sneakoscope 8.6.1 → 8.6.4

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 8.6.1** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 8.6.4** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "8.6.1"
+version = "8.6.4"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "8.6.1"
+version = "8.6.4"
 edition = "2021"
 
 [dependencies]

package/dist/commands/doctor.js

@@ -8,6 +8,9 @@ import { getCodexInfo } from '../core/codex-adapter.js';
 import { rustInfo } from '../core/rust-accelerator.js';
 import { codexAppIntegrationStatus } from '../core/codex-app.js';
 import { desktopBridgeStatusV3, executeDesktopBridgeCommandV3 } from '../core/codex-lb/desktop-controller-v3.js';
+import { bootstrapExistingDesktopBridgeService, desktopBridgeServiceStatus } from '../core/codex-lb/desktop-service.js';
+import { desktopBridgeRuntimeVersion, desktopBridgeRuntimeVersionStale } from '../core/codex-lb/desktop-bridge/state.js';
+import { PACKAGE_VERSION } from '../core/version.js';
 import { inspectCodexConfigReadability } from '../core/codex/codex-config-readability.js';
 import { inspectOAuthCallbackPortConflict, oauthCallbackDoctorGuidance } from '../core/codex/oauth-callback-port-diagnostic.js';
 import { inventoryCodexPermissionProfiles } from '../core/codex/codex-permission-profiles.js';
@@ -34,6 +37,28 @@ export { buildCodexAppUiDiagnosticFailure, buildRuntimeReadiness, formatCodexDoc
 export function doctorArgWarnings(args = []) {
     return baseDoctorArgWarnings(args);
 }
+export async function restartStaleDesktopBridgeRuntime(input) {
+    if (process.env.SKS_TEST_ISOLATION === '1' || process.env.SKS_RELEASE_UPGRADE_SMOKE === '1') {
+        return { restarted: false, warnings: [], blockers: [] };
+    }
+    const service = await desktopBridgeServiceStatus({ home: input.home }).catch(() => null);
+    if (!service?.running || !desktopBridgeRuntimeVersionStale(service.state)) {
+        return { restarted: false, warnings: [], blockers: [] };
+    }
+    const running = desktopBridgeRuntimeVersion(service.state) || 'pre-8.6.2';
+    if (!input.fix) {
+        return {
+            restarted: false,
+            warnings: [],
+            blockers: [`desktop_bridge_runtime_version_stale:${running}:${PACKAGE_VERSION}`]
+        };
+    }
+    const restarted = await bootstrapExistingDesktopBridgeService({ home: input.home }).catch(() => null);
+    const nowRunning = restarted?.running === true && !desktopBridgeRuntimeVersionStale(restarted.state);
+    return nowRunning
+        ? { restarted: true, warnings: [`desktop_bridge_runtime_restarted:${running}:${PACKAGE_VERSION}`], blockers: [] }
+        : { restarted: false, warnings: [], blockers: [`desktop_bridge_runtime_version_stale:${running}:${PACKAGE_VERSION}`] };
+}
 export function deferCommandAliasCleanupToMigrationReceipt(result) {
     const observedBlockers = Array.isArray(result?.blockers)
         ? result.blockers.map(String).filter(Boolean)
@@ -1008,11 +1033,18 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                             rollback_evidence: 'combined_catalog_previous_generation_preserved'
                         };
                         try {
+                            const restarted = await restartStaleDesktopBridgeRuntime({ home: root, fix: doctorFix });
                             const status = await desktopBridgeStatusV3({ home: root, env: process.env });
                             const blockers = (status?.readiness?.blockers || []).map(String);
                             const stale = blockers.filter((blocker) => blocker.endsWith('_catalog_stale'));
                             if (!status?.management?.managed || stale.length === 0) {
-                                return { ...base, ok: true, repaired: false, blockers: [] };
+                                return {
+                                    ...base,
+                                    ok: restarted.blockers.length === 0,
+                                    repaired: restarted.restarted,
+                                    warnings: restarted.warnings,
+                                    blockers: restarted.blockers
+                                };
                             }
                             const sync = await executeDesktopBridgeCommandV3({ operation: 'catalog.sync' }, { home: root, env: process.env });
                             const synced = sync?.ok === true && sync?.execution?.ok === true;

