sneakoscope 8.6.3 → 8.6.4

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 8.6.3** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 8.6.4** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "8.6.3"
+version = "8.6.4"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "8.6.3"
+version = "8.6.4"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "8.6.3",
+  "package_version": "8.6.4",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-lb/desktop-bridge/security.js

@@ -284,7 +284,7 @@ function sameSessionPin(left, right) {
         && left.catalog_generation === right.catalog_generation
         && left.route_policy_generation === right.route_policy_generation;
 }
-function canonicalSessionId(value) {
+export function canonicalSessionId(value) {
     const sessionId = typeof value === 'string' ? value.trim() : '';
     if (!sessionId || sessionId.length > 256 || !/^[A-Za-z0-9._:/-]+$/.test(sessionId)) {
         throw new DesktopBridgeError('bridge_session_id_invalid');

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -2,8 +2,9 @@ import { createHash, randomBytes } from 'node:crypto';
 import net from 'node:net';
 import tls from 'node:tls';
 import { buildProviderWebSocketHeaders } from './header-policy.js';
+import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { rewriteLocationHeader } from './location-rewrite.js';
-import { resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, singleBridgeHeader } from './security.js';
+import { resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader, canonicalSessionId } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
 import { DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL, DesktopBridgeError, } from './types.js';
 const MAX_HEAD = 64 * 1024;
@@ -64,10 +65,28 @@ function rewriteUpgradeResponseHead(head, providerBaseUrl, localOrigin) {
     }
     return Buffer.from(`${output.join('\r\n')}\r\n\r\n`, 'latin1');
 }
+function websocketPinnedModel(threadId, config) {
+    if (!threadId)
+        return null;
+    let canonical;
+    try {
+        canonical = canonicalSessionId(threadId);
+    }
+    catch {
+        return null;
+    }
+    const pin = config.providerSessionPins.find((entry) => entry.thread_id === canonical);
+    return pin?.public_model || null;
+}
 export async function prepareDesktopBridgeWebSocketRequest(req, config) {
     const sessionIdentity = resolveCodexSessionIdentity(req.headers);
+    const pinnedModel = websocketPinnedModel(sessionIdentity.thread_id, config);
+    const publicModel = singleBridgeHeader(req.headers, 'x-sks-model') || pinnedModel || '';
+    if (!publicModel) {
+        throw new DesktopBridgeError('bridge_websocket_route_unresolvable');
+    }
     const route = await resolveAndBindDesktopBridgeRouteContext({
-        public_model: singleBridgeHeader(req.headers, 'x-sks-model') || '',
+        public_model: publicModel,
         session_id: sessionIdentity.thread_id,
         pathname: new URL(req.url || '/', 'http://bridge.invalid').pathname,
         transport: 'websocket', headers: req.headers,
@@ -82,9 +101,28 @@ export async function prepareDesktopBridgeWebSocketRequest(req, config) {
     }
     return { route, provider, credential };
 }
-function writeUpgradeFailure(client) {
-    if (!client.destroyed)
-        client.end('HTTP/1.1 502 Bad Gateway\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n{"error":{"type":"sks_bridge_error","code":"bridge_websocket_upstream_unavailable"}}');
+const logWebSocketRejection = createDesktopBridgeRejectionLogger();
+const PERMANENT_UPGRADE_REFUSALS = new Set([
+    'bridge_websocket_route_unresolvable',
+    'catalog_model_route_missing',
+    'bridge_provider_route_unavailable',
+]);
+function writeUpgradeFailure(client, error, req) {
+    const code = safeBridgeErrorCode(error) || 'bridge_websocket_upstream_unavailable';
+    const permanent = PERMANENT_UPGRADE_REFUSALS.has(code);
+    const status = permanent ? 501 : 502;
+    const reason = permanent ? 'Not Implemented' : 'Bad Gateway';
+    logWebSocketRejection({
+        code,
+        transport: 'websocket',
+        ...(req?.method === undefined ? {} : { method: req.method }),
+        ...(req?.url === undefined ? {} : { url: req.url }),
+        status,
+    });
+    if (client.destroyed)
+        return;
+    client.end(`HTTP/1.1 ${status} ${reason}\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n`
+        + JSON.stringify({ error: { type: 'sks_bridge_error', code, retryable: !permanent } }));
 }
 export async function forwardWebSocket(req, client, head, config, authenticatedLocalBaseUrl = desktopBridgeListenOrigin(config)) {
     let prepared;
@@ -92,7 +130,7 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         prepared = await prepareDesktopBridgeWebSocketRequest(req, config);
     }
     catch (error) {
-        writeUpgradeFailure(client);
+        writeUpgradeFailure(client, error, req);
         throw error;
     }
     const { provider, credential } = prepared;
@@ -106,15 +144,22 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
     let response = Buffer.alloc(0);
     const timer = setTimeout(() => upstream.destroy(new DesktopBridgeError('bridge_upstream_connect_timeout')), config.connectTimeoutMs);
     timer.unref();
-    const fail = () => { clearTimeout(timer); if (!connected)
-        writeUpgradeFailure(client);
+    const fail = (error) => { clearTimeout(timer); if (!connected)
+        writeUpgradeFailure(client, error, req);
     else
         client.destroy(); };
     const onConnected = () => {
         connected = true;
         clearTimeout(timer);
         upstream.setNoDelay(true);
-        upstream.setTimeout(config.idleTimeoutMs, () => upstream.destroy());
+        upstream.setTimeout(config.idleTimeoutMs, () => {
+            logWebSocketRejection({
+                code: 'bridge_websocket_upstream_idle_timeout',
+                transport: 'websocket',
+                ...(req.url === undefined ? {} : { url: req.url }),
+            });
+            upstream.destroy(new DesktopBridgeError('bridge_websocket_upstream_idle_timeout'));
+        });
         const headers = buildProviderWebSocketHeaders(req.headers, { providerId: provider.provider_id, authTransport: provider.auth_transport, credential }, target.host);
         upstream.write([`${req.method || 'GET'} ${target.pathname}${target.search} HTTP/1.1`, ...serializeHeaders(headers), '', ''].join('\r\n'));
         if (head.length)
@@ -150,7 +195,7 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         upstream.once('secureConnect', onConnected);
     else
         upstream.once('connect', onConnected);
-    upstream.once('error', fail);
+    upstream.once('error', (error) => fail(error));
     upstream.once('close', () => { clearTimeout(timer); if (!client.destroyed)
         client.end(); });
     client.once('error', () => upstream.destroy());

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '8.6.3';
+export const PACKAGE_VERSION = '8.6.4';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "8.6.3",
+  "version": "8.6.4",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",