sneakoscope 8.3.0 → 8.3.2

package/dist/core/codex-lb/desktop-bridge-migration/retired-runtime-cleanup.js

@@ -2,13 +2,26 @@ import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { runProcess } from '../../fsx.js';
 const RETIRED_LAUNCHD_LABEL = 'com.sneakoscope.codex-lb-desktop-bridge';
-const RETIRED_SETTINGS_SCHEMA = 'sks.codex-lb-desktop-bridge-settings.v2';
-const RETIRED_STATE_SCHEMA = 'sks.codex-lb-desktop-bridge.v2';
-const SETTINGS_KEYS = new Set([
+const RETIRED_SETTINGS_V1_SCHEMA = 'sks.codex-lb-desktop-bridge-settings.v1';
+const RETIRED_SETTINGS_V2_SCHEMA = 'sks.codex-lb-desktop-bridge-settings.v2';
+const RETIRED_STATE_SCHEMAS = new Set([
+    'sks.codex-lb-desktop-bridge.v1',
+    'sks.codex-lb-desktop-bridge.v2',
+]);
+const SETTINGS_V1_KEYS = new Set([
+    'schema', 'listen_host', 'listen_port', 'provider_mode', 'allowed_models',
+    'gateway_auth_transport', 'allowed_origins', 'connect_timeout_ms',
+    'idle_timeout_ms', 'catalog_version', 'registered_child_models',
+    'session_pins', 'require_session_pin',
+]);
+const SETTINGS_V2_KEYS = new Set([
     'schema', 'listen_host', 'listen_port', 'provider_registry', 'route_policy',
     'provider_session_pins', 'client_capability_sha256', 'allowed_origins',
     'connect_timeout_ms', 'idle_timeout_ms',
 ]);
+const TRANSFERABLE_V1_KEYS = [
+    'listen_host', 'listen_port', 'allowed_origins', 'connect_timeout_ms', 'idle_timeout_ms',
+];
 function retiredPaths(home) {
     const resolvedHome = path.resolve(home);
     const runtime = path.join(resolvedHome, '.codex', 'sks');
@@ -51,14 +64,37 @@ async function readRetiredSettings(file) {
         throw new Error('desktop_bridge_retired_settings_invalid');
     }
     const row = value;
-    if (row.schema !== RETIRED_SETTINGS_SCHEMA || Object.keys(row).some((key) => !SETTINGS_KEYS.has(key))) {
+    const allowedKeys = row.schema === RETIRED_SETTINGS_V1_SCHEMA
+        ? SETTINGS_V1_KEYS
+        : row.schema === RETIRED_SETTINGS_V2_SCHEMA
+            ? SETTINGS_V2_KEYS
+            : null;
+    if (!allowedKeys || Object.keys(row).some((key) => !allowedKeys.has(key))) {
         throw new Error('desktop_bridge_retired_settings_invalid');
     }
-    if (/"(?:api_?key|secret|authorization|cookie|access_token|refresh_token)"\s*:/i.test(JSON.stringify(row))) {
+    if (/"(?:api_?key|secret|authorization|cookie|access_token|refresh_token|gatewayKey)"\s*:/i.test(JSON.stringify(row))) {
         throw new Error('desktop_bridge_retired_settings_secret_forbidden');
     }
     const { schema: _schema, ...settings } = row;
-    return settings;
+    if (row.schema === RETIRED_SETTINGS_V2_SCHEMA)
+        return settings;
+    validateTransferableSettings(settings);
+    return Object.fromEntries(TRANSFERABLE_V1_KEYS.map((key) => [key, settings[key]]));
+}
+function validateTransferableSettings(settings) {
+    const host = settings.listen_host;
+    const port = Number(settings.listen_port);
+    const origins = settings.allowed_origins;
+    const connectTimeout = Number(settings.connect_timeout_ms);
+    const idleTimeout = Number(settings.idle_timeout_ms);
+    if ((host !== '127.0.0.1' && host !== '::1')
+        || !Number.isInteger(port) || port < 49_152 || port > 65_535
+        || !Array.isArray(origins) || origins.length === 0
+        || origins.some((origin) => typeof origin !== 'string' || !origin.trim())
+        || !Number.isFinite(connectTimeout) || connectTimeout < 100 || connectTimeout > 120_000
+        || !Number.isFinite(idleTimeout) || idleTimeout < 1_000 || idleTimeout > 86_400_000) {
+        throw new Error('desktop_bridge_retired_settings_invalid');
+    }
 }
 function launchDomain(uid = typeof process.getuid === 'function' ? process.getuid() : 0) {
     return `gui/${uid}`;
@@ -91,13 +127,15 @@ export async function cleanupRetiredDesktopBridgeRuntime(preparation) {
         return;
     if (await regularFileExists(preparation.paths.settings)) {
         const raw = JSON.parse(await fsp.readFile(preparation.paths.settings, 'utf8'));
-        if (raw.schema !== RETIRED_SETTINGS_SCHEMA)
+        if (raw.schema !== RETIRED_SETTINGS_V1_SCHEMA && raw.schema !== RETIRED_SETTINGS_V2_SCHEMA) {
             throw new Error('desktop_bridge_retired_settings_changed');
+        }
     }
     if (await regularFileExists(preparation.paths.state)) {
         const raw = JSON.parse(await fsp.readFile(preparation.paths.state, 'utf8'));
-        if (raw.schema !== RETIRED_STATE_SCHEMA)
+        if (!RETIRED_STATE_SCHEMAS.has(String(raw.schema || ''))) {
             throw new Error('desktop_bridge_retired_state_changed');
+        }
     }
     for (const file of Object.values(preparation.paths)) {
         if (await regularFileExists(file))