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "8.6.1",
+  "package_version": "8.6.4",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex/agent-config-file-repair.js

@@ -2,7 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
 import { SKS_MANAGED_CODEX_CONFIG_MARKER, backupInvalidToml, inspectOfficialSubagentToml, mergeOfficialSubagentConfigResult, officialSubagentConfigOwnershipProof, officialSubagentConfigWarnings, readInheritedOfficialSubagentConfigText } from '../subagents/official-subagent-config.js';
-import { writeCodexConfigGuarded } from './codex-config-guard.js';
+import { isCodexHomeConfigPath, writeCodexConfigGuarded } from './codex-config-guard.js';
 function unmanagedConfigOperatorAction(configPath) {
     return `Refused to modify ${configPath}: no SKS ownership proof. `
         + `If SKS owns this file, add the line \`${SKS_MANAGED_CODEX_CONFIG_MARKER}\` as its first line `
@@ -11,6 +11,31 @@ function unmanagedConfigOperatorAction(configPath) {
 export async function repairAgentConfigFileReferences(input) {
     const root = path.resolve(input.root);
     const configPath = path.join(root, '.codex', 'config.toml');
+    if (isCodexHomeConfigPath(configPath, {
+        ...(input.home ? { home: input.home } : {}),
+        ...(input.codexHome ? { codexHome: input.codexHome } : {})
+    })) {
+        return writeReport(input.reportPath, root, {
+            schema: 'sks.agent-config-file-repair.v1',
+            generated_at: nowIso(),
+            ok: true,
+            apply: input.apply === true,
+            config_path: configPath,
+            backup_path: null,
+            repaired_paths: [],
+            created_files: [],
+            removed_unsupported_fields: [],
+            skipped_unmanaged_paths: [configPath],
+            manual_required: false,
+            blockers: [],
+            warnings: ['project_config_is_codex_home_noop'],
+            operator_actions: [
+                `${configPath} is the global Codex config, not a project config — SKS left it untouched. `
+                    + 'Run `sks doctor` from a project directory so the project config is repaired instead.'
+            ],
+            ownership_proof: { owned: false, reasons: [] }
+        });
+    }
     const configExists = await fs.stat(configPath).then((stat) => stat.isFile()).catch(() => false);
     const original = configExists ? await fs.readFile(configPath, 'utf8').catch(() => '') : '';
     const manifest = await readJson(path.join(root, '.sneakoscope', 'manifest.json'), null);

package/dist/core/codex/codex-config-guard.js

@@ -1,7 +1,8 @@
+import os from 'node:os';
 import path from 'node:path';
 import fsp from 'node:fs/promises';
 import { randomBytes } from 'node:crypto';
-import { appendJsonl, ensureDir, nowIso, readText, sha256, writeTextAtomic } from '../fsx.js';
+import { appendJsonl, ensureDir, nowIso, readText, sameFilesystemPathSync, sha256, writeTextAtomic } from '../fsx.js';
 import { diffCodexAppUiSnapshots, snapshotCodexAppUiState } from '../codex-app/codex-app-ui-state-snapshot.js';
 import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from './codex-config-toml.js';
 import { hasManagedAgentsConfigFingerprint } from '../subagents/official-subagent-config.js';
@@ -574,6 +575,11 @@ export function ensureTrailingNewline(text = '') {
 export function isProjectCodexConfig(root, configPath) {
     return path.resolve(configPath) === path.resolve(root, '.codex', 'config.toml');
 }
+export function isCodexHomeConfigPath(configPath, opts = {}) {
+    const home = opts.home || process.env.HOME || os.homedir();
+    const codexHome = opts.codexHome || process.env.CODEX_HOME || path.join(home, '.codex');
+    return sameFilesystemPathSync(path.resolve(configPath), path.resolve(codexHome, 'config.toml'));
+}
 export function hasSksManagedCodexConfigMarker(text) {
     const source = String(text || '');
     return hasExplicitSksManagedCodexConfigMarker(source)

