <pairing-code>` message to the bot before it expires. Only that
-   private chat/user pair is enrolled. Unpaired chats receive no reply.
-5. After the bot confirms pairing, send a typed command such as:
-
-   ```text
-   /sks status {}
-   ```
-
-   The command grammar is `/sks <command> <JSON object>`; the JSON object may
-   be omitted when the command needs no options. The allowlist is `gates`,
-   `paths`, `pipeline`, `proof`, `search`, `stats`, `status`, `stop-gate`,
-   `trust`, `update-check`, and `validate-artifacts`. If SKS replies with a
-   short-lived confirmation nonce, send the exact `/confirm <nonce>` message
-   once before it expires. Arbitrary prose and free-form shell commands are not
-   executed.
-6. Confirm runtime evidence:
-
-   ```sh
-   sks telegram status --json
-   sks telegram doctor --json
-   sks doctor
-   ```
-
-   `status` reads the secret-free liveness receipt. `telegram doctor` evaluates
-   token presence, the bot identity, pairing, audit health, poller state, and
-   liveness. A ready result requires a real `getMe` check, a paired private
-   chat, and a running poller; a configured token alone is not readiness.
-
-The transport accepts only allowlisted typed commands. It never accepts
-free-form shell input; higher-risk commands require actor-bound two-step
-confirmation and an audit receipt. Telegram long polling and a webhook cannot
-be active together. If Doctor reports a webhook/409 conflict, enter the token
-again in SKS Center and approve webhook removal, or repeat the no-echo CLI
-setup with `--remove-webhook`, then restart the poller. SKS never drops pending
-updates during that transition.
-
-If a token may have leaked, revoke/regenerate it in BotFather, enter the
-replacement through SKS Center (or the no-echo CLI flow), and restart the
-poller. Token rotation and BotFather credential changes are external actions;
-SKS does not publish packages, revoke tokens, or make any other irreversible
-remote change on the operator's behalf.
+### Recommended remote companion: Paseo
+
+For remote and cross-device coding, Sneakoscope officially recommends
+[Paseo](https://paseo.sh/docs). Start with the Paseo desktop app. For a
+headless machine, install and launch the official CLI:
+
+```sh
+npm install -g @getpaseo/cli
+paseo
+```
+
+Install and authenticate Codex CLI before using it through Paseo. Paseo runs
+the existing provider CLI, so your Codex subscription, configuration, skills,
+and MCP servers remain owned by Codex rather than copied into Sneakoscope.
+
+From this repository, start Codex in the current workspace with:
+
+```sh
+paseo run --provider codex "Review this repository"
+```
+
+For an isolated branch-backed worktree based on `main`, use:
+
+```sh
+paseo run --new-workspace worktree --worktree-mode branch-off --new-branch paseo-task --base main "Implement the task"
+```
+
+The committed `paseo.json` prepares each new worktree with
+`npm ci --ignore-scripts` followed by `npm run build:clean`. It also exposes
+these named repository actions through Paseo:
+
+| Paseo script | Repository command |
+| --- | --- |
+| `build` | `npm run build` |
+| `typecheck` | `npm run typecheck` |
+| `test` | `npm run test` |
+| `release-check` | `npm run release:check:affected` |
+| `release-confidence` | `npm run release:check:confidence` |
+
+Paseo is an independent project, not bundled with or operated by Sneakoscope.
+Sneakoscope maintains only this repository's `paseo.json` and usage guidance;
+Paseo installation, authentication, pairing, relay operation, security, and
+product support remain with Paseo and its official documentation.
 
