sneakoscope 8.2.1 → 8.3.1

package/dist/core/codex/codex-cli-syntax-builder.js

@@ -1,13 +1,7 @@
 export function buildCodexExecArgs(opts) {
-    if (opts.fullAuto && opts.danger) {
-        throw new Error('codex exec cannot combine full auto and danger modes');
-    }
     if (opts.danger && !opts.allowDanger) {
         throw new Error('codex exec danger mode requires explicit allowDanger=true');
     }
-    if (opts.fullAuto && !opts.allowFullAuto) {
-        throw new Error('codex exec full-auto mode requires explicit allowFullAuto=true');
-    }
     if (opts.profile && opts.ignoreUserConfig) {
         throw new Error('codex exec cannot combine --profile with --ignore-user-config');
     }
@@ -30,8 +24,6 @@ export function buildCodexExecArgs(opts) {
         args.push('--ignore-user-config');
     if (opts.ignoreRules)
         args.push('--ignore-rules');
-    if (opts.fullAuto)
-        args.push('--full-auto');
     if (opts.danger)
         args.push('--dangerously-bypass-approvals-and-sandbox');
     else if (opts.sandbox)

package/dist/core/codex-app/codex-models-cache.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { writeTextAtomic } from '../fsx.js';
 import { codexHomePath } from './codex-model-catalog.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 export const CODEX_MODELS_CACHE_STALE_FETCHED_AT = '2000-01-01T00:00:00Z';
 export const CODEX_MODELS_CACHE_FILENAME = 'models_cache.json';
 export function codexModelsCachePath(input = {}) {
@@ -116,7 +117,7 @@ export async function invalidateCodexModelsCache(input = {}) {
     const existingClient = typeof existing?.client_version === 'string' ? existing.client_version.trim() : '';
     const clientVersion = existingClient && existingClient !== '0.0.0'
         ? existingClient
-        : '0.146.0';
+        : CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion;
     const wrapper = {
         fetched_at: CODEX_MODELS_CACHE_STALE_FETCHED_AT,
         client_version: clientVersion,

package/dist/core/codex-app/menubar/config.js

@@ -4,18 +4,18 @@ import { readJson, runProcess, which, writeJsonAtomic } from '../../fsx.js';
 export async function readMenuBarConfig(configPath) {
     const value = await readJson(configPath, null);
     return {
-        schema: 'sks.sks-menubar-config.v1',
+        schema: 'sks.sks-menubar-config.v2',
         codex_bundle_id: typeof value?.codex_bundle_id === 'string' && value.codex_bundle_id.trim()
             ? value.codex_bundle_id.trim() : null,
-        quit_with_codex: value?.quit_with_codex === true
+        follow_codex_lifecycle: value?.follow_codex_lifecycle === true || value?.quit_with_codex === true
     };
 }
 export async function writeDefaultMenuBarConfig(configPath, codexBundleId) {
     const previous = await readMenuBarConfig(configPath);
     const value = {
-        schema: 'sks.sks-menubar-config.v1',
+        schema: 'sks.sks-menubar-config.v2',
         codex_bundle_id: codexBundleId || previous.codex_bundle_id,
-        quit_with_codex: previous.quit_with_codex
+        follow_codex_lifecycle: previous.follow_codex_lifecycle
     };
     await writeJsonAtomic(configPath, value);
     return value;