package/dist/core/codex-lb/desktop-bridge/rejection-log.js

@@ -0,0 +1,74 @@
+import { PACKAGE_VERSION } from '../../version.js';
+export const DESKTOP_BRIDGE_LOG_SCHEMA = 'sks.desktop-bridge-log.v2';
+export const REJECTION_LOG_BURST = 5;
+export const REJECTION_LOG_SUMMARY_INTERVAL_MS = 60_000;
+function safePathname(url) {
+    const raw = String(url || '').trim();
+    if (!raw.startsWith('/'))
+        return null;
+    const pathname = raw.split(/[?#]/)[0] || '';
+    if (!pathname || pathname.length > 512 || /[\r\n\0]/.test(pathname))
+        return null;
+    return pathname
+        .split('/')
+        .map((segment) => (segment.length >= 24 && /^[A-Za-z0-9_-]+$/.test(segment) ? '<redacted>' : segment))
+        .join('/');
+}
+function safeMethod(method) {
+    const value = String(method || '').trim().toUpperCase();
+    return /^[A-Z]{3,10}$/.test(value) ? value : null;
+}
+export function createDesktopBridgeRejectionLogger(options = {}) {
+    const write = options.write || ((line) => process.stdout.write(line));
+    const now = options.now || (() => Date.now());
+    const burst = Math.max(1, options.burst ?? REJECTION_LOG_BURST);
+    const summaryIntervalMs = Math.max(1_000, options.summaryIntervalMs ?? REJECTION_LOG_SUMMARY_INTERVAL_MS);
+    const windows = new Map();
+    function emit(payload) {
+        try {
+            write(`${JSON.stringify({
+                schema: DESKTOP_BRIDGE_LOG_SCHEMA,
+                sks_version: PACKAGE_VERSION,
+                secret_fields_redacted: true,
+                ...payload,
+            })}\n`);
+        }
+        catch {
+        }
+    }
+    return function logRejection(event) {
+        const code = String(event.code || 'bridge_rejected').slice(0, 128).replace(/[\r\n\0]/g, '');
+        const at = now();
+        const window = windows.get(code) || { emitted: 0, suppressed: 0, windowStartedMs: at };
+        if (at - window.windowStartedMs >= summaryIntervalMs) {
+            if (window.suppressed > 0) {
+                emit({
+                    event: 'sks.desktop_bridge.rejected_summary',
+                    code,
+                    suppressed: window.suppressed,
+                    window_ms: at - window.windowStartedMs,
+                });
+            }
+            window.emitted = 0;
+            window.suppressed = 0;
+            window.windowStartedMs = at;
+        }
+        if (window.emitted >= burst) {
+            window.suppressed += 1;
+            windows.set(code, window);
+            return;
+        }
+        window.emitted += 1;
+        windows.set(code, window);
+        const pathname = safePathname(event.url);
+        const method = safeMethod(event.method);
+        emit({
+            event: 'sks.desktop_bridge.rejected',
+            code,
+            transport: event.transport,
+            ...(method ? { method } : {}),
+            ...(pathname ? { pathname } : {}),
+            ...(Number.isInteger(event.status) ? { status: event.status } : {}),
+        });
+    };
+}

package/dist/core/codex-lb/desktop-bridge/security.js

@@ -284,7 +284,7 @@ function sameSessionPin(left, right) {
         && left.catalog_generation === right.catalog_generation
         && left.route_policy_generation === right.route_policy_generation;
 }
-function canonicalSessionId(value) {
+export function canonicalSessionId(value) {
     const sessionId = typeof value === 'string' ? value.trim() : '';
     if (!sessionId || sessionId.length > 256 || !/^[A-Za-z0-9._:/-]+$/.test(sessionId)) {
         throw new DesktopBridgeError('bridge_session_id_invalid');

