sneakoscope 8.3.0 → 8.3.2

package/dist/native/sks-menubar/Sources/ProvidersViewController.swift

@@ -29,6 +29,7 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
     let capabilityStatus = NativeView.detail("Capabilities have not been verified.")
     let capabilityLastCheckedStatus = NativeView.detail("Last feature check: never")
     let capabilityStack = NSStackView()
+    var capabilityFilterButton: NSButton!
     let routeModelField: NSTextField = {
         let field = NSTextField(frame: NSRect(x: 0, y: 0, width: 250, height: 24))
         field.placeholderString = "Select or enter an exact catalog model"
@@ -55,6 +56,7 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
     var lastStatusCheckedAt: Date?
     var lastStatusCorrelationId: String?
     var providerEnabled = ["codex-lb": false, "openrouter": false]
+    var showAllCapabilities = false
 
     init(processClient: ProcessClient, operations: OperationCoordinator) {
         self.processClient = processClient; self.operations = operations
@@ -103,7 +105,9 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
     }
 
     private func makeCapabilityMatrixCard() -> NSBox {
-        let card = NativeView.card(title: "Capability Matrix", subtitle: "Each row keeps its own scope, route, OAuth requirement, stage, root cause, and allowlisted recovery. Deep-only work not run is not a failure.", views: [capabilityStatus, capabilityLastCheckedStatus, capabilityStack])
+        capabilityFilterButton = NativeView.button("Show All Capabilities", target: self, action: #selector(toggleCapabilityFilter))
+        capabilityFilterButton.setAccessibilityIdentifier("sks-provider-capability-filter")
+        let card = NativeView.card(title: "Capability Matrix", subtitle: "Issues are shown first. Expand the verified and not-attempted rows only when you need the full diagnostic trace.", views: [capabilityStatus, capabilityLastCheckedStatus, ControlKit.actionRow([capabilityFilterButton]), capabilityStack])
         card.setAccessibilityIdentifier("sks-provider-card-capability-matrix")
         return card
     }
@@ -120,17 +124,6 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
         if providerActionInFlight.isEmpty { globalSpinner.stopAnimation(nil) } else { globalSpinner.startAnimation(nil) }
     }
 
-    private func run(_ args: [String], title: String, kind: String, group: String?, timeout: TimeInterval = NativeView.mutationTimeout, completion: (() -> Void)? = nil) {
-        guard let snapshot = operations.begin(kind: kind, mutationGroup: group, summary: title) else { providerStatus.stringValue = "Another guarded mutation is running."; return }
-        setBusy(true)
-        _ = operations.update(snapshot, state: .running, stage: "running", progress: nil, summary: title)
-        processClient.run(args, timeout: timeout) { [weak self] result in
-            guard let self = self else { return }; self.setBusy(false)
-            _ = self.operations.update(snapshot, state: result.code == 0 ? .succeeded : .failed, stage: "complete", progress: 1, summary: result.code == 0 ? "\(title) completed" : "\(title) failed")
-            completion?()
-        }
-    }
-
     func refresh() {
         refreshCredentialHealth()
         processClient.run(["bridge", "status", "--json"], timeout: NativeView.statusTimeout) { [weak self] result in
@@ -234,7 +227,9 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
     private func renderCapabilityReport(_ report: DesktopCapabilityReportV3) {
         lastCapabilityReport = report
         capabilityStack.arrangedSubviews.forEach { capabilityStack.removeArrangedSubview($0); $0.removeFromSuperview() }
-        for row in CapabilityDisplayRow.rows(from: report) {
+        let allRows = CapabilityDisplayRow.rows(from: report)
+        let visibleRows = CapabilityDisplayFilter.rows(allRows, showAll: showAllCapabilities)
+        for row in visibleRows {
             let cause = row.rootCause.map { " · root cause \(ProviderSecretRedactor.redact($0))" } ?? ""
             let recoveryAction = row.recoveryAction.flatMap(ProviderRecoveryAction.init(rawValue:))
             let recovery = recoveryAction.map { " · recovery \($0.buttonTitle)" } ?? ""
@@ -250,8 +245,14 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
                 capabilityStack.addArrangedSubview(value)
             }
         }
+        if visibleRows.isEmpty {
+            capabilityStack.addArrangedSubview(NativeView.detail("No capability issues in this report. Show all capabilities to inspect the complete trace."))
+        }
+        capabilityFilterButton.title = showAllCapabilities ? "Show Issues Only" : "Show All Capabilities"
+        capabilityFilterButton.setAccessibilityLabel(capabilityFilterButton.title)
+        let issueCount = CapabilityDisplayFilter.issueCount(allRows)
         let satisfied = report.summary.levelSatisfied
-        capabilityStatus.stringValue = "\(report.requestedLevel.capitalized) diagnostic completed · readiness \(satisfied ? "satisfied" : "needs action") · full deep \(report.summary.fullFeatureVerified ? "verified" : "not verified")"
+        capabilityStatus.stringValue = "\(report.requestedLevel.capitalized) diagnostic completed · \(issueCount) issue\(issueCount == 1 ? "" : "s") · readiness \(satisfied ? "satisfied" : "needs action") · full deep \(report.summary.fullFeatureVerified ? "verified" : "not verified")"
         capabilityStatus.textColor = satisfied ? .systemGreen : .systemOrange
         capabilityLastCheckedStatus.stringValue = "Last feature check: \(report.checkedAt) · report \(report.reportId)"
         renderCatalogStatus(report.catalogSync)
@@ -261,7 +262,40 @@ final class ProvidersViewController: NSViewController, ControlCenterPage, NSText
         ProviderStatusColor.forState(state.rawValue)
     }
 