package/dist/core/codex-app/menubar/constants.js

@@ -6,12 +6,13 @@ export const MENU_ITEMS = [
     'Pending approvals',
     'Check for Updates',
     'View Last Operation',
-    'Quit SKS Menu'
+    'Hide Until Codex Opens'
 ];
 export const NATIVE_SOURCE_FILES = [
     'main.swift',
     'AppDelegate.swift',
     'StatusItemController.swift',
+    'CodexLifecyclePolicy.swift',
     'ControlCenterWindowController.swift',
     'SidebarItem.swift',
     'ControlKit.swift',
@@ -25,7 +26,6 @@ export const NATIVE_SOURCE_FILES = [
     'ProvidersOpenRouter.swift',
     'ProvidersBridgeCatalog.swift',
     'RemoteCodingViewController.swift',
-    'RemoteCodingSettingsControls.swift',
     'DiagnosticsViewController.swift',
     'SettingsViewController.swift',
     'OperationModels.swift',
@@ -36,13 +36,6 @@ export const NATIVE_SOURCE_FILES = [
     'ProcessIdentityGuard.swift',
     'SecureProcessEnvelope.swift',
     'SKSKeychainStore.swift',
-    'TelegramStateLock.swift',
-    'TelegramPrivateFileSupport.swift',
-    'TelegramPrivateFileStore.swift',
-    'TelegramSupport.swift',
-    'TelegramRuntimeSupport.swift',
-    'TelegramTransport.swift',
-    'TelegramProcessGateway.swift',
     'NotificationCoordinator.swift',
     'AlertFactory.swift',
     'AppIdentity.swift',

package/dist/core/codex-app/menubar/global-install.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { exists, nowIso, readJson, readText, runProcess, writeJsonAtomic } from '../../fsx.js';
 import { ensureConfinedDirectory, inspectConfinedPath, removeManagedPathVerified } from '../../managed-path-safety.js';
+import { realUserHome } from './installer/runtime.js';
 const MENU_BAR_EXECUTABLE_SUFFIX = path.join('SKSMenuBar.app', 'Contents', 'MacOS', 'SKSMenuBar');
 const MENU_BAR_PROCESS_DISCOVERY_TIMEOUT_MS = 5_000;
 export function projectMenuBarDuplicateInstallDirs(input) {
@@ -21,6 +22,8 @@ export async function verifiedProjectMenuBarDuplicateExecutablePaths(input) {
     const executables = [];
     const candidates = await discoverProjectMenuBarDuplicateCandidates(input);
     for (const candidate of candidates.inspected) {
+        if (isOutsideScopeReapingRefused(candidate, root, home))
+            continue;
         const confinementRoot = confinementRootForCandidate(root, home, candidate);
         const state = await inspectConfinedPath(confinementRoot, candidate).catch(() => null);
         if (!state?.exists || state.leafSymlink || !state.stat?.isDirectory())
@@ -96,6 +99,11 @@ export async function cleanupProjectMenuBarDuplicates(input) {
     const blockers = [];
     const warnings = [];
     for (const candidate of inspected) {
+        if (isOutsideScopeReapingRefused(candidate, root, input.paths.home)) {
+            preserved.push(candidate);
+            warnings.push(`menubar_project_duplicate_outside_scope_preserved:${candidate}`);
+            continue;
+        }
         const confinementRoot = confinementRootForCandidate(root, input.paths.home, candidate);
         const state = await inspectConfinedPath(confinementRoot, candidate).catch(() => null);
         if (!state) {
@@ -254,6 +262,14 @@ function duplicateInstallDirForExecutable(executablePath, canonicalInstallDir) {
         return null;
     return executable.slice(0, -suffix.length);
 }
+function isOutsideScopeReapingRefused(candidateInput, rootInput, homeInput) {
+    const candidate = path.resolve(candidateInput);
+    const root = path.resolve(rootInput);
+    const home = path.resolve(homeInput);
+    if (isWithin(root, candidate) || isWithin(home, candidate))
+        return false;
+    return home !== realUserHome();
+}
 function confinementRootForCandidate(rootInput, homeInput, candidate) {
     const root = path.resolve(rootInput);
     const home = path.resolve(homeInput);