package/dist/core/codex-lb/desktop-controller-v3/lifecycle-commands.js

@@ -27,7 +27,8 @@ export async function ensureDesktopBridge(options, operation) {
     if (service.running)
         report = await verifyDesktopBridgeV3('shallow', options);
     const status = await desktopBridgeStatusV3(options);
-    return commandResult(operation, true, status, { service, catalog_sync: sync, capabilities: report }, [], options);
+    const outcome = desktopBridgeServiceCommandOutcome(service);
+    return commandResult(operation, outcome.ok, status, { service, catalog_sync: sync, capabilities: report }, outcome.blockers, options);
 }
 export async function repairDesktopBridge(options) {
     let core = await loadCore(options);
@@ -43,7 +44,16 @@ export async function repairDesktopBridge(options) {
     core = await loadCore(options);
     const report = service.running ? await verifyDesktopBridgeV3('shallow', options) : null;
     const status = await desktopBridgeStatusV3(options);
-    return commandResult('repair', true, status, { service, capabilities: report }, [], options);
+    const outcome = desktopBridgeServiceCommandOutcome(service);
+    return commandResult('repair', outcome.ok, status, { service, capabilities: report }, outcome.blockers, options);
+}
+export function desktopBridgeServiceCommandOutcome(service) {
+    const blockers = [...new Set(stringArray(service.blockers))];
+    const ok = service.ok && service.running && blockers.length === 0;
+    return {
+        ok,
+        blockers: ok ? [] : blockers.length > 0 ? blockers : ['desktop_bridge_service_not_running']
+    };
 }
 export async function setDefaultProvider(providerId, options) {
     const core = await loadCore(options);

package/dist/core/codex-lb/desktop-controller-v3/live-probes.js

@@ -6,6 +6,39 @@ import { runAuxiliarySurfacesProbeV3 } from '../probes/auxiliary-surfaces-probe.
 import { capabilityProbeResultV3 } from '../probes/probe-evidence.js';
 import { validateCapabilityDeepEvidenceV2 } from '../trusted-deep-evidence.js';
 import { bridgeClientUrl, providerCode, safeCode, timeoutMs, unique } from './shared.js';
+export function textResponsePayloadValid(contentType, text) {
+    if (/text\/event-stream/i.test(contentType || '')) {
+        let completed = false;
+        for (const line of text.split('\n')) {
+            if (!line.startsWith('data:'))
+                continue;
+            const data = line.slice(5).trim();
+            if (!data || data === '[DONE]')
+                continue;
+            let event;
+            try {
+                event = JSON.parse(data);
+            }
+            catch {
+                continue;
+            }
+            const type = event && typeof event === 'object' ? event.type : null;
+            if (type === 'response.failed' || type === 'error')
+                return false;
+            if (type === 'response.completed')
+                completed = true;
+        }
+        return completed;
+    }
+    let payload = null;
+    try {
+        payload = text ? JSON.parse(text) : null;
+    }
+    catch {
+        payload = null;
+    }
+    return payload !== null && typeof payload === 'object';
+}
 export async function probeProviderText(core, providerId, loopbackOrigin, context, options) {
     const route = core.policy
         ? Object.entries(core.policy.model_routes).find(([, target]) => target.provider_id === providerId)
@@ -69,14 +102,7 @@ export async function probeProviderText(core, providerId, loopbackOrigin, contex
         const text = await response.text();
         if (Buffer.byteLength(text) > 4 * 1024 * 1024)
             throw new Error('provider_text_response_too_large');
-        let payload = null;
-        try {
-            payload = text ? JSON.parse(text) : null;
-        }
-        catch {
-            payload = null;
-        }
-        const valid = response.ok && payload !== null && typeof payload === 'object';
+        const valid = response.ok && textResponsePayloadValid(response.headers.get('content-type'), text);
         const root = valid ? null : `${providerCode(providerId)}_text_response_failed`;
         return capabilityProbeResultV3({
             ...context,