 ## The Front Door
 
@@ -389,8 +326,8 @@ It shows the current quickstart flow: one-line install, `$sks-plan`, `sks review
 - Native capability repair: `sks doctor --fix` (imagegen/Computer Use/Browser Use), `.sneakoscope/reports/native-capability-readiness.json`
 - Desktop Bridge: `sks bridge status --json`, `sks bridge route explain <model> --json`, and `sks bridge verify --level transport --json` report service, explicit routing, and staged transport truth. A configured profile or catalog is not routing proof, and a missing route never silently falls back.
 - Agent bridge for any agent system: `sks mcp-server`, `sks agent-bridge setup`, `SKS_AGENT_MODE=1` — see [docs/AGENT-BRIDGE.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/AGENT-BRIDGE.md)
-- Release gates: `npm run release:check:affected` for ordinary change-aware verification and `npm run release:check:confidence` for the final local confidence pass. Release claims still require target-bound real evidence for macOS lifecycle, OAuth preservation, both provider profiles, WebSocket protocol/frame truth, and deep artifacts; documentation and fixtures do not satisfy those gates.
-- Direct npm publication: run `npm run release:check:full` (it creates the current clean-HEAD pack receipt), then publish from a clean `main` checkout that exactly matches `origin/main`. The Git release tag may be created afterward, and stage-only physical receipts do not block this direct path. The staged/OIDC workflow still requires all five source-bound physical receipts, exact tag proof, and its authenticated review gates.
+- Release gates: `npm run release:check:affected` for ordinary change-aware verification and `npm run release:check:confidence` for the final local confidence pass. Release claims still require target-bound real evidence for macOS lifecycle, OAuth preservation, both provider profiles, WebSocket protocol/frame truth, and deep artifacts; Paseo installation or pairing is not SKS release evidence, and documentation and fixtures do not satisfy protected gates.
+- Direct npm publication: run `npm run release:check:full` (it creates the current clean-HEAD pack receipt), then publish from a clean `main` checkout that exactly matches `origin/main`. The Git release tag may be created afterward, and stage-only physical receipts do not block this direct path. The staged/OIDC workflow still requires all four source-bound physical receipts, exact tag proof, and its authenticated review gates.
 - Release evidence boundaries: [docs/release-readiness.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/release-readiness.md), [docs/release-proof-truth.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/release-proof-truth.md), and [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md). Local configuration, fixtures, and diagnostics are not live release proof.
 - Image generation review routes require Codex App `$imagegen`/`gpt-image-2` evidence with recorded output hashes; direct API fallback and mock fixtures do not satisfy full route gates.
 
@@ -408,7 +345,6 @@ It shows the current quickstart flow: one-line install, `$sks-plan`, `sks review
   - The provider services remain independently operated. SKS never deploys them, changes remote credentials, or silently substitutes one profile for another.
   - Full release proof remains `not-run-real` until fresh target-bound evidence covers the real Desktop service/UI, OAuth preservation, both provider profiles, staged WebSocket verification, and each claimed deep artifact.
   - Update installs stop and verify every prior Menu Bar process before replacement, rebuild the companion from the newly installed SKS package, bootstrap it, and require exactly one running process whose version probe equals the current package version.
-  - Telegram remote control uses one bounded long-poller inside that same Menu Bar process. Release evidence must include a real cellular command/reply round trip; `getMe`, a local fixture, or a configured token alone cannot satisfy the E2E gate.
   - The menubar dropdown's `View Last Log` item opens the most recent background action's log file, so you don't need to keep a Terminal window open to see command output.
   - `Manage MCP Servers…` provides a resizable native table and add/remove/enable/disable controls for global Codex MCP configuration. Secret environment values and command arguments are accepted through native dialogs/stdin but omitted from list output and logs.
   - `sks menubar status --json` reports a `codex_sync` object with `bundle_id`, `codex_running`, and `icon_visible_expected` to show Codex-lifecycle detection state.