package/dist/core/codex-app/menubar/installer.js

@@ -6,7 +6,7 @@ import { aggregateFileHashes, createSksMenuBarBuildStamp, menuBarBuildStampsEqua
 import { SKS_MENUBAR_LABEL } from './constants.js';
 import { resolveCodexBundleId, writeDefaultMenuBarConfig } from './config.js';
 import { applyMenuBarGenerationTransaction, commitMenuBarGenerationTransaction, installGenerationPairs, MenuBarGenerationTransactionError, recoverMenuBarGenerationTransaction, rollbackGenerationPairs } from './generation-transaction.js';
-import { launchAgentSource, launchMenuBar, inspectRunningMenuBarProcess, seedMenuBarPreferredPosition, stopMenuBarForReplacement, terminateMenuBarProcesses } from './launch-agent.js';
+import { launchAgentSource, launchMenuBar, inspectRunningMenuBarProcess, menuBarLaunchdTouchAllowed, seedMenuBarPreferredPosition, stopMenuBarForReplacement, terminateMenuBarProcesses } from './launch-agent.js';
 import { cleanupProjectMenuBarDuplicates, verifiedProjectMenuBarDuplicateExecutablePaths } from './global-install.js';
 import { cleanupRetiredRemoteBridgeLaunchAgent, quarantineRetiredRemoteBridgeBindings } from './migration.js';
 import { sksMenuBarPaths } from './paths.js';
@@ -114,6 +114,11 @@ export async function installSksMenuBar(opts = {}) {
         return blocked('sks_entry_unresolved');
     if (targetCheck.project_local)
         warnings.push('sks_entry_project_local');
+    const macosProtectedRoots = ['Desktop', 'Documents', 'Downloads']
+        .map((dir) => `${path.join(paths.home, dir)}${path.sep}`);
+    if (targetCheck.resolved && macosProtectedRoots.some((root) => targetCheck.resolved.startsWith(root))) {
+        warnings.push('sks_entry_macos_protected_folder');
+    }
     const previousActionScript = await readText(paths.action_script_path, '');
     const previousLaunchAgent = await readText(paths.launch_agent_path, '');
     const previousRaw = await readJson(paths.build_stamp_path, null);
@@ -256,7 +261,15 @@ export async function installSksMenuBar(opts = {}) {
     });
     const mustStopCanonical = !upToDate || (launchWanted && launchAllowed);
     let canonicalStopped = false;
-    if (mustStopCanonical) {
+    if (mustStopCanonical && !menuBarLaunchdTouchAllowed(paths, env)) {
+        const stopped = await terminateMenuBarProcesses([paths.executable_path, ...duplicateExecutablePaths], env);
+        if (!stopped.ok) {
+            return blocked('menubar_stop_before_replace_failed', `Remaining PIDs: ${stopped.remaining_pids.join(',')}`);
+        }
+        warnings.push('launchd_stop_skipped_non_user_home');
+        actions.push('verified canonical/project duplicate processes stopped without touching the user launchd service');
+    }
+    else if (mustStopCanonical) {
         const stopped = await stopMenuBarForReplacement({
             launchctl,
             paths,

package/dist/core/codex-app/menubar/launch-agent.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { exists, readJson, runProcess, which, writeJsonAtomic } from '../../fsx.js';
 import { CONTROL_CENTER_DOMAIN, CONTROL_CENTER_PREFERRED_POSITION, SKS_MENUBAR_LABEL } from './constants.js';
+import { realUserHome } from './installer/runtime.js';
 export function launchAgentSource(executablePath, installDir) {
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -9,11 +10,15 @@ export function launchAgentSource(executablePath, installDir) {
 <key>Label</key><string>${SKS_MENUBAR_LABEL}</string>
 <key>ProgramArguments</key><array><string>${xml(executablePath)}</string></array>
 <key>RunAtLoad</key><true/>
+<key>KeepAlive</key><true/>
 <key>ProcessType</key><string>Interactive</string>
 <key>StandardOutPath</key><string>${xml(path.join(installDir, 'menubar.out.log'))}</string>
 <key>StandardErrorPath</key><string>${xml(path.join(installDir, 'menubar.err.log'))}</string>
 </dict></plist>\n`;
 }
+export function menuBarLaunchdTouchAllowed(paths, env) {
+    return Boolean(env.SKS_MENUBAR_LAUNCHCTL) || path.resolve(paths.home) === realUserHome();
+}
 export async function seedMenuBarPreferredPosition(env) {
     const defaults = env.SKS_MENUBAR_DEFAULTS || await which('defaults').catch(() => null) || '/usr/bin/defaults';
     const writes = [
@@ -304,15 +309,24 @@ export async function removeLaunchAgent(paths, env) {
     const actions = [];
     const warnings = [];
     const blockers = [];
-    const launchctl = env.SKS_MENUBAR_LAUNCHCTL || await which('launchctl').catch(() => null) || '/bin/launchctl';
-    const stopped = await stopMenuBarForReplacement({
-        launchctl,
-        paths,
-        executablePaths: [paths.executable_path],
-        env
-    });
-    if (!stopped.ok)
-        blockers.push(stopped.error || 'menubar_process_stop_failed');
+    if (menuBarLaunchdTouchAllowed(paths, env)) {
+        const launchctl = env.SKS_MENUBAR_LAUNCHCTL || await which('launchctl').catch(() => null) || '/bin/launchctl';
+        const stopped = await stopMenuBarForReplacement({
+            launchctl,
+            paths,
+            executablePaths: [paths.executable_path],
+            env
+        });
+        if (!stopped.ok)
+            blockers.push(stopped.error || 'menubar_process_stop_failed');
+    }
+    else {
+        const terminated = await terminateMenuBarProcesses([paths.executable_path], env);
+        if (!terminated.ok)
+            blockers.push('menubar_process_stop_failed');
+        else
+            warnings.push('launchd_stop_skipped_non_user_home');
+    }
     if (blockers.length > 0)
         return { actions, warnings, blockers };
     await fs.rm(paths.launch_agent_path, { force: true }).catch((error) => blockers.push(`remove_launch_agent_failed:${String(error)}`));