package/dist/core/codex-lb/desktop-controller-v3/preflight-probes.js

@@ -44,9 +44,11 @@ export function combinedRoutePolicyProbe(core, context) {
         }
     });
 }
-export function combinedModelRouteProbe(core, status, context) {
+export function combinedModelRouteProbe(core, status, context, liveTextResults = []) {
     const active = activeProviderIds(core);
     const verified = active.length > 0 && active.every((providerId) => Boolean(core.policy && Object.values(core.policy.model_routes).some((route) => route.provider_id === providerId)));
+    const liveRouteProven = verified && active.every((providerId) => liveTextResults.some((result) => result.scope === `provider:${providerId}`
+        && result.capability === 'text_responses' && result.state === 'verified'));
     return capabilityProbeResultV3({
         ...context,
         capability: 'model_route',
@@ -58,10 +60,11 @@ export function combinedModelRouteProbe(core, status, context) {
         blockers: verified ? [] : ['catalog_model_route_missing'],
         retryable: !verified,
         recoveryAction: verified ? null : 'refresh_catalog_or_select_supported_model',
-        source: 'config',
+        source: liveRouteProven ? 'transport' : 'config',
         evidence: {
             active_provider_ids: active,
             route_count: status.catalog_sync.route_count,
+            live_route_proven: liveRouteProven,
             fallback: 'none'
         }
     });
@@ -119,11 +122,16 @@ export function providerAuthProbe(core, providerId, context) {
         }
     });
 }
-export function providerModelRouteProbe(core, providerId, context) {
+export function providerModelRouteProbe(core, providerId, context, liveText = null) {
     const route = core.policy
         ? Object.entries(core.policy.model_routes).find(([, target]) => target.provider_id === providerId)
         : null;
     const verified = Boolean(route && core.catalogSync.providers[providerId].state === 'verified');
+    const liveRouteProven = Boolean(verified && route && liveText
+        && liveText.capability === 'text_responses'
+        && liveText.scope === `provider:${providerId}`
+        && liveText.state === 'verified'
+        && liveText.evidence.public_model === route[0]);
     return capabilityProbeResultV3({
         ...context,
         capability: 'model_route',
@@ -132,12 +140,13 @@ export function providerModelRouteProbe(core, providerId, context) {
         state: verified ? 'verified' : 'not_attempted',
         retryable: !verified,
         recoveryAction: verified ? null : 'refresh_catalog_or_select_supported_model',
-        source: 'config',
+        source: liveRouteProven ? 'transport' : 'config',
         evidence: {
             provider_id: providerId,
             public_model: route?.[0] || null,
             upstream_model: route?.[1].upstream_model || null,
             catalog_generation: core.policy?.catalog_generation || null,
+            live_route_proven: liveRouteProven,
             fallback: 'none'
         }
     });

package/dist/core/codex-lb/desktop-controller-v3/shared.js

@@ -118,7 +118,8 @@ export async function persistRuntimeSettings(core, options, behavior = {}) {
     }
     if (!restarted.ok || !restarted.running) {
         await stopAfterFailedRestart(restartOptions, options);
-        throw new Error(restarted.blockers[0] || 'desktop_bridge_restart_failed');
+        const rootCause = restarted.blockers.find((blocker) => blocker === 'desktop_bridge_entry_macos_protected_folder');
+        throw new Error(rootCause || restarted.blockers[0] || 'desktop_bridge_restart_failed');
     }
 }
 export async function quiesceRunningBridge(core, options) {