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "8.2.1"
+version = "8.3.0"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "8.2.1"
+version = "8.3.0"
 edition = "2021"
 
 [dependencies]

package/dist/cli/command-manifest-lite.js

@@ -39,7 +39,6 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'bridge', summary: 'Manage the single Desktop Bridge runtime, provider profiles, catalog, and routes', maturity: 'beta', skipMigrationGate: true },
     { name: 'menubar', summary: 'Inspect/install/restart/uninstall SKS menu bar', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
     { name: 'remote', summary: 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', maturity: 'beta' },
-    { name: 'telegram', summary: 'Pair and inspect the Telegram remote-control transport', maturity: 'beta', skipMigrationGate: true },
     { name: 'hooks', summary: 'Explain and inspect Codex hooks', maturity: 'beta', skipMigrationGate: true },
     { name: 'mad-sks', summary: 'MAD-SKS scoped permission modifier + SQL-plane execution', maturity: 'beta', mutatesRouteState: true },
     { name: 'auto-review', summary: 'Manage auto-review profile', maturity: 'beta' },
@@ -167,7 +166,6 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
         requiredCapabilities: ['proof.stop-gate']
     },
     task: { risk: 'R1', latency: 'long' },
-    telegram: { risk: 'R2', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     trust: {
         risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'trust', requiredCapabilities: ['proof.trust']
     },

package/dist/cli/command-registry.js

@@ -187,7 +187,6 @@ const COMMAND_DEFINITIONS = {
     bridge: skipMigrationGate(entry('beta', 'Manage the single Desktop Bridge runtime, provider profiles, catalog, and routes', 'dist/commands/bridge.js', directCommand(() => import('../commands/bridge.js'), 'dist/commands/bridge.js'))),
     menubar: activeRouteDiagnostic(entry('beta', 'Inspect/install/restart/uninstall SKS menu bar', 'dist/core/commands/menubar-command.js', subcommand(() => import('../core/commands/menubar-command.js'), 'menubarCommand', 'dist/core/commands/menubar-command.js', 'status'))),
     remote: entry('beta', 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', 'dist/core/commands/remote-command.js', argsCommand(() => import('../core/commands/remote-command.js'), 'remoteCommand', 'dist/core/commands/remote-command.js')),
-    telegram: skipMigrationGate(entry('beta', 'Pair and inspect the Telegram remote-control transport', 'dist/core/commands/telegram-command.js', argsCommand(() => import('../core/commands/telegram-command.js'), 'telegramCommand', 'dist/core/commands/telegram-command.js'))),
     hooks: skipMigrationGate(entry('beta', 'Explain and inspect Codex hooks', 'dist/commands/hooks.js', directCommand(() => import('../commands/hooks.js'), 'dist/commands/hooks.js'))),
     'mad-sks': routeStateMutator(entry('beta', 'MAD-SKS scoped permission modifier + SQL-plane execution', 'dist/commands/mad-sks.js', directCommand(() => import('../commands/mad-sks.js'), 'dist/commands/mad-sks.js')), ['mad-sks-gate.json']),
     'auto-review': entry('beta', 'Manage auto-review profile', 'dist/commands/auto-review.js', directCommand(() => import('../commands/auto-review.js'), 'dist/commands/auto-review.js')),
@@ -309,7 +308,6 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
         requiredCapabilities: ['proof.stop-gate']
     },
     task: { risk: 'R1', latency: 'long' },
-    telegram: { risk: 'R2', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     trust: {
         risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'trust', requiredCapabilities: ['proof.trust']
     },

package/dist/commands/codex.js

@@ -4,7 +4,7 @@ import { codexCompatibilityReport, codexDoctorReport } from '../core/codex-compa
 import { codexVersionReport } from '../core/codex-compat/codex-version.js';
 import { codexSchemaSnapshotReport } from '../core/codex-compat/codex-schema-snapshot.js';
 import { detectCodexCurrentCapability } from '../core/codex-control/codex-current-capability.js';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../core/codex-compat/codex-runtime-contract.js';
 import { codexCliUpdateConsoleLines, inspectCodexCliUpdate, updateCodexCliNow } from '../core/codex/codex-cli-update.js';
 export async function run(_command, args = []) {
     const action = args[0] || 'compatibility';
@@ -59,11 +59,11 @@ export async function run(_command, args = []) {
             process.exitCode = 1;
         return;
     }
-    if (action === 'current' || action === CURRENT_CODEX_RELEASE_MANIFEST.targetTag) {
+    if (action === 'current' || action === CURRENT_CODEX_RUNTIME_CONTRACT.targetTag) {
         const result = await detectCodexCurrentCapability({ requireReal: flag(args, '--require-real') });
         if (flag(args, '--json'))
             return printJson(result);
-        console.log(`Codex ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion} compatibility: ${result.ok ? 'ok' : 'blocked'} (${result.probe_mode})`);
+        console.log(`Codex ${CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion} compatibility: ${result.ok ? 'ok' : 'blocked'} (${result.probe_mode})`);
         for (const blocker of result.blockers || [])
             console.log(`- blocker: ${blocker}`);
         for (const warning of result.warnings || [])