package/dist/core/codex-app/menubar/rollback.js

@@ -2,7 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { readJson, sha256, which } from '../../fsx.js';
 import { applyMenuBarGenerationTransaction, commitMenuBarGenerationTransaction, installGenerationPairs, MenuBarGenerationTransactionError, recoverMenuBarGenerationTransaction, rollbackGenerationPairs } from './generation-transaction.js';
-import { launchMenuBar, stopMenuBarForReplacement } from './launch-agent.js';
+import { launchMenuBar, menuBarLaunchdTouchAllowed, stopMenuBarForReplacement, terminateMenuBarProcesses } from './launch-agent.js';
 import { sksMenuBarPaths } from './paths.js';
 import { aggregateFileHashes } from './build-stamp.js';
 import { inspectInstalledResources } from './resources.js';
@@ -286,7 +286,7 @@ export async function rollbackSksMenuBar(opts = {}) {
     else {
         transaction = committed;
     }
-    if (opts.launch === false || env.SKS_SKIP_SKS_MENUBAR_LAUNCH === '1') {
+    if (opts.launch === false || env.SKS_SKIP_SKS_MENUBAR_LAUNCH === '1' || !menuBarLaunchdTouchAllowed(paths, env)) {
         return result('rolled_back_launch_skipped', true, verificationBefore.package_version, replacedStamp?.package_version || null, verificationBefore, verificationAfter, { requested: false, method: 'skipped', ok: true }, [], warnings);
     }
     const launch = await launchMenuBar({
@@ -307,6 +307,16 @@ export async function rollbackSksMenuBar(opts = {}) {
     async function stopBeforeReplacement() {
         if (replacementStopped)
             return null;
+        if (!menuBarLaunchdTouchAllowed(paths, env)) {
+            const terminated = await terminateMenuBarProcesses([paths.executable_path], env);
+            if (!terminated.ok) {
+                return result('failed', false, null, null, null, null, { requested: false, method: 'none', ok: false, error: 'menubar_rollback_stop_failed' }, ['menubar_rollback_stop_failed'], warnings);
+            }
+            replacementStopped = true;
+            warnings.push('launchd_stop_skipped_non_user_home');
+            actions.push('verified process termination without touching the user launchd service before journaled rollback replacement');
+            return null;
+        }
         const stopped = await stopMenuBarForReplacement({
             launchctl,
             paths,