package/dist/core/codex-lb/desktop-controller-v3/verification.js

@@ -30,6 +30,12 @@ export async function verifyDesktopBridgeV3(requestedLevel, options = {}) {
         sessionId,
         attemptId: 1
     };
+    const activeProviders = activeProviderIds(core);
+    const enabledProviders = ['codex-lb', 'openrouter']
+        .filter((providerId) => core.registry.profiles[providerId].enabled);
+    const textResults = requestedLevel !== 'shallow'
+        ? await Promise.all(activeProviders.map((providerId) => probeProviderText(core, providerId, status.service.loopback_origin, probeContext, options)))
+        : [];
     const results = [
         ...runBridgeProbeV3({
             ...probeContext,
@@ -40,18 +46,13 @@ export async function verifyDesktopBridgeV3(requestedLevel, options = {}) {
         }),
         nativeIdentityProbe(core, probeContext),
         combinedRoutePolicyProbe(core, probeContext),
-        combinedModelRouteProbe(core, status, probeContext)
+        combinedModelRouteProbe(core, status, probeContext, textResults)
     ];
-    const activeProviders = activeProviderIds(core);
-    const enabledProviders = ['codex-lb', 'openrouter']
-        .filter((providerId) => core.registry.profiles[providerId].enabled);
     for (const providerId of ['codex-lb', 'openrouter']) {
-        results.push(providerCredentialProbe(core, providerId, probeContext), providerAuthProbe(core, providerId, probeContext), providerModelRouteProbe(core, providerId, probeContext));
-    }
-    if (requestedLevel !== 'shallow') {
-        const textResults = await Promise.all(activeProviders.map((providerId) => probeProviderText(core, providerId, status.service.loopback_origin, probeContext, options)));
-        results.push(...textResults);
+        const liveText = textResults.find((result) => result.scope === `provider:${providerId}`) || null;
+        results.push(providerCredentialProbe(core, providerId, probeContext), providerAuthProbe(core, providerId, probeContext), providerModelRouteProbe(core, providerId, probeContext, liveText));
     }
+    results.push(...textResults);
     if (requestedLevel === 'deep') {
         const deepResults = await Promise.all(activeProviders.map((providerId) => probeProviderDeep(core, providerId, probeContext, options)));
         results.push(...deepResults.flat());