package/dist/commands/doctor.js

@@ -8,10 +8,6 @@ import { getCodexInfo } from '../core/codex-adapter.js';
 import { rustInfo } from '../core/rust-accelerator.js';
 import { codexAppIntegrationStatus } from '../core/codex-app.js';
 import { desktopBridgeStatusV3 } from '../core/codex-lb/desktop-controller-v3.js';
-import { probeTelegram, telegramSelfHealAction } from '../core/telegram/doctor.js';
-import { TelegramClient } from '../core/telegram/client.js';
-import { resolveTelegramBotToken } from '../core/telegram/keychain.js';
-import { telegramLivenessPath } from '../core/telegram/liveness.js';
 import { inspectCodexConfigReadability } from '../core/codex/codex-config-readability.js';
 import { inspectOAuthCallbackPortConflict, oauthCallbackDoctorGuidance } from '../core/codex/oauth-callback-port-diagnostic.js';
 import { inventoryCodexPermissionProfiles } from '../core/codex/codex-permission-profiles.js';
@@ -26,11 +22,10 @@ import { withSecretPreservationGuard } from '../core/config/config-migration-jou
 import { reconcileDoctorSkills } from '../core/doctor/doctor-skill-reconcile.js';
 import { buildSksMenuBarDoctorPostcheck } from '../core/doctor/sks-menubar-doctor.js';
 import { isUpdateMigrationReceiptCurrent, projectUpdateMigrationReceiptPath, writeProjectUpdateMigrationReceipt } from '../core/update/update-migration-state.js';
-import { inspectSksMenuBarStatus, installSksMenuBar, sksMenuBarPaths, sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
-import { restartLaunchAgent } from '../core/codex-app/menubar/launch-agent.js';
+import { inspectSksMenuBarStatus, installSksMenuBar, sksMenuBarRestartDeferred } from '../core/codex-app/menubar/index.js';
 import { sweepSksTempDirs } from '../core/retention.js';
 import { detectImagegenCapability } from '../core/imagegen/imagegen-capability.js';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../core/codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../core/codex-compat/codex-runtime-contract.js';
 import { formatHarnessConflictReport, scanHarnessConflicts } from '../core/harness-conflicts.js';
 import { doctorArgWarnings as baseDoctorArgWarnings, doctorMenuBarInstallPolicy, doctorPhaseIdsForProfile, doctorProfileFromArgs, doctorProfileRequiresDesktopBridgeReadiness } from './doctor-profile.js';
 import { buildCodexAppUiDiagnosticFailure, buildRuntimeReadiness, captureCodexConfigSnapshot, deferredNativeRepair, doctorDedupeStatus, doctorSkillStatus, fallbackCodexNativeFeatureMatrix, formatCodexDoctorConsoleStatus, installScopeFromArgs, isMigrationUserOwnedProjectConfigBlocker, mergeObservedCodexStartupWarnings, nativeCapabilityStatus, readOption, rebootstrapSksMenuBarLaunchdForDoctorFix, sksMenuBarRunningVersionConsoleLines, uniqueNativeManualActions, writeFixMigrationJournal, writeJsonReportFile } from './doctor-helpers.js';
@@ -212,13 +207,6 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         home,
         processEnv: doctorEnv
     }, { desktopBridgeStatusImpl: deps.desktopBridgeStatusImpl });
-    const telegramRemote = await inspectTelegramRemote({
-        live: true,
-        fix: true,
-        root,
-        home,
-        env: doctorEnv
-    }, deps);
     const globalSkillsReady = !globalSkills?.error
         && globalSkills?.ok !== false
         && globalSkills?.core_skill_integrity?.ok !== false;
@@ -261,12 +249,10 @@ export async function executeDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         codex_app_fast_mode: globalFastMode,
         openrouter_provider: desktopBridge.providers?.openrouter || null,
         sks_menubar: menuBar,
-        telegram_remote: telegramRemote,
         desktop_bridge: desktopBridge,
         blockers,
         next_actions: [
             ...(desktopBridge.ok === false ? desktopBridge.recovery_actions || [] : []),
-            ...telegramDoctorOperatorActions(telegramRemote),
             'Run `sks doctor --fix --json` from a specific project directory when project-scoped repair is required.'
