sneakoscope 8.6.4 → 8.6.6

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 8.6.4** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 8.6.6** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "8.6.4"
+version = "8.6.6"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "8.6.4"
+version = "8.6.6"
 edition = "2021"
 
 [dependencies]

package/dist/commands/doctor.js

@@ -59,6 +59,7 @@ export async function restartStaleDesktopBridgeRuntime(input) {
         ? { restarted: true, warnings: [`desktop_bridge_runtime_restarted:${running}:${PACKAGE_VERSION}`], blockers: [] }
         : { restarted: false, warnings: [], blockers: [`desktop_bridge_runtime_version_stale:${running}:${PACKAGE_VERSION}`] };
 }
+export const CATALOG_REPAIR_MAX_ATTEMPTS = 2;
 export function deferCommandAliasCleanupToMigrationReceipt(result) {
     const observedBlockers = Array.isArray(result?.blockers)
         ? result.blockers.map(String).filter(Boolean)
@@ -1033,7 +1034,10 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                             rollback_evidence: 'combined_catalog_previous_generation_preserved'
                         };
                         try {
-                            const restarted = await restartStaleDesktopBridgeRuntime({ home: root, fix: doctorFix });
+                            const restarted = await restartStaleDesktopBridgeRuntime({
+                                home: path.resolve(process.env.HOME || os.homedir()),
+                                fix: doctorFix,
+                            });
                             const status = await desktopBridgeStatusV3({ home: root, env: process.env });
                             const blockers = (status?.readiness?.blockers || []).map(String);
                             const stale = blockers.filter((blocker) => blocker.endsWith('_catalog_stale'));
@@ -1046,13 +1050,29 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                                     blockers: restarted.blockers
                                 };
                             }
-                            const sync = await executeDesktopBridgeCommandV3({ operation: 'catalog.sync' }, { home: root, env: process.env });
-                            const synced = sync?.ok === true && sync?.execution?.ok === true;
+                            const attempts = [];
+                            let syncedAndVerified = false;
+                            for (let attempt = 1; attempt <= CATALOG_REPAIR_MAX_ATTEMPTS; attempt += 1) {
+                                const sync = await executeDesktopBridgeCommandV3({ operation: 'catalog.sync' }, { home: root, env: process.env });
+                                const commandOk = sync?.ok === true && sync?.execution?.ok === true;
+                                const after = await desktopBridgeStatusV3({ home: root, env: process.env });
+                                const stillStale = (after?.readiness?.blockers || [])
+                                    .map(String).filter((blocker) => blocker.endsWith('_catalog_stale'));
+                                if (commandOk && stillStale.length === 0) {
+                                    syncedAndVerified = true;
+                                    break;
+                                }
+                                attempts.push(`catalog_sync_attempt_${attempt}:${commandOk ? `still_stale:${stillStale.join(',')}` : (sync?.execution?.blockers || ['failed']).map(String).join(',')}`);
+                            }
                             return {
                                 ...base,
-                                ok: synced,
-                                repaired: synced,
-                                blockers: synced ? [] : (sync?.execution?.blockers || ['desktop_bridge_catalog_sync_failed']).map(String)
+                                ok: syncedAndVerified && restarted.blockers.length === 0,
+                                repaired: syncedAndVerified || restarted.restarted,
+                                warnings: [...restarted.warnings, ...(syncedAndVerified ? attempts : [])],
+                                blockers: [
+                                    ...(syncedAndVerified ? [] : ['desktop_bridge_catalog_still_stale_after_repair', ...attempts]),
+                                    ...restarted.blockers
+                                ]
                             };
                         }
                         catch (error) {

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "8.6.4",
+  "package_version": "8.6.6",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -3,6 +3,7 @@ import https from 'node:https';
 import zlib from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
 import { buildProviderUpstreamHeaders, rewriteResponseHeaders } from './header-policy.js';
+import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
 import { DesktopBridgeError } from './types.js';
@@ -120,8 +121,20 @@ function connectTimeout(request, config) {
         socket.once('close', () => clearTimeout(timer));
     });
 }
-function writeHttpBridgeError(res, error) {
+const logHttpRejection = createDesktopBridgeRejectionLogger();
+function underlyingErrorCode(error) {
+    const code = error?.code;
+    return typeof code === 'string' && /^[A-Za-z0-9_]{1,64}$/.test(code) ? code : null;
+}
+function writeHttpBridgeError(res, error, req) {
     const code = safeBridgeErrorCode(error);
+    const cause = code === 'bridge_upstream_unavailable' ? underlyingErrorCode(error) : null;
+    logHttpRejection({
+        code: cause ? `${code}:${cause}` : code,
+        transport: 'http',
+        ...(req?.method === undefined ? {} : { method: req.method }),
+        ...(req?.url === undefined ? {} : { url: req.url }),
+    });
     if (res.headersSent) {
         res.destroy(error instanceof Error ? error : undefined);
         return;
@@ -215,6 +228,6 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
         });
     }
     catch (error) {
-        writeHttpBridgeError(res, error);
+        writeHttpBridgeError(res, error, req);
     }
 }