package/dist/core/codex-lb/desktop-service.js

@@ -354,13 +354,16 @@ export async function installAndStartDesktopBridgeService(options = {}) {
     const domain = launchDomain(options.uid);
     await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
     await removeStaleState(paths.state_path, options.processExists);
-    const bootstrap = await run(ctl, ['bootstrap', domain, paths.launch_agent_path], { timeoutMs: 10_000, maxOutputBytes: 32 * 1024 }).catch((error) => failedProcess(error));
+    const bootstrap = await bootstrapLaunchdWithRetry(options, domain, service, paths.launch_agent_path);
     if (bootstrap.code !== 0 && !bootstrap.timedOut)
         return failedStatus(paths, settings, service, 'missing', 'desktop_bridge_launchd_bootstrap_failed');
     await run(ctl, ['kickstart', '-k', service], { timeoutMs: 10_000, maxOutputBytes: 32 * 1024 }).catch(() => undefined);
     const status = await waitForBridge({ ...options, home });
     if (!status.ok) {
         await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
+        if (await launchTargetsProtectedFolder([command.executable, ...command.arguments], home)) {
+            return withProtectedFolderBlocker(status);
+        }
         return status;
     }
     try {
@@ -382,10 +385,14 @@ export async function bootstrapExistingDesktopBridgeService(options = {}) {
     const ctl = options.launchctl || '/bin/launchctl';
     const service = launchService(options.uid);
     await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
-    const result = await run(ctl, ['bootstrap', launchDomain(options.uid), paths.launch_agent_path], { timeoutMs: 10_000, maxOutputBytes: 32 * 1024 }).catch((error) => failedProcess(error));
+    const result = await bootstrapLaunchdWithRetry(options, launchDomain(options.uid), service, paths.launch_agent_path);
     if (result.code === 0 || result.timedOut)
         await run(ctl, ['kickstart', '-k', service], { timeoutMs: 10_000, maxOutputBytes: 32 * 1024 }).catch(() => undefined);
-    return waitForBridge({ ...options, home });
+    const status = await waitForBridge({ ...options, home });
+    if (!status.ok && await launchAgentTargetsProtectedFolder(paths.launch_agent_path, home)) {
+        return withProtectedFolderBlocker(status);
+    }
+    return status;
 }
 export async function stopDesktopBridgeService(options = {}) {
     const home = options.home || options.env?.HOME || process.env.HOME || os.homedir();
@@ -569,10 +576,56 @@ function launchService(uid) { return `${launchDomain(uid)}/${DESKTOP_BRIDGE_LAUN
 async function resolveLaunchCommand(options) { if (options.executablePath)
     return await exists(path.resolve(options.executablePath)) ? { executable: path.resolve(options.executablePath), arguments: [...(options.executableArguments || [])] } : null; const entry = String(process.argv[1] || ''); if (entry && ['sks', 'sneakoscope'].includes(path.basename(entry).replace(/\.js$/i, '')) && await exists(entry))
     return { executable: path.resolve(process.execPath), arguments: [path.resolve(entry)] }; const sks = await which('sks').catch(() => null); return sks ? { executable: path.resolve(sks), arguments: [] } : null; }
+function macosProtectedUserPath(target, home) {
+    if (!target)
+        return false;
+    return ['Desktop', 'Documents', 'Downloads']
+        .some((dir) => target.startsWith(`${path.resolve(home, dir)}${path.sep}`));
+}
+async function launchTargetsProtectedFolder(targets, home) {
+    const resolved = await Promise.all(targets.map(async (target) => {
+        try {
+            return await fsp.realpath(target);
+        }
+        catch {
+            return target;
+        }
+    }));
+    return resolved.some((target) => macosProtectedUserPath(target, home));
+}
+async function launchAgentTargetsProtectedFolder(plistPath, home) {
+    let text = '';
+    try {
+        text = await fsp.readFile(plistPath, 'utf8');
+    }
+    catch {
+        return false;
+    }
+    const targets = [...text.matchAll(/<string>([^<]+)<\/string>/g)].map((match) => match[1]);
+    return launchTargetsProtectedFolder(targets, home);
+}
+function withProtectedFolderBlocker(status) {
+    return { ...status, blockers: [...new Set([...status.blockers, 'desktop_bridge_entry_macos_protected_folder'])] };
+}
+export async function bootstrapLaunchdWithRetry(options, domain, service, plistPath) {
+    const run = options.run || runProcess;
+    const ctl = options.launchctl || '/bin/launchctl';
+    let result = { code: 1, timedOut: false };
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        if (attempt > 0)
+            await run(ctl, ['bootout', service], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => undefined);
+        for (let poll = 0; poll < 20 && (await inspectLaunchd(options, service)).loaded; poll += 1)
+            await delay(100);
+        result = await run(ctl, ['bootstrap', domain, plistPath], { timeoutMs: 10_000, maxOutputBytes: 32 * 1024 }).catch((error) => failedProcess(error));
+        if (result.code === 0 || result.timedOut)
+            return result;
+    }
+    return result;
+}
 async function inspectLaunchd(options, service) { if ((options.platform || process.platform) !== 'darwin')
     return { loaded: false, running: false }; const result = await (options.run || runProcess)(options.launchctl || '/bin/launchctl', ['print', service], { timeoutMs: 3_000, maxOutputBytes: 32 * 1024 }).catch(() => null); if (!result || result.code !== 0)
     return { loaded: false, running: false }; const text = `${result.stdout}\n${result.stderr}`; return { loaded: true, running: /state = running/.test(text) && /pid = \d+/.test(text) }; }
-async function waitForBridge(options) { let status = await desktopBridgeServiceStatus(options); for (let i = 0; i < 40 && !status.ok; i += 1) {
+async function waitForBridge(options) { let status = await desktopBridgeServiceStatus(options); for (let i = 0; i < 150 && !status.ok; i += 1) {
     await delay(100);
     status = await desktopBridgeServiceStatus(options);
 } return status; }

package/dist/core/codex-lb/route-index.js

@@ -35,6 +35,7 @@ export function buildBridgeRouteIndex(input) {
         const model = {
             ...source,
             public_id: publicId,
+            slug: source.slug || publicId,
             upstream_model: upstream,
             capabilities: unique(source.capabilities).sort(),
             route_key: providerRouteKey(source.provider_id, publicId)

package/dist/core/managed-assets/managed-assets-manifest.js

@@ -192,6 +192,7 @@ Verify with the narrowest compile, deterministic template, or live native check
         instructions: `You are the scoped Computer Use operator.
 
 Use Codex Computer Use only for the explicit native macOS, desktop-app, OS-settings, or non-web visual slice assigned by the parent.
+Do not target the hosting Codex Desktop app (com.openai.codex). For Codex-linked checks, observe Codex through structured host/process evidence and operate only the external native target.
 Do not replace judgment, debugging, planning, or security review; return captured evidence to the appropriate Sol Max specialist.
 Honor the parent permission scope, avoid destructive or irreversible UI actions, do not edit source files, and report exactly what was observed or changed.`
     }),