-    @objc private func repairDesktopBridge() { run(["bridge", "repair", "--json"], title: "Repair Desktop Bridge", kind: "bridge-repair", group: "codex-config") { [weak self] in self?.refresh() } }
+    @objc private func toggleCapabilityFilter() {
+        showAllCapabilities.toggle()
+        if let report = lastCapabilityReport { renderCapabilityReport(report) }
+    }
+
+    @objc private func repairDesktopBridge() {
+        guard let snapshot = operations.begin(kind: "bridge-repair", mutationGroup: "codex-config", summary: "Repair Desktop Bridge") else {
+            providerStatus.stringValue = "Another guarded mutation is running."
+            return
+        }
+        setBusy(true)
+        providerStatus.stringValue = "Desktop Bridge repair running…"
+        _ = operations.update(snapshot, state: .running, stage: "repairing", progress: nil, summary: "Repair Desktop Bridge")
+        processClient.run(["bridge", "repair", "--json"], timeout: NativeView.mutationTimeout) { [weak self] result in
+            guard let self = self else { return }
+            self.setBusy(false)
+            let parsed = self.json(result.output)
+            let truth = parsed.flatMap {
+                try? DesktopBridgeCommandResultTruth.decode(from: $0, expectedOperation: "repair")
+            }
+            let nativeError = parsed.flatMap { row -> String? in
+                row["schema"] as? String == "sks.native-process-error.v1" ? row["error"] as? String : nil
+            }
+            let completed = result.code == 0 && truth?.completed == true
+            let blocker = (truth?.blockers.first ?? nativeError).map(ProviderSecretRedactor.redact)
+            let summary = completed
+                ? "Repair Desktop Bridge completed"
+                : blocker.map { "Repair Desktop Bridge needs action · \($0)" } ?? "Repair Desktop Bridge result schema invalid"
+            _ = self.operations.update(snapshot, state: completed ? .succeeded : .failed, stage: "complete", progress: 1, summary: summary)
+            self.providerStatus.stringValue = summary
+            self.providerStatus.textColor = completed ? .systemGreen : .systemRed
+            self.refresh()
+        }
+    }
 
     @objc private func performRecoveryAction(_ sender: NSButton) {
         let prefix = "sks-provider-recovery-"

package/dist/native/sks-menubar/Sources/SKSKeychainStore.swift

@@ -153,8 +153,18 @@ final class SKSKeychainStore {
         return SKSKeychainReadResult(state: .available, secret: data)
     }
 
+    /// Status checks query item attributes only. The classic Keychain ACL
+    /// password dialog protects item *data*, not attributes, and it is NOT
+    /// suppressed by LAContext.interactionNotAllowed — so a status check that
+    /// requested kSecReturnData would beach-ball the app behind a system
+    /// password prompt whenever a rebuilt/resigned binary no longer matches
+    /// the stored item's ACL. Attributes-only presence can never prompt.
     func statusNonInteractive(_ credential: SKSKeychainCredential) -> SKSKeychainCredentialState {
-        readNonInteractive(credential).state
+        let result = client.copyMatching(statusQuery(for: credential))
+        guard result.status == errSecSuccess else {
+            return state(for: result.status)
+        }
+        return .available
     }
 
     /// Writing is permitted only after an explicit Center action. Callers cannot
@@ -301,6 +311,16 @@ final class SKSKeychainStore {
         ]
     }
 