         ]
     };
@@ -288,14 +274,6 @@ async function runDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         console.log(`SKS Doctor global repair: ${result.ok ? 'ok' : 'blocked'}`);
         console.log(`Global skills: ${result.skills.global?.error ? 'blocked' : 'reconciled'}`);
         console.log(`SKS menu bar: ${result.sks_menubar?.status || (result.sks_menubar?.ok ? 'ok' : 'blocked')}`);
-        const telegramOutcome = result.telegram_remote?.self_heal_outcome;
-        const telegramAction = telegramOutcome?.attempted
-            ? telegramOutcome.action
-            : result.telegram_remote?.self_heal_action || 'none';
-        console.log(`Telegram Remote: ${result.telegram_remote?.status || 'unknown'} (self-heal ${telegramAction}${telegramOutcome?.attempted ? `, ${telegramOutcome.recovered ? 'recovered' : 'still degraded'}` : ''})`);
-        const telegramCheckedLine = telegramDoctorCheckedLine(result.telegram_remote);
-        if (telegramCheckedLine)
-            console.log(telegramCheckedLine);
         console.log(`Desktop Bridge: ${result.desktop_bridge.ok ? 'ready' : 'blocked'} (${result.desktop_bridge.status?.readiness?.state || 'unavailable'})`);
         for (const blocker of result.blockers)
             console.log(`- blocker: ${blocker}`);
@@ -306,109 +284,6 @@ async function runDoctorGlobalOnlyFix(args = [], root, deps = {}) {
         process.exitCode = 1;
     return result;
 }
-export async function inspectTelegramRemote(input = {}, deps = {}) {
-    const env = input.env || process.env;
-    const home = path.resolve(input.home || env.HOME || os.homedir());
-    const receiptPath = input.receiptPath || telegramLivenessPath(home);
-    const probeImpl = deps.probeTelegramImpl || probeTelegram;
-    let tokenProvider = deps.telegramTokenProvider;
-    let client = deps.telegramClient;
-    if (input.live && (!tokenProvider || !client)) {
-        const resolveImpl = deps.resolveTelegramBotTokenImpl || resolveTelegramBotToken;
-        let resolvedToken = null;
-        tokenProvider ||= {
-            loadToken: () => {
-                resolvedToken ||= Promise.resolve(resolveImpl({ env })).then((result) => result.token);
-                return resolvedToken;
-            }
-        };
-        client ||= new TelegramClient({ tokenProvider });
-    }
-    const runProbe = () => {
-        if (!input.live)
-            return probeImpl({ receiptPath });
-        if (!client || !tokenProvider)
-            throw new Error('telegram_live_probe_dependencies_missing');
-        return probeImpl({ client, tokenProvider, receiptPath });
-    };
-    const before = await runProbe();
-    const action = telegramSelfHealAction(before);
-    if (!input.fix || action !== 'restart_poll' || !before.token_configured || before.paired_chat_count < 1) {
-        return {
-            ...before,
-            self_heal_action: action,
-            self_heal_outcome: {
-                requested: input.fix === true,
-                attempted: false,
-                action,
-                reason: input.fix !== true
-                    ? 'report_only'
-                    : action !== 'restart_poll'
-                        ? 'action_not_restart_poll'
-                        : 'telegram_not_configured_or_paired'
-            }
-        };
-    }
-    const restartImpl = deps.restartLaunchAgentImpl || restartLaunchAgent;
-    const restart = await restartImpl(sksMenuBarPaths(home, input.root), env).catch((error) => ({
-        ok: false,
-        error: error instanceof Error ? error.message : String(error)
-    }));
-    const maximumReprobes = Math.max(1, Math.min(deps.telegramReprobeAttempts ?? 3, 5));
-    const reprobeDelayMs = Math.max(0, Math.min(deps.telegramReprobeDelayMs ?? 500, 5_000));
-    const sleepImpl = deps.telegramSleepImpl || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-    let reprobeAttempts = 1;