package/dist/core/release/canonical-test-proof.js

@@ -25,7 +25,7 @@ export function canonicalTestProofPath(root) {
 }
 export function canonicalTestFiles(root) {
     const compiled = discover(path.join(root, 'dist'), (file) => {
-        if (!file.endsWith('.test.js') || !file.includes(`${path.sep}__tests__${path.sep}`))
+        if (!isCurrentCompiledTest(root, file))
             return false;
         const relative = repoRelative(root, file);
         return relative.startsWith('dist/core/release/__tests__/') || CURRENT_COMPILED_TESTS.has(relative);
@@ -43,7 +43,7 @@ export function allCanonicalTestFiles(root) {
     unit.push(...discover(path.join(root, 'test', 'regression'), (file) => file.endsWith('.test.mjs')));
     unit.sort();
     return {
-        compiled: discover(path.join(root, 'dist'), (file) => file.endsWith('.test.js') && file.includes(`${path.sep}__tests__${path.sep}`)),
+        compiled: discover(path.join(root, 'dist'), (file) => isCurrentCompiledTest(root, file)),
         unit
     };
 }
@@ -150,6 +150,12 @@ function validCorpus(value) {
 function readPackage(root) {
     return JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
 }
+function isCurrentCompiledTest(root, file) {
+    if (!file.endsWith('.test.js') || !file.includes(`${path.sep}__tests__${path.sep}`))
+        return false;
+    const relative = path.relative(path.join(root, 'dist'), file);
+    return fs.existsSync(path.join(root, 'src', `${relative.slice(0, -'.js'.length)}.ts`));
+}
 function discover(dir, accept) {
     const out = [];
     if (!fs.existsSync(dir))

package/dist/core/routes/evidence.js

@@ -22,7 +22,7 @@ export const QA_INTERACTION_SURFACES = Object.freeze([
 ]);
 export const CODEX_QA_SURFACE_ROUTING_POLICY = `Codex QA surface routing follows the official Codex App split: use @Browser / in-app Browser (${CODEX_IN_APP_BROWSER_DOC_URL}) first for localhost, local development servers, file-backed previews, and public pages that do not require sign-in; use @Chrome / Codex Chrome Extension (${CODEX_CHROME_EXTENSION_DOC_URL}) for signed-in websites, cookies, browser profiles, extensions, existing tabs, or internal tools; use @Computer or @AppName (${CODEX_COMPUTER_USE_DOC_URL}) for native macOS/Windows apps, OS settings, cross-app workflows, and GUI-only bugs. Prefer structured Plugins/MCPs for repeatable data operations, then verify rendered user-visible results with Browser, Chrome, or Computer Use. Playwright, Selenium, Puppeteer, Chrome MCP, static screenshots, plugin cache, and final-agent prose are not Codex App live action proof. App Server evidence (${CODEX_APP_SERVER_DOC_URL}) must correlate thread, turn, item/tool events, approvals, diffs, actions, observations, findings, fixes, and same-flow replay before a real QA pass is claimed.`;
 export const CODEX_WEB_VERIFICATION_POLICY = CODEX_QA_SURFACE_ROUTING_POLICY;
-export const CODEX_COMPUTER_USE_ONLY_POLICY = `Codex Computer Use is a live GUI surface for supported macOS and Windows environments, invoked with @Computer or @AppName for native apps, OS settings, browser contexts that truly require GUI-level operation, and cross-app workflows. Do not replace @Browser localhost/public-page checks or @Chrome signed-in checks with Computer Use unless the surface router records a specific GUI-only/cross-app reason. If live Computer Use tools, permissions, or app access are unavailable, mark the affected native/GUI evidence blocked or unverified instead of fabricating screenshots or actions. Codex App readiness/config checks are capability evidence only, not target interaction proof.`;
+export const CODEX_COMPUTER_USE_ONLY_POLICY = `Codex Computer Use is a live GUI surface for supported macOS and Windows environments, invoked with @Computer or @AppName for native apps, OS settings, browser contexts that truly require GUI-level operation, and cross-app workflows. Computer Use must never target the hosting Codex Desktop app itself (com.openai.codex), because host self-control is outside the allowed safety boundary. For Codex-linked native QA, use structured App Server, process, or NSWorkspace evidence for the Codex side and direct Computer Use only at the external native target. Do not replace @Browser localhost/public-page checks or @Chrome signed-in checks with Computer Use unless the surface router records a specific GUI-only/cross-app reason. If live Computer Use tools, permissions, or app access are unavailable, mark the affected native/GUI evidence blocked or unverified instead of fabricating screenshots or actions. Codex App readiness/config checks are capability evidence only, not target interaction proof.`;
 export const IMAGEGEN_SOCIAL_SOURCE_POLICY = 'Use public X/social/community reports only as prompt-quality and workflow-sentiment hints after official OpenAI/Codex docs. Social posts are not capability specs, evidence of tool availability, or proof that a generated asset was created.';
 export const CODEX_IMAGEGEN_REQUIRED_POLICY = 'Pipeline image generation, raster asset creation/editing, and generated image-review evidence must use gpt-image-2 through the user-selected Codex provider when that evidence is required for full verification: Codex App imagegen/$imagegen, or the selected and ready codex-lb Responses provider. Only completed response output or a final response.output_item.done image result qualifies; streamed partial preview frames never count as generated-image evidence. For newest-model image requests, prompt explicitly for "ChatGPT Images 2.0 / GPT Image 2.0 with gpt-image-2" instead of relying on generic image-generation wording. Do not substitute placeholder SVG/HTML/CSS, prose-only critique, stock-like stand-ins, manually fabricated files, or missing-output ledgers for requested/generated raster assets or required generated review images. If imagegen/gpt-image-2 is unavailable or generated annotated images cannot be created/linked, record the blocker and cap any closeout at verified_partial/reference-only instead of claiming generated-image evidence or full route verification; that partial closeout requires source screenshots plus hashes, docs evidence, source Image Voxel anchors, and Honest Mode evidence. In Codex App prompts, invoke $imagegen when live image generation is needed; SKS hooks and skills can require the policy but cannot attach missing host image-generation tools to an already-started turn. Official OpenAI/Codex docs are authoritative for capabilities, surfaces, limits, and evidence rules; X/social/community reports may inform prompt style only.';
 export const DEFAULT_CODEX_APP_PLUGINS = Object.freeze([