package/dist/core/codex-lb/desktop-bridge/server.js

@@ -2,6 +2,7 @@ import { createHash, randomInt, timingSafeEqual } from 'node:crypto';
 import http, {} from 'node:http';
 import net, {} from 'node:net';
 import { forwardHttp, prepareDesktopBridgeRequest } from './http-forward.js';
+import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { assertAllowedOrigin, assertAllowedPath, assertLoopbackPeer, assertLoopbackListenHost, assertWebSocketUpgrade, prepareDesktopBridgeConfig, safeBridgeErrorCode, validatePreparedDesktopBridgeConfig, } from './security.js';
 import { createDesktopBridgePublicState, desktopBridgeListenOrigin, desktopBridgeStatePath, refreshDesktopBridgeState, removeDesktopBridgeStateIfOwned, writeDesktopBridgeState, } from './state.js';
 import { DesktopBridgeError } from './types.js';
@@ -103,12 +104,21 @@ function rejectionStatusText(status) {
         return 'Service Unavailable';
     return 'Bad Request';
 }
-function writeBridgeRejection(res, error) {
+const logBridgeRejection = createDesktopBridgeRejectionLogger();
+function writeBridgeRejection(res, error, req) {
+    const rejectedCode = safeBridgeErrorCode(error);
+    logBridgeRejection({
+        code: rejectedCode,
+        transport: 'http',
+        method: req?.method,
+        url: req?.url,
+        status: rejectionStatus(rejectedCode),
+    });
     if (res.headersSent) {
         res.destroy(error instanceof Error ? error : undefined);
         return;
     }
-    const code = safeBridgeErrorCode(error);
+    const code = rejectedCode;
     res.writeHead(rejectionStatus(code), {
         'content-type': 'application/json',
         'cache-control': 'no-store',
@@ -116,7 +126,14 @@ function writeBridgeRejection(res, error) {
     });
     res.end(JSON.stringify({ error: { type: 'sks_bridge_rejection', code, message: code } }));
 }
-function writeUpgradeRejection(socket, error) {
+function writeUpgradeRejection(socket, error, req) {
+    logBridgeRejection({
+        code: safeBridgeErrorCode(error),
+        transport: 'websocket',
+        method: req?.method,
+        url: req?.url,
+        status: rejectionStatus(safeBridgeErrorCode(error)),
+    });
     socket.on('error', () => undefined);
     if (socket.destroyed || socket.writableEnded)
         return;
@@ -235,7 +252,7 @@ export async function startPreparedDesktopBridge(input, options = {}) {
                     if (!req.complete)
                         req.destroy();
                 });
-                writeBridgeRejection(res, error);
+                writeBridgeRejection(res, error, req);
             }
             finally {
                 if (admitted)
@@ -266,10 +283,10 @@ export async function startPreparedDesktopBridge(input, options = {}) {
                 return;
             }
             assertAllowedPath(authenticated.pathname, input.allowedPathPrefixes);
-            void forwardWebSocket(req, socket, head, input, `${desktopBridgeListenOrigin(input)}${authenticated.clientBasePath}`).catch((error) => writeUpgradeRejection(socket, error));
+            void forwardWebSocket(req, socket, head, input, `${desktopBridgeListenOrigin(input)}${authenticated.clientBasePath}`).catch((error) => writeUpgradeRejection(socket, error, req));
         }
         catch (error) {
-            writeUpgradeRejection(socket, error);
+            writeUpgradeRejection(socket, error, req);
         }
     });
     await listenExact(server, input.listenHost, input.listenPort);