+    private func statusQuery(for credential: SKSKeychainCredential) -> [String: Any] {
+        var query = identityQuery(for: credential)
+        let authenticationContext = LAContext()
+        authenticationContext.interactionNotAllowed = true
+        query[kSecReturnAttributes as String] = true
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecUseAuthenticationContext as String] = authenticationContext
+        return query
+    }
+
     private func readQuery(for credential: SKSKeychainCredential) -> [String: Any] {
         var query = identityQuery(for: credential)
         let authenticationContext = LAContext()

package/dist/native/sks-menubar/Sources/SettingsViewController.swift

@@ -9,20 +9,20 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
     }
 
     private let notifications: NotificationCoordinator
-    private let quitWithCodex = NSButton(checkboxWithTitle: "Quit SKS Menu when Codex quits", target: nil, action: nil)
+    private let followCodexLifecycle = NSButton(checkboxWithTitle: "Show SKS Menu only while Codex is running", target: nil, action: nil)
     private let status = NativeView.detail("Settings use the native app configuration file.")
     private var notificationButton: NSButton!
     init(notifications: NotificationCoordinator) { self.notifications = notifications; super.init(nibName: nil, bundle: nil) }
     required init?(coder: NSCoder) { nil }
 
     override func loadView() {
-        quitWithCodex.target = self; quitWithCodex.action = #selector(save)
-        quitWithCodex.setAccessibilityLabel("Quit SKS Menu when Codex quits")
+        followCodexLifecycle.target = self; followCodexLifecycle.action = #selector(save)
+        followCodexLifecycle.setAccessibilityLabel("Show SKS Menu only while Codex is running")
         notificationButton = NativeView.button("Enable Notifications", target: self, action: #selector(enableNotifications))
         let lifecycleCard = NativeView.card(
             title: "Codex lifecycle",
-            subtitle: "Off keeps the menu icon available on cold start and hides it only after a Codex session ends.",
-            views: [quitWithCodex]
+            subtitle: "On keeps a lightweight observer running, hides the icon when Codex is closed, and shows it automatically when Codex opens.",
+            views: [followCodexLifecycle]
         )
         let notificationsCard = NativeView.card(
             title: "Notifications",
@@ -39,13 +39,13 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
         let configResult = readConfig()
         switch configResult {
         case .loaded(let config):
-            quitWithCodex.isEnabled = true
-            quitWithCodex.state = config["quit_with_codex"] as? Bool == true ? .on : .off
+            followCodexLifecycle.isEnabled = true
+            followCodexLifecycle.state = CodexLifecyclePolicy.followsCodex(from: config) ? .on : .off
         case .missing:
-            quitWithCodex.isEnabled = true
-            quitWithCodex.state = .off
+            followCodexLifecycle.isEnabled = true
+            followCodexLifecycle.state = .off
         case .unreadable, .malformed:
-            quitWithCodex.isEnabled = false
+            followCodexLifecycle.isEnabled = false
         }
         if notifications.authorizationDenied {
             notificationButton.title = "Open Notification Settings…"
@@ -89,17 +89,18 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
         case .missing:
             config = [:]
         case .unreadable:
-            quitWithCodex.isEnabled = false
+            followCodexLifecycle.isEnabled = false
             status.stringValue = "Settings were not saved because the existing file cannot be read. No file was overwritten."
             return
         case .malformed:
-            quitWithCodex.isEnabled = false
+            followCodexLifecycle.isEnabled = false
             status.stringValue = "Settings were not saved because the existing file is malformed. No file was overwritten."
             return
         }
-        config["schema"] = "sks.sks-menubar-config.v1"
+        config["schema"] = "sks.sks-menubar-config.v2"
         config["codex_bundle_id"] = AppRuntime.codexBundleId as Any
-        config["quit_with_codex"] = quitWithCodex.state == .on
+        config["follow_codex_lifecycle"] = followCodexLifecycle.state == .on
+        config.removeValue(forKey: "quit_with_codex")
         guard JSONSerialization.isValidJSONObject(config), let data = try? JSONSerialization.data(withJSONObject: config, options: [.prettyPrinted]) else {
             status.stringValue = "Settings could not be encoded."
             return
@@ -116,9 +117,9 @@ final class SettingsViewController: NSViewController, ControlCenterPage {
                 try FileManager.default.moveItem(at: temporary, to: target)
             }
             try FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: target.path)
-            status.stringValue = quitWithCodex.state == .on
-                ? "Saved. SKS Menu will quit when Codex quits."
-                : "Saved. SKS Menu stays available on cold start; after a Codex session ends it hides until Codex returns."
+            status.stringValue = followCodexLifecycle.state == .on
+                ? "Saved. The observer stays running; the icon follows Codex without quitting."
+                : "Saved. SKS Menu stays visible whether Codex is open or closed."
         } catch {
             try? FileManager.default.removeItem(at: temporary)
             status.stringValue = "Settings could not be saved. Confirm \(directory.path) is writable."