package/dist/core/codex-compat/codex-capability-matrix.js

@@ -1,5 +1,5 @@
 import { runProcess } from '../fsx.js';
-import { CURRENT_CODEX_RELEASE_MANIFEST, NARUTO_REQUIRED_CODEX_VERSION } from './codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT, NARUTO_REQUIRED_CODEX_VERSION } from './codex-runtime-contract.js';
 import { compareSemverLike, parseCodexVersionText } from './codex-version-policy.js';
 export const CODEX_CAPABILITY_MATRIX_SCHEMA = 'sks.codex-capability-matrix.v1';
 export const SKS_CODEX_CAPABILITY_IDS = [
@@ -13,10 +13,10 @@ export const SKS_CODEX_CAPABILITY_IDS = [
 ];
 const UPDATE_CTA = 'Update Codex CLI to the preferred latest: `sks codex update` or Menu Bar / SKS Center → Update Codex CLI Now.';
 export function preferredCodexCliVersion() {
-    return CURRENT_CODEX_RELEASE_MANIFEST.preferredCliVersion || CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion;
+    return CURRENT_CODEX_RUNTIME_CONTRACT.preferredCliVersion || CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion;
 }
 export function softMinimumCodexCliVersion() {
-    return CURRENT_CODEX_RELEASE_MANIFEST.minimumSupportedVersion;
+    return CURRENT_CODEX_RUNTIME_CONTRACT.minimumSupportedVersion;
 }
 export function narutoCodexFloorVersion() {
     return NARUTO_REQUIRED_CODEX_VERSION;
@@ -26,7 +26,7 @@ export function buildCodexCapabilityMatrix(input = {}) {
     const help = String(input.helpText || '');
     const config = String(input.configText || '');
     const schema = String(input.schemaText || '');
-    const policies = CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies;
+    const policies = CURRENT_CODEX_RUNTIME_CONTRACT.featurePolicies;
     const warnings = [];
     if (detected && compareSemverLike(detected, preferredCodexCliVersion()) < 0) {
         warnings.push(`detected Codex ${detected} is below preferred ${preferredCodexCliVersion()}; prefer latest via SKS update inducement`);
@@ -122,8 +122,8 @@ export async function probeNarutoCodexCapability(input) {
     return { matrix, naruto: assertNarutoMultiAgentV2Capability(matrix) };
 }
 function resolveMultiAgentV2(input) {
-    const policy = CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies.multiAgentV2
-        || CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies.multiAgentMode
+    const policy = CURRENT_CODEX_RUNTIME_CONTRACT.featurePolicies.multiAgentV2
+        || CURRENT_CODEX_RUNTIME_CONTRACT.featurePolicies.multiAgentMode
         || 'delegate';
     const evidence = [];
     const helpHit = /\bmulti_agent_v2\b/.test(input.help);
@@ -167,7 +167,7 @@ function resolveMultiAgentV2(input) {
     };
 }
 function resolveAgentsConcurrency(input) {
-    const policy = CURRENT_CODEX_RELEASE_MANIFEST.featurePolicies.agentsMaxConcurrentThreads || 'delegate';
+    const policy = CURRENT_CODEX_RUNTIME_CONTRACT.featurePolicies.agentsMaxConcurrentThreads || 'delegate';
     const hit = /max_concurrent_threads_per_session/.test(input.help)
         || /max_concurrent_threads_per_session/.test(input.config);
     const available = hit || input.multiAgentV2;