-    let after = await runProbe();
-    let afterAction = telegramSelfHealAction(after);
-    while (restart?.ok === true && afterAction === 'restart_poll' && reprobeAttempts < maximumReprobes) {
-        await sleepImpl(reprobeDelayMs);
-        after = await runProbe();
-        afterAction = telegramSelfHealAction(after);
-        reprobeAttempts += 1;
-    }
-    return {
-        ...after,
-        self_heal_action: afterAction,
-        self_heal_attempted_action: action,
-        self_heal_before: before,
-        self_heal_outcome: {
-            requested: true,
-            attempted: true,
-            action,
-            after_action: afterAction,
-            restart_ok: restart?.ok === true,
-            reprobe_ok: after.ok,
-            reprobe_attempts: reprobeAttempts,
-            recovered: restart?.ok === true && after.ok && afterAction === 'none',
-            error: restart?.error || null,
-            restart
-        }
-    };
-}
-export function telegramDoctorCheckedLine(probe, indent = '') {
-    if (!probe?.getme_checked_at)
-        return null;
-    return `${indent}checked: ${probe.getme_checked_at} (${probe.getme_latency_ms ?? 'unknown'} ms, ${probe.getme_check_kind || 'receipt'})`;
-}
-function telegramDoctorOperatorActions(probe) {
-    if (!probe || probe.status === 'not_configured')
-        return [];
-    if (probe.self_heal_action === 'restart_poll') {
-        if (probe.self_heal_outcome?.recovered === true)
-            return [];
-        return ['Run `sks menubar restart` to restart the resident Telegram long poller.'];
-    }
-    if (probe.self_heal_action === 'revalidate_token') {
-        return ['Run `sks telegram setup --token-stdin`, then `sks menubar restart`, to revalidate the bot identity.'];
-    }
-    if (probe.self_heal_action === 'operator_remove_webhook') {
-        return ['Remove the Telegram bot webhook through the Bot API, then run `sks menubar restart`; getUpdates and webhooks cannot be active together.'];
-    }
-    if (probe.self_heal_action === 'operator_repair_audit') {
-        return ['Restore owner-only write access to `~/.codex/sks-menubar/logs/telegram-audit.jsonl`, then run `sks menubar restart`.'];
-    }
-    return [];
-}
 async function runDoctorJsonFastPath(args = [], root) {
     const startedAtMs = Date.now();
     const reportFile = readOption(args, '--report-file', null);
@@ -435,7 +310,6 @@ async function runDoctorJsonFastPath(args = [], root) {
         inspectDoctorDesktopBridgeStatus({ processEnv: process.env })
     ]);
     const oauthCallbackOperatorActions = oauthCallbackDoctorGuidance(oauthCallbackPortDiagnostic);
-    const telegramRemote = await inspectTelegramRemote();
     const ready = {
         schema: 'sks.doctor-readiness-matrix.v2',
         generated_at: nowIso(),
@@ -473,8 +347,7 @@ async function runDoctorJsonFastPath(args = [], root) {
         not_counted_as_full_doctor: true,
         next_actions: [
             'Run sks doctor --full --json for deep diagnostics.',
-            ...(desktopBridge.ok === false ? desktopBridge.recovery_actions || [] : []),
-            ...telegramDoctorOperatorActions(telegramRemote)
+            ...(desktopBridge.ok === false ? desktopBridge.recovery_actions || [] : [])
         ],
         root,
         fast_path: true,
@@ -509,7 +382,6 @@ async function runDoctorJsonFastPath(args = [], root) {
             blockers: [],
             warnings: ['menubar_install_deferred_to_fix_or_full_doctor']
         },
-        telegram_remote: telegramRemote,
         provider_context: {
             schema: 'sks.provider-context.v2',
             generated_at: nowIso(),
@@ -881,12 +753,6 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
         blockers: [err?.message || String(err)],
         warnings: []
     }));
-    const telegramRemote = await inspectTelegramRemote({
-        live: deepDiagnostics || doctorFix,