package/dist/core/codex-lb/desktop-bridge/state.js

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { PACKAGE_VERSION } from '../../version.js';
 import { DESKTOP_BRIDGE_STATE_SCHEMA, DesktopBridgeError } from './types.js';
 const DEFAULT_FRESHNESS_MS = 5 * 60_000;
 export function desktopBridgeStatePath(home = os.homedir()) {
@@ -38,8 +39,18 @@ export function createDesktopBridgePublicState(config, options = {}) {
         provider_registry_generation: registry.generation, route_policy_generation: config.routePolicy.policy_generation,
         catalog_generation: config.routePolicy.catalog_generation, enabled_providers: enabled,
         provider_credential_generations: credentialGenerations, last_verified_probe_ids: [], config_generation: desktopBridgeConfigGeneration(config),
+        sks_version: PACKAGE_VERSION,
     };
 }
+export function desktopBridgeRuntimeVersion(state) {
+    const version = state?.sks_version;
+    return typeof version === 'string' && version.trim() ? version.trim() : null;
+}
+export function desktopBridgeRuntimeVersionStale(state, installed = PACKAGE_VERSION) {
+    if (!state)
+        return false;
+    return desktopBridgeRuntimeVersion(state) !== installed;
+}
 function isGeneration(value) { return typeof value === 'string' && value.length > 0 && value.length <= 256 && !/[\r\n\0]/.test(value); }
 export function isDesktopBridgePublicState(value) {
     if (!value || typeof value !== 'object')