package/dist/core/codex-compat/codex-compat-report.js

@@ -2,21 +2,18 @@ import { projectRoot } from '../fsx.js';
 import { detectCodexCurrentCapability } from '../codex-control/codex-current-capability.js';
 import { codexVersionReport } from './codex-version.js';
 import { CODEX_COMPAT_SCHEMA, CODEX_HOOK_SCHEMA_BASELINE_TAG, CODEX_REQUIRED_BASELINE_TAG } from './codex-version-policy.js';
-import { codexReleaseManifestParity } from './codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from './codex-runtime-contract.js';
 import { codexSchemaSnapshotReport } from './codex-schema-snapshot.js';
 import { codexHookWarningCheck } from './codex-hook-warning-detector.js';
 export async function codexCompatibilityReport(opts = {}) {
     const root = opts.root || await projectRoot();
     const requiredBaseline = opts.requiredBaseline || opts.require || CODEX_REQUIRED_BASELINE_TAG;
     const version = await codexVersionReport({ ...opts, requiredBaseline });
-    const releaseManifest = await codexReleaseManifestParity(root).catch((err) => ({
-        ok: false,
-        mismatches: ['manifest_load_failed'],
-        manifest: null,
-        manifest_path: null,
-        manifest_sha256: null,
-        error: err?.message || String(err)
-    }));
+    const releaseContract = {
+        ok: true,
+        dependency_source: CURRENT_CODEX_RUNTIME_CONTRACT.dependencySource,
+        contract: CURRENT_CODEX_RUNTIME_CONTRACT
+    };
     const snapshot = await codexSchemaSnapshotReport();
     const hooks = await codexHookWarningCheck(root, { recordWrongness: false });
     const current = await detectCodexCurrentCapability({
@@ -24,11 +21,11 @@ export async function codexCompatibilityReport(opts = {}) {
         codexBin: opts.codexBin || null,
         requireReal: opts.requireReal === true
     });
-    const ok = Boolean(version.policy.ok && releaseManifest.ok && snapshot.ok && hooks.ok && current.ok);
+    const ok = Boolean(version.policy.ok && snapshot.ok && hooks.ok && current.ok);
     return {
         schema: CODEX_COMPAT_SCHEMA,
         required_baseline: requiredBaseline,
-        release_manifest: releaseManifest,
+        release_contract: releaseContract,
         detected: version.detected,
         current_capability: current,
         capabilities: current.feature_states,
@@ -58,7 +55,6 @@ export async function codexCompatibilityReport(opts = {}) {
         ],
         blockers: [
             ...(version.policy.ok ? [] : ['codex_version_policy_failed']),
-            ...(releaseManifest.ok ? [] : ['codex_release_manifest_mismatch']),
             ...(snapshot.ok ? [] : ['codex_hook_schema_snapshot_invalid']),
             ...(hooks.ok ? [] : ['codex_hook_semantic_warning']),
             ...current.blockers

package/dist/core/codex-compat/codex-runtime-contract.js

@@ -0,0 +1,62 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { packageRoot } from '../fsx.js';
+export const CODEX_RUNTIME_CONTRACT_SCHEMA = 'sks.codex-runtime-contract.v2';
+const sdkVersion = codexSdkDependencyVersion();
+export const CURRENT_CODEX_RUNTIME_CONTRACT = {
+    schema: CODEX_RUNTIME_CONTRACT_SCHEMA,
+    targetTag: `rust-v${sdkVersion}`,
+    requiredCliVersion: sdkVersion,
+    preferredCliVersion: sdkVersion,
+    sdkVersion,
+    minimumSupportedVersion: sdkVersion,
+    narutoCapabilityFloorVersion: sdkVersion,
+    protocolMode: 'app-server-v2',
+    dependencySource: 'package.json#dependencies.@openai/codex-sdk',
+    featurePolicies: {
+        multiAgentMode: 'delegate',
+        multiAgentV2: 'delegate',
+        agentsMaxConcurrentThreads: 'delegate',
+        indexedWebSearch: 'probe',
+        currentTimeRead: 'wrap',
+        threadListSearchRead: 'probe',
+        pluginCatalogRefresh: 'probe',
+        terminalSubagentErrorPropagation: 'probe',
+        execMcpTransientRecovery: 'probe',
+        remoteNativeEnvironment: 'probe',
+        rolloutTokenBudget: 'probe',
+        mcpStartupToolTimeouts: 'wrap',
+        gpt56TerraLunaSolRouting: 'delegate',
+        mcpPaginatedDiscovery: 'wrap',
+        portableAgentPlugins: 'delegate',
+        automaticApprovalReview: 'delegate'
+    },
+    requiredRealProbes: [
+        'runtime_identity',
+        'protocol_schema_generation',
+        'multi_agent_mode_schema',
+        'indexed_web_search_schema',
+        'current_time_read_schema',
+        'thread_list_search_schema',
+        'terminal_error_schema',
+        'rollout_budget_schema'
+    ],
+    supportedPlatforms: [
+        'darwin-arm64',
+        'darwin-x64',
+        'linux-arm64',
+        'linux-x64',
+        'win32-arm64',
+        'win32-x64'
+    ]
+};
+export const NARUTO_REQUIRED_CODEX_VERSION = CURRENT_CODEX_RUNTIME_CONTRACT.narutoCapabilityFloorVersion;
+export function codexSdkDependencyVersion(root = packageRoot()) {
+    const packagePath = path.join(root, 'package.json');
+    const pkg = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+    const value = String(pkg.dependencies?.['@openai/codex-sdk'] || '').trim();
+    if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value)) {
+        throw new Error(`@openai/codex-sdk must be an exact semver in ${packagePath}`);
+    }
+    return value;
+}