package/dist/native/sks-menubar/Sources/StatusItemController.swift

@@ -74,7 +74,7 @@ final class StatusItemController: NSObject, NSMenuDelegate {
         menu.addItem(item("View Last Operation", #selector(viewLastOperation)))
         menu.addItem(item("Retry Last Operation", #selector(retryLastOperation)))
         menu.addItem(NSMenuItem.separator())
-        menu.addItem(item("Quit SKS Menu", #selector(quit)))
+        menu.addItem(item("Hide Until Codex Opens", #selector(hideUntilCodexOpens)))
         statusItem.menu = menu
         configureCodexLifecycle()
         refreshLocalState()
@@ -297,25 +297,25 @@ final class StatusItemController: NSObject, NSMenuDelegate {
 
     private func configureCodexLifecycle() {
         guard let bundle = AppRuntime.codexBundleId else { return }
-        // Keep the status item visible on cold start even when Codex is not
-        // running. Accessory apps have no Dock icon, so hiding before the first
-        // Codex session made Control Center unreachable after install/restart.
-        statusItem.isVisible = true
+        let config = readJson(path: AppRuntime.configPath)
+        let followCodex = CodexLifecyclePolicy.followsCodex(from: config)
+        let codexRunning = NSWorkspace.shared.runningApplications.contains { $0.bundleIdentifier == bundle }
+        statusItem.isVisible = CodexLifecyclePolicy.initialVisibility(
+            followCodex: followCodex,
+            codexRunning: codexRunning
+        )
         let center = NSWorkspace.shared.notificationCenter
         center.addObserver(forName: NSWorkspace.didLaunchApplicationNotification, object: nil, queue: .main) { [weak self] note in
             guard let app = note.userInfo?[NSWorkspace.applicationUserInfoKey] as? NSRunningApplication, app.bundleIdentifier == bundle else { return }
-            self?.statusItem.isVisible = true
+            self?.statusItem.isVisible = CodexLifecyclePolicy.visibilityAfterCodexLaunch()
+            self?.refreshLocalState()
         }
         center.addObserver(forName: NSWorkspace.didTerminateApplicationNotification, object: nil, queue: .main) { [weak self] note in
             guard let app = note.userInfo?[NSWorkspace.applicationUserInfoKey] as? NSRunningApplication, app.bundleIdentifier == bundle else { return }
             let config = self?.readJson(path: AppRuntime.configPath)
-            if config?["quit_with_codex"] as? Bool == true { NSApplication.shared.terminate(nil) }
-            else {
-                // Provider/proxy/network failure must not strand recovery behind
-                // a hidden accessory app. Keep settings and retry actions alive.
-                self?.statusItem.isVisible = true
-                self?.refreshLocalState()
-            }
+            let followCodex = CodexLifecyclePolicy.followsCodex(from: config)
+            self?.statusItem.isVisible = CodexLifecyclePolicy.visibilityAfterCodexTermination(followCodex: followCodex)
+            self?.refreshLocalState()
         }
     }
 
@@ -373,5 +373,5 @@ final class StatusItemController: NSObject, NSMenuDelegate {
         if FileManager.default.fileExists(atPath: AppRuntime.lastActionLogPath) { NSWorkspace.shared.open(URL(fileURLWithPath: AppRuntime.lastActionLogPath)) }
         else { openControlCenter(.overview) }
     }
-    @objc private func quit() { NSApplication.shared.terminate(nil) }
+    @objc private func hideUntilCodexOpens() { statusItem.isVisible = false }
 }