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -2,8 +2,9 @@ import { createHash, randomBytes } from 'node:crypto';
 import net from 'node:net';
 import tls from 'node:tls';
 import { buildProviderWebSocketHeaders } from './header-policy.js';
+import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { rewriteLocationHeader } from './location-rewrite.js';
-import { resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, singleBridgeHeader } from './security.js';
+import { resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader, canonicalSessionId } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
 import { DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL, DesktopBridgeError, } from './types.js';
 const MAX_HEAD = 64 * 1024;
@@ -64,10 +65,28 @@ function rewriteUpgradeResponseHead(head, providerBaseUrl, localOrigin) {
     }
     return Buffer.from(`${output.join('\r\n')}\r\n\r\n`, 'latin1');
 }
+function websocketPinnedModel(threadId, config) {
+    if (!threadId)
+        return null;
+    let canonical;
+    try {
+        canonical = canonicalSessionId(threadId);
+    }
+    catch {
+        return null;
+    }
+    const pin = config.providerSessionPins.find((entry) => entry.thread_id === canonical);
+    return pin?.public_model || null;
+}
 export async function prepareDesktopBridgeWebSocketRequest(req, config) {
     const sessionIdentity = resolveCodexSessionIdentity(req.headers);
+    const pinnedModel = websocketPinnedModel(sessionIdentity.thread_id, config);
+    const publicModel = singleBridgeHeader(req.headers, 'x-sks-model') || pinnedModel || '';
+    if (!publicModel) {
+        throw new DesktopBridgeError('bridge_websocket_route_unresolvable');
+    }
     const route = await resolveAndBindDesktopBridgeRouteContext({
-        public_model: singleBridgeHeader(req.headers, 'x-sks-model') || '',
+        public_model: publicModel,
         session_id: sessionIdentity.thread_id,
         pathname: new URL(req.url || '/', 'http://bridge.invalid').pathname,
         transport: 'websocket', headers: req.headers,
@@ -82,9 +101,28 @@ export async function prepareDesktopBridgeWebSocketRequest(req, config) {
     }
     return { route, provider, credential };
 }
-function writeUpgradeFailure(client) {
-    if (!client.destroyed)
-        client.end('HTTP/1.1 502 Bad Gateway\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n{"error":{"type":"sks_bridge_error","code":"bridge_websocket_upstream_unavailable"}}');
+const logWebSocketRejection = createDesktopBridgeRejectionLogger();
+const PERMANENT_UPGRADE_REFUSALS = new Set([
+    'bridge_websocket_route_unresolvable',
+    'catalog_model_route_missing',
+    'bridge_provider_route_unavailable',
+]);
+function writeUpgradeFailure(client, error, req) {
+    const code = safeBridgeErrorCode(error) || 'bridge_websocket_upstream_unavailable';
+    const permanent = PERMANENT_UPGRADE_REFUSALS.has(code);
+    const status = permanent ? 501 : 502;
+    const reason = permanent ? 'Not Implemented' : 'Bad Gateway';
+    logWebSocketRejection({
+        code,
+        transport: 'websocket',
+        ...(req?.method === undefined ? {} : { method: req.method }),
+        ...(req?.url === undefined ? {} : { url: req.url }),
+        status,
+    });
+    if (client.destroyed)
+        return;
+    client.end(`HTTP/1.1 ${status} ${reason}\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n`
+        + JSON.stringify({ error: { type: 'sks_bridge_error', code, retryable: !permanent } }));
 }
 export async function forwardWebSocket(req, client, head, config, authenticatedLocalBaseUrl = desktopBridgeListenOrigin(config)) {
     let prepared;
@@ -92,7 +130,7 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         prepared = await prepareDesktopBridgeWebSocketRequest(req, config);
     }
     catch (error) {
-        writeUpgradeFailure(client);
+        writeUpgradeFailure(client, error, req);
         throw error;
     }
     const { provider, credential } = prepared;
@@ -106,15 +144,22 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
     let response = Buffer.alloc(0);
     const timer = setTimeout(() => upstream.destroy(new DesktopBridgeError('bridge_upstream_connect_timeout')), config.connectTimeoutMs);
     timer.unref();
-    const fail = () => { clearTimeout(timer); if (!connected)
-        writeUpgradeFailure(client);
+    const fail = (error) => { clearTimeout(timer); if (!connected)
+        writeUpgradeFailure(client, error, req);
     else
         client.destroy(); };
     const onConnected = () => {
         connected = true;
         clearTimeout(timer);
         upstream.setNoDelay(true);
-        upstream.setTimeout(config.idleTimeoutMs, () => upstream.destroy());
+        upstream.setTimeout(config.idleTimeoutMs, () => {
+            logWebSocketRejection({
+                code: 'bridge_websocket_upstream_idle_timeout',
+                transport: 'websocket',
+                ...(req.url === undefined ? {} : { url: req.url }),
+            });
+            upstream.destroy(new DesktopBridgeError('bridge_websocket_upstream_idle_timeout'));
+        });
         const headers = buildProviderWebSocketHeaders(req.headers, { providerId: provider.provider_id, authTransport: provider.auth_transport, credential }, target.host);
         upstream.write([`${req.method || 'GET'} ${target.pathname}${target.search} HTTP/1.1`, ...serializeHeaders(headers), '', ''].join('\r\n'));
         if (head.length)
@@ -150,7 +195,7 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         upstream.once('secureConnect', onConnected);
     else
         upstream.once('connect', onConnected);
-    upstream.once('error', fail);
+    upstream.once('error', (error) => fail(error));
     upstream.once('close', () => { clearTimeout(timer); if (!client.destroyed)
         client.end(); });
     client.once('error', () => upstream.destroy());