package/dist/core/codex-lb/desktop-bridge/server.js

@@ -188,7 +188,14 @@ async function listenExact(server, host, port) {
         server.listen({ host, port, exclusive: true });
     });
 }
-async function closeServer(server, sockets) {
+export const DESKTOP_BRIDGE_DRAIN_GRACE_MS = 10_000;
+async function closeServer(server, sockets, activeRequests) {
+    if (activeRequests) {
+        const deadline = Date.now() + DESKTOP_BRIDGE_DRAIN_GRACE_MS;
+        while (activeRequests() > 0 && Date.now() < deadline) {
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+    }
     for (const socket of sockets)
         socket.destroy();
     if (!server.listening)
@@ -301,7 +308,7 @@ export async function startPreparedDesktopBridge(input, options = {}) {
             await writeDesktopBridgeState(statePath, state);
     }
     catch (error) {
-        await closeServer(server, sockets);
+        await closeServer(server, sockets, () => activeRequests);
         throw error;
     }
     const freshnessMs = input.stateFreshnessMs ?? 5 * 60_000;
@@ -321,7 +328,7 @@ export async function startPreparedDesktopBridge(input, options = {}) {
             stopped = true;
             if (heartbeat)
                 clearInterval(heartbeat);
-            await closeServer(server, sockets);
+            await closeServer(server, sockets, () => activeRequests);
             if (statePath)
                 await removeDesktopBridgeStateIfOwned(statePath, state);
         },

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -131,7 +131,7 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
     }
     catch (error) {
         writeUpgradeFailure(client, error, req);
-        throw error;
+        return;
     }
     const { provider, credential } = prepared;
     const target = resolveDesktopBridgeTarget(req.url, provider.remote);

package/dist/core/codex-lb/desktop-bridge-migration.js

@@ -222,7 +222,7 @@ async function migrateDesktopBridgeConfigUnlocked(input) {
             receipt_path: null,
             auth_semantic_identity_preserved: provisional.auth_semantic_identity_preserved,
             blockers: [
-                'desktop_bridge_unification_migration_failed',
+                migrationFailureBlocker(error),
                 ...(rollback && !rollback.ok ? ['desktop_bridge_unification_rollback_failed'] : [])
             ],
             ...(rollback ? { rollback } : {}),
@@ -230,6 +230,14 @@ async function migrateDesktopBridgeConfigUnlocked(input) {
         };
     }
 }
+export function migrationFailureBlocker(error) {
+    const base = 'desktop_bridge_unification_migration_failed';
+    const code = error?.code;
+    if (typeof code === 'string' && /^[A-Za-z0-9_]{1,64}$/.test(code))
+        return `${base}:${code}`;
+    const message = errorMessage(error).trim();
+    return /^[a-z0-9_]{1,64}$/.test(message) ? `${base}:${message}` : base;
+}
 function validateConfigTarget(home, configPath) {
     const canonicalPath = path.join(path.resolve(home), '.codex', 'config.toml');
     if (!path.isAbsolute(configPath) || path.resolve(configPath) !== canonicalPath) {

package/dist/core/doctor/doctor-readiness-matrix.js

@@ -373,6 +373,9 @@ function nextActionsForBlockers(blockers) {
     });
 }
 function nextActionForRouteBlocker(scope, blocker) {
+    if (scope === 'route-image' && /real_output_unverified|not_verified|unverified/.test(blocker)) {
+        return `Image route needs manual readiness (${blocker}): invoke Codex App \`$imagegen\` with gpt-image-2 in a fresh task and record the selected raster output path. No \`sks doctor\` run can satisfy this on its own.`;
+    }
     if (scope === 'route-image')
         return `Repair image route capability (${blocker}): run \`sks doctor --fix --full --yes\`, then verify Codex App/image auth.`;
     if (scope === 'route-computer-use')

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '8.6.4';
+export const PACKAGE_VERSION = '8.6.6';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "8.6.4",
+  "version": "8.6.6",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",