package/dist/scripts/canonical-test-runner.js

@@ -3,7 +3,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { spawn } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
 import { SKS_TEMP_LEASE_FILE, tmpdir, writeJsonAtomic } from '../core/fsx.js';
 import { allCanonicalTestFiles, canonicalTestCorpus, canonicalTestFiles, canonicalTestProofPath, RELEASE_HARNESS_REGRESSION_TESTS, sameCanonicalTestCorpus, writeCanonicalTestProof } from '../core/release/canonical-test-proof.js';
 import { releaseAuthorizationSnapshot, sameReleaseAuthorizationSnapshot } from '../core/release/release-authorization-snapshot.js';
@@ -148,6 +148,74 @@ function diffIsolatedCodexHome(before, after) {
     return breaches.sort();
 }
 const isolatedHomeBaseline = snapshotIsolatedCodexHome();
+const realMenuBarInstallDir = path.join(realHome, '.codex', 'sks-menubar');
+const realMenuBarLaunchAgentPath = path.join(realHome, 'Library', 'LaunchAgents', 'com.sneakoscope.sks-menubar.plist');
+const realMenuBarStableEntries = ['SKSMenuBar.app', 'build-stamp.json', 'sks-menubar-action.sh'];
+function snapshotRealMenuBarInstall() {
+    const out = new Map();
+    const record = (file) => {
+        try {
+            const stat = fs.lstatSync(file);
+            if (stat.isSymbolicLink()) {
+                out.set(path.relative(realHome, file), 'symlink');
+                return;
+            }
+            if (!stat.isFile())
+                return;
+            const hash = crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+            out.set(path.relative(realHome, file), `${(stat.mode & 0o777).toString(8)}:${hash}`);
+        }
+        catch { }
+    };
+    const walk = (dir) => {
+        let entries = [];
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const file = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                walk(file);
+            else
+                record(file);
+        }
+    };
+    for (const name of realMenuBarStableEntries) {
+        const target = path.join(realMenuBarInstallDir, name);
+        let directory = false;
+        try {
+            directory = fs.lstatSync(target).isDirectory();
+        }
+        catch {
+            continue;
+        }
+        if (directory)
+            walk(target);
+        else
+            record(target);
+    }
+    record(realMenuBarLaunchAgentPath);
+    return out;
+}
+function realMenuBarLaunchdLoaded() {
+    if (process.platform !== 'darwin' || typeof process.getuid !== 'function')
+        return null;
+    try {
+        execFileSync('/bin/launchctl', ['print', `gui/${process.getuid()}/com.sneakoscope.sks-menubar`], {
+            stdio: 'ignore',
+            timeout: 5_000
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const realMenuBarBaseline = snapshotRealMenuBarInstall();
+const realMenuBarLaunchdBaseline = realMenuBarLaunchdLoaded();
 const isolatedProcessGroup = process.platform !== 'win32';
 const childEnv = {
     ...process.env,
@@ -229,6 +297,13 @@ async function finalize(code, signal, spawnError) {
         clearTimeout(signalTimer);
     await settleChildTree();
     const homeBreaches = diffIsolatedCodexHome(isolatedHomeBaseline, snapshotIsolatedCodexHome());
+    const menubarBreaches = diffIsolatedCodexHome(realMenuBarBaseline, snapshotRealMenuBarInstall());
+    const realMenuBarLaunchdAfter = realMenuBarLaunchdLoaded();
+    if (realMenuBarLaunchdBaseline !== null && realMenuBarLaunchdAfter !== null && realMenuBarLaunchdBaseline !== realMenuBarLaunchdAfter) {
+        menubarBreaches.push(realMenuBarLaunchdBaseline
+            ? 'launchd_service_booted_out:com.sneakoscope.sks-menubar'
+            : 'launchd_service_bootstrapped:com.sneakoscope.sks-menubar');
+    }
     const cleanupError = await cleanup();
     removeSignalHandlers();
     if (spawnError)
@@ -240,8 +315,13 @@ async function finalize(code, signal, spawnError) {
         : null;
     if (breachError)
         console.error(breachError.message);
+    const menubarBreachError = menubarBreaches.length
+        ? new Error(`canonical_test_menubar_isolation_breach: a test mutated the real SKS Menu Bar install (${menubarBreaches.join(', ')})`)
+        : null;
+    if (menubarBreachError)
+        console.error(menubarBreachError.message);
     let proofError = null;
-    const successfulRun = code === 0 && !signal && !forwardedSignal && !spawnError && !cleanupError && !breachError;
+    const successfulRun = code === 0 && !signal && !forwardedSignal && !spawnError && !cleanupError && !breachError && !menubarBreachError;
     if (successfulRun && !allTestsRequested) {
         try {
             const finalAuthorization = releaseAuthorizationSnapshot(root, pkg);
@@ -272,7 +352,7 @@ async function finalize(code, signal, spawnError) {
     else if (signal)
         process.kill(process.pid, signal);
     else
-        process.exitCode = spawnError || cleanupError || breachError || proofError ? 1 : code;
+        process.exitCode = spawnError || cleanupError || breachError || menubarBreachError || proofError ? 1 : code;
 }
 function signalChildTree(signal) {
     const child = activeChild;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "8.3.0",
+  "version": "8.3.2",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",