package/dist/core/codex-lb/desktop-service.js

@@ -9,6 +9,8 @@ import { loadCodexLbEnv } from './codex-lb-env.js';
 import { resolveOpenRouterApiKey } from '../providers/openrouter/openrouter-secret-store.js';
 import { cleanupRetiredDesktopBridgeRuntime, prepareRetiredDesktopBridgeRuntime, } from './desktop-bridge-migration/retired-runtime-cleanup.js';
 import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, sha256Stable } from './route-index.js';
+import { desktopBridgeRuntimeVersion, desktopBridgeRuntimeVersionStale } from './desktop-bridge/state.js';
+import { PACKAGE_VERSION } from '../version.js';
 import { DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, DESKTOP_BRIDGE_LAUNCHD_LABEL, desktopBridgeConfigGeneration, desktopBridgeLaunchdPlistPath, desktopBridgeProcessExists, desktopBridgeStatePath, getDesktopBridgeStatus, preflightDesktopBridge, readDesktopBridgeState, safeBridgeErrorCode, writeDesktopBridgeLaunchdPlist, selectAvailableDesktopBridgePort, startPreparedDesktopBridge, DESKTOP_BRIDGE_STATE_SCHEMA, DesktopBridgeError, } from './desktop-bridge/index.js';
 export const DEFAULT_DESKTOP_BRIDGE_HOST = '127.0.0.1';
 export const DEFAULT_DESKTOP_BRIDGE_PORT = 49_152;
@@ -307,6 +309,9 @@ export async function desktopBridgeServiceStatus(options = {}) {
         blockers.push(bridgeStatusBlocker(bridge));
     if (launchd.loaded && !launchd.running)
         blockers.push('desktop_bridge_launchd_not_running');
+    if (bridge.status === 'running' && desktopBridgeRuntimeVersionStale(bridge.state)) {
+        blockers.push(`desktop_bridge_runtime_version_stale:${desktopBridgeRuntimeVersion(bridge.state) || 'pre-8.6.2'}:${PACKAGE_VERSION}`);
+    }
     return { schema: DESKTOP_BRIDGE_SERVICE_SCHEMA, ok: bridge.status === 'running' && blockers.length === 0, supported: true, installed: await exists(paths.launch_agent_path), loaded: launchd.loaded, running: bridge.status === 'running', status: !settings ? 'settings_missing' : blockers.some((b) => b.includes('credential')) ? 'credentials_unavailable' : bridge.status, service, paths, state: bridge.state, settings, expected_config_generation: expected, credential_source: source, credential_sources: sources, blockers: [...new Set(blockers.filter(Boolean))] };
 }
 export async function installAndStartDesktopBridgeService(options = {}) {