-        fix: doctorFix,
-        root,
-        env: process.env
-    }, deps);
     const context7Repair = await runDoctorContext7Repair({ root, fix: doctorFix }).catch((err) => ({
         schema: 'sks.doctor-context7-repair.v1',
         ok: false,
@@ -1398,7 +1264,6 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
         repair: configRepair,
         codex_app_ui: codexAppUi,
         sks_menubar: sksMenuBar,
-        telegram_remote: telegramRemote,
         codex_current_app_doctor: codexCurrentAppDoctor,
         codex_plugin_inventory: pluginInventory?.report || null,
         codex_plugin_app_template_policy: pluginPolicy,
@@ -1410,8 +1275,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
             ...(codexStartupRepair.manual_actions || []),
             ...(codexConfigSyntaxRepair?.manual_actions || []),
             ...(pluginPolicy?.doctor_warnings || []),
-            ...(desktopBridge.ok === false ? desktopBridge.recovery_actions || [] : []),
-            ...telegramDoctorOperatorActions(telegramRemote)
+            ...(desktopBridge.ok === false ? desktopBridge.recovery_actions || [] : [])
         ]
     };
     let ready = await writeDoctorReadinessMatrix(root, doctorReadinessInput);
@@ -1527,7 +1391,6 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
         codex_app_ui: codexAppUi,
         openrouter_provider: desktopBridge.providers?.openrouter || null,
         sks_menubar: sksMenuBar,
-        telegram_remote: telegramRemote,
         provider_context: providerContext,
         desktop_bridge: desktopBridge,
         codex_doctor: authoritativeCodexDoctor,
@@ -1742,21 +1605,6 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
         console.log(`  blockers: ${sksMenuBar.blockers.join(', ')}`);
     if (Array.isArray(sksMenuBar.warnings) && sksMenuBar.warnings.length)
         console.log(`  warnings: ${sksMenuBar.warnings.join(', ')}`);
-    console.log('Telegram Remote:');
-    console.log(`  status: ${telegramRemote.status || 'unknown'}`);
-    console.log(`  getMe: ${telegramRemote.bot_identity_valid ? 'verified' : telegramRemote.token_configured ? 'invalid' : 'not configured'}`);
-    console.log(`  audit: ${telegramRemote.audit_healthy ? 'healthy' : 'unavailable'}`);
-    const telegramCheckedLine = telegramDoctorCheckedLine(telegramRemote, '  ');
-    if (telegramCheckedLine)
-        console.log(telegramCheckedLine);
-    console.log(`  long poll: ${telegramRemote.poller?.running ? 'running' : 'stopped'}`);
-    const telegramSelfHealOutcome = telegramRemote.self_heal_outcome;
-    const telegramDisplayedAction = telegramSelfHealOutcome?.attempted
-        ? telegramSelfHealOutcome.action
-        : telegramRemote.self_heal_action;
-    if (telegramDisplayedAction && telegramDisplayedAction !== 'none') {
-        console.log(`  self-heal: ${telegramDisplayedAction}${telegramSelfHealOutcome?.attempted ? ` (${telegramSelfHealOutcome.recovered ? 'recovered' : 'attempted, still degraded'})` : ''}`);
-    }
     console.log(`Provider: ${providerContext.provider || 'unknown'} ${providerContext.service_tier || ''} (${providerContext.source || 'unknown'}, ${providerContext.confidence || 'low'})`);
     const imagegenReady = imagegen.auth_readiness;
     if (imagegenReady) {
@@ -1787,7 +1635,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
     }
     const codexCurrentApp = codexCurrentAppCapability.report || {};
     console.log('Codex current compatibility:');
-    console.log(`  target: ${CURRENT_CODEX_RELEASE_MANIFEST.targetTag}`);
+    console.log(`  target: ${CURRENT_CODEX_RUNTIME_CONTRACT.targetTag}`);
     console.log(`  runtime: ${codex.version || 'unknown'}`);
     console.log(`  multi-agent mode: ${codexNativeFeatureMatrix.features?.multi_agent_mode?.ok ? 'verified' : 'unverified'}`);
     console.log(`  rollout budget: ${codexNativeFeatureMatrix.features?.rollout_budget?.ok ? 'verified' : 'unverified'}`);