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '8.3.0';
+export const PACKAGE_VERSION = '8.3.2';

package/dist/native/sks-menubar/Sources/CodexLifecyclePolicy.swift

@@ -0,0 +1,18 @@
+import Foundation
+
+enum CodexLifecyclePolicy {
+    static func followsCodex(from config: [String: Any]?) -> Bool {
+        if let current = config?["follow_codex_lifecycle"] as? Bool { return current }
+        return config?["quit_with_codex"] as? Bool == true
+    }
+
+    static func initialVisibility(followCodex: Bool, codexRunning: Bool) -> Bool {
+        !followCodex || codexRunning
+    }
+
+    static func visibilityAfterCodexLaunch() -> Bool { true }
+
+    static func visibilityAfterCodexTermination(followCodex: Bool) -> Bool {
+        !followCodex
+    }
+}

package/dist/native/sks-menubar/Sources/ProcessClient.swift

@@ -16,7 +16,9 @@ final class ProcessClient {
     private let actionScript: String
     private let logPath: String
     private let projectRoot: String
-    private let outputLimit = 64 * 1024
+    // Bridge status/repair JSON scales with the combined catalog (395+ models
+    // ≈ 120KB today); 64KB truncated every routing-aware command result.
+    private let outputLimit = 1024 * 1024
     private let processIdentityGuard: ProcessIdentityGuard
     private let ownedProcessRegistry: OwnedProcessRegistry
 

package/dist/native/sks-menubar/Sources/ProvidersRoutingTruth.swift

@@ -247,15 +247,22 @@ struct DesktopBridgeStatusV3Truth {
     private static let keys: Set<String> = [
         "schema", "checked_at", "correlation_id", "management", "service",
         "http_probe", "websocket_probe", "native_identity", "providers", "routing",
-        "catalog_sync", "capabilities", "readiness", "recovery_actions"
+        "catalog_sync", "capabilities", "readiness", "recovery_actions",
+        "ok", "execution_ok", "command_summary"
     ]
     let raw: [String: Any]
     let checkedAt: String
     let correlationId: String
     let capabilities: DesktopCapabilityReportV3?
 
+    // The envelope trio (ok/execution_ok/command_summary) exists on top-level
+    // `bridge status` output but NOT on the status object nested inside a
+    // command result, so it is allowed and type-checked — never required.
+    private static let envelopeKeys: Set<String> = ["ok", "execution_ok", "command_summary"]
+
     static func decode(from json: [String: Any]) throws -> DesktopBridgeStatusV3Truth {
-        guard Set(json.keys) == keys,
+        let required = keys.subtracting(envelopeKeys)
+        guard required.isSubset(of: Set(json.keys)), Set(json.keys).isSubset(of: keys),
               json["schema"] as? String == "sks.desktop-bridge-status.v3",
               let checkedAt = nonempty(json["checked_at"]), let correlationId = nonempty(json["correlation_id"]),
               let management = json["management"] as? [String: Any],
@@ -265,7 +272,10 @@ struct DesktopBridgeStatusV3Truth {
               let routing = json["routing"] as? [String: Any],
               let catalog = json["catalog_sync"] as? [String: Any],
               let readiness = json["readiness"] as? [String: Any],
-              json["recovery_actions"] is [String] else {
+              json["recovery_actions"] is [String],
+              json["ok"] == nil || json["ok"] is Bool,
+              json["execution_ok"] == nil || json["execution_ok"] is Bool,
+              json["command_summary"] == nil || nonempty(json["command_summary"]) != nil else {
             throw ProviderFacadeError.schemaInvalid("desktop_bridge_status_schema_invalid")
         }
         let managed = management["managed"] as? Bool == true
@@ -356,6 +366,70 @@ struct DesktopBridgeStatusV3Truth {
     }
 }
 