package/dist/core/release/publish-registry-auth.js

@@ -0,0 +1,104 @@
+import { spawnSync } from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+export const NPM_REGISTRY = 'https://registry.npmjs.org/';
+function npmBinary() {
+    return process.platform === 'win32' ? 'npm.cmd' : 'npm';
+}
+function registryReadEnv() {
+    const env = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (/^npm_config_/i.test(key) && !/^npm_config_(?:registry|cache|userconfig|globalconfig|prefix)$/i.test(key))
+            continue;
+        if (/^npm_(?:command|lifecycle_event|package_)/i.test(key))
+            continue;
+        env[key] = value;
+    }
+    env.npm_config_registry = NPM_REGISTRY;
+    env.npm_config_cache = process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache');
+    return env;
+}
+function runNpm(args, timeoutMs = 30_000) {
+    return spawnSync(npmBinary(), [...args], {
+        encoding: 'utf8',
+        timeout: timeoutMs,
+        env: registryReadEnv(),
+        stdio: ['ignore', 'pipe', 'pipe']
+    });
+}
+function normalizeNpmUser(value) {
+    const user = String(value || '').trim().split('\n').pop()?.trim() || '';
+    return /^[A-Za-z0-9._~-]{1,128}$/.test(user) ? user : null;
+}
+function maintainerLogins(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        const rows = Array.isArray(parsed) ? parsed : [parsed];
+        return rows
+            .map((row) => (typeof row === 'string' ? row.split('<')[0] : row?.name))
+            .map((login) => String(login || '').trim())
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+export function inspectPublishRegistryAuth(input = {}) {
+    const base = {
+        schema: 'sks.publish-registry-auth.v1',
+        registry: NPM_REGISTRY,
+        package: input.packageName || null,
+        npm_user: null,
+        maintainers: [],
+        blockers: [],
+        operator_actions: []
+    };
+    if (input.publishing === false) {
+        return { ...base, ok: true, status: 'skipped_not_publishing' };
+    }
+    if (String(process.env.SKS_PUBLISH_AUTH_MODE || 'token').trim().toLowerCase() === 'trusted-publisher') {
+        return { ...base, ok: true, status: 'skipped_trusted_publisher' };
+    }
+    if (process.env.SKS_SKIP_REGISTRY_NETWORK_CHECK === '1') {
+        return { ...base, ok: true, status: 'skipped_offline' };
+    }
+    const whoami = runNpm(['whoami', '--registry', NPM_REGISTRY]);
+    const user = whoami.status === 0 ? normalizeNpmUser(whoami.stdout) : null;
+    if (!user) {
+        return {
+            ...base,
+            ok: false,
+            status: 'unauthenticated',
+            blockers: ['npm_publish_auth_missing_or_expired'],
+            operator_actions: [
+                `Not authenticated to ${NPM_REGISTRY}. Run \`npm login --registry ${NPM_REGISTRY}\` and publish again.`,
+                'npm answers an unauthorized publish with 404, not 401, so this would otherwise surface as '
+                    + '"404 Not Found - PUT" after the whole tarball had already been built.'
+            ]
+        };
+    }
+    const maintainers = input.packageName
+        ? maintainerLogins(runNpm(['view', input.packageName, 'maintainers', '--json', '--registry', NPM_REGISTRY]).stdout || '')
+        : [];
+    if (maintainers.length > 0 && !maintainers.includes(user)) {
+        return {
+            ...base,
+            ok: false,
+            status: 'not_a_maintainer',
+            npm_user: user,
+            maintainers,
+            blockers: ['npm_publish_user_is_not_a_maintainer'],
+            operator_actions: [
+                `Authenticated as \`${user}\`, who is not a maintainer of ${input.packageName} `
+                    + `(${maintainers.join(', ')}). Log in as a maintainer, or have an owner run `
+                    + `\`npm owner add ${user} ${input.packageName}\`.`
+            ]
+        };
+    }
+    return { ...base, ok: true, status: 'authenticated', npm_user: user, maintainers };
+}
+export function isRealNpmPublish(env = process.env) {
+    if (String(env.npm_command || '').trim() !== 'publish')
+        return false;
+    return String(env.npm_config_dry_run || '').trim() !== 'true';
+}

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '8.6.1';
+export const PACKAGE_VERSION = '8.6.4';

package/dist/scripts/publish-preflight.js

@@ -1,15 +1,39 @@
 #!/usr/bin/env node
+import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { inspectPublishPreflight } from '../core/release/publish-preflight.js';
+import { inspectPublishRegistryAuth, isRealNpmPublish } from '../core/release/publish-registry-auth.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const report = inspectPublishPreflight({
     root,
     requireReleaseTag: false,
     requirePhysicalReleaseGates: false,
 });
-console.log(JSON.stringify(report, null, 2));
+const publishing = isRealNpmPublish();
+const packageName = (() => {
+    try {
+        return String(JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).name || '') || null;
+    }
+    catch {
+        return null;
+    }
+})();
+const registryAuth = inspectPublishRegistryAuth({ packageName, publishing });
+const combined = {
+    ...report,
+    registry_auth: registryAuth,
+    ok: report.ok && registryAuth.ok,
+    blockers: [...report.blockers, ...registryAuth.blockers],
+};
+console.log(JSON.stringify(combined, null, 2));
 if (!report.ok) {
     console.error(`npm publish blocked by reproducibility preflight: ${report.blockers.join(', ')}`);
-    process.exitCode = 1;
 }
+if (!registryAuth.ok) {
+    console.error(`npm publish blocked by registry auth: ${registryAuth.blockers.join(', ')}`);
+    for (const action of registryAuth.operator_actions)
+        console.error(action);
+}
+if (!combined.ok)
+    process.exitCode = 1;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "8.6.1",
+  "version": "8.6.4",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",