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "8.2.1",
+  "package_version": "8.3.0",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex/codex-cli-syntax-builder.js

@@ -1,13 +1,7 @@
 export function buildCodexExecArgs(opts) {
-    if (opts.fullAuto && opts.danger) {
-        throw new Error('codex exec cannot combine full auto and danger modes');
-    }
     if (opts.danger && !opts.allowDanger) {
         throw new Error('codex exec danger mode requires explicit allowDanger=true');
     }
-    if (opts.fullAuto && !opts.allowFullAuto) {
-        throw new Error('codex exec full-auto mode requires explicit allowFullAuto=true');
-    }
     if (opts.profile && opts.ignoreUserConfig) {
         throw new Error('codex exec cannot combine --profile with --ignore-user-config');
     }
@@ -30,8 +24,6 @@ export function buildCodexExecArgs(opts) {
         args.push('--ignore-user-config');
     if (opts.ignoreRules)
         args.push('--ignore-rules');
-    if (opts.fullAuto)
-        args.push('--full-auto');
     if (opts.danger)
         args.push('--dangerously-bypass-approvals-and-sandbox');
     else if (opts.sandbox)

package/dist/core/codex-app/codex-models-cache.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { writeTextAtomic } from '../fsx.js';
 import { codexHomePath } from './codex-model-catalog.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 export const CODEX_MODELS_CACHE_STALE_FETCHED_AT = '2000-01-01T00:00:00Z';
 export const CODEX_MODELS_CACHE_FILENAME = 'models_cache.json';
 export function codexModelsCachePath(input = {}) {
@@ -116,7 +117,7 @@ export async function invalidateCodexModelsCache(input = {}) {
     const existingClient = typeof existing?.client_version === 'string' ? existing.client_version.trim() : '';
     const clientVersion = existingClient && existingClient !== '0.0.0'
         ? existingClient
-        : '0.146.0';
+        : CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion;
     const wrapper = {
         fetched_at: CODEX_MODELS_CACHE_STALE_FETCHED_AT,
         client_version: clientVersion,

package/dist/core/codex-app/menubar/constants.js

@@ -25,7 +25,6 @@ export const NATIVE_SOURCE_FILES = [
     'ProvidersOpenRouter.swift',
     'ProvidersBridgeCatalog.swift',
     'RemoteCodingViewController.swift',
-    'RemoteCodingSettingsControls.swift',
     'DiagnosticsViewController.swift',
     'SettingsViewController.swift',
     'OperationModels.swift',
@@ -36,13 +35,6 @@ export const NATIVE_SOURCE_FILES = [
     'ProcessIdentityGuard.swift',
     'SecureProcessEnvelope.swift',
     'SKSKeychainStore.swift',
-    'TelegramStateLock.swift',
-    'TelegramPrivateFileSupport.swift',
-    'TelegramPrivateFileStore.swift',
-    'TelegramSupport.swift',
-    'TelegramRuntimeSupport.swift',
-    'TelegramTransport.swift',
-    'TelegramProcessGateway.swift',
     'NotificationCoordinator.swift',
     'AlertFactory.swift',
     'AppIdentity.swift',