package/dist/core/codex-compat/codex-version-policy.js

@@ -1,12 +1,12 @@
-import { CURRENT_CODEX_RELEASE_MANIFEST } from './codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from './codex-runtime-contract.js';
 export const CODEX_COMPAT_SCHEMA = 'sks.codex-compat.v2';
-export const CODEX_REQUIRED_BASELINE_TAG = CURRENT_CODEX_RELEASE_MANIFEST.targetTag;
-export const CODEX_REQUIRED_VERSION = CURRENT_CODEX_RELEASE_MANIFEST.preferredCliVersion
-    || CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion;
+export const CODEX_REQUIRED_BASELINE_TAG = CURRENT_CODEX_RUNTIME_CONTRACT.targetTag;
+export const CODEX_REQUIRED_VERSION = CURRENT_CODEX_RUNTIME_CONTRACT.preferredCliVersion
+    || CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion;
 export const CODEX_PREFERRED_VERSION = CODEX_REQUIRED_VERSION;
-export const CODEX_MINIMUM_SUPPORTED_VERSION = CURRENT_CODEX_RELEASE_MANIFEST.minimumSupportedVersion;
-export const CODEX_HOOK_SCHEMA_BASELINE_TAG = CURRENT_CODEX_RELEASE_MANIFEST.targetTag;
-export const CODEX_HOOK_SCHEMA_VERSION = CURRENT_CODEX_RELEASE_MANIFEST.targetTag;
+export const CODEX_MINIMUM_SUPPORTED_VERSION = CURRENT_CODEX_RUNTIME_CONTRACT.minimumSupportedVersion;
+export const CODEX_HOOK_SCHEMA_BASELINE_TAG = 'latest';
+export const CODEX_HOOK_SCHEMA_VERSION = 'latest';
 const UPDATE_CTA = 'prefer latest Codex CLI via `sks codex update` or Menu Bar / SKS Center → Update Codex CLI Now';
 export function compareSemverLike(a, b) {
     const pa = parseVersionParts(a);

package/dist/core/codex-control/codex-current-app-capability.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { findCodexBinary } from '../codex-adapter.js';
 import { compareSemverLike, parseCodexVersionText } from '../codex-compat/codex-version-policy.js';
-import { CURRENT_CODEX_RELEASE_MANIFEST } from '../codex-compat/codex-release-manifest.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT } from '../codex-compat/codex-runtime-contract.js';
 import { nowIso, runProcess, writeJsonAtomic } from '../fsx.js';
 export async function detectCodexCurrentAppCapability(input = {}) {
     const fake = process.env.SKS_CODEX_CURRENT_APP_FAKE === '1';
@@ -9,10 +9,10 @@ export async function detectCodexCurrentAppCapability(input = {}) {
         ? input.codexBin || process.env.CODEX_BIN || 'codex'
         : input.codexBin || process.env.CODEX_BIN || await findCodexBinary();
     const versionText = fake
-        ? String(process.env.SKS_CODEX_VERSION_FAKE || `codex-cli ${CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion}`)
+        ? String(process.env.SKS_CODEX_VERSION_FAKE || `codex-cli ${CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion}`)
         : await readCodexVersionText(codexBin);
     const parsed = parseCodexVersion(versionText);
-    const currentRelease = Boolean(parsed && semverGte(parsed, CURRENT_CODEX_RELEASE_MANIFEST.requiredCliVersion));
+    const currentRelease = Boolean(parsed && semverGte(parsed, CURRENT_CODEX_RUNTIME_CONTRACT.requiredCliVersion));
     const probeMode = process.env.SKS_CODEX_CURRENT_APP_PROBE === '1' ? 'feature-probe' : 'version-only';
     const featureProbeResults = probeMode === 'feature-probe'
         ? await probeCodexCurrentAppFeatures(codexBin, { fake })