+struct DesktopBridgeCommandResultTruth: Equatable {
+    private static let keys: Set<String> = [
+        "schema", "operation", "operation_id", "correlation_id", "checked_at", "ok",
+        "execution", "readiness", "status", "result", "recovery_action",
+        "execution_ok", "command_summary"
+    ]
+    let completed: Bool
+    let blockers: [String]
+    let recoveryAction: String?
+
+    static func decode(from json: [String: Any], expectedOperation: String) throws -> DesktopBridgeCommandResultTruth {
+        guard Set(json.keys) == keys,
+              json["schema"] as? String == "sks.desktop-bridge-command-result.v1",
+              json["operation"] as? String == expectedOperation,
+              nonempty(json["operation_id"]) != nil,
+              nonempty(json["correlation_id"]) != nil,
+              nonempty(json["checked_at"]) != nil,
+              let topLevelOK = json["ok"] as? Bool,
+              let execution = json["execution"] as? [String: Any],
+              Set(execution.keys) == ["ok", "status", "blockers"],
+              let executionOK = execution["ok"] as? Bool,
+              let executionStatus = execution["status"] as? String,
+              ["completed", "partial", "failed"].contains(executionStatus),
+              let blockers = execution["blockers"] as? [String],
+              let readiness = json["readiness"] as? [String: Any],
+              Set(readiness.keys) == ["ready", "blockers", "warnings"],
+              readiness["ready"] is Bool,
+              readiness["blockers"] is [String],
+              readiness["warnings"] is [String],
+              (json["status"] is NSNull || json["status"] is [String: Any]),
+              let result = json["result"] as? [String: Any],
+              (json["recovery_action"] is NSNull || json["recovery_action"] is String),
+              json["execution_ok"] as? Bool == executionOK,
+              nonempty(json["command_summary"]) != nil,
+              topLevelOK == executionOK else {
+            throw ProviderFacadeError.schemaInvalid("desktop_bridge_command_result_schema_invalid")
+        }
+        let completed = topLevelOK && executionStatus == "completed" && blockers.isEmpty
+        let partial = topLevelOK && executionStatus == "partial" && !blockers.isEmpty
+        let failed = !topLevelOK && executionStatus == "failed"
+        guard completed || partial || failed else {
+            throw ProviderFacadeError.schemaInvalid("desktop_bridge_command_result_execution_invalid")
+        }
+        if completed && expectedOperation == "repair" {
+            guard let service = result["service"] as? [String: Any],
+                  service["ok"] as? Bool == true,
+                  service["running"] as? Bool == true else {
+                throw ProviderFacadeError.schemaInvalid("desktop_bridge_command_result_service_invalid")
+            }
+        }
+        return DesktopBridgeCommandResultTruth(
+            completed: completed,
+            blockers: blockers,
+            recoveryAction: json["recovery_action"] as? String
+        )
+    }
+
+    private static func nonempty(_ value: Any?) -> String? {
+        guard let string = value as? String else { return nil }
+        let trimmed = string.trimmingCharacters(in: .whitespacesAndNewlines)
+        return trimmed.isEmpty ? nil : trimmed
+    }
+}
+
 struct CapabilityDisplayRow: Equatable {
     let scope: CapabilityScope
     let capability: String
@@ -385,3 +459,20 @@ struct CapabilityDisplayRow: Equatable {
         return nil
     }
 }
+
+enum CapabilityDisplayFilter {
+    static func rows(_ rows: [CapabilityDisplayRow], showAll: Bool) -> [CapabilityDisplayRow] {
+        showAll ? rows : rows.filter { isIssue($0.state) }
+    }
+
+    static func issueCount(_ rows: [CapabilityDisplayRow]) -> Int {
+        rows.filter { isIssue($0.state) }.count
+    }
+
+    private static func isIssue(_ state: CapabilityProbeState) -> Bool {
+        switch state {
+        case .degraded, .blocked, .failed, .stale: return true
+        case .notAttempted, .running, .verified, .unsupported: return false
+        }
+    }
+}